MANI-Pure：面向对抗净化的幅度自适应噪声注入

摘要

基於擴散模型的對抗淨化已成為一種頗具前景的防禦策略，但現有方法通常依賴於均勻噪聲注入，這種方式不加區分地擾動所有頻率，破壞了語義結構並削弱了魯棒性。我們的實證研究表明，對抗擾動並非均勻分佈：它們主要集中於高頻區域，且在不同頻率和攻擊類型間呈現出異質的幅值強度模式。基於這一觀察，我們提出了MANI-Pure，這是一種幅值自適應的淨化框架，它利用輸入的幅值頻譜來指導淨化過程。與注入同質噪聲不同，MANI-Pure自適應地應用異質的、針對特定頻率的噪聲，有效抑制了脆弱的高頻低幅值頻帶中的對抗擾動，同時保留了語義關鍵的低頻內容。在CIFAR-10和ImageNet-1K上的大量實驗驗證了MANI-Pure的有效性。它將乾淨準確率與原始分類器的差距縮小至0.59以內，同時將魯棒準確率提升了2.15，並在RobustBench排行榜上取得了頂級魯棒準確率，超越了之前的最先進方法。

English

Adversarial purification with diffusion models has emerged as a promising defense strategy, but existing methods typically rely on uniform noise injection, which indiscriminately perturbs all frequencies, corrupting semantic structures and undermining robustness. Our empirical study reveals that adversarial perturbations are not uniformly distributed: they are predominantly concentrated in high-frequency regions, with heterogeneous magnitude intensity patterns that vary across frequencies and attack types. Motivated by this observation, we introduce MANI-Pure, a magnitude-adaptive purification framework that leverages the magnitude spectrum of inputs to guide the purification process. Instead of injecting homogeneous noise, MANI-Pure adaptively applies heterogeneous, frequency-targeted noise, effectively suppressing adversarial perturbations in fragile high-frequency, low-magnitude bands while preserving semantically critical low-frequency content. Extensive experiments on CIFAR-10 and ImageNet-1K validate the effectiveness of MANI-Pure. It narrows the clean accuracy gap to within 0.59 of the original classifier, while boosting robust accuracy by 2.15, and achieves the top-1 robust accuracy on the RobustBench leaderboard, surpassing the previous state-of-the-art method.

MANI-Pure：面向对抗净化的幅度自适应噪声注入

MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification

摘要

Support