用随机共振提升模型抗攻击能力，不丢信息还通用。
Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensembles
- 输入图像加微小平移扰动，融合特征再还原
- 分类任务恢复68.1%准确率损失，立体匹配恢复71.9%
- 无需训练、适配任意模型，适合部署于各类视觉任务
我们提出一种测试时防御对抗攻击的方法：通过不可察觉的图像扰动显著改变模型预测。不同于依赖特征过滤或平滑导致信息丢失的现有方法，我们采用“以噪制噪”的策略，利用随机共振增强鲁棒性并最小化信息损失。该方法对输入图像施加微小平移扰动，对变换后的特征嵌入进行对齐，并在映射回原始参考图像前进行聚合，可表示为闭式公式。该方法无需额外网络模块或针对特定攻击的微调，完全训练自由、架构无关且攻击无关。实验表明其在图像分类上达到最先进鲁棒性，并首次实现密集预测任务（如立体匹配与光流）的通用测试时防御，凸显其泛化性与实用性。具体而言，在各类对抗攻击下，相对干净（未扰动）性能，该方法在图像分类中恢复68.1%的准确率损失，立体匹配恢复71.9%，光流恢复29.2%。
原文摘要 · Abstract (English)
We propose a test-time defense mechanism against adversarial attacks: imperceptible image perturbations that significantly alter the predictions of a model. Unlike existing methods that rely on feature filtering or smoothing, which can lead to information loss, we propose to "combat noise with noise" by leveraging stochastic resonance to enhance robustness while minimizing information loss. Our approach introduces small translational perturbations to the input image, aligns the transformed feature embeddings, and aggregates them before mapping back to the original reference image. This can be expressed in a closed-form formula, which can be deployed on diverse existing network architectures without introducing additional network modules or fine-tuning for specific attack types. The resulting method is entirely training-free, architecture-agnostic, and attack-agnostic. Empirical results show state-of-the-art robustness on image classification and, for the first time, establish a generic test-time defense for dense prediction tasks, including stereo matching and optical flow, highlighting the method's versatility and practicality. Specifically, relative to clean (unperturbed) performance, our method recovers up to 68.1% of the accuracy loss on image classification, 71.9% on stereo matching, and 29.2% on optical flow under various types of adversarial attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。