AMRM-Pure: Semantic-Preserving Adversarial Purification

2026-07-05

AI Summary

This work addresses the semantic distortion commonly observed in existing adversarial purification methods, which often neglect the semantic relationships among image patches. To mitigate this issue, the paper introduces a novel semantic-preserving purification framework, AMRM-Pure, which, for the first time, explicitly incorporates patch-level semantic dependencies into the purification process. The proposed method formulates purification as a tractable optimization problem and leverages a reconstruction model based on an attention-guided mask—termed the Attention Mask Reconstruction Model (AMRM)—integrating architectural elements from MAE and MaskDiT. Semantic consistency is further enhanced through fine-tuning with classification loss. Extensive experiments demonstrate that AMRM-Pure achieves state-of-the-art performance across multiple benchmarks, significantly improving both the robustness and semantic fidelity of purified images.

Abstract

Adversarial purification is a defense technique that employs generative models to remove adversarial perturbations. Current methods often rely on powerful generators, typically diffusion models, and focus on reducing the gap between adversarial and clean samples in the feature space, while overlooking semantic correlation within a single sample. To address this issue, we explore adversarial purification from the perspective of preserving semantic relationships among image patches. We employ an Attentive Mask Reconstruction Model (AMRM), which shows superior performance. Our theoretical and experimental analysis reveals that AMRM is highly sensitive to adversarial noise, as such noise significantly distorts patch relationships. Based on this observation, we propose AMRM-Pure, a purification framework that denoises adversarial inputs by preserving patch-level semantics, and formulate this process as a tractable optimization problem with respect to the input. To further enhance robustness, we finetune AMRM-Pure with classification loss to strengthen semantic consistency. We apply our insight to two AMRM architectures, including Mask Autoencoder (MAE) and MaskDiT. Extensive experiments confirm the effectiveness of our method, establishing new state-of-the-art performance across multiple benchmarks.

Problem

• adversarial purification
• semantic preservation
• patch-level semantics
• adversarial robustness
• generative models

Innovation

• adversarial purification
• semantic preservation
• patch-level semantics
• Attentive Mask Reconstruction Model
• diffusion-free defense