DiffPAD：基于去噪扩散的对抗补丁净化
DiffPAD: Denoising Diffusion-based Adversarial Patch Decontamination
AI总结：
提出DiffAD框架，利用扩散模型进行对抗补丁净化，通过超分辨率重建和图像修复技术实现最先进的对抗鲁棒性。
摘要：
在不断发展的对抗机器学习领域，开发针对补丁攻击的有效防御已成为一项关键挑战，需要可靠的解决方案来保护现实世界的AI系统。尽管扩散模型在图像合成方面显示出卓越能力，并最近被用于对抗ℓp范数有界攻击，但其在缓解局部补丁攻击方面的潜力很大程度上仍未被探索。在本工作中，我们提出了DiffPAD，这是一个利用扩散模型能力进行对抗补丁净化的新框架。DiffPAD首先对下采样输入图像执行超分辨率重建，然后采用二值化、动态阈值方案和滑动窗口以有效定位对抗补丁。这种设计受到理论上推导出的补丁大小与扩散重建误差之间相关性的启发，该相关性可推广至多种补丁攻击场景。最后，DiffAD将图像修复技术应用于原始输入图像，其中估计的补丁区域被掩蔽。通过将超分辨率重建和图像修复的闭式解集成到预训练扩散模型的条件反向采样过程中，DiffPAD避免了文本引导或微调的需求。通过全面实验，我们证明DiffPAD不仅实现了针对补丁攻击的最先进对抗鲁棒性，而且在恢复无补丁残留的自然图像方面表现出色。源代码可在https://github.com/JasonFu1998/DiffAD获取。
英文摘要：
In the ever-evolving adversarial machine learning landscape, developing effective defenses against patch attacks has become a critical challenge, necessitating reliable solutions to safeguard real-world AI systems. Although diffusion models have shown remarkable capacity in image synthesis and have been recently utilized to counter $\ell_p$-norm bounded attacks, their potential in mitigating localized patch attacks remains largely underexplored. In this work, we propose DiffPAD, a novel framework that harnesses the power of diffusion models for adversarial patch decontamination. DiffPAD first performs super-resolution restoration on downsampled input images, then adopts binarization, dynamic thresholding scheme and sliding window for effective localization of adversarial patches. Such a design is inspired by the theoretically derived correlation between patch size and diffusion restoration error that is generalized across diverse patch attack scenarios. Finally, DiffPAD applies inpainting techniques to the original input images with the estimated patch region being masked. By integrating closed-form solutions for super-resolution restoration and image inpainting into the conditional reverse sampling process of a pre-trained diffusion model, DiffPAD obviates the need for text guidance or fine-tuning. Through comprehensive experiments, we demonstrate that DiffPAD not only achieves state-of-the-art adversarial robustness against patch attacks but also excels in recovering naturalistic images without patch remnants. The source code is available at https://github.com/JasonFu1998/DiffPAD.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
