关键词: 对抗扰动, 对抗净化, 扩散模型, 鲁棒准确率, 神经网络, 引导

Abstract: Deep Neural Networks (DNNs) are susceptible to adversarial perturbations, so attackers may deceive DNNs by adding imperceptible adversarial perturbations to the image. The adversarial purification method based on diffusion model uses diffusion model to generate clean samples to defend against such attacks, but the diffusion model itself is also affected by adversarial perturbations. To combat such attacks, diffusion models were used for adversarial purification, where clean samples were generated to restore model robustness. However, diffusion models themselves were also influenced by adversarial perturbations. Therefore, a novel adversarial purification approach named StraightDiffusion was proposed, in which the diffusion process was directly guided by adversarial samples. Firstly, key problems and limitations of existing methods that used diffusion models for adversarial purification were discussed. Secondly, a new sampling method was proposed, which used a two-stage guidance approach in the denoising process — head guidance and tail guidance. Guidance was applied only in the early and late stages of denoising, and not in other stages. Experiments were conducted on CIFAR-10 and ImageNet datasets using three classifiers—WideResNet-70-16, WideResNet-28-10, and ResNet50. The results showed that StraightDiffusion outperformed baseline methods in defense performance. Compared to diffusion models for adversarial purification (Diffpure) and guided diffusion model for purification (GDMP), the best standard and robust accuracy was achieved on both CIFAR-10 and ImageNet datasets. The experimental results verified that the proposed method could improve purification performance, thereby enhancing the robust accuracy of classification models against adversarial samples and achieving effective defense under multiple attack scenarios.

Key words: adversarial perturbation, adversarial purification, diffusion model, robust accuracy, neural network, guidance