The Positive-Incentive Noise Predictor (PnP) is proposed, the first framework that explicitly introduces positive-incentive noise ({\pi}-noise) into the purification task and effectively defends against adversarial attacks while preserving performance on natural speech.
Abstract
Modern automatic speaker verification (ASV) systems are vulnerable to adversarial perturbations. Diffusion-based purification has recently shown strong effectiveness against such perturbations, but its reverse denoising process requires iterative sampling and leads to high inference latency. We find that the forward noising process provides most of the robustness gain. Motivated by this observation, we reformulate adversarial purification as a learnable noising problem, and propose the Positive-Incentive Noise Predictor (PnP), the first framework that explicitly introduces positive-incentive noise ({\pi}-noise) into the purification task. PnP learns input-adaptive {\pi}-noise and mixes it with the input to improve the robustness of downstream ASV systems. Experiments on four advanced ASV backbones show that PnP effectively defends against adversarial attacks while preserving performance on natural speech. Compared with representative purification baselines, the proposed framework provides a competitive balance among defense effectiveness, impact on genuine utterances, and inference efficiency under white-box, black-box, and defender-aware adaptive attacks, with a real-time factor as low as 0.014. Moreover, PnP can be cascaded with a diffusion denoiser to further improve the perceptual quality of purified utterances. Code and purified audio examples are available at https://eurecom-asp.github.io/pnp/
Adversarial purification is a defense technique that employs generative models to remove adversarial perturbations. Current methods often rely on powerful generators, typically diffusion models, and focus on reducing the gap between adversarial and clean samples in the feature space, while overlooking semantic correlation within a single sample. To address this issue, we explore adversarial purification from the perspective of preserving semantic relationships among image patches. We employ an Attentive Mask Reconstruction Model (AMRM), which shows superior performance. Our theoretical and experimental analysis reveals that AMRM is highly sensitive to adversarial noise, as such noise significantly distorts patch relationships. Based on this observation, we propose AMRM-Pure, a purification framework that denoises adversarial inputs by preserving patch-level semantics, and formulate this process as a tractable optimization problem with respect to the input. To further enhance robustness, we finetune AMRM-Pure with classification loss to strengthen semantic consistency. We apply our insight to two AMRM architectures, including Mask Autoencoder (MAE) and MaskDiT. Extensive experiments confirm the effectiveness of our method, establishing new state-of-the-art performance across multiple benchmarks.
Zhihao Dou, Zhiqiang Gao, Dongfei Cui et al.· 0 citations
Deep neural networks (DNNs) are vulnerable to adversarial samples crafted by adding imperceptible perturbations to clean data, potentially leading to incorrect and dangerous predictions. Adversarial purification has been an effective means to improve DNNs robustness by removing these perturbations before feeding the data into the model. However, it faces significant challenges in preserving key structural and semantic information of data, as the imperceptible nature of adversarial perturbations makes it hard to avoid over-correcting, which can destroy important information and degrade model performance. In this paper, we break away from traditional adversarial purification methods by focusing on the clean data manifold. To this end, we reveal that samples generated by a well-trained generative model are close to clean ones but far from adversarial ones. Leveraging this insight, we propose Consistency Model-based Adversarial Purification (CMAP), which optimizes vectors within the latent space of a pre-trained consistency model to generate samples for restoring clean data. Specifically, 1) we propose a Perceptual consistency restoration mechanism by minimizing the discrepancy between generated samples and input samples in both pixel and perceptual spaces. 2) To maintain the optimized latent vectors within the valid data manifold, we introduce a Latent distribution consistency constraint strategy to align generated samples with the clean data distribution. 3) We also apply a Latent vector consistency prediction scheme via an ensemble approach to enhance prediction reliability. (CMAP) fundamentally addresses adversarial perturbations at their source, providing a robust purification. Extensive experiments on CIFAR-10 and ImageNet-100 show that our (CMAP) significantly enhances robustness against strong adversarial attacks while preserving high natural accuracy.
Shuhai Zhang, Jiahao Yang, Hui Luo et al.· IEEE Transactions on Pattern...· 0 citations
Recent studies have shown that deep learning-based automatic speech recognition (ASR) systems are vulnerable to adversarial examples (AEs), which can mislead ASR systems by embedding carefully crafted perturbations into speech signals. These attacks introduce significant challenges to the real-world deployment and reliability of ASR systems. Most existing AE detection methods align inputs by truncating or padding audio samples, which fails to fully use the information in speech and leads to a degradation in detection performance. In addition, few studies have explored the intrinsic characteristics of audio adversarial examples or how these characteristics can be leveraged for robust detection. To address this limitation, this paper proposes CAFAD, a plug-and-play detection framework that combines multi-domain acoustic feature fusion and temporal pyramid matching for variable-length adversarial audio detection. Experiments on LibriSpeech with nine adversarial attacks demonstrate that CAFAD achieves an average detection accuracy of 99.25%, with a false positive rate of 1.00% on benign samples. These results suggest that CAFAD has the potential to be used as a front-end screening module for ASR services, where incoming speech inputs can be inspected before transcription to reduce the risk of adversarial commands in security-sensitive applications such as voice-controlled authentication, smart-home control, and in-vehicle voice interaction. The source code is publicly available at https://anonymous.4open.science/r/CAFAD-59D0.