Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain

• URL: http://arxiv.org/abs/2505.01267v3
• Date: Wed, 11 Jun 2025 07:31:27 GMT
• Title: Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
• Authors: Gaozheng Pei, Ke Ma, Yingfei Sun, Qianqian Xu, Qingming Huang,
• Abstract summary: adversarial purification methods attempt to drown adversarial perturbations into a part of isotropic noise through the forward process.<n>We turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spectrum.<n>We find that for both spectra, the damage caused by adversarial perturbations tends to increase monotonically with frequency.<n>We propose a purification method that can eliminate adversarial perturbations while maximizing the preservation of the original image.
• Score: 82.7588726818454
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The diffusion-based adversarial purification methods attempt to drown adversarial perturbations into a part of isotropic noise through the forward process, and then recover the clean images through the reverse process. Due to the lack of distribution information about adversarial perturbations in the pixel domain, it is often unavoidable to damage normal semantics. We turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spectrum. We find that for both spectra, the damage caused by adversarial perturbations tends to increase monotonically with frequency. This means that we can extract the content and structural information of the original clean sample from the frequency components that are less damaged. Meanwhile, theoretical analysis indicates that existing purification methods indiscriminately damage all frequency components, leading to excessive damage to the image. Therefore, we propose a purification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. Specifically, at each time step during the reverse process, for the amplitude spectrum, we replace the low-frequency components of the estimated image's amplitude spectrum with the corresponding parts of the adversarial image. For the phase spectrum, we project the phase of the estimated image into a designated range of the adversarial image's phase spectrum, focusing on the low frequencies. Empirical evidence from extensive experiments demonstrates that our method significantly outperforms most current defense methods.

Related papers

• Frequency Domain-Based Diffusion Model for Unpaired Image Dehazing [92.61216319417208]
  We propose a novel frequency domain-based diffusion model, named ours, for fully exploiting the beneficial knowledge in unpaired clear data.<n>Inspired by the strong generative ability shown by Diffusion Models (DMs), we tackle the dehazing task from the perspective of frequency domain reconstruction.
  arXiv  Detail & Related papers  (2025-07-02T01:22:46Z)
• Freqformer: Image-Demoiréing Transformer via Efficient Frequency Decomposition [83.40450475728792]
  We present Freqformer, a Transformer-based framework specifically designed for image demoir'eing through targeted frequency separation.<n>Our method performs an effective frequency decomposition that explicitly splits moir'e patterns into high-frequency spatially-localized textures and low-frequency scale-robust color distortions.<n>Experiments on various demoir'eing benchmarks demonstrate that Freqformer achieves state-of-the-art performance with a compact model size.
  arXiv  Detail & Related papers  (2025-05-25T12:23:10Z)
• Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification [75.09791002021947]
  Existing purification methods aim to disrupt adversarial perturbations by introducing a certain amount of noise through a forward diffusion process, followed by a reverse process to recover clean examples.<n>This approach is fundamentally flawed as the uniform operation of the forward process compromises normal pixels while attempting to combat adversarial perturbations.<n>We propose a heterogeneous purification strategy grounded in the interpretability of neural networks.<n>Our method decisively applies higher-intensity noise to specific pixels that the target model focuses on while the remaining pixels are subjected to only low-intensity noise.
  arXiv  Detail & Related papers  (2025-03-03T11:00:25Z)
• AdaIR: Adaptive All-in-One Image Restoration via Frequency Mining and Modulation [99.57024606542416]
  We propose an adaptive all-in-one image restoration network based on frequency mining and modulation. Our approach is motivated by the observation that different degradation types impact the image content on different frequency subbands. The proposed model achieves adaptive reconstruction by accentuating the informative frequency subbands according to different input degradations.
  arXiv  Detail & Related papers  (2024-03-21T17:58:14Z)
• Spectrum Translation for Refinement of Image Generation (STIG) Based on Contrastive Learning and Spectral Filter Profile [15.5188527312094]
  We propose a framework to mitigate the disparity in frequency domain of the generated images. This is realized by spectrum translation for the refinement of image generation (STIG) based on contrastive learning. We evaluate our framework across eight fake image datasets and various cutting-edge models to demonstrate the effectiveness of STIG.
  arXiv  Detail & Related papers  (2024-03-08T06:39:24Z)
• On the Use of Singular Value Decomposition as a Clutter Filter for Ultrasound Flow Imaging [3.997460889704809]
  Singular Value Decomposition (SVD) provides substantial separation of clutter, flow and noise in high frame rate ultrasound flow imaging. The removal of clutter and noise relies on the assumption that tissue, flow and noise are each represented by different subsets of singular values. Ghosting and splitting artefacts are observed in the microvasculature where the flow signal is distributed.
  arXiv  Detail & Related papers  (2023-04-25T13:05:53Z)
• Adversarial amplitude swap towards robust image classifiers [3.480626767752489]
  We investigate the effect of the amplitude and phase spectra of adversarial images on the robustness of CNN classifiers. Experiments revealed that the images generated by combining the amplitude spectrum of adversarial images and the phase spectrum of clean images accommodates moderate and general perturbations.
  arXiv  Detail & Related papers  (2022-03-14T14:32:11Z)
• Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domain [31.182376196295365]
  CNN tends to converge at the local optimum which is closely related to the high-frequency components of the training images. A new perspective on data augmentation designed by re-combing the phase spectrum of the current image and the amplitude spectrum of the distracter image.
  arXiv  Detail & Related papers  (2021-08-19T04:04:41Z)
• Loss of Antibunching [0.0]
  We consider contamination by noise, a time jitter in the photon detection and the effect of frequency filtering. The emission from a two-level system under both incoherent and coherent driving is taken as a particular case of special interest.
  arXiv  Detail & Related papers  (2021-08-06T17:58:46Z)
• WaveFill: A Wavelet-based Generation Network for Image Inpainting [57.012173791320855]
  WaveFill is a wavelet-based inpainting network that decomposes images into multiple frequency bands. WaveFill decomposes images by using discrete wavelet transform (DWT) that preserves spatial information naturally. It applies L1 reconstruction loss to the low-frequency bands and adversarial loss to high-frequency bands, hence effectively mitigate inter-frequency conflicts.
  arXiv  Detail & Related papers  (2021-07-23T04:44:40Z)
• Spatial-Phase Shallow Learning: Rethinking Face Forgery Detection in Frequency Domain [88.7339322596758]
  We present a novel Spatial-Phase Shallow Learning (SPSL) method, which combines spatial image and phase spectrum to capture the up-sampling artifacts of face forgery. SPSL can achieve the state-of-the-art performance on cross-datasets evaluation as well as multi-class classification and obtain comparable results on single dataset evaluation.
  arXiv  Detail & Related papers  (2021-03-02T16:45:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.