TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models

TL;DR

TopoReformer introduces a topological purification pipeline that enhances OCR robustness against adversarial attacks by preserving structural integrity through topological features, without relying on model-specific defenses.

Contribution

It proposes a novel, model-agnostic topological autoencoder approach for defending OCR systems from adversarial perturbations, maintaining performance on clean inputs.

Findings

Effective against standard adversarial attacks (FGSM, PGD, CW)

Robust to adaptive attacks like EOT and BDPA

Preserves OCR accuracy on unperturbed images

Abstract

Adversarially perturbed images of text can cause sophisticated OCR systems to produce misleading or incorrect transcriptions from seemingly invisible changes to humans. Some of these perturbations even survive physical capture, posing security risks to high-stakes applications such as document processing, license plate recognition, and automated compliance systems. Existing defenses, such as adversarial training, input preprocessing, or post-recognition correction, are often model-specific, computationally expensive, and affect performance on unperturbed inputs while remaining vulnerable to unseen or adaptive attacks. To address these challenges, TopoReformer is introduced, a model-agnostic reformation pipeline that mitigates adversarial perturbations while preserving the structural integrity of text images. Topology studies properties of shapes and spaces that remain unchanged under continuous deformations, focusing on global structures such as connectivity, holes, and loops rather than exact distance. Leveraging these topological features, TopoReformer employs a topological autoencoder to enforce manifold-level consistency in latent space and improve robustness without explicit gradient regularization. The proposed method is benchmarked on EMNIST, MNIST, against standard adversarial attacks (FGSM, PGD, Carlini-Wagner), adaptive attacks (EOT, BDPA), and an OCR-specific watermark attack (FAWA).