Abstract:Adversarial attacks meticulously generate minuscule, imperceptible perturbations to images to deceive neural networks. Counteracting these, adversarial purification methods seek to transform adversarial input samples into clean output images to defend against adversarial attacks. Nonetheless, extent generative models fail to effectively eliminate adversarial perturbations, yielding less-than-ideal purification results. We emphasize the potential threat of residual adversarial perturbations to target models, quantitatively establishing a relationship between perturbation scale and attack capability. Notably, the residual perturbations on the purified image primarily stem from the same-position patch and similar patches of the adversarial sample. We propose a novel adversarial purification approach named Information Mask Purification (IMPure), aims to extensively eliminate adversarial perturbations. To obtain an adversarial sample, we first mask part of the patches information, then reconstruct the patches to resist adversarial perturbations from the patches. We reconstruct all patches in parallel to obtain a cohesive image. Then, in order to protect the purified samples against potential similar regional perturbations, we simulate this risk by randomly mixing the purified samples with the input samples before inputting them into the feature extraction network. Finally, we establish a combined constraint of pixel loss and perceptual loss to augment the model's reconstruction adaptability. Extensive experiments on the ImageNet dataset with three classifier models demonstrate that our approach achieves state-of-the-art results against nine adversarial attack methods. Implementation code and pre-trained weights can be accessed at \textcolor{blue}{<a class="link-external link-https" href="https://github.com/NoWindButRain/IMPure" rel="external noopener nofollow">this https URL</a>}.

High-Frequency Anti-DreamBooth: Robust Defense against Personalized Image Synthesis

Anti-DreamBooth: Protecting users from personalized text-to-image synthesis

Adversarial Robust Safeguard for Evading Deep Facial Manipulation

Toward Robust Imperceptible Perturbation against Unauthorized Text-to-image Diffusion-based Synthesis

Adversarial Purification of Information Masking

DDAP: Dual-Domain Anti-Personalization against Text-to-Image Diffusion Models

Anti-Reference: Universal and Immediate Defense Against Reference-Based Generation

Rethinking and Defending Protective Perturbation in Personalized Diffusion Models

Exploiting vulnerabilities of deep neural networks for privacy protection

Coexistence of Deepfake Defenses: Addressing the Poisoning Challenge

Evading Deepfake-Image Detectors with White- and Black-Box Attacks

Clean-label attack based on negative afterimage on neural networks

DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing

Adversarial Attacks Hidden in Plain Sight

A New Defense Against Adversarial Images: Turning a Weakness into a Strength

MaskPure: Improving Defense Against Text Adversaries with Stochastic Purification

Natural Language Induced Adversarial Images

A novel privacy protection approach with better human imperceptibility

Architectural Resilience to Foreground-and-Background Adversarial Noise

Adversarial Defense by Suppressing High-frequency Components

LightPure: Realtime Adversarial Image Purification for Mobile Devices Using Diffusion Models