分而治之：面向基于扩散的对抗纯化的异构噪声整合
Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
AI总结：
针对现有扩散对抗纯化方法统一加噪损害正常像素、防御效果有限的问题，提出基于模型可解释性的异构加噪策略，重设计扩散采样过程并通过单步重采样降本增效，在三个数据集上性能显著优于现有方法。
摘要：
现有基于扩散的纯化方法旨在通过前向扩散过程引入一定量的噪声来破坏对抗扰动，随后通过反向过程恢复干净样本。然而，该方法存在根本性缺陷：前向过程对所有像素的统一操作在试图对抗对抗扰动的同时会损害正常像素，导致目标模型产生错误预测。仅依赖低强度噪声不足以实现有效防御。为解决这一关键问题，我们基于神经网络的可解释性实施了一种异构纯化策略。我们的方法对目标模型关注的特定像素果断施加更高强度的噪声，而其余像素仅承受低强度噪声。这一需求促使我们重新设计扩散模型的采样过程，以有效去除不同水平的噪声。此外，为在强自适应攻击下评估我们的方法，所提方法通过单步重采样大幅降低了时间成本和内存占用。在三个数据集上开展的大量实验的实证结果表明，我们的方法大幅优于大多数当前的对抗训练和纯化技术。
英文摘要：
Existing diffusion-based purification methods aim to disrupt adversarial perturbations by introducing a certain amount of noise through a forward diffusion process, followed by a reverse process to recover clean examples. However, this approach is fundamentally flawed: the uniform operation of the forward process across all pixels compromises normal pixels while attempting to combat adversarial perturbations, resulting in the target model producing incorrect predictions. Simply relying on low-intensity noise is insufficient for effective defense. To address this critical issue, we implement a heterogeneous purification strategy grounded in the interpretability of neural networks. Our method decisively applies higher-intensity noise to specific pixels that the target model focuses on while the remaining pixels are subjected to only low-intensity noise. This requirement motivates us to redesign the sampling process of the diffusion model, allowing for the effective removal of varying noise levels. Furthermore, to evaluate our method against strong adaptative attack, our proposed method sharply reduces time cost and memory usage through a single-step resampling. The empirical evidence from extensive experiments across three datasets demonstrates that our method outperforms most current adversarial training and purification techniques by a substantial margin.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
