Diffusion models (DMs) based adversarial purification (AP) has shown to be
the most powerful alternative to adversarial training (AT). However, these
methods neglect the fact that pre-trained diffusion models themselves are not
robust to adversarial attacks as well. Additionally, the diffusion process can
easily destroy semantic information and generate a high quality image but
totally different from the original input image after the reverse process,
leading to degraded standard accuracy. To overcome these issues, a natural idea
is to harness adversarial training strategy to retrain or fine-tune the
pre-trained diffusion model, which is computationally prohibitive. We propose a
novel robust reverse process with adversarial guidance, which is independent of
given pre-trained DMs and avoids retraining or fine-tuning the DMs. This robust
guidance can not only ensure to generate purified examples retaining more
semantic content but also mitigate the accuracy-robustness trade-off of DMs for
the first time, which also provides DM-based AP an efficient adaptive ability
to new attacks. Extensive experiments are conducted to demonstrate that our
method achieves the state-of-the-art results and exhibits generalization
against different attacks.

我们提出了一种具有逆向过程的鲁棒性指导方法，该方法独立于预训练的扩散模型，在不重新训练或微调扩散模型的情况下实现了对抗训练策略，保留了更多的语义内容，并减轻了扩散模型的准确性和鲁棒性之间的权衡，从而为基于扩散模型的对抗净化方法提供了对新攻击的高效适应能力。通过大量实验证实，我们的方法达到了最先进的结果，并展现了对不同攻击的泛化能力。

对抗净化的鲁棒扩散模型

Robust Diffusion Models for Adversarial Purification

Machine learning models have recently found tremendous success in data-driven
control systems. However, standard learning models often suffer from an
accuracy-robustness trade-off, which is a limitation that must be overcome in
the control of safety-critical systems that require both high performance and
rigorous robustness guarantees. In this work, we build upon the recent "locally
biased smoothing" method to develop classifiers that simultaneously inherit
high accuracy from standard models and high robustness from robust models.
Specifically, we extend locally biased smoothing to the multi-class setting,
and then overcome its performance bottleneck by generalizing the formulation to
"mix" the outputs of a standard neural network and a robust neural network. We
prove that when the robustness of the robust base model is certifiable, within
a closed-form $\ell_p$ radius, no alteration or attack on an input can result
in misclassification of the mixed classifier; the proposed model inherits the
certified robustness. Moreover, we use numerical experiments on the CIFAR-10
benchmark dataset to verify that the mixed model noticeably improves the
accuracy-robustness trade-off.

机器学习模型在数据驱动的控制系统中取得了巨大的成功，然而标准学习模型通常会受到准确性和鲁棒性之间的权衡的限制，本文建立在最近的 “局部偏置平滑” 方法之上，开发了既具有标准模型高准确性又具有鲁棒模型高鲁棒性的分类器。