Efficient Preemptive Robustification with Image Sharpening

Abstract

Despite their great success, deep neural networks rely on high-dimensional, non-robust representations, making them vulnerable to imperceptible perturbations, even in transfer scenarios. To address this, both training-time defenses (e.g., adversarial training and robust architecture design) and post-attack defenses (e.g., input purification and adversarial detection) have been extensively studied. Recently, a limited body of work has preliminarily explored a pre-attack defense paradigm, termed preemptive robustification, which introduces subtle modifications to benign samples prior to attack to proactively resist adversarial perturbations. Unfortunately, their practical applicability remains questionable due to several limitations, including (1) reliance on well-trained classifiers as surrogates to provide robustness priors, (2) substantial computational overhead arising from iterative optimization or trained generators for robustification, and (3) limited interpretability of the optimization- or generation-based robustification processes. Inspired by recent studies revealing a positive correlation between texture intensity and the robustness of benign samples, we show that image sharpening alone can efficiently robustify images. To the best of our knowledge, this is the first surrogate-free, optimization-free, generator-free, and human-interpretable robustification approach. Extensive experiments demonstrate that sharpening yields remarkable robustness gains with low computational cost, especially in transfer scenarios.

Figures (9)

• Figure 1: Visual examples of the proposed Laplacian Sharpening for preemptive robustification. Adversarial examples (AEs) are generated by MA attack with R50 as the surrogate, perturbation budget $\epsilon=10/255$, and iterations $T=10$. The target model is Visformer-S.
• Figure 2: Visualizations of Laplacian sharpened images with varying coefficients $\alpha$.
• Figure 3: Black-box accuracy (%) under various non-targeted attacks and $\epsilon^{a}$, evaluated on benign images sharpened with different $\alpha$. Gains from $\alpha=0.00$ (without image sharpening) to $\alpha=0.25$ are annotated at the top. Similar annotations apply hereafter.
• Figure 4: Explanation of image sharpening as an effective preemptive robustification process.
• Figure 5: White-box accuracy (%) under various non-targeted attacks and $\epsilon^{a}$, evaluated on benign images sharpened with different $\alpha$.