Adversarial Purification by Consistency-aware Latent Space Optimization on Data Manifolds

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep neural networks (DNNs) are susceptible to adversarial samples, which are slightly altered inputs designed to cause incorrect predictions.
• Adversarial purification methods aim to remove these perturbations but often damage essential data information, degrading model performance.
• Existing methods struggle to balance perturbation removal with the preservation of clean data characteristics.

Purpose of the Study:

• To develop a novel adversarial purification method that effectively removes perturbations while preserving data integrity.
• To enhance the robustness of DNNs against adversarial attacks without compromising their performance on clean data.
• To address the limitations of traditional purification techniques by focusing on the clean data manifold.

Main Methods:

• Propose Consistency Model-based Adversarial Purification (CMAP), leveraging a pre-trained consistency model.
• Implement a Perceptual consistency restoration mechanism to minimize discrepancies in pixel and perceptual spaces.
• Introduce a Latent distribution consistency constraint to align generated samples with the clean data distribution.
• Apply a Latent vector consistency prediction scheme using an ensemble approach for improved reliability.

Main Results:

• CMAP effectively restores clean data by optimizing latent space vectors within a consistency model.
• The method significantly enhances DNN robustness against strong adversarial attacks.
• High natural accuracy is preserved, demonstrating the effectiveness of the purification process.
• Experiments on CIFAR-10 and ImageNet-100 datasets validate the proposed approach.

Conclusions:

• CMAP offers a robust solution for adversarial purification by addressing perturbations at their source.
• The proposed method successfully balances adversarial robustness with the preservation of data accuracy.
• CMAP represents a significant advancement in defending DNNs against adversarial examples.