Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Cost
Not on the map. Why?
Abstract (arXiv)
Deep learning models are known to be vulnerable to adversarial attacks by injecting sophisticated designed perturbations to input data. Training-time defenses still exhibit a significant performance gap between natural accuracy and robust accuracy. In this paper, we investigate a new test-time adversarial defense method via diffusion-based recovery along opposite adversarial paths (OAPs). We present a purifier that can be plugged into a pre-trained model to resist adversarial attacks. Different from prior arts, the key idea is excessive denoising or purification by integrating the opposite adversarial direction with reverse diffusion to push the input image further toward the opposite adversarial direction. For the first time, we also exemplify the pitfall of conducting AutoAttack (Rand) for diffusion-based defense methods. Through the lens of time complexity, we examine the trade-off between the effectiveness of adaptive attack and its computation complexity against our defense. Experimental evaluation along with time cost analysis verifies the effectiveness of the proposed method.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 44 of its 54 references that are in the map. First posted on arXiv 22 Oct 2024.
Builds on
44 of 54 references.
References · 44
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
- 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
- 2016Wide Residual Networkscited by 3,070
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
32 more
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2021Swin Transformer V2: Scaling Up Capacity and Resolutioncited by 1,228
- 2018Learning Implicit Fields for Generative Shape Modelingcited by 1,060
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
- 2021ILVR: Conditioning Method for Denoising Diffusion Probabilistic Modelscited by 635
- 2020Learning Continuous Image Representation with Local Implicit Image Functioncited by 552
- 2022Diffusion Models for Adversarial Purificationcited by 476
- 2019On Evaluating Adversarial Robustnesscited by 447
- 2020Scalable Gradients for Stochastic Differential Equationscited by 271
- 2021Improving Robustness using Generated Datacited by 234
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
- 2021Data Augmentation Can Improve Robustnesscited by 194
- 2021Adversarial purification with Score-based generative modelscited by 134
- 2022Guided Diffusion Model for Adversarial Purificationcited by 92
- 2022Back to the Source: Diffusion-Driven Test-Time Adaptationcited by 71
- 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
- 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
- 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
- 2023Decoupled Kullback-Leibler Divergence Losscited by 58
- 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
- 2022Guided Diffusion Model for Adversarial Purification from Random Noisecited by 35
- 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
- 2021Combating Adversaries with Anti-Adversariescited by 27
- 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
- 2023Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shiftscited by 23
- 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
- 2023The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attackscited by 15
- 2022Holistic Adversarial Robustness of Deep Learning Modelscited by 11
- 2021Towards Evaluating the Robustness of Neural Networks Learned by Transductioncited by 8
- 2023Adversarial Finetuning with Latent Representation Constraint to Mitigate Accuracy-Robustness Tradeoffcited by 7
Built on by
Citing papers per year: 2025: 1.
1 paper.