为每张图片动态调整去噪强度，提升对抗样本净化效果。
Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification
- 用得分网络衡量样本偏离干净数据的程度，动态决定加噪量。
- 在CIFAR-10和ImageNet上，准确率与鲁棒性均有显著提升。
- 适合需要高精度净化对抗样本的图像安全应用。
基于扩散的净化（DBP）方法通过前向扩散注入高斯噪声，再经反向生成过程恢复干净样本。现有方法对所有样本使用固定的噪声水平 $t^*$，但本文发现不同样本应有不同的最优 $t^*$：越干净的样本应注入越少噪声。为此提出样本感知得分噪声注入（SSNI）框架，利用预训练得分网络估计数据点与干净分布的偏离程度（即得分范数），并据此调整 $t^*$，实现样本自适应加噪。实验表明，将SSNI集成至现有DBP方法，在CIFAR-10和ImageNet-1K上均显著提升准确率与鲁棒性，证明了在DBP中为不同样本分配异构噪声水平的必要性。代码已开源。
原文摘要 · Abstract (English)
Diffusion-based purification (DBP) methods aim to remove adversarial noise from the input sample by first injecting Gaussian noise through a forward diffusion process, and then recovering the clean example through a reverse generative process. In the above process, how much Gaussian noise is injected to the input sample is key to the success of DBP methods, which is controlled by a constant noise level $t^*$ for all samples in existing methods. In this paper, we discover that an optimal $t^*$ for each sample indeed could be different. Intuitively, the cleaner a sample is, the less the noise it should be injected, and vice versa. Motivated by this finding, we propose a new framework, called Sample-specific Score-aware Noise Injection (SSNI). Specifically, SSNI uses a pre-trained score network to estimate how much a data point deviates from the clean data distribution (i.e., score norms). Then, based on the magnitude of score norms, SSNI applies a reweighting function to adaptively adjust $t^*$ for each sample, achieving sample-specific noise injections. Empirically, incorporating our framework with existing DBP methods results in a notable improvement in both accuracy and robustness on CIFAR-10 and ImageNet-1K, highlighting the necessity to allocate distinct noise levels to different samples in DBP methods. Our code is available at: https://github.com/tmlr-group/SSNI.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。