Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Recurso digital |
| Language: | |
| Published: |
Zenodo
2025
|
| Online Access: | https://doi.org/10.5281/zenodo.16740405 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
Table of Contents:
- <p>Despite significant advancements in the area, adversarial robustness remains a critical challenge in systems employing neural networks. The removal of adversarial perturbations at inference time, known as <em>adversarial purification</em>, has emerged as a promising defense strategy. To achieve this, state-of-the-art methods leverage diffusion models to inject Gaussian noise during a forward process to dilute adversarial perturbations, followed by a denoising step to restore clean samples before classification. Although effective, this technique often degrades benign performance as a side effect, due to the excessive noise introduced. <br>In this work, we propose FlowPure, an alternative purification approach based on Continuous Normalizing Flows (CNFs). Unlike diffusion-based approaches, FlowPure is not limited to Gaussian noise and can directly learn to remove adversarial noise. As such we propose two variants: one that is trained to remove adversarial noise directly, and one that is trained to remove Gaussian noise. We show that the adversarially trained variant outperforms state-of-the-art methods under preprocessor-blind threat models, while the Gaussian-trained variant achieves superior robustness against strong white-box attacks.</p>