Enhancing Adversarial Robustness of Diffusion Denoised Smoothing via Image Super-Resolution
摘要
The diffusion denoised smoothing (DDS) technique has performed well in certified defense against \({l_2}\) -norm bounded adversarial perturbations. However, we investigate that DDS is susceptible to the image resampling operations. For instance, the up-sampling reduces the classification accuracy of the base classifier and thus weakens the certified robustness of DDS. In this paper, we propose an enhanced certified defense based on DDS. To alleviate the model misclassification due to the use of bicubic interpolation upsampling, we employ an image super-resolution model to upscale the images, adapting them to the input size required by the classifier during the certification process. Because the base classifier is more accurate on super-resolution images than the traditional up-sampling images, this improved classifier benefits for the certified accuracy of the proposed defense. On the ImageNet dataset our proposed method achieves a certified top-1 accuracy of 53.8% when the adversarial perturbations are less than a \(l_{2}\) radius \(\varepsilon = 1.0\) , achieving at least 1.6% improvement over prior denoised smoothing defenses.