使用扩散模型的无梯度对抗净化
Gradient-Free Adversarial Purification with Diffusion Models
AI总结：
本文提出一种无梯度的对抗净化防御框架，通过对抗抗锯齿和对抗超分辨率技术有效抵御基于扰动和无限制的对抗攻击，并引入基于对比学习的微调方法增强跨数据集鲁棒性。
摘要：
对抗训练和对抗净化是两种广泛使用的防御策略，用于增强模型抵御对抗攻击的鲁棒性。然而，对抗训练需要昂贵的重新训练，而对抗净化通常存在效率低下的问题。更关键的是，现有的防御主要是在基于扰动的对抗威胁模型下设计的，这对最近引入的无限制对抗攻击无效。在本文中，我们提出了一个有效且高效的防御框架，可同时应对基于扰动和无限制的对抗攻击。我们的方法基于这样的观察：对抗样本通常位于决策边界附近，并且对像素级扰动高度敏感。为了解决这个问题，我们引入了对抗抗锯齿，这是一种预处理技术，通过减少像素级扰动的幅度来减轻对抗噪声。此外，我们提出了对抗超分辨率，它利用来自干净数据集的先验知识，从对抗性退化的图像中良性恢复高质量图像。与生成全新图像的图像合成方法不同，对抗超分辨率专注于图像恢复，使其更适合净化。重要的是，这两种技术都不需要额外的训练，并且在计算上非常高效，因为它们不依赖梯度计算。为了进一步提高跨不同数据集的鲁棒性，我们引入了一种基于对比学习的对抗去模糊微调方法。通过在目标数据集上微调期间引入对抗先验，该方法无需重新训练扩散模型即可增强净化效果。
英文摘要：
Adversarial training and adversarial purification are two widely used defense strategies for enhancing model robustness against adversarial attacks. However, adversarial training requires costly retraining, while adversarial purification often suffers from low efficiency. More critically, existing defenses are primarily designed under the perturbation-based adversarial threat model, which is ineffective against recently introduced unrestricted adversarial attacks. In this paper, we propose an effective and efficient defense framework that counters both perturbation-based and unrestricted adversarial attacks. Our approach is motivated by the observation that adversarial examples typically lie near the decision boundary and are highly sensitive to pixel-level perturbations. To address this, we introduce adversarial anti-aliasing, a preprocessing technique that mitigates adversarial noise by reducing the magnitude of pixel-level perturbations. In addition, we propose adversarial super-resolution, which leverages prior knowledge from clean datasets to benignly restore high-quality images from adversarially degraded ones. Unlike image synthesis methods that generate entirely new images, adversarial super-resolution focuses on image restoration, making it more suitable for purification. Importantly, both techniques require no additional training and are computationally efficient since they do not rely on gradient computations. To further improve robustness across diverse datasets, we introduce a contrastive learning-based adversarial deblurring fine-tuning method. By incorporating adversarial priors during fine-tuning on the target dataset, this method enhances purification effectiveness without the need to retrain diffusion models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
