PaperlayerView exact revision on arXiv

Source-linked AI summary

Guided Diffusion Model for Adversarial Purification

Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, Hongfei Fu

arXiv:2205.14969v3cs.CVcs.AI

TL;DR

Adversarial perturbations can mislead image classifiers, and purification must balance removing them with preserving clean-image semantics. GDMP embeds purification in DDPM denoising, guides the reverse process with the attacked image, and is reported to outperform predecessor defenses across CIFAR-10 and ImageNet attack evaluations.

  • Problem

    Adversarial perturbations can fool DNN image classifiers, while purification remains challenging on large datasets because removing perturbations can conflict with retaining clean-image semantics.

    Source: §1 · pp. 1–2

  • Method

    GDMP embeds purification in DDPM denoising and guides the reverse process with the adversarial image to keep the purified output close to it.

    Source: §1 · p. 2, §4.2 · p. 5

  • Results

    GDMP outperforms predecessor defenses in evaluations using PGD, BPDA+EOT, and black-box attacks on CIFAR-10 and ImageNet.

    Source: §6 · p. 10

  • Takeaways & Limitations

    Guidance maintains classification accuracy as denoising steps increase, and repeated purification performs better than a single iteration.

    Source: §5 · p. 8

    The evaluated perturbations are bounded by an ℓ∞ maximum pixel difference γ, relative to a pixel-intensity scale of 255.

    Source: §5 · p. 7

Abstract

from arXiv · show

With wider application of deep neural networks (DNNs) in various algorithms and frameworks, security threats have become one of the concerns. Adversarial attacks disturb DNN-based image classifiers, in which attackers can intentionally add imperceptible adversarial perturbations on input images to fool the classifiers. In this paper, we propose a novel purification approach, referred to as guided diffusion model for purification (GDMP), to help protect classifiers from adversarial attacks. The core of our approach is to embed purification into the diffusion denoising process of a Denoised Diffusion Probabilistic Model (DDPM), so that its diffusion process could submerge the adversarial perturbations with gradually added Gaussian noises, and both of these noises can be simultaneously removed following a guided denoising process. On our comprehensive experiments across various datasets, the proposed GDMP is shown to reduce the perturbations raised by adversarial attacks to a shallow range, thereby significantly improving the correctness of classification. GDMP improves the robust accuracy by 5%, obtaining 90.1% under PGD attack on the CIFAR10 dataset. Moreover, GDMP achieves 70.94% robustness on the challenging ImageNet dataset.

1 Introduction

Adversarial perturbations can fool DNN image classifiers, while purification must balance removing perturbations with retaining image semantics. The paper embeds purification in DDPM denoising and adds guidance to preserve consistency with the attacked image.

1 Introduction

  • Adversarial attacks use slight, human-undetectable image perturbations to induce unexpected classifier predictions and create safety concerns.The introduction says robust defenses are especially needed for real-world applications.Source: §1 · p. 1
  • Purification must balance removing adversarial perturbations against faithfully retaining clean-image semantics, a challenge especially on large datasets such as ImageNet.The introduction contrasts purification with adversarial training, which may not handle unseen attack types or image corruptions.Source: §1 · pp. 1–2
  • GDMP partially diffuses attacked images to submerge perturbations, then guides DDPM denoising to remove noise while keeping the output consistent with the input.Guidance minimizes mean squared error or maximizes SSIM similarity between the adversarial image and denoised image.Source: §1 · p. 2
  • 70.94% robustness accuracy is reported on ImageNet under PGD, outperforming previous methods by a large margin.The authors identify this as their first application of adversarial purification to a large-scale dataset.Source: §1 · p. 2

2 Related Work

Related work groups adversarial defenses into training, preprocessing, and purification approaches. The section describes how these methods approximate attacks or transform attacked inputs before classification.

2 Related Work

  • Adversarial training optimizes a surrogate loss over limited classes of adversarial samples, with PGD used by Madry et al. (2018) to approximate the inner maximization.Perfect evaluation and optimization of worst-case risk are described as impossible, so an approximation is needed.Source: §2 · p. 3
  • In adversarial training, A(x_i) denotes images generated on the fly by applying an adversarial attack to x during network training.Source: §2 · p. 3
  • Preprocessing transforms inputs before classification, using stochasticity or non-differentiable transformations to make gradient estimation harder.The section lists Guo et al. (2018), Dhillon et al. (2018), Buckman et al. (2018), and Xiao et al. (2020) as examples.Source: §2 · p. 3
  • Adversarial purification trains a generative model to restore clean images from attacked inputs and uses it as a preprocessor.Examples include defense-GAN, autoregressive models, denoising autoencoders with MALA, MCMC with EBMs, and denoising score-based models.Source: §2 · p. 3

3 Background of DDPM

DDPMs comprise a forward diffusion chain that progressively adds noise to clean data and a reverse chain that denoises latent samples. The forward process approaches a Gaussian latent distribution, while the reverse process predicts and removes added noise.

3 Background of DDPM

  • DDPMs use two Markov chains: forward diffusion adds noise to clean images, and reverse denoising maps sampled Gaussian noise toward clean images.Both chains have length T.Source: §3.1 · p. 3
  • The forward diffusion process progressively adds noise to clean data until it approaches the latent distribution.The process is defined as a Markov process, with β_t values specified as small positive constants.Source: §3.1 · p. 3
  • For sufficiently large T, q(x_T|x_0) approaches the latent distribution, and x_t can be sampled directly from x_0 using the closed-form expression.The text defines α_t = 1 − β_t and introduces the cumulative ᾱ_t term used in that expression.Source: §3.1 · pp. 3–4
  • The reverse process predicts and removes the noise added during diffusion, using a neural-network mean μ_θ(x_t,t).Source: §3.1 · p. 4

4 Methodology

The method purifies adversarial images by partially diffusing them with Gaussian noise and then denoising, with guidance intended to preserve image content while removing perturbations. It balances purification strength against fidelity through repeated runs and a time-dependent guidance scale, and accelerates ImageNet sampling by skipping reverse-process steps.

4.1 Diffusion Method for Adversarial Purification

  • Partial forward diffusion submerges adversarial perturbations in Gaussian noise; reverse denoising removes both noises and moves the image toward the clean-image domain.The diffusion length must be large enough to submerge perturbations while preserving the image's main content.Source: §4.1 · p. 4
  • Repeated purification with moderate diffusion lengths can remove perturbations that survive earlier runs, and outperformed one run with a large diffusion length in experiments.A large diffusion length can distort the clean image, while a small one may leave perturbations.Source: §4.1 · p. 4

4.2 Guided DDPM

  • Guidance conditions reverse denoising on the adversarial image, encouraging the purified image to stay close to it and thereby to the original clean image.The guidance scale must not be so large that the purified image retains the adversarial perturbation.Source: §4.2 · pp. 5–6

4.3 Guidance Scale

  • The time-dependent guidance scale is chosen to track Gaussian-noise magnitude relative to adversarial-perturbation magnitude, allowing stronger guidance when perturbations are submerged.The scale should be smaller at low time steps, when adversarial perturbations are largely retained.Source: §4.3 · pp. 6–7

4.4 DDPM acceleration

  • Skipping reverse-process steps requires no DDPM retraining and accelerates ImageNet purification four times when respacing T=1000 steps to 250.Source: §4.4 · p. 7

5 Experiments

The experiments evaluate GDMP on CIFAR-10 and ImageNet under preprocessor-blind, adaptive, and black-box attacks, with comparisons to other defense methods. They also examine how guidance and repeated purification affect classification accuracy.

5 Experiments

  • CIFAR-10 evaluations include preprocessor-blind PGD attacks and adaptive attacks, with Table 1 and Table 2 reporting results at ℓ∞ γ=8/255.The respective settings are Tc=36, M=4 for Table 1 and Tc=50, M=2 for Table 2.Source: Table 1 · p. 8, §5 · p. 8, Table 2 · p. 9
  • Guidance maintains classification accuracy as the number of denoising steps increases, improves on unguided results, and multiple purification runs outperform one run.These comparisons are reported in Figure 4.Source: §5 · p. 8
  • In a CIFAR-10 black-box evaluation, GDPM reportedly defended most attacks using SPSA, with inquiries increased to 1,280; the passage reports no numerical accuracy result.Source: §5 · p. 8
  • ImageNet evaluation uses top-1 accuracy and compares preprocessor-blind and strong adaptive attacks; Table 3 reports results with 250 respaced steps and diffusion length 45.Because of the computation budget, the adaptive-attack evaluation randomly samples 5,000 validation images.Source: Table 3 · p. 9, §5 · p. 9

6 Conclusion

The paper concludes that guided diffusion is an effective purification approach, reporting results across CIFAR-10 and ImageNet attack evaluations. It also identifies processing time and possible watermark-removal misuse as concerns.

6 Conclusion

  • GDMP is reported to outperform predecessor defenses across PGD, BPDA+EOT, and black-box evaluations on CIFAR-10 and ImageNet.The conclusion describes the method as an effective tool for noise removal.Source: §6 · p. 10
  • Purification takes too much time, and the authors identify acceleration as a direction for further study.Source: §6 · p. 10
  • The authors flag possible misuse for image-watermark removal that could cause copyright infringement.Source: §6 · p. 10

A.1 Software and Hardware Configurations

The experiments were implemented with Python, PyTorch, Linux, and Slurm, using RTX 3090 or A100 GPUs.

A.1 Software and Hardware Configurations

  • Experiments used Python 3.8, PyTorch 1.7, Linux with Slurm, and RTX 3090 or A100 GPUs.The authors state that source code is available on GitHub.Source: §A.1 · p. 14

A.2 Acceleration Experiment Results

The appendix tests reverse-process step skipping as an acceleration strategy for purification under ImageNet PGD attacks without guidance.

A.2 Acceleration Experiment Results

  • The acceleration experiment tests reverse-process step skipping for unguided purification against PGD on ImageNet.Table 4 is identified as the acceleration experiment result, but no result values are supplied here.Source: §A.2 · p. 14, Table 4 · p. 14

Related papers

Loading 2205.14969v3…