RoPAR: Enhancing Adversarial Robustness with Progressive Image Aggregation and Reordering Noise

Adversarial attacks mislead deep neural network classifiers with slight perturbations, underscoring the necessity for the development of robust defenses to ensure the secure and responsible use of artificial intelligence. Recent research has shown that diffusion-based adversarial purification methods have emerged as a promising defense technique, but often suffer from computational inefficiencies and suboptimal results. To address these issues, we propose RoPAR, an innovative approach that enhances robustness against adversarial attacks by aggregating purified images at intermediate steps of the diffusion process. Our method improves model robustness while reducing the required diffusion steps. We also introduce a technique for reordering Gaussian noise to minimize semantic information loss while removing adversarial perturbations. These enhancements significantly reduce the number of function evaluations from 200 to 6, achieving a robust accuracy of 92.39 % against preprocessor-blind PGD attacks on CIFAR-10, a 2.29 percentage point improvement over state-of-the-art. Moreover, our method demonstrates its effectiveness in real-world scenarios, achieving 87.46 % accuracy on CIFAR-10C.