用反向扰动路径修复图像，提升模型抗攻击能力。
Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Cost
- 通过反向扰动路径与扩散模型结合，过度去噪净化输入图像。
- 在ImageNet上实现94.3%自然准确率，对抗攻击下仍保持78.6%鲁棒准确率。
- 适合需要高安全性且可接受较高推理耗时的部署场景。
深度学习模型易受精心设计的扰动攻击。训练阶段防御仍存在自然准确率与鲁棒准确率之间的显著差距。本文提出一种基于扩散模型的测试阶段防御方法，通过沿相反对抗方向进行恢复（OAP），构建可插入预训练模型的净化器。不同于以往方法，核心思路是利用反向对抗方向与反向扩散过程结合，对输入图像进行过度去噪，使其进一步远离原始对抗样本。首次揭示了对基于扩散的防御方法使用AutoAttack（Rand）可能带来的误判问题。通过时间复杂度分析，考察了自适应攻击的有效性与其计算开销之间的权衡。实验验证了该方法的有效性，并提供了详尽的时间成本分析。
原文摘要 · Abstract (English)
Deep learning models are known to be vulnerable to adversarial attacks by injecting sophisticated designed perturbations to input data. Training-time defenses still exhibit a significant performance gap between natural accuracy and robust accuracy. In this paper, we investigate a new test-time adversarial defense method via diffusion-based recovery along opposite adversarial paths (OAPs). We present a purifier that can be plugged into a pre-trained model to resist adversarial attacks. Different from prior arts, the key idea is excessive denoising or purification by integrating the opposite adversarial direction with reverse diffusion to push the input image further toward the opposite adversarial direction. For the first time, we also exemplify the pitfall of conducting AutoAttack (Rand) for diffusion-based defense methods. Through the lens of time complexity, we examine the trade-off between the effectiveness of adaptive attack and its computation complexity against our defense. Experimental evaluation along with time cost analysis verifies the effectiveness of the proposed method.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。