Guided Diffusion Model for Adversarial Purification
Jinyi Wang1,3 ∗ Zhaoyang Lyu2,3 Dahua Lin2,3 Bo Dai3 Hongfei Fu1 1Shanghai JiaoTong University 2The Chinese University of Hong Kong 3Shanghai AI Laboratory Equal Contribution
Abstract
With wider application of deep neural networks (DNNs) in various algorithms and frameworks, security threats have become one of the concerns. Adversarial attacks disturb DNN-based image classifiers, in which attackers can intentionally add imperceptible adversarial perturbations on input images to fool the classifiers. In this paper, we propose a novel purification approach, referred to as guided diffusion model for purification (GDMP), to help protect classifiers from adversarial attacks. The core of our approach is to embed purification into the diffusion-denoising process of a Denoised Diffusion Probabilistic Model (DDPM), so that its diffusion process could submerge the adversarial perturbations with gradually added Gaussian noises, and both of these noises can be simultaneously removed following a guided denoising process. On our comprehensive experiments across various datasets, the proposed GDMP is shown to reduce the perturbations raised by adversarial attacks to a shallow range, thereby significantly improving the correctness of classification. GDMP improves the robust accuracy by 5%, obtaining 90.1% under PGD attack on the CIFAR10 dataset. Moreover, GDMP achieves 70.94% r
中文速览
深度神经网络图像分类器容易被对抗攻击（adversarial attack）欺骗——攻击者只需在图片上添加肉眼几乎察觉不到的微小扰动，就能让分类器产生错误预测。为此，研究者提出了一种名为"引导扩散模型净化"（Guided Diffusion Model for Purification，GDMP）的防御方案：先借助去噪扩散概率模型（Denoising Diffusion Probabilistic Model，DDPM）的正向扩散过程，用逐步叠加的高斯噪声将对抗扰动"淹没"，再在反向去噪过程中同时清除高斯噪声和对抗扰动，并引入以对抗图像本身为参考的相似度约束，防止净化后的图像偏离原始语义内容。实验表明，GDMP在CIFAR10数据集上对PGD攻击的鲁棒准确率达到90.1%，较此前方法提升约5%，在更具挑战性的ImageNet数据集上也实现了70.94%的鲁棒准确率，是首个在ImageNet规模上验证对抗净化有效性的方案，展示了扩散模型在提升分类器安全性方面的巨大潜力。
原文 arXiv:2205.14969;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2205.14969v3