[Paper Review] Adversarial purification with Score-based generative models

Jongmin Yoon, Sung Ju Hwang+1 more|arXiv (Cornell University)|Jun 11, 2021

Adversarial Robustness in Machine Learning46 references34 citations

TL;DR

The paper introduces adversarial purification using a denoising score-matching trained energy-based model, enabling fast, robust purification of attacked images plus randomized-noise enhancement for certified robustness.

ABSTRACT

While adversarial training is considered as a standard defense method against adversarial attacks for image classifiers, adversarial purification, which purifies attacked images into clean images with a standalone purification model, has shown promises as an alternative defense method. Recently, an Energy-Based Model (EBM) trained with Markov-Chain Monte-Carlo (MCMC) has been highlighted as a purification model, where an attacked image is purified by running a long Markov-chain using the gradients of the EBM. Yet, the practicality of the adversarial purification using an EBM remains questionable because the number of MCMC steps required for such purification is too large. In this paper, we propose a novel adversarial purification method based on an EBM trained with Denoising Score-Matching (DSM). We show that an EBM trained with DSM can quickly purify attacked images within a few steps. We further introduce a simple yet effective randomized purification scheme that injects random noises into images before purification. This process screens the adversarial perturbations imposed on images by the random noises and brings the images to the regime where the EBM can denoise well. We show that our purification method is robust against various attacks and demonstrate its state-of-the-art performances.

Motivation & Objective

• Motivate adversarial purification as a viable defense separate from adversarial training.
• Leverage denoising score matching to train a score-based model for purification.
• Develop a deterministic update purification scheme with adaptive step sizes.
• Enhance robustness with random noise injection and show certified robustness via randomized smoothing.
• Demonstrate state-of-the-art performance against strong adaptive attacks on standard datasets.

Proposed method

• Train an energy-based model using denoising score matching (dsm) to learn the score function for purification.
• Use a multi-scale Noise Conditional Score Network (NCSN) to handle different perturbation levels.
• Perform purification with deterministic updates guided by the learned score, rather than Langevin dynamics.
• Introduce a random Gaussian noise injection before purification to improve robustness and enable randomized smoothing.
• Adapt step sizes during purification to ensure controlled descent in the score landscape.
• Combine multiple randomized purification runs and ensemble the outputs for final prediction.

Experimental results

Research questions

• RQ1 Can a score-based model trained with denoising score matching effectively purify adversarial examples faster than traditional MCMC-based EBMs?
• RQ2 Does random noise injection before purification yield certified robustness under norm-bounded threat models?
• RQ3 How does the proposed method perform against strong adaptive attacks compared to existing adversarial purification methods?
• RQ4 Is a deterministic purification update preferable to stochastic Langevin dynamics in terms of purification speed and accuracy?
• RQ5 Can adaptive step sizes improve purification stability without extensive hyperparameter tuning?

Key findings

• Deterministic score-guided purification with dsm-based EBMs purifies attacked images much faster than prior long-run MCMC approaches.
• Random Gaussian noise before purification improves robustness and enables randomized smoothing, achieving certified robustness under certain threat models.
• The method achieves strong robustness against a suite of adaptive attacks and compares favorably to existing adversarial purification and adversarial training baselines on CIFAR-10/100 and other datasets.
• A multi-scale score network trained with DSM (NCSN) enhances purification across varying attack strengths and data perturbations.
• Adaptive step-size strategies further stabilize purification and improve final classification accuracy under attack.