Research map / Adversarial robustness and security / Attacks on text and graphs
IRAD: Implicit Representation-driven Image Resampling against Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IRAD, an image-resampling adversarial defense that pairs an implicit continuous image representation (LIIF-style) with a learned SampleNet that predicts pixel-wise coordinate shifts, and can be combined with DiffPure to speed it up.
Problem
Test-time adversarial defense: naive image resampling (fixed interpolation and uniform shifts) either hurts clean accuracy or gives only limited robustness against strong attacks such as AutoAttack and BPDA.
Approach
Reconstruct the input as a continuous implicit representation and train a SampleNet to predict input-dependent pixel-wise coordinate shifts for resampling, trained with adversarial denoising pairs generated from ResNet18, so resampling removes adversarial textures while keeping semantics.
Key results
- On CIFAR10 under AutoAttack (eps 8/255), IRAD reaches 91.70 SA and 89.72 RA (avg 90.71), versus 85.63 RA for DISCO and 87.54 RA for DiffPure.
- Under BPDA on CIFAR10, IRAD gets 74.32 RA, below DiffPure's 87.06 RA, but above DISCO's 22.60 RA.
- IRAD+DiffPure with 20 steps matches DiffPure (t=100) robustness at about 5x lower cost (27.70 ms vs 132.8 ms per image).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use IRAD instead of the strongest reported baseline | WRN28-10 · CIFAR10 AutoAttack | robust accuracy: 87.54 -> 89.72 | Helped |
| use IRAD instead of DISCO | WRN28-10 · CIFAR100 AutoAttack | robust accuracy: 68.52 -> 72.49 | Helped |
| use IRAD instead of DISCO | ResNet50 · ImageNet AutoAttack | robust accuracy: 68.26 -> 71.60 | Helped |
| use IRAD rather than DiffPure | WRN28-10 · CIFAR10 BPDA | robust accuracy: 87.06 -> 74.32 | Hurt |
| use IRAD rather than DiffPure | ResNet50 · ImageNet BPDA | robust accuracy: 61.42 -> 71.12 | Helped |
| train the implicit representation with PGD adversarial denoising rather than Clean2Clean (ablation) | IRAD · CIFAR10 AutoAttack | robust accuracy: 0.10 -> 76.69 | Helped |
| train the implicit representation with Gaussian denoising rather than Clean2Clean (ablation) | IRAD · CIFAR10 AutoAttack | robust accuracy: 0.10 -> 24.40 | Helped |
| replace SampleNet with spatial-invariant sampling (d=1.5) (ablation) | IRAD · CIFAR10 AutoAttack | robust accuracy: 89.72 -> 47.55 | Hurt |
| replace SampleNet with spatial-variant sampling (gamma=1.5) (ablation) | IRAD · CIFAR10 AutoAttack | robust accuracy: 89.72 -> 77.90 | Hurt |
| remove SampleNet sampling (ablation) | IRAD · CIFAR10 AutoAttack | robust accuracy: 89.72 -> 84.60 | Hurt |
| replace implicit reconstruction with nearest reconstruction (ablation) | IRAD with SampleNet · CIFAR10 AutoAttack | robust accuracy: 89.72 -> 0.96 | Hurt |
| replace implicit reconstruction with bilinear reconstruction (ablation) | IRAD with SampleNet · CIFAR10 AutoAttack | robust accuracy: 89.72 -> 79.20 | Hurt |
Surprising findings
- Naive nearest-neighbor resampling with fixed shifts gives almost no robustness (RA 0.93) even though bilinear with the same shift gives 42.30.
- IRAD with an AutoAttack-based adaptive adversary (attacking the full pipeline) drops to 0% robust accuracy, so the gains do not survive full-pipeline adaptive attacks.
Limitations
- Robustness drops sharply under BPDA and fully adaptive AutoAttack, with 0% RA when the attacker targets the full IRAD pipeline.
- Standard accuracy on CIFAR10 is reduced compared to no defense (91.70 vs 94.77).
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet
Benchmarks: CIFAR10 CIFAR100 ImageNet RobustBench AutoAttack leaderboard
Metrics: standard accuracy robust accuracy average accuracy inference cost (ms) PSNR SSIM LPIPS
Baselines: DISCO DiffPure JPEG Bit Reduction Randomization Median Filter NRP STL
Builds on: local implicit image function (LIIF) DISCO DiffPure
Closest papers by meaning
- Deflecting Adversarial Attacks With Pixel Deflection (CVPR 2018 · similarity 0.86)
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · similarity 0.86)
- Improving the Transferability of Adversarial Samples With Adversarial Transformations (CVPR 2021 · similarity 0.86)
- Enhancing the Adversarial Robustness via Manifold Projection (AAAI 2025 · similarity 0.85)
- AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · similarity 0.84)
- Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training (ICML 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.