Test-Time Defense Against Adversarial Attacks via Stochastic Resonance of Latent Ensembles

2025-10-03

AI Summary

This work addresses the problem of defending against test-time adversarial attacks without model retraining or architectural modification. The proposed method leverages latent-variable ensembling grounded in stochastic resonance theory: it generates multi-view features via small random translations of the input image, followed by feature alignment and aggregation to enable closed-form robust inference—establishing an architecture-agnostic and attack-agnostic “noise-to-counter-noise” defense paradigm. Crucially, this is the first work to extend test-time defense to dense prediction tasks, including stereo matching and optical flow estimation. Empirical evaluation demonstrates substantial robustness gains: the method recovers 68.1% of performance degradation on image classification, 71.9% on stereo matching, and 29.2% on optical flow under adversarial perturbations. These results underscore its effectiveness across diverse vision tasks while preserving model integrity and inference efficiency.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

We propose a test-time defense mechanism against adversarial attacks: imperceptible image perturbations that significantly alter the predictions of a model. Unlike existing methods that rely on feature filtering or smoothing, which can lead to information loss, we propose to "combat noise with noise" by leveraging stochastic resonance to enhance robustness while minimizing information loss. Our approach introduces small translational perturbations to the input image, aligns the transformed feature embeddings, and aggregates them before mapping back to the original reference image. This can be expressed in a closed-form formula, which can be deployed on diverse existing network architectures without introducing additional network modules or fine-tuning for specific attack types. The resulting method is entirely training-free, architecture-agnostic, and attack-agnostic. Empirical results show state-of-the-art robustness on image classification and, for the first time, establish a generic test-time defense for dense prediction tasks, including stereo matching and optical flow, highlighting the method's versatility and practicality. Specifically, relative to clean (unperturbed) performance, our method recovers up to 68.1% of the accuracy loss on image classification, 71.9% on stereo matching, and 29.2% on optical flow under various types of adversarial attacks.

Problem

• Defends against adversarial attacks via stochastic resonance
• Enhances robustness without training or architectural changes
• Provides test-time protection for image classification and dense prediction tasks

Innovation

• Uses stochastic resonance to enhance model robustness
• Introduces translational perturbations to input images
• Training-free method works across diverse network architectures