Adversarial Image Purification by Explaining Adversarial Detectors

Adversarial example detectors reported in recent years have demonstrated the ability to identify the existence of adversarial components by capturing anomalies in image processing and in latent representation. We have determined that these detectors can also be trained to attribute adversarial attacks to local superpixels and have developed a target-agnostic adversarial purification method based on explainable AI analysis. The first step is to generate a gradient saliency map using relevance propagation with robust training loss. The next is to reduce false positives by using on-manifold Shapley values from an ensemble of detectors. Finally, the original example is restored from masked input while restraining adversarial representations by using minimax optimization in the latent space of a generative model. Experiments showed that the proposed method improves existing target-agnostic generative defense models, particularly their ability to preserve image quality under adversarial patch attacks.