Robust Overfitting Does Matter: Test-Time Adversarial Purification with FGSM

Authors:
Publisher website
Google Scholar
Abstract
Numerous studies have demonstrated the susce, of deep neural networks (DNNs) to subtle adversar turbations, prompting the development of many at adversarial defense methods aimed at mitigating ac ial attacks. Current defense strategies usually train for a specific adversarial attack method and can good robustness in defense against this type of ac ial attack. Nevertheless, when subjected to evan involving unfamiliar attack modalities, empirical e reveals a pronounced deterioration in the robust DNNs. Meanwhile, there is a trade-off between the classification accuracy of clean examples and adversarial examples. Most defense methods often sacrifice the accuracy of clean examples in order to improve the adversarial robustness of DNNs. To alleviate these problems and enhance the overall robust generalization of DNNs, we propose the Test-Time Pixel-Level Adversarial Purification (TPAP) method. This approach is based on the robust overfitting character-istic of DNNs to the fast gradient sign method (FGSM) on training and test datasets. It utilizes FGSM for adversarial purification, to process images for purifying unknown adversarial perturbations from pixels at testing time in a “counter changes with changelessness” manner, thereby enhancing the defense capability of DNNs against various unknown adversarial attacks. Extensive experimental results show that our method can effectively improve both overall robust generalization of DNNs, notably over pre-vious methods. Code is available https://github.com/tly18/TPAP.