The diffusion denoised smoothing (DDS) technique has performed well in certified defense against \({l_2}\) -norm bounded adversarial perturbations. However, we investigate that DDS is susceptible to the image resampling operations. For instance, the up-sampling reduces the classification accuracy of the base classifier and thus weakens the certified robustness of DDS. In this paper, we propose an enhanced certified defense based on DDS. To alleviate the model misclassification due to the use of bicubic interpolation upsampling, we employ an image super-resolution model to upscale the images, adapting them to the input size required by the classifier during the certification process. Because the base classifier is more accurate on super-resolution images than the traditional up-sampling images, this improved classifier benefits for the certified accuracy of the proposed defense. On the ImageNet dataset our proposed method achieves a certified top-1 accuracy of 53.8% when the adversarial perturbations are less than a \(l_{2}\) radius \(\varepsilon = 1.0\) , achieving at least 1.6% improvement over prior denoised smoothing defenses.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Enhancing Adversarial Robustness of Diffusion Denoised Smoothing via Image Super-Resolution

  • Qian Zeng,
  • Anjie Peng,
  • Hui Zeng,
  • Wenxin Yu

摘要

The diffusion denoised smoothing (DDS) technique has performed well in certified defense against \({l_2}\) -norm bounded adversarial perturbations. However, we investigate that DDS is susceptible to the image resampling operations. For instance, the up-sampling reduces the classification accuracy of the base classifier and thus weakens the certified robustness of DDS. In this paper, we propose an enhanced certified defense based on DDS. To alleviate the model misclassification due to the use of bicubic interpolation upsampling, we employ an image super-resolution model to upscale the images, adapting them to the input size required by the classifier during the certification process. Because the base classifier is more accurate on super-resolution images than the traditional up-sampling images, this improved classifier benefits for the certified accuracy of the proposed defense. On the ImageNet dataset our proposed method achieves a certified top-1 accuracy of 53.8% when the adversarial perturbations are less than a \(l_{2}\) radius \(\varepsilon = 1.0\) , achieving at least 1.6% improvement over prior denoised smoothing defenses.