Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain

TL;DR

This paper introduces a frequency domain perspective for diffusion-based adversarial purification, selectively preserving low-frequency components to effectively eliminate adversarial noise while maintaining image content.

Contribution

The paper proposes a novel frequency-based purification method that selectively preserves low-frequency information, improving defense against adversarial attacks compared to existing methods.

Findings

Significantly outperforms current defense methods in experiments.

Damage from adversarial perturbations increases with frequency.

Selective frequency component replacement enhances purification effectiveness.

Abstract

The diffusion-based adversarial purification methods attempt to drown adversarial perturbations into a part of isotropic noise through the forward process, and then recover the clean images through the reverse process. Due to the lack of distribution information about adversarial perturbations in the pixel domain, it is often unavoidable to damage normal semantics. We turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spectrum. We find that for both spectra, the damage caused by adversarial perturbations tends to increase monotonically with frequency. This means that we can extract the content and structural information of the original clean sample from the frequency components that are less damaged. Meanwhile, theoretical analysis indicates that existing purification methods indiscriminately damage all frequency components, leading to excessive damage to the image. Therefore, we propose a purification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. Specifically, at each time step during the reverse process, for the amplitude spectrum, we replace the low-frequency components of the estimated image's amplitude spectrum with the corresponding parts of the adversarial image. For the phase spectrum, we project the phase of the estimated image into a designated range of the adversarial image's phase spectrum, focusing on the low frequencies. Empirical evidence from extensive experiments demonstrates that our method significantly outperforms most current defense methods.