基于扩散模型的针对补丁攻击的真实世界对抗防御
Real-world Adversarial Defense against Patch Attacks based on Diffusion Model
AI总结：
该研究提出基于扩散模型的DIFFender防御框架，利用对抗异常感知现象定位并修复对抗补丁，通过少样本提示微调适配任务，在多任务及真实场景中表现鲁棒，还可扩展至红外域防御。
摘要：
对抗补丁给深度学习模型的鲁棒性带来了严峻挑战，因此开发有效的防御方法对真实世界应用至关重要。本文提出了DIFFender，这是一种新型的基于扩散的防御框架，它利用文本引导扩散模型的能力来对抗对抗补丁攻击。我们方法的核心是发现了对抗异常感知（Adversarial Anomaly Perception，AAP）现象，该现象使扩散模型能够通过分析分布异常来准确检测并定位对抗补丁。DIFFender将补丁定位和修复任务无缝整合到一个统一的扩散模型框架中，通过二者的紧密交互提升防御效果。此外，DIFFender采用了一种高效的少样本提示微调算法，无需大量重新训练即可使预训练扩散模型适配防御任务。我们的综合评估涵盖图像分类和人脸识别任务以及真实世界场景，证明了DIFFender在对抗攻击下的鲁棒性能。该框架在不同设置、分类器和攻击方法间的通用性和可推广性标志着对抗补丁防御策略的重大进步。除了常见的可见光域，我们还发现了DIFFender的另一项优势：它能够轻松扩展到红外域。因此，我们证明了DIFFender具有良好的灵活性，可使用一个通用防御框架同时防御红外和可见光对抗补丁攻击。
英文摘要：
Adversarial patches present significant challenges to the robustness of deep learning models, making the development of effective defenses become critical for real-world applications. This paper introduces DIFFender, a novel DIFfusion-based DeFender framework that leverages the power of a text-guided diffusion model to counter adversarial patch attacks. At the core of our approach is the discovery of the Adversarial Anomaly Perception (AAP) phenomenon, which enables the diffusion model to accurately detect and locate adversarial patches by analyzing distributional anomalies. DIFFender seamlessly integrates the tasks of patch localization and restoration within a unified diffusion model framework, enhancing defense efficacy through their close interaction. Additionally, DIFFender employs an efficient few-shot prompt-tuning algorithm, facilitating the adaptation of the pre-trained diffusion model to defense tasks without the need for extensive retraining. Our comprehensive evaluation, covering image classification and face recognition tasks, as well as real-world scenarios, demonstrates DIFFender's robust performance against adversarial attacks. The framework's versatility and generalizability across various settings, classifiers, and attack methodologies mark a significant advancement in adversarial patch defense strategies. Except for the popular visible domain, we have identified another advantage of DIFFender: its capability to easily expand into the infrared domain. Consequently, we demonstrate the good flexibility of DIFFender, which can defend against both infrared and visible adversarial patch attacks alternatively using a universal defense framework.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
