MAPE: Defending Against Transferable Adversarial Attacks Using Multi-Source Adversarial Perturbations Elimination

2026-06-30

AI Summary

This work addresses the challenge posed by transferable adversarial attacks in image classification, which exhibit both high imperceptibility and strong generalization, thereby evading conventional defenses. To counter this threat, the authors propose Multi-source Adversarial Perturbation Elimination (MAPE), a novel defense framework that integrates a channel-attention U-Net architecture with a multi-model probability scheduling strategy based on model discrepancy quantification and negative momentum. Designed for black-box settings, MAPE effectively removes diverse unknown adversarial perturbations. Experimental results demonstrate that, when evaluated against a ResNet-34 target model, MAPE achieves average defense success rates exceeding 95.1% on CIFAR-10 and 71.5% on Mini-ImageNet, substantially outperforming existing methods and exhibiting exceptional generalization capability across datasets and attack types.

Abstract

Neural networks are vulnerable to meticulously crafted adversarial examples, leading to high-confidence misclassifications in image classification tasks. Due to their consistency with regular input patterns and the absence of reliance on the target model and its output information, transferable adversarial attacks exhibit a notably high stealthiness and detection difficulty, making them a significant focus of defense. In this work, we propose a deep learning defense known as multi-source adversarial perturbations elimination (MAPE) to counter diverse transferable attacks. MAPE comprises the single-source adversarial perturbation elimination (SAPE) mechanism and the pre-trained models probabilistic scheduling algorithm (PPSA). SAPE utilizes a thoughtfully designed channel-attention U-Net as the defense model and employs adversarial examples generated by a pre-trained model (e.g., ResNet) for its training, thereby enabling the elimination of known adversarial perturbations. PPSA introduces model difference quantification and negative momentum to strategically schedule multiple pre-trained models, thereby maximizing the differences among adversarial examples during the defense model's training and enhancing its robustness in eliminating adversarial perturbations. MAPE effectively eliminates adversarial perturbations in various adversarial examples, providing a robust defense against attacks from different substitute models. In a black-box attack scenario utilizing ResNet-34 as the target model, our approach achieves average defense rates of over 95.1\% on CIFAR-10 and over 71.5\% on Mini-ImageNet, demonstrating state-of-the-art performance.

Problem

• adversarial attacks
• transferable attacks
• adversarial perturbations
• defense
• black-box attack

Innovation

• transferable adversarial attacks
• adversarial perturbations elimination
• channel-attention U-Net
• probabilistic scheduling
• black-box defense