Abstract:Deep neural networks (DNNs) are vulnerable to adversarial samples crafted by adding imperceptible perturbations to clean data, potentially leading to incorrect and dangerous predictions. Adversarial purification has been an effective means to improve DNNs robustness by removing these perturbations before feeding the data into the model. However, it faces significant challenges in preserving key structural and semantic information of data, as the imperceptible nature of adversarial perturbations makes it hard to avoid over-correcting, which can destroy important information and degrade model performance. In this paper, we break away from traditional adversarial purification methods by focusing on the clean data manifold. To this end, we reveal that samples generated by a well-trained generative model are close to clean ones but far from adversarial ones. Leveraging this insight, we propose Consistency Model-based Adversarial Purification (CMAP), which optimizes vectors within the latent space of a pre-trained consistency model to generate samples for restoring clean data. Specifically, 1) we propose a \textit{Perceptual consistency restoration} mechanism by minimizing the discrepancy between generated samples and input samples in both pixel and perceptual spaces. 2) To maintain the optimized latent vectors within the valid data manifold, we introduce a \textit{Latent distribution consistency constraint} strategy to align generated samples with the clean data distribution. 3) We also apply a \textit{Latent vector consistency prediction} scheme via an ensemble approach to enhance prediction reliability. CMAP fundamentally addresses adversarial perturbations at their source, providing a robust purification. Extensive experiments on CIFAR-10 and ImageNet-100 show that our CMAP significantly enhances robustness against strong adversarial attacks while preserving high natural accuracy.

Adversarial purification with Score-based generative models

NCIS: Neural Contextual Iterative Smoothing for Purifying Adversarial Perturbations

Guided Diffusion Model for Adversarial Purification

Adversarial Purification of Information Masking

Text Adversarial Purification As Defense Against Adversarial Attacks

Language Guided Adversarial Purification

PureEBM: Universal Poison Purification via Mid-Run Dynamics of Energy-Based Models

Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attacks

Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models

Adversarial Purification by Consistency-aware Latent Space Optimization on Data Manifolds

ZeroPur: Succinct Training-Free Adversarial Purification

Robust Evaluation of Diffusion-Based Adversarial Purification

Random Sampling for Diffusion-based Adversarial Purification

Guided Diffusion-based Adversarial Purification Model with Denoised Prior Constraint

LightPure: Realtime Adversarial Image Purification for Mobile Devices Using Diffusion Models

Adversarial Text Purification: A Large Language Model Approach for Defense

Rethinking and Defending Protective Perturbation in Personalized Diffusion Models

Robust Diffusion Models for Adversarial Purification

Learning Energy-Based Models in High-Dimensional Spaces with Multiscale Denoising-Score Matching

Learning Energy-Based Models in High-Dimensional Spaces with Multi-scale Denoising Score Matching

MaskPure: Improving Defense Against Text Adversaries with Stochastic Purification