Abstract
We propose a test-time defense mechanism against adversarial attacks: imperceptible image perturbations that significantly alter the predictions of a model. Unlike existing methods that rely on feature filtering or smoothing, which can lead to information loss, we propose to "combat noise with noise" by leveraging stochastic resonance to enhance robustness while minimizing information loss. Our approach introduces small translational perturbations to the input image, aligns the transformed feature embeddings, and aggregates them before mapping back to the original reference image. This can be expressed in a closed-form formula, which can be deployed on diverse existing network architectures without introducing additional network modules or fine-tuning for specific attack types. The resulting method is entirely training-free, architecture-agnostic, and attack-agnostic. Empirical results show state-of-the-art robustness on image classification and, for the first time, establish a generic test-time defense for dense prediction tasks, including stereo matching and optical flow, highlighting the method's versatility and practicality. Specifically, relative to clean (unperturbed) performance, our method recovers up to 68.1% of the accuracy loss on image classification, 71.9% on stereo matching, and 29.2% on optical flow under various types of adversarial attacks.
Abstract (translated)
我们提出了一种对抗攻击的测试时间防御机制：通过施加几乎不可察觉的图像扰动来显著改变模型预测结果。与现有的依赖特征过滤或平滑的方法不同，这些方法可能会导致信息丢失，我们提议采用“以噪音对抗噪音”的策略，利用随机共振增强鲁棒性的同时将信息损失最小化。我们的方法通过对输入图像进行小的平移扰动、对转换后的特征嵌入进行对齐并聚合，然后映射回原始参考图像来实现这一目标。这种方法可以用闭合形式公式表示，并且可以在各种现有的网络架构上部署，而无需引入额外的网络模块或针对特定攻击类型进行微调。该方法完全不需要训练，对于不同的网络架构和攻击方式都是通用的。 实验结果表明，在图像分类任务中，我们的方法达到了最先进的鲁棒性；此外，首次为密集预测任务（如立体匹配和光流）建立了一种通用测试时间防御机制，突显了该方法的灵活性和实用性。具体而言，相对于干净（未受干扰）的表现，我们的方法在各种类型的对抗攻击下，在图像分类中恢复了高达68.1%的精度损失，在立体匹配中恢复了71.9%，在光流中恢复了29.2%。
URL
https://arxiv.org/abs/2510.03224
