mlsanityData to 14 Oct 2026

NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations

arXiv 2510.14025 ↗First posted 15 Oct 2025cs.CVcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial purification has achieved great success in combating adversarial image perturbations, which are usually assumed to be additive. However, non-additive adversarial perturbations such as blur, occlusion, and distortion are also common in the real world. Under such perturbations, existing adversarial purification methods are much less effective since they are designed to fit the additive nature. In this paper, we propose an extended adversarial purification framework named NAPPure, which can further handle non-additive perturbations. Specifically, we first establish the generation process of an adversarial image, and then disentangle the underlying clean image and perturbation parameters through likelihood maximization. Experiments on GTSRB and CIFAR-10 datasets show that NAPPure significantly boosts the robustness of image classification models against non-additive perturbations.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 37 of its 49 references that are in the map. First posted on arXiv 15 Oct 2025.

Builds on

37 of 49 references.

References · 37

  1. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  2. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2016Wide Residual Networkscited by 3,070
  7. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 3,045
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  9. 2016Adversarial Machine Learning at Scalecited by 936
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  11. 2017Adversarial Patchcited by 517
  12. 2022Diffusion Models for Adversarial Purificationcited by 476
25 more
  1. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  2. 2023Denoising Diffusion Models for Plug-and-Play Image Restorationcited by 340
  3. 2019Adversarial Attacks and Defenses in Images, Graphs and Text: A Reviewcited by 237
  4. 2016Semantic Image Inpainting with Deep Generative Modelscited by 157
  5. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 147
  6. 2022Guided Diffusion Model for Adversarial Purificationcited by 92
  7. 2023Robust Classification via a Single Diffusion Modelcited by 79
  8. 2021Improving Image Restoration by Revisiting Global Information Aggregationcited by 61
  9. 2023RealFill: Reference-Driven Generation for Authentic Image Completioncited by 59
  10. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  11. 2017Geometric robustness of deep networks: analysis and improvementcited by 45
  12. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 23
  13. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
  14. 2020Generalizing Universal Adversarial Attacks Beyond Additive Perturbationscited by 17
  15. 2021Learning to Adversarially Blur Visual Object Trackingcited by 14
  16. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  17. 2018Defense-VAE: A Fast and Accurate Defense against Adversarial Attackscited by 9
  18. 2022Defending Person Detection Against Adversarial Patch Attack by using Universal Defensive Framecited by 9
  19. 2023Deformation-Invariant Neural Network and Its Applications in Distorted Image Restoration and Analysiscited by 8
  20. 2022Towards Adversarial Purification using Denoising AutoEncoderscited by 6
  21. 2024Adversarial Training: A Surveycited by 6
  22. 2024Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Informationcited by 5
  23. 2024CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defensecited by 4
  24. 2020Watch out! Motion is Blurring the Vision of Your Deep Neural Networkscited by 1
  25. 2023Defending Adversarial Patches via Joint Region Localizing and Inpaintingcited by 1

Built on by

Not cited yet.