Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce a novel adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. We conduct comprehensive experiments on multiple datasets, including CIFAR10, CIFAR100 and ImageNet. Our experimental results demonstrate that our approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.
Paper
Similar papers
Peer review
Summary
This paper proposes a dynamic defense named ScoreOpt, which maximizes the likelihood of input images by minimizing the score-matching loss. To regulate the optimization, the authors propose Score Regularization Loss which bound the distance between the denoised original images and denoised purified images.
Strengths
1. This paper proposes a novel test time defense, which is much more efficient than previous diffusion-based purification methods. 2. This paper is well written.
Weaknesses
1. The baseline model, DiffPure with Wide-ResNet-28, achieves 81.40% robustness in your paper. However, according to [1], the original paper where this baseline was proposed, it only achieves 70.64% robustness. This suggests that the robustness of the baselines and proposed method in your paper may be greatly over-estimated. 2. The proposed method contains an optimization that is typically considered hard to evaluate due to indifferentiability. [1] Nie, Weili, et al. "Diffusion Models for Adversarial Purification." International Conference on Machine Learning. PMLR, 2022.
Questions
I would recommend using more advanced evaluation methods for DiffPure and your proposed method, as suggested in [1], [2], and [3]. These methods could provide a more comprehensive evaluation and a fair comparison with state-of-the-art methods. I would like to request a detailed derivation of Equation (1) and an explanation of why it is the variational upper bound of -logp(x). [1] Nie, Weili, et al. "Diffusion Models for Adversarial Purification." International Conference on Machine Learning. PMLR, 2022. [2] Chen, Huanran, et al. "Robust Classification via a Single Diffusion Model." arXiv preprint arXiv:2305.15241 (2023). [3] Lee, Minjong, and Dongwoo Kim. "Robust evaluation of diffusion-based adversarial purification." arXiv preprint arXiv:2303.09051 (2023).
Rating
4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
2 fair
Presentation
3 good
Contribution
2 fair
Limitations
Limitation is not mentioned in the paper.
Summary
This paper introduces an adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. Comprehensive experiments are conducted on multiple datasets, including CIFAR10/100 and ImageNet, demonstrating that ScoreOpt outperforms existing adversarial defenses in terms of both robustness performance and inference speed.
Strengths
I like the problem formulation in Section 3.1 (although there are some questions that need to be clarified as mentioned in Questions) and a principle perspective from variational inference. Although heuristic, I think the formulation of SR loss is reasonable, especially the send term that minimizing the pixel-level distance between the denoised versions of the current sample $x$ and initial adversarial sample $x_a$. The empirical improvements compared to previous AP baselines are also promising.
Weaknesses
- I cannot find the values of iteration steps $M$ and $N$ used for Ours(o) and Ours(n) in, e.g., Tables 1, 2 and 4. Do the Ours methods and other AT/AP baselines require comparable inference time to achieve the results reported in Tables 1, 2 and 4? The authors should report inference time for both Ours methods and other AT/AP baselines in these Tables, because in practice, higher inference cost is a much bigger concern than higher training cost. - Each computation of the SR loss in Equation (5) actually include two forward passes through the scorenet (one for $x_{t}$ and another for $x_{a,t}$). So it is unfair to just compare diffusion steps with previous baselines, the authors should report the actual inference time as mentioned above. - The proposed ScoreOpt applies EDM, while the considered diffusion-based baselines (both AT and AP) still mainly apply DDPM. Therefore, the authors should add comparisons with more advanced baselines that also apply EDM, such as [1] listed in RobustBench. [1] Better Diffusion Models Further Improve Adversarial Training
Questions
- The second term in Equation (1) is the KL divergence between the conditional distribution $q(x|x_a)$ and model distribution $p_{\theta}(x)$, then how it could be equivalent to the diffusion loss in Equation (2) that formulated between the marginal distribution $q(x)$ and model distribution $p_{\theta}(x)$? - Equation (2) is NOT training loss of diffusion models since there is no expectation over $x$. Specifically, denoising score matching (DSM) used for training diffusion models includes expectation over $x$ (i.e., $\mathbb{E}_{x}$), and this expectation over $x$ is necessary such that the optimal solution of minimizing DSM is equal to the optimal solution of minimizing score matching (SM, or Fisher divergence). - The weighting coefficient $\omega(t)$ in Equation (2) should be $g(t)^{2}$ to make it a bound for log-likelihood, thus it is not guaranteed the relationship between Equation (3) and log-likelihood. - Equation (4) is only reasonable for $\ell_{2}$ threat model, but it is not justified why this loss could be effective under, e.g., $\ell_{\infty}$ threat model.
Rating
7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
Limitations and potential negative societal impact are not discussed in this paper.
Summary
This paper proposes an adversarial defense scheme named ScoreOpt, which uses purification technology to eliminate adversarial perturbations. Specifically, ScoreOpt formulates the adversarial defense as an optimization problem, which optimizes adversarial examples based on pre-trained score-based priors. And experimental results show that the adversarial robustness of the proposed method outperforms existing adversarial defenses against both transfer-based attacks and adaptive white-box attacks.
Strengths
1. This paper is well-written and easy to follow. 2. The proposed ScoreOpt departs from the sequential step-by-step denoising procedure, which doesn’t involve the process of carefully selecting the forward diffusion timestep. 3. The proposed hyperparameter-free score regularization loss function takes into account not only the alignment between pixels but also the alignment between score estimations.
Weaknesses
1. In this paper, the pre-designed noise plan is focused on lower noise levels. However, some clear explanations are necessary for this lower noise level. For example, how this lower noise level is defined, whether it is relevant to the dataset and whether too low noise level will affect the effectiveness of the proposed method. 2. This paper evaluates the robustness performance of adversarial defenses against transfer-based attacks and adaptive white-box attacks. To further illustrate the effectiveness of the proposed method, this paper should also test performance against some other advanced attack methods, such as score-based black-box attacks.
Questions
1. The authors may need to discuss the selection method of the noise level range, that is, how the values of $t_{min}$ and $t_{max}$ are determined, and the impact of the noise level range on the proposed algorithm. 2. It is recommended to test performance against some other advanced attack methods to enhance the credibility and universality of the method.
Rating
5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.
Confidence
3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
Soundness
3 good
Presentation
3 good
Contribution
3 good
Limitations
The authors point out the limitations of the proposed method in terms of computational memory cost and theoretical convergence analysis.
Summary
The paper proposes a new approach for defending against adversarial attacks using adversarial purification, i.e., removing the adversarial noise from the input image at test time. To that end, the authors leverage diffusion models -- which have been used recently for adversarial purification -- and propose several modifications to previous approaches in order to 1) improve performance and 2) speed up the process. Two big problems faced by previous diffusion-based approaches for adversarial purification include the sensitivity to the choice of hyperparameters for the diffusion model, and the long runtime since many denoising steps need to be applied. To solve the first problem, the authors propose a new hyper-parameter-free objective function for the adversarial purification using diffusion models. In order to solve the inference speed problem, the authors propose using a one-step denoiser, rather than employing the diffusion model denoise for several steps. The authors test their proposed defense in several setups, including standard adversarial attacks and adaptive adversarial attacks. The authors compare their results with previous baselines from the adversarial training literature and the adversarial purification literature. The evaluation shows the effectiveness of the defense, as the proposed method outperforms previous approaches in robust accuracy, while being faster.
Strengths
Strengths: - The paper addresses one important problem with previous diffusion-based adv purification approaches: the sensitivity to the choice of hyperparameters. To solve this problem, the authors propose a new objective function for the denoising, where they remove explicit dependence on hyperparameters. - The paper recognizes that previous approaches for adv purification using diffusion models are slow since the denoising step needs to be applied several times. To solve this issue, the authors propose using a one-shot denoiser. - The authors notice that some of the components needed for their objective function computation are absent, and propose choices to get circumvent the problem. For example, the authors notice the absence of the distribution of clean images conditioned on adversarial images, and propose an initialization to circumvent this issue. - The proposed approach is simple and intuitive. - The proposed approach outperforms previous methods in defending against adversarial attacks on a range of classification tasks. - The propose approach works well under traditional and adaptive attacks.
Weaknesses
- The presentation of the ideas needs to be improved. In particular, the methodology section can be confusing, especially when the authors propose new approaches to circumvent some problems. For example, the paragraph about the choice of the noise update rule is very confusing. - The authors mix notation a lot. For example, the authors use $q(x)$ and $q(x|x_a)$ interchangeably, even though they are not the same. - Some of the choices made need a slightly better explanation/intuition behind them. For example, the choice of taking gradient in the SR loss w.r.t. $\mathbf{x}_t$ instead of w.r.t. $\mathbf{x}$ lacks intuition. - There seems to be no proofs to the some of the statements of the paper. Are they provided in the appendix, or are they referencing proofs from previous papers? - The pseudocodes for the two proposed algorithms could be made clearer. First, having a clear explanation what each term represents would be helpful. Furthermore, in alg 1, it would be nice to show the term (5) rather than referencing it. Similarly, in alg 2, show the full term. Also the term $\mathbf{x}_{j,t}$ doesn't seem to be defined?
Questions
- How's Tweedie's formula used in the paper? - How much time in total the proposed approach requires? - Which converges faster: ScoreOpt(n) or ScoreOpt(o)? - Why does ScoreOpt(n) perform better? The intuition is not very clear. - The regularization term in the SR loss is not parametrized by a hyper-param. This works well in practice. I am not sure I agree about the reasoning of having similar order of magnitude, since a hyperparameter to control this regularization term can keep the same order of magnitude. Did the authors test adding a hyperparameter to the regularization term, and explore the sensitivity of the method to the choice? - Does having a different noise level during every iteration help? Have the authors tested having a fixed noise level? -
Rating
7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Soundness
3 good
Presentation
2 fair
Contribution
3 good
Limitations
- The authors identified some of the missing terms needed for their approximation, and proposed simple solutions to fix the issue. For example, the authors initialize the optimization variable $\mathbf{x}$ to the adv image $\mathbf{x}_a$ since they cannot take expectation over $q(\mathbf{x}|\mathbf{x}_a)$ in (1). However, this choice doesn't seem very convincing. - The method has not been fully tested against adaptive whitebox attacks since the computation cost of differentiation through the U-Net is very expensive. As a result, the authors only differentiate through one step. The results might look a bit different when the attack differentiates through multiple denoising steps.
Follow-up concerns about the evaluation
Thanks for providing the rebuttal. However, the effectiveness of the proposed method regarding the flawed evaluation cannot convince me. The detailed comments are as follows. First, the experiments in this paper are fundamentally flawed. In Table 6, the authors report that their proposed method only achieves 65.04% robustness against the $\ell_\infty(\epsilon=8/255)$ PGD+EOT attack. This is 5.65% lower than the state-of-the-art adversarial training method [1] and even lower than a defense method published two years ago [2]. However, in the main tables of the paper (Table 1), the authors report a robustness of 90.11%, which is obtained using the much weaker Transfer-PGD attack. The authors even claim that "**They use the weak attack for all defense methods, so their comparison is fair.**" This is completely nonsensical. It is impossible for anyone working in this field to use a weaker attack to get 90%+ robustness of an algorithm that cannot be compared with the method two years ago, and then use it as the main result of the paper. Second, the robustness of the proposed method may be greatly overestimated. Although the authors' experiments in Table 6 have shown that the robustness of their method is at most 65.04%, which is at least lower than the method of adversarial training 2 years ago, their robustness may be even lower. The proposed method contains multiple steps of optimization, making it difficult to sufficiently evaluate its robustness. Many adaptive attacks should be designed and combined with AutoAttack to sufficiently evaluate the robustness. Therefore, I would keep my original rating and lean towards rejection. [1] Better Diffusion Models Further Improve Adversarial Training [2] Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
Further Responses Part 1
Thanks for your detailed feedback. We will further address the concerns about the evaluation in the following paragraphs. > In the main tables of the paper (Table 1), the authors report robustness of 90.11%, which is obtained using the much weaker Transfer-PGD attack. The authors are supposed to provide clarifications or detailed discussions on that. (A1) Clarification of experimental results in the main text. ScoreOpt is a kind of adversarial purification method. We use different kinds of attacks to evaluate the robustness of ScoreOpt and baselines in the main text. We agree that the transfer-PGD attack in Table 1 is the weakest attack we used for evaluation. However, **there is an importance and necessity for evaluating adversarial defenses under such an attack**. For instance, AI systems are usually exposed to gray-box attacks, where the attackers have access to training surrogate models. So transfer-based attacks are also commonly used as evaluation benchmarks in adversarial purification literature [5,6,7,8]. Besides transfer-based attacks, **we also evaluate ScoreOpt against BPDA+EOT and PGD+EOT attacks to explore the limits of ScoreOpt**. BPDA+EOT is a widely used benchmark for adaptive test-time defenses and it is much stronger than transfer-based attacks. According to existing literature [3], PGD+EOT is stronger and more effective than AutoAttack for the robust evaluation of diffusion-based adversarial purification. So we think the evaluation against PGD+EOT is more convincing than AutoAttack. As a result, we summarize the robust accuracies of ScoreOpt under $\ell_{\infty}$ threats against different attacks in the table **General Rebuttal - Evaluation**. ScoreOpt outperforms previous diffusion-based purification baselines by a significant margin across all attacks, which shows the strong empirical robustness of ScoreOpt. > The authors claim that "They use the weak attack for all defense methods, so their comparison is fair." (A2) We feel that you may have misunderstood the meaning of our presentations. We have no any meaning that "we use the weak attack for all defense methods, so our comparison is fair". Indeed, we used different kinds of attacks to evaluate the robustness of ScoreOpt and baselines, including gray-box attacks (weaker) and white-box attacks (strong). ScoreOpt shows strong empirical performance against both weak and strong attacks. > The ScoreOpt contains multiple steps of optimization, making it difficult to sufficiently evaluate its robustness. (A3) We agree that backpropagating through the entire optimization steps to calculate the exact gradients for robustness evaluation is difficult due to the large memory cost. To address this issue, we propose an alternative surrogate process to obtain approximate gradients for robustness evaluation. Our proposed ScoreOpt-N method includes a gradient-descent step and a one-shot-denoising step for every optimization iteration. We use the one-shot denoising surrogate process for each optimization step, and it corresponds to approximate the gradient-descent step as an identity mapping. To show the effectiveness of our surrogate process for sufficient robustness evaluation, we evaluate ScoreOpt (with only one single optimization step) on a 512 CIFAR-10 subset. We use exact gradients and approximate gradients obtained by backpropagating through the surrogate process, respectively. The attack success rates of PGD+EOT are 33.99% (w/ exact gradients) vs 34.11% (w/ approximate gradients) under $\ell_2$, and 50.976563% vs 50.976562% under $\ell_{\infty}$. Therefore, this kind of approximate gradient obtained by the surrogate process can be considered as effective as computing the exact gradient to sufficiently evaluate the robustness of ScoreOpt.
Further Responses Part 2
> In Table 6, the authors report that their proposed method only achieves 65.04% robustness against the PGD+EOT attack. This is lower than the state-of-the-art adversarial training method [1] in RobustBench. (A4) **Comparison to RobustBench.** We totally agree that RobustBench is a widely used benchmark for a comprehensive comparison. So we provide an additional comparison to the current top-rank adversarial training methods in RobustBench. It is worth noting that all the experimental results we reported in the main text are generated with the same WRN-28-10 classifier architecture, but the top-rank models in RobustBench use WRN-70-16 architecture. **So direct comparison of accuracies is not suitable, because the base classifiers are different (WRN-28-10 vs WRN-70-16).** To make a fair comparison of ScoreOpt to other defenses, in the rebuttal period, we additionally evaluate ScoreOpt with WRN-70-16. With WRN-70-16 classifier architecture, ScoreOpt achieves 67.38% and 87.11% under $\ell_{\infty}$ and $\ell_2$. It outperforms previous SOTA (Rank1) under $\ell_2$ and performs better than Rank2 without using additional 50M synthetic images to retrain classifiers for each threat. This shows that ScoreOpt is strongly robust, threat-agnostic, and can generalize well to unseen threats. We give more analysis behind Table A. **Table A** Comparison to ATs in RobustBench | Methods| $\ell_{\infty}$ | $\ell_2$ | | ---------- | ---------- | ---------- | |WRN-70-16| | Rank1 [1]| 70.69 | 84.97 | | Rank2 [4]| 66.56 | 82.32 | | [2] | 65.88 | 80.53 | |ScoreOpt | 67.38 | **87.11**| **Analysis of Table A:** 1) ScoreOpt outperforms the SOTA defense AT-EDM [1] (Rank1) in RobustBench under the $\ell_2$-norm threat model with a significant margin. This indicates the strong empirical robustness performance of ScoreOpt among all defenses (including both AP and AT). 2) It outperforms most adversarial training models and achieves Rank2 under the $\ell_{\infty}$-norm; 3) Under the $\ell_{\infty}$-norm threat, ScoreOpt does not match Rank1, but performs better than Rank2. This is due to that the ScoreOPT is designed to defend against arbitrary attacks (i.e. it is free from assumptions of the forms of attacks). **On the contrary, AT needs to train with a specific attack and is fragile to other attacks.** We are very willing to further explore more improvements of ScoreOpt in order to achieve stronger performance under $\ell_{\infty}$ threat in the revision. For example, because ScoreOpt is orthogonal to retraining classifier methods, combining ScoreOpt with existing stronger classifiers in a plug-and-play manner may lead to improved performance. We put the discussion of generalization ability to unseen threats in the following paragraph. **ScoreOpt generalizes well to unseen threats.** A significant advantage of adversarial purification is that it can defend against unseen threats in a plug-and-play fashion, while most adversarial training methods can only defend against the specific attack that they are trained with. Even when AT models are robust against a specific threat model, they are still vulnerable to other unseen threat models. The following **Table B** shows the poor generalization of AT methods to unseen attacks and the strong generalization of our proposed method across different threat models. The threat model that AT is trained with is marked with an *italic*, and another is considered unseen. **Table B** Denfend against Unseen Attacks | Methods| $\ell_{\infty}$ | $\ell_2$ | Avg. | | ---------- | ---------- | ---------- | ---------- | | Rank1 [1] | *70.69* | 69.52 | 70.11 | | Rank1 [1] | 53.45 | *84.97* | 69.21 | | Rank2 [4] | *66.56* | 68.01 | 67.29 | | Rank2 [4] | 50.18 | *82.32* | 66.25 | | ScoreOpt | 67.38 | **87.11** | **77.25** | **Analysis of Table B:** As indicated in Table B, the performance of AT baselines drops significantly against unseen attacks. In real-world applications, we usually have no information about the attacker. Therefore, the generalization ability to unknown threats is crucial for adversarial defenses, which makes ScoreOpt (and other adversarial purification methods) preferred for a wide range of applications. **As a conclusion**, ScoreOpt achieves state-of-the-art among all diffusion-based purification methods with improved inference time. It also outperforms SOTA adversarial training methods under $\ell_2$. Under $\ell_{\infty}$, it is only worse than the best-performing model AT-EDM and ranks 2nd in RobustBench. However, the performance of AT-EDM drops significantly against other attacks, which are unseen during training (see **Tabe B**). The average robust accuracy across different threat models of ScoreOpt outperforms AT-EDM by a large margin. Overall, the ScoreOpt can be viewed as the strongest defense method when the defender has no information about the adversarial attacker in real-world scenarios.
Thanks for constructive questions
Thank you for your constructive questions. We hope our answers have resolved all of your concerns. If you still have any concerns, please do let us know. [1] Wang, Zekai, et al. "Better diffusion models further improve adversarial training." arXiv preprint arXiv:2302.04638 (2023). [2] Gowal, Sven, et al. "Uncovering the limits of adversarial training against norm-bounded adversarial examples." arXiv preprint arXiv:2010.03593 (2020). [3] Lee, Minjong, and Dongwoo Kim. "Robust evaluation of diffusion-based adversarial purification." arXiv preprint arXiv:2303.09051 (2023). [4] Rebuffi, Sylvestre-Alvise, et al. "Fixing data augmentation to improve adversarial robustness." arXiv preprint arXiv:2103.01946 (2021). [5] Nie, Weili, et al. "Diffusion Models for Adversarial Purification." International Conference on Machine Learning. PMLR, 2022. [6] Yoon, Jongmin, Sung Ju Hwang, and Juho Lee. "Adversarial purification with score-based generative models." International Conference on Machine Learning. PMLR, 2021. [7] Wang, Jinyi, et al. "Guided diffusion model for adversarial purification." arXiv preprint arXiv:2205.14969 (2022). [8] Ho, Chih-Hui, and Nuno Vasconcelos. "DISCO: Adversarial defense with local implicit functions." Advances in Neural Information Processing Systems 35 (2022): 23818-23837.
I have similar concerns as Reviewer wKkn. Too much inference computation is a far more serious problem in practice than too much training computation, because inference-phase devices (such as phones or PCs) have far fewer computing resources than training-phase GPU clusters. As a result, if we use adversarial purification at the expense of heavy inference computation, it is expected to outperform adversarial training significantly. However, 65.04 \% robust accuracy (which may or may not be under the most adaptive attacks) appears to be inadequate when compared to the methods listed on RobustBench.
Further Responses Part 1
Thank you for your suggestions. We agree that the computational cost in inference time is a limitation of ScoreOpt (and all adversarial purification methods). However, the advantage of ScoreOpt is still significant. One of the most important advantages of ScoreOpt over adversarial training (ATs) is the strong generalization ability to unseen threats. ATs are usually trained with a specific attack and the performance of AT baselines drops significantly against unseen attacks. In the real-world scene, we usually have no information about the threat model. Therefore, the generalization ability to unknown threats is also crucial for adversarial defenses to maintain adversarial robustness in real-world applications. To show the superior robustness of ScoreOpt across different attacks (without knowing the attack forms in advance), we re-organize results in the following **Tables A and B** to compare ScoreOpt with AT methods in RobustBench. We first provide an additional comparison to the current top-rank adversarial training methods in RobustBench. It is worth noting that all the experimental results we reported in the main paper are generated with the same WRN-28-10 classifier architecture, while the top-rank models in RobustBench use WRN-70-16 architecture. **So direct comparison of accuracies is not suitable, because the base classifiers are different (WRN-28-10 vs WRN70-16).** To show the effectiveness of our method, in the rebuttal period, we evaluate ScoreOpt with WRN-70-16. ScoreOpt achieves **67.38%** and **87.11%** under $\ell_{\infty}$ and $\ell_2$, with WRN-70-16 classifier architecture. **It outperforms previous SOTA (Rank1) under $\ell_2$ and performs better than Rank2 under $\ell_{\infty}$ without using additional 50M synthetic images to retrain classifiers for both threats.** This shows that ScoreOpt is strongly robust, threat-agnostic, and can generalize well to unseen threats. We give some analysis behind the table. **Table A** Comparison to ATs in RobustBench | Methods| $\ell_{\infty}$ | $\ell_2$ | | ---------- | ---------- | ---------- | |WRN-70-16| | Rank1 [1]| 70.69 | 84.97 | | Rank2 [4]| 66.56 | 82.32 | | [2] | 65.88 | 80.53 | |ScoreOpt | 67.38 | **87.11**| **Analysis of Table A:** (1) ScoreOpt outperforms the previous SOTA defense AT-EDM [1] (Rank1) in RobustBench under the $\ell_2$-norm threat model with a significant margin. This indicates the strong robustness performance of ScoreOpt among all defenses (including both AP and AT). (2) It outperforms most previous adversarial training models and achieves Rank2 under the $\ell_{\infty}$-norm; (3) Under the $\ell_{\infty}$-norm threat, ScoreOpt does not match Rank1, but performs better than Rank2. This is due to that the ScoreOPT is designed to defend against arbitrary attacks (i.e. it is free from assumptions of the forms of attacks). On the contrary, AT needs to train with a specific attack and is fragile to other attacks. We are very willing to further explore more improvements of ScoreOpt in order to achieve stronger performance under $\ell_{\infty}$ threat in the revision. For example, ScoreOpt is orthogonal to retraining classifier methods, we can simply combine ScoreOpt with existing stronger classifiers in a plug-and-play manner. But right now, we put the discussion of generalization ability to unseen threats in the following paragraph.
Further Responses Part 2
**ScoreOpt generalizes well to unseen threats.** A significant advantage of adversarial purification is that it can defend against unseen threats in a plug-and-play fashion, while most adversarial training methods can only defend against the specific attack that they are trained with. Even when AT models are robust against a specific threat model, they are still vulnerable to other unseen threat models. The following **Table B** shows the poor generalization of AT methods to unseen attacks and the strong generalization of our proposed method across different threat models. The threat model AT trained with is marked as *italic* and another is considered unseen. **Table B** Denfend against Unseen Attacks | Methods| $\ell_{\infty}$ | $\ell_2$ | Avg. | | ---------- | ---------- | ---------- | ---------- | | Rank1 [1] | *70.69* | 69.52 | 70.11 | | Rank1 [1] | 53.45 | *84.97* | 69.21 | | Rank2 [4] | *66.56* | 68.01 | 67.29 | | Rank2 [4] | 50.18 | *82.32* | 66.25 | | ScoreOpt | 67.38 | **87.11** | **77.25** | As indicated in **Table B**, the performance of AT baselines drops significantly against unseen attacks. In real-world practice, we usually have no information about the attacker. Therefore, the generalization ability to unknown threats is crucial for adversarial defenses. **As a conclusion**, we summarize the main performance improvements of our proposed method here. **ScoreOpt achieves state-of-the-art among all diffusion-based purification methods and improves inference time significantly in the meanwhile. It also outperforms previous SOTA adversarial training methods under $\ell_2$. Under $\ell_{\infty}$, it is only worse than the best-performing model AT-EDM and ranks 2nd in RobustBench.** However, the performance of AT-EDM drops significantly against other attacks, which are unseen during training (see **Tabe B**). **The average robust accuracy across different threat models of ScoreOpt outperforms AT-EDM by a large margin. Overall, the ScoreOpt can be viewed as the strongest defense method when the defender has no information about the adversarial attacker in real-world scenarios.** We hope our answers have resolved your concerns. If you still have any concerns, please do let us know. [1] Wang, Zekai, et al. "Better diffusion models further improve adversarial training." arXiv preprint arXiv:2302.04638 (2023). [2] Gowal, Sven, et al. "Uncovering the limits of adversarial training against norm-bounded adversarial examples." arXiv preprint arXiv:2010.03593 (2020). [3] Lee, Minjong, and Dongwoo Kim. "Robust evaluation of diffusion-based adversarial purification." arXiv preprint arXiv:2303.09051 (2023). [4] Rebuffi, Sylvestre-Alvise, et al. "Fixing data augmentation to improve adversarial robustness." arXiv preprint arXiv:2103.01946 (2021).
I thank the authors for the new results, which are quite informative. If possible, I would like to know more about: - ScoreOpt currently consists of a standardly trained model and an EDM, what if substituting the standardly trained model with an adversarially trained one like AT-EDM? Will the robust accuracy be further improved? - The authors claim that ScoreOpt is general to any threat model, which I cannot agree with as I mentioned in my initial review (Gaussian diffusion only corresponds to $\\ell_{2}$ threat model, and if the explanations in authors' rebuttal hold, then a $\\ell_{2}$ adversarially trained model should also be robust to $\\ell_{\\infty}$ threat model). What's the performance of ScoreOpt under common corruption (e.g., CIFAR-10-C) such as rotation? - Could you report the inference time (average time and worst-case time) of ScoreOpt and AT-EDM, such that I can compare the cost of inference computation? - Can ScoreOpt always perform well when using either ODE solver or SDE solver for EDM? *I do not expect the authors to answer all these questions during rebuttal, just try to answer some of them if time is enough.*
Further Response to Reviewer US8D
Thanks for your responses. We are glad that we have addressed some of your concerns. In the following paragraphs, we will address other concerns one by one. > ScoreOpt currently consists of a standardly trained model and an EDM, what if substituting the standardly trained model with an adversarially trained one like AT-EDM? Will the robust accuracy be further improved? (A1) We appreciate your keen intuition. We agree that combining ScoreOpt with a stronger base classifier is a promising direction. To further explore such a direction, we have conducted an additional experiment that combines ScoreOpt with AT-EDM. We evaluated the robustness of the combination against the PGD+EOT attack and observe improvements under both $l_\infty$ (from 67.38\% to 72.27\%) and $l_2$ (from 87.11\% to 89.06\%), respectively. Thank you for your promising suggestions which help to improve our work. > The authors claim that ScoreOpt is general to any threat model...What's the performance of ScoreOpt under common corruption (e.g., CIFAR-10-C) such as rotation? (A2) Thanks for your question. We have conducted additional experiments on CIFAR-10-C datasets. We also evaluated against the spatially transformed adversarial examples StAdv. The robustness performance of ScoreOpt and AT-EDM are summarized in **Table C** and **Table D**. **Table C** Defend against StAdv | Defense | Standard Acc | Robust Acc | | --- | --- | --- | | Base WRN-70-16 | 95.31 | 0 | | AT-EDM (trained with $\ell_{\infty}$)| 92.97 | 3.13| | AT-EDM (trained with $\ell_2$)| 96.09 | 5.27 | | ScoreOpt (w/ WRN-70-16) | 93.55 | 93.36 | **Table D** Performance on CIFAR-10-C | Defense | gaussian noise | shot noise | impulse noise | elastic transform | pixelate | jpeg compression | snow | frost | fog | brightness | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | AT-EDM (trained with $\ell_{\infty}$)| 79.85 | 81.22 | 62.02 | 86.14 | 88.89 | 89.93 | 84.75 | 83.94 | 37.87 | 88.04 | | AT-EDM (trained with $\ell_2$) | 81.91 | 83.17 | 63.74 | 89.96 | 92.0 | 93.61 | 89.26 | 88.17 | 48.55 | 92.88 | | Base WRN-70-16 | 25.71 | 32.19 | 27.89 | 73.17 | 44.93 | 67.32 | 77.82 | 66.49 | 71.37 | 91.33 | | ScoreOpt (w/ WRN-70-16) | 89.94 | 87.96 | 82.68 | 83.64 | 86.36 | 89.26 | 83.5 | 85.73 | 80.2 | 91.21 | As is shown in **Table C** and **Table D**, ScoreOpt maintains strong robustness across different attacks (beyond the $\ell_p$ norm-based attacks). This demonstrates the promising ability of ScoreOpt when handling different kinds of attacks. We guess one possible reason for such good generalization ability of ScoreOpt is the powerful capability of pre-trained generative models. We agree that more explorations are needed and we intend to leave them in future work. > Could you report the inference time (average time and worst-case time) of ScoreOpt and AT-EDM, such that I can compare the cost of inference computation? (A3) We are glad to provide a comparison of inference time between ScoreOpt and AT-EDM. The following table shows the wall-clock inference time (seconds) needed to purify and classify one single adversarial example successfully, not including the time cost by the attackers to generate adversarial samples. Experiments are conducted on 1 Nvidia Titan RTX GPU. |Defense | AT-EDM-$\ell_{\infty}$ | AT-EDM-$\ell_2$ | ScoreOpt | | --- | --- | --- | --- | | Time | 1.401$\pm$0.037 | 1.391$\pm$0.014 | 1.746$\pm$0.028 | Since the inference time of ScoreOpt is related to the number of optimization steps, we also report the inference time of ScoreOpt when the total optimization steps are increased to 20. In this extreme case, the wall-clock inference time is 2.596$\pm$0.025. > Can ScoreOpt always perform well when using either ODE solver or SDE solver for EDM? (A4) We feel sorry for the confusion. By our understanding, we assume that you may misunderstand that our ScoreOpt requires running reversed ODE or SDE with diffusion models. However, we would like to clarify that the ScoreOpt does not require ODE or SDE. Instead, the ScoreOpt defends adversarial samples by solving an optimization problem. This makes ScoreOpt different from previous diffusion-based defenses such as [1,2,3]. We hope our answers have resolved your concerns. If you still have any concerns, please let us know and we are glad to further address them. [1] Nie, Weili, et al. "Diffusion Models for Adversarial Purification." International Conference on Machine Learning. PMLR, 2022. [2] Blau, Tsachi, et al. "Threat model-agnostic adversarial defense using diffusion models." arXiv preprint arXiv:2207.08089 (2022). [3] Wang, Jinyi, et al. "Guided diffusion model for adversarial purification." arXiv preprint arXiv:2205.14969 (2022).
I thank the authors for their comprehensive responses and new results. I decide to raise the score and hope the authors can incorporate the new results of, e.g., combining AT-EDM, in the revision to further enhance the conclusion.
Thank you for the reply
We really appreciate your reply and we will take your valuable suggestions in the revision to further improve our work.
Thank you for addressing most of the comments - this was helpful! I still have few concerns: - (A2): the general comment addresses the issue where $q(x_a | x)$ in Eq. (1) has been updated to $q(x)$. It doesn't however provide a clear definition/separation of $q(x)$ and $q(x_a | x)$, and where $q(x_a)$ needs to be used instead. A clearer definition/separation would be very helpful. - (A3): Do you have some experiments to validate your hypothesis, i.e., where you consider both approaches (taking gradient w.r.t. $x$ and w.r.t. $x_t$) and plot the distribution, and showing that the gradients are indeed more stable? - (A6): I see. The term $\Sigma_z$ was the confusing part. I thought it was a summation over $z$. Can you please update and state that this term is the covariance matrix? - (A10): The adversarial sample is in the vicinity of the clean sample in the pixel space. However, once it is passed to a model, the clean and adversarial outputs are far from each other. I am still not very convinced about the choice. Can you please provide more intuition? Thanks in advance!
Further Responses to Reviewer epqL
Thanks for your valuable feedback. We are glad that we have addressed some of your concerns. In the following paragraphs, we will address other concerns one by one. > The general comment addresses the issue where $q(x_a|x)$ in Eq. (1) has been updated to $q(x)$. It doesn't however provide a clear definition/separation of $q(x)$ and $q(x_a|x)$, and where $q(x_a)$ needs to be used instead. A clearer definition/separation would be very helpful. (A1) We feel sorry for the confusion. First, let us make some clarification. We use $q(x)$ to approximate the true posterior distribution $p(x|x_a)$, not $q(x_a|x)$. The derivation is based on variational inference. Our motivation is to find a way to determine the true posterior distribution $p(x|x_a)$. However, it is difficult to infer $p(x|x_a)$ directly. The idea behind variational inference to solve this problem is to use a simpler, so tractable distribution $q(x)$ to approximate $p(x|x_a)$. That's why $q(x)$ is used in Eq. (1). And when the evidence upper bound in Eq. (1) is minimized, the KL-divergence between the two distributions, $q(x)$ and $p(x|x_a)$, is also minimized. > Do you have some experiments to validate your hypothesis, i.e., where you consider both approaches (taking gradient w.r.t. $x$ and w.r.t. $x_t$) and plot the distribution, and showing that the gradients are indeed more stable? (A2) Thank you for the question. It is true that more explorations are favored to verify our hypothesis. However, since the discussion period is short, we only conduct a relatively small experiment to explore the stability of the optimization process. In order to check the stability, we compute the standard deviation of the l2-norm of the gradients in the optimization process. The standard deviation of the l2-norm of the gradients of ScoreOpt-O is 2.07e-4. The standard deviation of ScoreOpt-N is 6.51e-5, smaller than ScoreOpt-O, which shows the stability of the scale of gradients. However, due to the limited time of the discussion period, our exploration may not be very sufficient. We are willing to explore more on this aspect in the future and put the results in the revision. > The term $\Sigma_z$ was the confusing part. I thought it was a summation over $z$. Can you please update and state that this term is the covariance matrix? (A3) We feel sorry for the confusion. The term $\Sigma_z$ in $\mu_z=z+\Sigma_z \nabla_z \log p(z)$ does represent the covariance matrix of $z$. We will refine it in the revision. > The adversarial sample is in the vicinity of the clean sample in the pixel space. However, once it is passed to a model, the clean and adversarial outputs are far from each other. I am still not very convinced about the choice. Can you please provide more intuition? (A4) We appreciate your keen intuition. We agree that the classifier outputs of the clean and the adversarial examples are distinct from each other. However, the purpose of our ScoreOpt is to recover the clean sample from the adversarial sample in the pixel space before feeding it into the downstream classifier. Ideally, the final purified sample should remain in the vicinity of the clean sample. And our method is independent of the downstream classifier. We hope our answers have resolved your concerns. And if there are any other new questions, please let us know and we are glad to further address them.
I thank the authors for the clarifications. After reading other reviewers' opinions, I decide to keep my score.
Decision
Accept (poster)