We propose a novel and effective purification based adversarial defense method against pre-processor blind white- and black-box attacks. Our method is computationally efficient and trained only with self-supervised learning on general images, without requiring any adversarial training or retraining of the classification model. We first show an empirical analysis on the adversarial noise, defined to be the residual between an original image and its adversarial example, has almost zero mean, symmetric distribution. Based on this observation, we propose a very simple iterative Gaussian Smoothing (GS) which can effectively smooth out adversarial noise and achieve substantially high robust accuracy. To further improve it, we propose Neural Contextual Iterative Smoothing (NCIS), which trains a blind-spot network (BSN) in a self-supervised manner to reconstruct the discriminative features of the original image that is also smoothed out by GS. From our extensive experiments on the large-scale ImageNet using four classification models, we show that our method achieves both competitive standard accuracy and state-of-the-art robust accuracy against most strong purifier-blind white- and black-box attacks. Also, we propose a new benchmark for evaluating a purification method based on commercial image classification APIs, such as AWS, Azure, Clarifai and Google. We generate adversarial examples by ensemble transfer-based black-box attack, which can induce complete misclassification of APIs, and demonstrate that our method can be used to increase adversarial robustness of APIs.
翻译:我们建议一种基于新颖而有效的净化的对抗性防御方法,以对抗前处理器盲白和黑箱袭击。我们的方法是计算效率高,训练仅以自我监督的方式学习一般图像,而不需要任何对抗性培训或对分类模式进行再培训。我们首先对对抗性噪音进行实证分析,其定义是原始图像与其敌对范例之间的剩余部分,其分布几乎是零和对称的。根据这一观察,我们建议一种非常简单的迭接高斯平滑(GS),可以有效地平息对抗性噪音,并实现相当强的准确性。为了进一步改进这种方法,我们建议采用神经性环境环境超常温和(NCIS),以自我监督的方式培训盲点网络(BSN),以重建原始图像的歧视性特征,而这种原始图像也是由GS平滑动的。我们用四个分类模型对大型图像网络进行的广泛实验,我们表明我们的方法既能达到竞争性的标准准确性,又能达到最强的准确性强的对最强的纯净白和黑色袭击进行精确的准确性。为了进一步改进。为了进一步改进它。为了进一步改进它,我们用A-BISA-BISA和BAR模型模型来评估,我们提出一种基于A-BA-BA-BA-BARMA-BA-BA-BA-BA-BA-BA-BA的新的标准,我们用的新方法,我们提出一种新的BBBA-C-BA-BA-BA-BBBBBBBBA-C-BA-C-C-C-C-C-BA-C-C-C-B-B-B-B-B-B-B-B-B-B-B-B-B-A-A-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-B-A-A-B-B-B-B-B-A-A-A-A-A-A-A-A-B-B-A-A-A-A-A-A-A-A-A-A-A-A-A-A-A-A-A-A-B