NCIS: Neural Contextual Iterative Smoothing for Purifying Adversarial Perturbations

TL;DR

This paper introduces NCIS, a novel self-supervised purification method that effectively defends against adversarial attacks by smoothing noise and reconstructing original features, achieving high robustness on ImageNet without adversarial training.

Contribution

The paper presents NCIS, a self-supervised neural purification technique combining iterative Gaussian smoothing and a blind-spot network, improving adversarial robustness without retraining classifiers.

Findings

Achieves state-of-the-art robust accuracy against strong attacks.

Effective on large-scale ImageNet classification models.

Enhances robustness of commercial image APIs.

Abstract

We propose a novel and effective purification based adversarial defense method against pre-processor blind white- and black-box attacks. Our method is computationally efficient and trained only with self-supervised learning on general images, without requiring any adversarial training or retraining of the classification model. We first show an empirical analysis on the adversarial noise, defined to be the residual between an original image and its adversarial example, has almost zero mean, symmetric distribution. Based on this observation, we propose a very simple iterative Gaussian Smoothing (GS) which can effectively smooth out adversarial noise and achieve substantially high robust accuracy. To further improve it, we propose Neural Contextual Iterative Smoothing (NCIS), which trains a blind-spot network (BSN) in a self-supervised manner to reconstruct the discriminative features of the original image that is also smoothed out by GS. From our extensive experiments on the large-scale ImageNet using four classification models, we show that our method achieves both competitive standard accuracy and state-of-the-art robust accuracy against most strong purifier-blind white- and black-box attacks. Also, we propose a new benchmark for evaluating a purification method based on commercial image classification APIs, such as AWS, Azure, Clarifai and Google. We generate adversarial examples by ensemble transfer-based black-box attack, which can induce complete misclassification of APIs, and demonstrate that our method can be used to increase adversarial robustness of APIs.