Iterative Window Mean Filter: Thwarting Diffusion-based Adversarial Purification

Abstract

Face authentication systems have brought significant convenience and advanced developments, yet they have become unreliable due to their sensitivity to inconspicuous perturbations, such as adversarial attacks. Existing defenses often exhibit weaknesses when facing various attack algorithms and adaptive attacks or compromise accuracy for enhanced security. To address these challenges, we have developed a novel and highly efficient non-deep-learning-based image filter called the Iterative Window Mean Filter (IWMF) and proposed a new framework for adversarial purification, named IWMF-Diff, which integrates IWMF and denoising diffusion models. These methods can function as pre-processing modules to eliminate adversarial perturbations without necessitating further modifications or retraining of the target system. We demonstrate that our proposed methodologies fulfill four critical requirements: preserved accuracy, improved security, generalizability to various threats in different settings, and better resistance to adaptive attacks. This performance surpasses that of the state-of-the-art adversarial purification method, DiffPure.

Accepted in IEEE Transactions on Dependable and Secure Computing

References in corpus (26)

• Auto-Encoding Variational Bayes
• Distilling the Knowledge in a Neural Network
• FaceNet: A Unified Embedding for Face Recognition and Clustering
• Explaining and Harnessing Adversarial Examples
• Denoising Diffusion Probabilistic Models
• Intriguing properties of neural networks
• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Evaluating Adversarial Robustness
• NVAE: A Deep Hierarchical Variational Autoencoder
• Distributional Smoothing with Virtual Adversarial Training
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Denoising Diffusion Restoration Models
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Stochastic Activation Pruning for Robust Adversarial Defense
• Early Methods for Detecting Adversarial Images
• Diffusion Models for Adversarial Purification
• Guided Diffusion Model for Adversarial Purification
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Guided Diffusion Model for Adversarial Purification from Random Noise
• Threat Model-Agnostic Adversarial Defense using Diffusion Models
• Evaluating the Adversarial Robustness of Adaptive Test-time Defenses
• PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognition
• Similarity-based Gray-box Adversarial Attack Against Deep Face Recognition