ShapePuri: Shape Guided and Appearance Generalized Adversarial Purification

TL;DR

ShapePuri is a new adversarial defense framework that improves robustness by aligning model representations with structural invariants and mitigating appearance bias, achieving high accuracy with low computational cost.

Contribution

It introduces ShapePuri, combining shape-guided geometric encoding and appearance debiasing, surpassing 80% robustness on AutoAttack benchmark.

Findings

Achieves 84.06% clean accuracy

Achieves 81.64% robust accuracy under AutoAttack

First to surpass 80% robustness threshold on this benchmark

Abstract

Deep neural networks demonstrate impressive performance in visual recognition, but they remain vulnerable to adversarial attacks that is imperceptible to the human. Although existing defense strategies such as adversarial training and purification have achieved progress, diffusion-based purification often involves high computational costs and information loss. To address these challenges, we introduce Shape Guided Purification (ShapePuri), a novel defense framework enhances robustness by aligning model representations with stable structural invariants. ShapePuri integrates two components: a Shape Encoding Module (SEM) that provides dense geometric guidance through Signed Distance Functions (SDF), and a Global Appearance Debiasing (GAD) module that mitigates appearance bias via stochastic transformations. In our experiments, ShapePuri achieves $84.06\%$ clean accuracy and $81.64\%$ robust accuracy under the AutoAttack protocol, representing the first defense framework to surpass the $80\%$ threshold on this benchmark. Our approach provides a scalable and efficient adversarial defense that preserves prediction stability during inference without requiring auxiliary modules or additional computational cost.