Knowledge distillation (KD) attacks pose a significant threat to deep model intellectual property by enabling adversaries to train student networks using a teacher model's outputs. While recent defenses in image classification have successfully disrupted KD by perturbing output probabilities, extending these methods to image restoration is difficult. Unlike classification, restoration is a generative task with continuous, high-dimensional outputs that depend on spatial coherence and fine details. Minor perturbations are often insufficient, as students can still learn the underlying mapping.To address this, we propose Adaptive Singular Value Perturbation (ASVP), a runtime defense tailored for image restoration models. ASVP operates on internal feature maps of the teacher using singular value decomposition (SVD). It amplifies the topk singular values to inject structured, high-frequency perturbations, disrupting the alignment needed for distillation. This hinders student learning while preserving the teacher's output quality.We evaluate ASVP across five image restoration tasks: super-resolution, low-light enhancement, underwater enhancement, dehazing, and deraining. Experiments show ASVP reduces student PSNR by up to 4 dB and SSIM by 60-75%, with negligible impact on the teacher's performance. Compared to prior methods, ASVP offers a stronger and more consistent defense.Our approach provides a practical solution to protect open-source restoration models from unauthorized knowledge distillation.
Inception Institute of Artificial Intelligence（起点人工智能研究院）；University of Canberra（堪培拉大学）；Data61-CSIRO（澳大利亚联邦科学与工业研究组织数据61所）；Beijing Institute of Technology（北京理工大学）
Convolutional Neural Networks have achieved significant success across multiple computer vision tasks. However, they are vulnerable to carefully crafted, human-imperceptible adversarial noise patterns which constrain their deployment in critical security-sensitive systems. This paper proposes a computationally efficient image enhancement approach that provides a strong defense mechanism to effectively mitigate the effect of such adversarial perturbations. We show that deep image restoration networks learn mapping functions that can bring off-the-manifold adversarial samples onto the natural im…
AD-SRF: Attack-Defense Semantic Reinforcement for Multi-Modal Image Fusion
Electronic Information School, Wuhan University（武汉大学电子信息学院）；School of Robotics, Wuhan University（武汉大学机器人学院）；Suzhou Institute, Wuhan University（武汉大学苏州研究院）
VOID: Defeating Unauthorized Mimicry in Latent Diffusion Models
School of Cyber Science and Engineering, Wuhan University（武汉大学网络空间安全学院）；School of Computer Science, Wuhan University（武汉大学计算机学院）；Institute for Math&AI, Wuhan University（武汉大学数学与人工智能研究所）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；School of Cyber Science and Engineering, Xi’an Jiaotong University（西安交通大学网络空间安全学院）
Point cloud is an important 3D data representation widely used in many essential applications. Leveraging deep neural networks, recent works have shown great success in processing 3D point clouds. However, those deep neural networks are vulnerable to various 3D adversarial attacks, which can be summarized as two primary types: point perturbation that affects local point distribution, and surface distortion that causes dramatic changes in geometry. In this paper, we simultaneously address both the aforementioned attacks by learning to restore the clean point clouds from the attacked ones. More …
Asymmetric Invertible Threat: Learning Reversible Privacy Defense for Face Recognition
School of Cyber Science and Engineering, Sichuan University（四川大学计算机科学与工程学院）；Lee Kong Chian School of Medicine, Nanyang Technological University（南洋理工大学李科钦医学院）；School of Electrical and Electronic Engineering, Yonsei University（延世大学电子与电气工程学院）
Thermal Topology Collapse: Universal Physical Patch Attacks on Infrared Vision Systems
China University of Petroleum-Beijing at Karamay（中国石油大学（北京）克拉玛依校区）；University of Electronic Science and Technology of China（电子科技大学）；College of Intelligence and Computing, Tianjin University（天津大学智能与计算学部）；School of Software, Shandong University（山东大学软件学院）；Shanghai Jiaotong University（上海交通大学）
Immunizing 3D Gaussian Generative Models Against Unauthorized Fine-Tuning via Attribute-Space Traps
School of Computer Science and Engineering, University of Electronic Science and Technology of China（电子科技大学计算机科学与工程学院）；Sydney AI Centre, The University of Sydney（悉尼大学悉尼人工智能中心）；Machine Learning Department, Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学机器学习系）；School of Robotics and Advanced Manufacture, Harbin Institute of Technology（哈尔滨工业大学（深圳）机器人技术与先进制造学院）
To See is Not to Learn: Protecting Multimodal Data from Unauthorized Fine-Tuning of Large Vision-Language Model
School of Computing；Augmented Intelligence, Arizona State University, Tempe, AZ, USA；Department of Computer Science；Engineering, Texas A\&M University, College Station, TX, USA
Adversarial robustness of deep neural networks is an extensively studied problem in the literature and various methods have been proposed to defend against adversarial images. However, only a handful of defense methods have been developed for defending against attacked videos. In this paper, we propose a novel Over-and-Under complete restoration network for Defending against adversarial videos (OUDefend). Most restoration networks adopt an encoder-decoder architecture that first shrinks spatial dimension then expands it back. This approach learns undercomplete representations, which have large…
Shanghai Jiao Tong University（上海交通大学）；Tencent AI Lab（腾讯人工智能实验室）
While deep convolutional neural networks (CNNs) are vulnerable to adversarial attacks, considerably few efforts have been paid to construct robust deep tracking algorithms against adversarial attacks. Current studies on adversarial attack and defense mainly reside in a single image. In this work, we first attempt to generate adversarial examples on top of video sequences to improve the tracking robustness against adversarial attacks. To this end, we take temporal motion into consideration when generating lightweight perturbations over the estimated tracking results frame-by-frame. On one hand,…
DIFFender: Diffusion-Based Adversarial Defense against Patch Attacks
Institute of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）；Tsinghua-Bosch Joint ML Center, Tsinghua University（清华大学-博世联合机器学习中心）；Hangzhou Innovation Institute, Beihang University（北京航空航天大学杭州创新研究院）；Zhongguancun Laboratory（中关村实验室）；RealAI
PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoors
Institute of Information Engineering, Chinese Academy of Sciences（信息工程研究所，中国科学院）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；BraneMatrix AI；School of Cyber Science and Technology, Shenzhen Campus, Sun Yat-sen University（中山大学深圳校区计算机科学与技术学院）
RISE Research Institutes of Sweden（瑞典RISE研究机构）；KTH Royal Institute of Technology（KTH皇家理工学院）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全研究中心）；Halmstad University（哈尔姆斯塔德大学）
Illinois Institute of Technology（伊利诺伊理工学院）；Rochester Institute of Technology（罗切斯特理工学院）
Deep learning models have been shown to be vulnerable to adversarial attacks. In particular, gradient-based attacks have demonstrated high success rates recently. The gradient measures how each image pixel affects the model output, which contains critical information for generating malicious perturbations. In this paper, we show that the gradients can also be exploited as a powerful weapon to defend against adversarial attacks. By using both gradient maps and adversarial images as inputs, we propose a Two-stream Restoration Network (TRN) to restore the adversarial images. To optimally restore …
