Adversarial Purification of Information Masking

Liang Xiao; Shuangquan Zhang; Sitong Liu; Zhichao Lian

RECORD

Adversarial Purification of Information Masking

Sitong Liu, Zhichao Lian, Shuangquan Zhang, Liang Xiao

Computer Vision and Pattern Recognition · Submitted 26 Nov 2023

abstract compiled · 2026-09-23 · no language-model review

The authors' main claim Extensive experiments on the ImageNet dataset with three classifier models demonstrate that our approach achieves state-of-the-art results against nine adversarial attack methods.

how it is stated · asserted 1.00 read the record →

Comment (0) Read on arXiv ↗

Cite ▾

Claim paper

The compiled record

The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.

Open the compiled record

Compiled by classifier-1.13.0 via TypeSafe API, question bank abstract-p1-20260923, 2026-09-23: 1 request, 8,876 input tokens.

What the abstract itself states, as probabilities: claims first 0.07 · states limitation 0.14 · human participants 0.02 · controlled comparison 0.30 · randomized assignment 0.05 · states quantitative result 0.32 · compares with prior results 0.80 · mentions code or data availability 0.98.

The abstract, sentence by sentence

arXiv listing abstract v1. Results and the main claim are underlined; show every role.

Adversarial attacks meticulously generate minuscule, imperceptible perturbations to images to deceive neural networks. Counteracting these, adversarial purification methods seek to transform adversarial input samples into clean output images to defend against adversarial attacks. Nonetheless, extent generative models fail to effectively eliminate adversarial perturbations, yielding less-than-ideal purification results. We emphasize the potential threat of residual adversarial perturbations to target models, quantitatively establishing a relationship between perturbation scale and attack capability. Notably, the residual perturbations on the purified image primarily stem from the same-position patch and similar patches of the adversarial sample. We propose a novel adversarial purification approach named Information Mask Purification (IMPure), aims to extensively eliminate adversarial perturbations. To obtain an adversarial sample, we first mask part of the patches information, then reconstruct the patches to resist adversarial perturbations from the patches. We reconstruct all patches in parallel to obtain a cohesive image. Then, in order to protect the purified samples against potential similar regional perturbations, we simulate this risk by randomly mixing the purified samples with the input samples before inputting them into the feature extraction network. Finally, we establish a combined constraint of pixel loss and perceptual loss to augment the model's reconstruction adaptability. Extensive experiments on the ImageNet dataset with three classifier models demonstrate that our approach achieves state-of-the-art results against nine adversarial attack methods. Implementation code and pre-trained weights can be accessed at \textcolor{blue}{https://github.com/NoWindButRain/IMPure}.

background contribution method result interpretation main claim

What the classifier reports for each sentence. The number is the probability it gave the label.
#	sentence	role	the authors' own work	states the main conclusion	strength
s0	Adversarial attacks meticulously generate minuscule, imperceptible perturbations to images to deceive neural networks.	background 1.00	0.05	0.02	asserted 1.00
s1	Counteracting these, adversarial purification methods seek to transform adversarial input samples into clean output images to defend against adversarial attacks.	background 1.00	0.04	0.03	asserted 1.00
s2	Nonetheless, extent generative models fail to effectively eliminate adversarial perturbations, yielding less-than-ideal purification results.	gap 0.71	0.08	0.04	asserted 1.00
s3	We emphasize the potential threat of residual adversarial perturbations to target models, quantitatively establishing a relationship between perturbation scale and attack capability.	contribution 0.79	0.92	0.15	asserted 0.96
s4	Notably, the residual perturbations on the purified image primarily stem from the same-position patch and similar patches of the adversarial sample.	result 0.85	0.84	0.12	asserted 1.00
s5	We propose a novel adversarial purification approach named Information Mask Purification (IMPure), aims to extensively eliminate adversarial perturbations.	contribution 0.97	0.81	0.16	asserted 0.96
s6	To obtain an adversarial sample, we first mask part of the patches information, then reconstruct the patches to resist adversarial perturbations from the patches.	method 1.00	0.82	0.04	asserted 0.95
s7	We reconstruct all patches in parallel to obtain a cohesive image.	method 1.00	0.82	0.03	asserted 0.98
s8	Then, in order to protect the purified samples against potential similar regional perturbations, we simulate this risk by randomly mixing the purified samples with the input samples before inputting them into the feature extraction network.	method 0.99	0.92	0.03	asserted 0.80
s9	Finally, we establish a combined constraint of pixel loss and perceptual loss to augment the model's reconstruction adaptability.	method 0.99	0.92	0.04	asserted 0.97
s10	Extensive experiments on the ImageNet dataset with three classifier models demonstrate that our approach achieves state-of-the-art results against nine adversarial attack methods.	result 1.00	0.96	0.78	asserted 1.00
s11	Implementation code and pre-trained weights can be accessed at \textcolor{blue}{https://github.com/NoWindButRain/IMPure}.	contribution 0.57	0.27	0.02	asserted 0.95

What kind of paper the classifier reports this is: method or tool 1.00 · evidence from observation or experiment 1.00.

What was examined, and what was not

sources read

arXiv listing abstract v1

not examined

full text
figures and tables
references and citing sentences
relations to other papers

levels run

P abstract

not run

S sections
T body sentences
C citations
R cross-paper relations

Every quoted sentence on this record is the authors'. Every label is from Pith's closed vocabulary, with the probability shown beside it. Every number in the measurements table is the authors', checked by code. Record as JSON

The paper

Original abstract

Adversarial attacks meticulously generate minuscule, imperceptible perturbations to images to deceive neural networks. Counteracting these, adversarial purification methods seek to transform adversarial input samples into clean output images to defend against adversarial attacks. Nonetheless, extent generative models fail to effectively eliminate adversarial perturbations, yielding less-than-ideal purification results. We emphasize the potential threat of residual adversarial perturbations to target models, quantitatively establishing a relationship between perturbation scale and attack capability. Notably, the residual perturbations on the purified image primarily stem from the same-position patch and similar patches of the adversarial sample. We propose a novel adversarial purification approach named Information Mask Purification (IMPure), aims to extensively eliminate adversarial perturbations. To obtain an adversarial sample, we first mask part of the patches information, then reconstruct the patches to resist adversarial perturbations from the patches. We reconstruct all patches in parallel to obtain a cohesive image. Then, in order to protect the purified samples against potential similar regional perturbations, we simulate this risk by randomly mixing the purified samples with the input samples before inputting them into the feature extraction network. Finally, we establish a combined constraint of pixel loss and perceptual loss to augment the model's reconstruction adaptability. Extensive experiments on the ImageNet dataset with three classifier models demonstrate that our approach achieves state-of-the-art results against nine adversarial attack methods. Implementation code and pre-trained weights can be accessed at \textcolor{blue}{https://github.com/NoWindButRain/IMPure}.

Human review

How Pith checks papers → · Full audit of this paper →

How the literature uses it

What this paper does with the arXiv papers it cites

Each citing sentence is taken from the citing paper's LaTeX source and typed by Pith's classifier. A label appears at probability 0.8 or more (0.95 for support), a contest at 0.7 or more; the quoted words are the citing authors'. How each label was checked · JSON

What it cites · 6 sentences without a confident label

Uses the method or tool of 4 papers

Attack methods: We select a series of adversarial attack methods to generate adversarial examples, including FGSM [ref] , C&W (CW) [ref] , Deepfool (Df) [ref] , PGD [ref] , MIFGSM (MI) [ref] , DIFGSM (DI) [ref] , MDFGSM (MD) [ref] , APGD-ce (A-ce) [ref] and APGD-dlr (A-dlr) [ref] .

Explaining and Harnessing Adversarial Examples · Experimental Settngs · 0.96
The code implementation of the first five methods refers to the CleverHans library[https://github.com/cleverhans-lab/cleverhans] [ref] , and the remaining four come from the Torchattacks library[https://github.com/Harry24k/adversarial-attacks-pytorch] [ref] .

Torchattacks: A PyTorch Repository for Adversarial Attacks · Experimental Settngs · 1.00
Implementation details: The structure and parameter settings of the transformer part of Regional Intersection AutoEncoder refer to MFFAE [ref] .

Improving Pixel-based MIM by Reducing Wasted Modeling Capability · Experimental Settngs · 1.00

Cites as background 1 paper

Adversarial training [ref] , a model-specific defense, has garnered considerable attention.

Explaining and Harnessing Adversarial Examples · Defense against adversarial attack · 0.91

Discussion

Know something about this paper? Leave a comment, or highlight any passage above to comment on it.