Deep learning based image classification models are shown vulnerable to adversarial attacks by injecting deliberately crafted noises to clean images. To defend against adversarial attacks in a training-free and attack-agnostic manner, this work proposes a novel and effective reconstruction-based defense framework by delving into deep image prior (DIP). Fundamentally different from existing reconstruction-based defenses, the proposed method analyzes and explicitly incorporates the model decision process into our defense. Given an adversarial image, firstly we map its reconstructed images during DIP optimization to the model decision space, where cross-boundary images can be detected and on-boundary images can be further localized. Then, adversarial noise is purified by perturbing on-boundary images along the reverse direction to the adversarial image. Finally, on-manifold images are stitched to construct an image that can be correctly predicted by the victim classifier. Extensive experiments demonstrate that the proposed method outperforms existing state-of-the-art reconstruction-based methods both in defending white-box attacks and defense-aware attacks. Moreover, the proposed method can maintain a high visual quality during adversarial image reconstruction.

针对深度学习图像分类模型易受恶意注入噪声的对抗攻击，本文基于深度图像先验提出了一种新颖有效的重建防御框架，并且分析和明确地将模型决策过程纳入了防御范畴，通过倒推清晰的“干净样本”，最终构造出一幅可以被正确识别的图像，实验表明，在白盒、防御感知攻击下，该方法表现出优异的防御效果且重建图像的视觉质量较高。

探究基于深度图像先验的对抗防御：一种新颖的基于重建的防御框架