arXiv 2604.107152026-04-12cs.CV

通过谱分解防御基于补丁和纹理的对抗攻击

Defending against Patch-Based and Texture-Based Adversarial Attacks with Spectral Decomposition

Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）；School of Software, Tsinghua University（清华大学软件学院）；School of Computer and Communication Engineering, University of Science and Technology Beijing（北京科技大学计算机与通信工程学院）；Institute for AI, BNRist, IDG/McGovern Institute for Brain Research, Tsinghua University（清华大学人工智能研究院、北京信息科学与技术国家研究中心、IDG/麦戈文脑科学研究院）；Chinese Institute for Brain Research (CIBR)（北京脑科学与类脑研究中心）

Wei Zhang, Xinyu Chang, Xiao Li, Yiming Zhu, Xiaolin Hu

备注：: Accepted by IEEE TIFS

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出Adversarial Spectrum Defense (ASD)，利用DWT进行谱分解分析对抗模式，结合Adversarial Training提升防御效果，实验表明ASD+AT在对抗攻击中表现优异。

摘要：

对抗示例对深度神经网络（DNN）应用的安全性构成重大挑战。特别是基于补丁和纹理的攻击，通常用于制造现实世界中的对抗示例，对安全关键应用如监控中的人员检测和自动驾驶系统构成真实威胁，因为这些攻击是物理可实现的。现有防御机制在适应性攻击设置下面临挑战，即攻击专门针对它们设计。本文提出Adversarial Spectrum Defense (ASD)，一种利用离散小波变换（DWT）进行谱分解来分析对抗模式的防御机制。DWT的多分辨率和定位能力使ASD能够捕捉高频率（细粒度）和低频率（空间广泛）的扰动。通过将此谱分析与现成的对抗训练（AT）模型结合，ASD提供了一种全面的防御策略，以应对基于补丁和纹理的对抗攻击。大量实验表明，ASD+AT在各种攻击中实现了最先进的性能，优于先前防御方法的21.73%，即使面对专门针对ASD设计的强大适应性对手。代码可在https://github.com/weiz0823/adv-spectral-defense上获得。

英文摘要：

Adversarial examples present significant challenges to the security of Deep Neural Network (DNN) applications. Specifically, there are patch-based and texture-based attacks that are usually used to craft physical-world adversarial examples, posing real threats to security-critical applications such as person detection in surveillance and autonomous systems, because those attacks are physically realizable. Existing defense mechanisms face challenges in the adaptive attack setting, i.e., the attacks are specifically designed against them. In this paper, we propose Adversarial Spectrum Defense (ASD), a defense mechanism that leverages spectral decomposition via Discrete Wavelet Transform (DWT) to analyze adversarial patterns across multiple frequency scales. The multi-resolution and localization capability of DWT enables ASD to capture both high-frequency (fine-grained) and low-frequency (spatially pervasive) perturbations. By integrating this spectral analysis with the off-the-shelf Adversarial Training (AT) model, ASD provides a comprehensive defense strategy against both patch-based and texture-based adversarial attacks. Extensive experiments demonstrate that ASD+AT achieved state-of-the-art (SOTA) performance against various attacks, outperforming the APs of previous defense methods by 21.73%, in the face of strong adaptive adversaries specifically designed against ASD. Code available at https://github.com/weiz0823/adv-spectral-defense .

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。