Destruction and Reconstruction Chain: An Adaptive Adversarial Purification Framework

Adversarial attacks can cause abnormal behavior in deep neural networks by adding imperceptible perturbations to input data. Adversarial purification is an effective defense method by transforming adversarial data into clean data. Existing purification methods utilize only simple corruptions and specified reconstructors to eliminate perturbations, and thus are non-adaptive to different attack algorithms. To address this challenge, we propose an adaptive adversarial purification framework, which combines multiple Destruction and Reconstruction (D&R) operations to form a multi-stage D&R chain. The Destruction operations consist of corruptions in both spatial and frequency domains. The Reconstruction operations are implemented by deep networks trained respectively for corresponding corruptions to restore images. The D&R chain is constructed dynamically during purification based on the link probabilities of D&R operations with a self-supervised search algorithm. We test our framework on CIFAR10 datasets under five attacks. The experiment results indicate that the proposed framework can adapt to a wide range of attacks and achieve comparable performance.