Title: Model-Free Adversarial Purification via Coarse-To-Fine Tensor Network Representation
Venue: NeurIPS 2025
Accepted: no
Keywords: Tensor Network Representation

Robustness
Abstract: Deep neural networks are known to be vulnerable to well-designed adversarial attacks. Although numerous defense strategies have been proposed, many are tailored to specific attacks or tasks and often fail to generalize across diverse scenarios. In this paper, we propose Tensor Network Purification (TNP), a novel model-free optimization-based purification framework built upon a specially designed tensor network decomposition algorithm. TNP depends neither on the pre-trained generative model nor the specific dataset, resulting in robust generalization across diverse adversarial scenarios. To this end, the key challenge lies in relaxing Gaussian-noise assumptions of classical decompositions and accommodating the unknown distribution of adversarial perturbations. Unlike the low-rank representation of classical decompositions, TNP aims to reconstruct the unobserved clean example from an adversarial example. Specifically, TNP leverages progressive downsampling and introduces a novel adversarial optimization objective to address the challenge of minimizing reconstruction error but without inadvertently restoring adversarial perturbations. Extensive experiments conducted on CIFAR-10, CIFAR-100, and ImageNet demonstrate that our method generalizes effectively across various norm threats, attack types, and tasks, providing a versatile and promising adversarial purification technique.

Abstract

Deep neural networks are known to be vulnerable to well-designed adversarial attacks. Although numerous defense strategies have been proposed, many are tailored to specific attacks or tasks and often fail to generalize across diverse scenarios. In this paper, we propose Tensor Network Purification (TNP), a novel model-free optimization-based purification framework built upon a specially designed tensor network decomposition algorithm. TNP depends neither on the pre-trained generative model nor the specific dataset, resulting in robust generalization across diverse adversarial scenarios. To this end, the key challenge lies in relaxing Gaussian-noise assumptions of classical decompositions and accommodating the unknown distribution of adversarial perturbations. Unlike the low-rank representation of classical decompositions, TNP aims to reconstruct the unobserved clean example from an adversarial example. Specifically, TNP leverages progressive downsampling and introduces a novel adversarial optimization objective to address the challenge of minimizing reconstruction error but without inadvertently restoring adversarial perturbations. Extensive experiments conducted on CIFAR-10, CIFAR-100, and ImageNet demonstrate that our method generalizes effectively across various norm threats, attack types, and tasks, providing a versatile and promising adversarial purification technique.

1 Introduction 19

Deep neural networks (DNNs) have achieved remarkable success across a wide range of tasks. 20

However, DNNs have been shown to be vulnerable to adversarial examples (Szegedy et al., 2014; 21 Goodfellow et al., 2015), which are generated by adding small, human-imperceptible perturbations to 22 natural images but completely incorrect the prediction results to DNNs with potentially disastrous 23 consequences. This inherent vulnerability of DNNs underscores the critical need for robust defense 24 mechanisms to mitigate adversarial attacks effectively. 25

26

Since then, numerous methods have been proposed to defend against adversarial examples. Notably,

27

28

29

30

adversarial training (AT, Goodfellow et al., 2015) typically aims to retrain DNNs using specific adversarial examples, achieving robustness to seen types of adversarial attacks but performing

poorly against unseen perturbations (Laidlaw et al., 2021). Another class of defense methods is

adversarial purification (AP, Yoon et al., 2021), which leverages pre-trained generative models to

remove adversarial perturbations and demonstrates better generalization than AT against unseen 31

attacks (Nie et al., 2022; Lin et al., 2024a). However, AP methods heavily rely on pre-trained models 32

tailored to specific datasets, limiting their transferability to different data distributions and tasks. As a 33

result, both mainstream techniques face generalization challenges: AT struggles with diverse norm 34

threats, and AP with task generalization, restricting their deployment to broader scenarios. 35

To address these challenges, we propose a novel model-free optimization-based adversarial purifica-

36 tion framework built upon a coarse-to-fine tensor network decomposition, termed Tensor Network 37 Purification (TNP), which bridges the gap between low-rank tensor network representation with 38 Gaussian noise assumption and removal of adversarial perturbations with unknown distributions. As 39 a model-free optimization-based technique, tensor network (TN) depends neither on any pre-trained 40 generative model nor specific dataset (Oseledets, 2011; Zhao et al., 2016), enabling it to achieve 41 strong generalization across diverse adversarial scenarios. As a pre-processing step, TN can eliminate 42 potential adversarial perturbations for both clean and adversarial examples before feeding them 43 into the classifier (Yoon et al., 2021), which also implies that TN can defend against adversarial 44 attacks without retraining the classifier model. Moreover, by acting directly on a single input without 45 fixed model parameters, TN is inherently more resistant to adversarial attacks, as discussed further 46 in Appendix C. Consequently, benefiting from the aforementioned advantages, it is evident that 47 TN-based adversarial purification represents a highly promising direction, offering the transferability 48 to be effectively applied across diverse adversarial scenarios. 49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

The existing TN methods are particularly favorable for image completion and denoising when the corruption is sparse or follows a Gaussian distribution as long as it can be modeled explicitly. However, the distribution of well-designed adversarial perturbations fundamentally differs from these assumptions and often aligns with the intrinsic statistics of the data (Ilyas et al., 2019; Allen-Zhu & Li, 2022). Consequently, these perturbations behave more like genuine features than noise, making them challenging to be modeled explicitly and prone to being inadvertently reconstructed. To address this issue, we first explore the distribution changes of perturbations during the optimization process and initially mitigate their impact through progressive downsampling. Building upon these insights, we propose a coarse-to-fine TN incremental learning algorithm and introduce a novel adversarial optimization objective to avoid overly constraining the reconstruction error, preventing inadvertently restoring adversarial perturbations. Unlike classical TN methods applied to adversarial examples, our coarse-to-fine TN method prevents naive low-rank representation of the input and encourages the reconstructed examples to approximate the unobserved clean examples.

We empirically evaluate the performance of TNP by comparing it with AT and AP across attack settings using multiple classifiers on CIFAR-10, CIFAR-100, and ImageNet. The results demonstrate that TNP achieves robustness with strong generalization across diverse adversarial scenarios. Specifically, TNP achieved a 26.45% improvement in average robust accuracy over AT across different norm threats, a 9.39% improvement over AP across multiple attacks, and a 6.47% improvement over AP across different datasets. Furthermore, in denoising tasks, TNP effectively removes adversarial perturbations while preserving consistency between the reconstructed clean example and the reconstructed adversarial example. These results collectively underscore the effectiveness and potential of TNP. In summary, our contributions are as follows:

We propose a model-free optimization-based technique based on tensor network representation, which requires neither a powerful generative model nor reliance on specific dataset distributions, making it a general-purpose adversarial purification.

Based on our analysis of the distribution changes of adversarial perturbations during optimization, we design a novel adversarial optimization objective for coarse-to-fine TN representation learning to prevent the restoration of adversarial perturbations.

We conduct extensive experiments on various datasets, demonstrating that our method achieves state-of-the-art performance, especially exhibiting strong generalization across diverse adversarial scenarios.

2 Related Works

Adversarial robustness To defend against adversarial attacks, researchers have developed various 82 techniques aimed at enhancing the robustness of DNNs. Goodfellow et al. (2015) propose AT 83 technique to defend against adversarial attacks by retraining classifiers with adversarial examples 84 (Wang et al., 2019; Tack et al., 2022). In contrast, AP methods (Shi et al., 2021; Srinivasan et al., 2021) 85 aim to purify adversarial examples before classification without retraining the classifier. Currently, the 86 most common AP methods (Nie et al., 2022; Bai et al., 2024) rely on pre-trained generative models 87 as purifiers, which are trained on specific datasets and hard to generalize to data distributions outside 88 their training domain. Lin et al. (2024a) propose applying AT (Zhang et al., 2019) technique to AP, 89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

optimizing the purifier to adapt to new data distributions, at the cost of substantial training costs. Although TNP employs AP technique, it fundamentally differs from these works in that a model-free optimization-based framework relying solely on the information of the single input example for AP, without requiring any additional priors from pre-trained models and training costs.

Tensor network and TN-based defense methods Tensor network (TN) is a classical tool in signal processing, with many successful applications in image completion and denoising (Kolda & Bader, 2009; Cichocki et al., 2015). Compared to classical TN methods such as TT (Oseledets, 2011) and TR (Zhao et al., 2016), we employ the quantized technique (Khoromskij, 2011) and develop a coarse-to-fine strategy. Recent work (PuTT, Loeschcke et al., 2024) also employs a coarse-tofine strategy, aiming to achieve better initialization for faster and more efficient TT decomposition by minimizing the reconstruction error. In comparison, our method progresses from low to high resolution, explicitly targeting perturbation removal and analyzing the impact of downsampling on perturbations. Furthermore, we propose a novel optimization objective that goes beyond simply minimizing the reconstruction error, focusing instead on preventing the restoration of perturbations.

With the growing concern over adversarial robustness, a line of work has attempted to leverage TNs as robust denoisers to defend against adversarial attacks. In particular, Yang et al. (2019) reconstruct images and retrain classifiers to adapt to the new reconstructed distribution. Entezari & Papalexakis (2022) analyze vanilla TNs and show their effectiveness in removing high-frequency perturbations. Additionally, (Bhattarai et al., 2023) extend the application of TNs beyond data to include classifiers, a concept similar to the approaches of (Rudkiewicz et al., 2024; Phan et al., 2023). Furthermore, (Song et al., 2024) employ training-free techniques while incorporating ground truth information to defend against adversarial attacks. However, the aforementioned methods rely on additional prior or are limited to specific attacks. In this paper, we aim to achieve robustness solely by optimizing TNs themselves, establishing them as a plug-and-play and promising adversarial purification technique.

3 Backgrounds

Notations Throughout the paper, we denote scalars, vectors, matrices, and tensors as lowercase letters, bold lowercase letters, bold capital letters, and calligraphic bold capital letters, e.g., x , x , X and X , respectively. A D -order tensor is an D -dimensional array, e.g., a vector is a 1st-order tensor and a matrix is a 2nd-order tensor. For a D -order tensor X ∈ R I 1 ×···× I D , we denote its ( i 1 , . . . , i D )-th entry as x i , where i = ( i 1 , . . . , i D ). Following the conventions in deep learning, we treat images as vectors, e.g., input example x in , clean example x cln , adversarial example x adv and reconstructed example y .

Tensor network decomposition Given a D -order tensor X ∈ R I 1 × ... × I D , tensor network decomposition factorizes X into D smaller latent components by using some predefined tensor contraction rules. Among tensor network decompositions, Tensor Train (TT) decomposition (Oseledets, 2011) enjoys both quasi-optimal approximation as well as the high compression rate of large and complex data tensors. In particular, a D -order tensor X ∈ R I 1 × ... × I D has the TT format as x i = A 1 i 1 A 2 i 2 . . . A D i D , where A d i d ∈ R r d -1 × r d , for d ∈ [ D ] and i d ∈ [ I d ] . Then, (1 , r 1 , . . . , r d -1 , 1) is the TT rank of X . For simplicity, we denote X = TT ( A 1 , . . . , A D ) . When each dimension I d of X is large, quantized tensor train (QTT, Khoromskij, 2011) becomes highly efficient, which splits each dimension in powers of two. For example, a 2 D × 2 D image can be rearranged into a more expressive and balanced D -order tensor. For brevity, hereafter, a 2 D × 2 D image x D shall be called a resolution D image, whose quantized tensor is X D = Q( x D ) . QTT core denotes the core tensor after decomposition.

4 Method

Tensor network (TN) is a classical tool in signal processing, with many successful applications in image completion and denoising. By leveraging the ℓ 2 -norm as the primary optimization criterion, which aligns well with the statistical properties of a normal distribution, these methods (Phan et al., 2020; Loeschcke et al., 2024) have demonstrated strong capabilities in removing Gaussian noise.

However, the distribution of well-designed adversarial perturbations is essentially different from Gaussian noise and cannot be modeled explicitly (Ilyas et al., 2019; Allen-Zhu & Li, 2022), which challenges the conventional assumptions of TN-based denoising methods, leading to ineffectiveness

Upsample

Upsample

…

(…)

Average Pooling

Adversarial

Perturbations

Kernel Density

Estimation

×0.007

Upsample

2

!

×2

!

2

!"#

×2

!"#

2

!"#$%

×2

!"#$%

2

!

×2

!

2

!"#$&

×2

!"#$&

(a)

(b)

240 -

Perturbation

Downsamplingfactor2

220

Downsamplingfactor4

Downsamplingfactor8

60-

Downsamplingfactor16

40

20

0

0.0

0.5

1.0

KL Divergence

1.5

2.0

2.5

z

on adversarial purification for x adv . To minimize the loss ∥ x adv -TN ( x adv ) ∥ 2 , TN decompositions 141 fit all feature components of x adv , including the adversarial perturbations. However, in the presence of 142 adversarial attacks, we aim to restore unobserved x cln from the input x adv , that is: TN ( x adv ) ≈ x cln 143 rather than x adv . Based on the above analysis, it is crucial to overcome two challenges in designing 144 an effective TN method: Q1. How can we transform the non-specific adversarial perturbations into a 145 form amenable to TN modeling? Q2. How can we avoid overly constraining the reconstruction error 146 from inadvertently restoring those perturbations? 147

148

149

150

151

For Q1 , we explore how adversarial perturbations behave under downsampling with average pooling. Intuitively, the central limit theorem suggests that as an image is progressively downsampled, aggregated perturbations begin to resemble a normal distribution. Thus, even an ℓ 2 -based penalty becomes effective in suppressing the perturbations at coarse resolution.

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

However, while this insight helps suppress perturbations at lower resolutions, there remains the challenge of reconstructing the original resolution image. When upsampling and further optimizing using ∥ x adv -TN ( x adv ) ∥ 2 , the perturbations will still be restored. This connects with Q2 , for which we design a new optimization objective.

4.1 Downsampling using average pooling

An intuitive explanation for why downsampling aids in perturbation removal can be derived from the Central Limit Theorem (CLT, Grzenda & Zieba, 2008). When an image is downsampled by average pooling, the random components (e.g., pixel-level noise or minor adversarial perturbations) within those pooling patches are aggregated. We hypothesize that, given an adversarial example x adv , downsampling the x adv from its original resolution D to a lower resolution D -1 will smooth out the perturbations. As the downsampling process progresses further, the distribution of the aggregated perturbations in the coarse resolution image x D -l is expected to converge toward a normal distribution, as illustrated in Figure 1a. More results are shown in Appendix G.

To investigate this hypothesis in real datasets, we measure the KL divergence between the histograms of adversarial perturbations and the Gaussian distributions with the same sample mean and variance across 512 images from ImageNet. As shown in Figure 1b, the distribution of those perturbations progressively aligns with that of Gaussian noise as the downsampling process progresses. Consequently, even classical TN methods can effectively remove or mitigate adversarial perturbations at coarse resolution. Additionally, we further compare the influence of different downsampling methods to underscore the advantages of average pooling, as discussed in Appendix A.

4.2 Tensor network purification

Building upon our downsampling-based intuition, we design a coarse-to-fine purification pipeline 173 by extending PuTT (Loeschcke et al., 2024), which employs progressive downsampling for better 174 initialization of QTT cores. The workflow of tensor network purification (TNP) for classification 175 tasks is illustrated in Figure 2, where the quantized X = Q( x ) , TT decomposition X ≈ Y = 176 TT ( A 1 , . . . , A D ) , and reconstruction y = Q -1 ( Y ) processes are depicted. 177

Algorithm 1 Adversarial optimization process.

z

Upsample

Upsample

(…)

Average Pooling

Input

Example

Upsample

2

!

×2

!

2

!"#

×2

!"#

2

!"#$%

×2

!"#$%

2

!

×2

!

2

!"#$&

×2

!"#$&

Classifier model

𝑓

Final

prediction

Output logits

'dog'

❄

Backpropagation

Adversarial optimization process

Quantized

Downsampled

image (    )

Reconstructed

image (    )

TT

(2×2×2×⋯×2)

Initialized by PuTT

x

d

Y

= TT(

A

1

, . . . ,

A

D

)

||

x

d

-

(

y

d

+

δ

∗

d

)

||

2

+

||

P

d

(

y

d

-

1

)

-

y

d

||

2

y

d

Initially, the 2 D × 2 D input example x D (potentially adversarial example x adv or clean example x cln ), 178 whose quantized version is a D -order tensor X D , is first downsampled to a resolution D -l example 179 x D -l , corresponding to a ( D -l ) -order tensor X D -l . The QTT cores of X D -l are optimized 180 by PuTT via backpropagation within a standard reconstruction error || x D -l -y D -l || 2 . Once the 181 approximation of X D -l is stabilized, the prolongation operator P D -l +1 is applied to the QTT format 182 of X D -l , producing a ( D -l +1) -order tensor P D -l +1 X D -l . Additionally, we define the linear 183 function P d ( · ) acts on the image level, with the effect of upsampling from resolution d -1 to d , 184 details in Appendix B.2. This serves as an initialization to find the optimal QTT cores of X D -l +1 185 and reconstructed downsampled example y D -l . 186

187

188

189

190

191

Next, the input example x D is once again downsampled to a resolution D -l +1 example x D -l +1 . At this stage, the QTT cores of X D -l +1 are optimized using the adversarial optimization objective within a novel loss function as shown in Eq. (1). Similarly, once the approximation of X D -l +1 stabilizes, the upsampling operation is performed. This process is repeated iteratively until reaching the QTT approximation Y D of the original resolution X D .

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

The auxiliary variable δ ∗ is determined through an inner maximization process that utilizes a non209 convex loss function L adv . We employ a perceptual metric, structural similarity index measure 210 (SSIM, Hore & Ziou, 2010), as L adv to explore more potential solutions and better handle complex 211 perturbation patterns. While δ ∗ does not exactly represent the true adversarial perturbation, bounding 212

<latexi sh

1_b

64="SJI

fn5

gDPuo2/3

VBL

q

7

>A

8H

c

C

N

F

0

XzG+

K

W

QrM

R

w

k

Z

y

Y

v

d

9

E

U

p

m

T

<latexi sh

1_b

64="XY/

u

z

CKdjmF+gDG3H7

V

8

>A

Un

c

JLSwM

E

r

q

0

y2

P

ZB

WN

9

p

RQ

5

I

k

v

f

o

O

T

<latexi sh

1_b

64="8EcUH

2Xd yY

p

jz

DF

>

CO

V

7S

NB

J

r

f

u

o

W

+

I

Z

5n

k

M3

v

K

/

R

G

9

P

L

Q

T

q

m

0

<latexi sh

1_b

64="zS/HR

g5pG

+

UFI3

D

nEB

o

>A

8

c

V

9T

Mw

XK

y

f

YW

Jq

0

r

mPZ

Q

j

2

d

7u

v

O

k

N

C

L

Finally, TNP can purify potential adversarial examples ( x cln or x adv ) before feeding them into classifier f , e.g., f ( TNP ( x cln )) = f ( TNP ( x adv )) = gt , where gt is the ground truth label. As a plug-and-play module, TNP requires no modification to f and can be integrated with any classifier.

4.3 Adversarial optimization process

Following the coarse-to-fine process, despite the downsampling with average pooling and subsequent PuTT at lower resolutions can mitigate adversarial perturbations, the other challenge arises upon reconstructing the image at the original resolution, where minimizing the standard reconstruction error will inevitably restore the adversarial perturbations.

Unlike traditional reconstruction, in the context of adversarial attacks, we can only observe the adversarial example x adv , while the goal is to reconstruct a 'clean' y closing to the unobserved clean example x cln . To bridge the gap between x adv and x cln , we propose a new optimization objective that introduces an auxiliary variable δ . Moreover, we leverage the previously reconstructed downsampled example as a crucial prior to guide the approximation toward x cln .

Here, we outline the optimization procedure for x d , which corresponds to the gray box in Figure 2. Formally, given the resolution d example x d , we attempt to obtain the reconstructed example y d by performing gradient descent on optimization loss functions of

where d ∈ [ D -l +1 , D ] and η is a scale hyperparameter.

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

∥ δ ∥ < η can partially ensure that the misalignment between y and x adv remains controlled, effectively ensuring that y does not simply collapse into the adversarial example x adv .

However, precisely because δ ∗ does not represent the true perturbation, minimizing || x d -( y d + δ ∗ d ) || 2 may not yield the desired clean example. To address this limitation, we introduce a second loss term || P d ( y d -1 ) -y d || 2 , which serves as a crucial 'prior'. Specifically, we utilize the reconstructed downsampled example y d -1 as an additional constraint to aid in approximating the x cln . Building upon the observations in Figure 1, we start from the resolution D -l example x D -l that is optimized by PuTT, and then perform upsampling to the higher resolution to produce a clean-leaning reference, which acts to nudge y toward a less perturbed distribution. Although we never have direct access to the true clean example x cln , our loss provides an effective surrogate prior and guides the optimization process. The detailed algorithm of our adversarial optimization process is shown in Algorithm 1.

5 Experiments

In this section, we conduct comprehensive experiments on multiple datasets across various settings. The classification results demonstrate that TNP achieves robustness with strong generalization. We further investigate the removal of adversarial perturbations using tensor network decompositions and find that only TNP effectively removes the perturbations while preserving consistency between clean and adversarial examples. These results collectively highlight the effectiveness and potential of TNP.

5.1 Experimental setup

Datasets and model architectures We conduct extensive experiments on CIFAR-10, CIFAR-100 (Krizhevsky et al., 2009) and ImageNet (Deng et al., 2009) to empirically validate the effectiveness of the proposed methods against adversarial attacks. For classification tasks, we utilize the pre-trained ResNet (He et al., 2016) and WideResNet (Zagoruyko & Komodakis, 2016) models.

Adversarial attacks We evaluate our method against AutoAttack (Croce & Hein, 2020), a widely used benchmark that integrates both white-box and black-box attacks. Additionally, following the guidance of Lee & Kim (2023), we utilize PGD (Madry et al., 2018) with EOT (Athalye et al., 2018b) for a more comprehensive evaluation. Considering the potential robustness overestimation caused by obfuscated gradients of the purifier model, we utilize BPDA (Athalye et al., 2018a) as an adaptive attack with the knowledge of both purifier and classifier, following the setting by Yang et al. (2019); Lin et al. (2024a). Further implementation details and discussion are provided in Appendix C.

Compared methods We conduct experiments on the common benchmark and compare the robustness of our method with those listed in RobustBench (Croce et al., 2021). We evaluate the generalization of existing defense methods, including AT methods (Gowal et al., 2020, 2021; Laidlaw et al., 2021; Dolatabadi et al., 2022; Pang et al., 2022) and AP methods, with particular attention to diffusion-based AP (Yoon et al., 2021; Nie et al., 2022; Lee & Kim, 2023; Lin et al., 2024b). Furthermore, we include comparisons with Tensor Train (TT, Oseledets, 2011), Tensor Ring (TR, Zhao et al., 2016), quantized technique (Khoromskij, 2011) and PuTT (Loeschcke et al., 2024).

Due to the high computational cost of evaluating methods with multiple attacks, following the guidance of Nie et al. (2022), we randomly select 512 images from the test set for robust evaluation. All experiments presented in the paper are conducted by NVIDIA RTX A5000 with 24GB GPU memory, CUDA v11.7, and cuDNN v8.5.0 in PyTorch v1.13.11. More details in Appendix D.

5.2 Robustness comparison on RobustBench

In this section, we evaluate our method for defending against AutoAttack and compare it with the methods under all adversarial settings listed in RobustBench (Croce et al., 2021). Tables 1 to 4 present the performance of various defense methods against l ∞ ( ϵ = 8 / 255 ) and l 2 ( ϵ = 0 . 5 ) threats. Overall, the highest robust accuracy achievable by our method is generally on par with existing methods without using extra data (the dataset introduced by Carmon et al. (2019)). Specifically, compared to the second-best method, our method improves the robust accuracy by 1.67% on CIFAR-100, by 1.84% on ImageNet, and the average robust accuracy by 0.36% on CIFAR-10.

Due to the overfitting of WideResNet-28-10 trained on the limited data available in CIFAR-10, we observe that the results with standard classifier (Ours) struggle to reach state-of-the-art performance,

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

consistent with findings from Chen & Lee (2024). To further improve robust accuracy, most AT methods incorporate additional synthetic data to train a robust classifier. Following this, we conduct experiments with the robust classifier (Ours ∗ ), which utilizes an additional 20M synthetic images in training (Cui et al., 2024). This leads to a significant improvement in robust accuracy on CIFAR-10. Moreover, compared to the used robust classifier (Cui et al., 2024), our method further improves the robust accuracy by 5.12%. These results are consistent across multiple datasets and norm threats, confirming the effectiveness of our method and its potential for defending against adversarial attacks.

5.3 Generalization comparison across various adversarial scenarios

As previously highlighted, the existing defense methods are often criticized for their lack of generalization across different norm threats, attacks, and datasets. In the following, we evaluate the performance of our method under various adversarial settings to demonstrate its robust generalization.

Results analysis on different norm threats Table 5 shows that AT methods (Laidlaw et al., 2021; Dolatabadi et al., 2022) are limited in defending against unseen attacks and can only effectively be against the specific attacks they are trained on. An intuitive idea is to apply AT across all norm threats or develop more general constraints to obtain a robust model. However, training such a model is challenging due to the inherent differences among various attacks. In contrast, AP methods (Nie et al., 2022; Lin et al., 2024a) exhibit strong generalization, effectively defending against unseen attacks. The results demonstrate that our method also possesses strong generalization capabilities against unseen attacks, achieving performance close to

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

AT methods

AP methods

Ours*

Acc.

70

60

50

PGD+EOT

AutoAttack

40

30

the AP methods while significantly outperforming the existing AT methods. Specifically, compared to the best AT method, our method improves average robust accuracy by 26.45%.

Results analysis on multiple attacks Figure 3 shows the comparison of robust accuracy against PGD+EOT and AutoAttack with l ∞ ( ϵ = 8 / 255 ) threat on CIFAR-10 with WideResNet-28-10. When facing different attacks within the same threat, AT methods (Gowal et al., 2020, 2021; Pang et al., 2022) exhibit better generalization than AP methods (Yoon et al., 2021; Nie et al., 2022; Lee & Kim, 2023). Typically, robustness evaluation is based on the worst-case results of the robust accuracy. Under this criterion, our method outperforms all AT and AP methods. Specifically, compared to the best AP method, our method improves average robust accuracy by 9.39%.

Results analysis on different datasets Table 6 shows the generalization of the methods across different datasets. As previously highlighted, the existing AP methods typically rely on specific datasets. For AP method, when a pre-trained generative model trained on CIFAR-10 is applied to adversarial robustness evaluation on CIFAR-100, both standard accuracy and robust accuracy drop significantly. This occurs because the pre-trained generative model can only generate the data it has learned. Although the input examples originate from CIFAR-100, the generative model attempts to output one of the ten classes from CIFAR-10, severely distorting the semantic information of the input examples and leading to low classification accuracy. In contrast, our method exhibits strong generalization across different datasets, achieving comparable robust performance on CIFAR-100 as on CIFAR-10. Specifically, compared to the AP method (Nie et al., 2022), our method improves the average robust accuracy by 6.47%.

Unlike existing methods, TNP employs an optimization-based strategy that operates solely on the given input, without relying on prior knowledge learned from large-scale training datasets or strong assumptions about attacks, thereby retaining strong generalization across various scenarios.

5.4 Denoising tasks

In this section, we evaluate the effectiveness of our method on non-classification tasks through visual comparisons and various quantitative metrics.

Ablation study Figure 4 shows the comparison of visualizations on ImageNet. The top row in (a) displays the input clean example (CE), and its corresponding reconstructed clean examples (rec. CE) generated by traditional ℓ 2 loss || x -y || 2 and our proposed loss function, while (b) displays the

(a) Clean example

Input image

Traditional

ℓ

!

loss

Ours

(b) Adversarial example

Input image

Traditional

ℓ

!

loss

Ours, w/o 'prior'

Ours

Ours, w/o 'prior'

0.07

0.8

0.06

0.05

0.6

0.04

0.4

0.03

0.2

0.02

0.0

0.01

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

reconstructed adversarial examples (rec. AE) for the input adversarial example (AE). Additionally, we create error maps to highlight differences, which (a) between the rec. CEs and the input CEs, and (b) between the rec. AEs and the rec. CEs, as shown at the bottom of Figure 4. The results indicate that while our method does not match the classical TN methods in reconstructing CEs, it significantly outperforms them in removing adversarial perturbations from AEs.

Specifically, when processing CEs, the rec. examples generated by traditional ℓ 2 loss are almost identical to the original ones, whereas our method is slightly less effective in restoring some details. However, when processing AEs, the rec. examples from traditional ℓ 2 loss remain consistent with the original ones, leading to the preservation of adversarial perturbations, as highlighted in Figure 4b. In contrast, our method better removes those perturbations, ensuring that the rec. AEs and the rec. CEs retain similar information. Moreover, we evaluate the necessity of the second term in Eq. (1), which serves as a surrogate prior constraint to optimize the reconstructed examples toward the clean data distribution. As observed, removing this constraint eliminates prior information from the optimization process, increasing the likelihood of significant deviation in the wrong direction.

Quantitative results analysis Table 7 shows the quantitative results of the denoising task for AEs and CEs, with detailed descriptions of evaluation metrics provided in Appendix D.2. We compare our method with existing tensor network decompositions, including TT, TR, QTT, QTR, and PuTT. While our method does not achieve the best denoising performance on clean examples, it still maintains classification performance well, achieving 82.23% standard accuracy with vanilla WideResNet-28-10. More importantly, our method outperforms others in the next two columns. Specifically, when processing AEs, our method yields the highest NRMSE and the lowest SSIM and PSNR, achieving the highest robust accuracy. This outcome is expected, as our goal is to ensure that the rec. AEs differ from the original AEs (i.e., lower SSIM and PSNR, and higher NRMSE in the 'ADV' column) while rec. AEs closely resembling the rec. CEs (i.e., higher SSIM and PSNR, and lower NRMSE in the 'REC' column). These results align well with the visual observations in Figure 4 and consistently demonstrate the effectiveness of our method, highlighting its potential in adversarial scenarios.

Limitations and future works We identify several open problems related to TNP: (1) Although TNP is a training-free technique, it incurs additional optimization costs during inference, which poses challenges for deployment in low-latency scenarios, see more discussion in Appendices E.1 and E.2. (2) As a model-free optimization-based technique, TNP is inherently more resistant to adaptive attacks, see more discussion in Appendix C. Accordingly, developing more advanced optimization strategies and adaptive attack strategies specifically tailored to TNP remains a valuable direction for future research. We hope that our work will motivate further exploration of these challenges.

6 Conclusion

In this paper, we propose a novel model-free optimization-based adversarial purification (AP) built upon a specially designed tensor network decomposition. Extensive experiments on CIFAR-10, CIFAR-100, and ImageNet demonstrate that our method (TNP) achieves state-of-the-art performance with strong generalization across diverse scenarios. Additionally, we further identify several open challenges related to TNP, and believe that continued exploration of TN-based purification remains an exciting research direction for developing a plug-and-play and effective AP technique.

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

References

Allen-Zhu, Z. and Li, Y. Feature purification: How adversarial training performs robust deep learning. In 2021 IEEE 62nd Annual Symposium on Foundations of Computer Science (FOCS) , pp. 977-988. IEEE, 2022.

Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning , pp. 274-283. PMLR, 2018a.

Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. Synthesizing robust adversarial examples. In International conference on machine learning , pp. 284-293. PMLR, 2018b.

Augustin, M., Meinke, A., and Hein, M. Adversarial robustness on in-and out-distribution improves explainability. In European Conference on Computer Vision , pp. 228-245. Springer, 2020.

Bai, M., Huang, W., Li, T., Wang, A., Gao, J., Caiafa, C. F., and Zhao, Q. Diffusion models demand contrastive guidance for adversarial purification to advance. In Forty-first International Conference on Machine Learning , 2024.

Bai, Y., Mei, J., Yuille, A. L., and Xie, C. Are transformers more robust than cnns? Advances in neural information processing systems , 34:26831-26843, 2021.

Bai, Y., Anderson, B. G., Kim, A., and Sojoudi, S. Improving the accuracy-robustness trade-off of classifiers via adaptive smoothing. arXiv preprint arXiv:2301.12554 , 2023.

Bhattarai, M., Kaymak, M. C., Barron, R., Nebgen, B., Rasmussen, K., and Alexandrov, B. S. Robust adversarial defense by tensor factorization. In 2023 International Conference on Machine Learning and Applications (ICMLA) , pp. 308-315. IEEE, 2023.

Botchkarev, A. Performance metrics (error measures) in machine learning regression, forecasting and prognostics: Properties and typology. arXiv preprint arXiv:1809.03006 , 2018.

Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J. C., and Liang, P. S. Unlabeled data improves adversarial robustness. Advances in neural information processing systems , 32, 2019.

Chen, E.-C. and Lee, C.-R. Data filtering for efficient adversarial training. Pattern Recognition , 151: 110394, 2024.

Cichocki, A., Mandic, D., De Lathauwer, L., Zhou, G., Zhao, Q., Caiafa, C., and Phan, H. A. Tensor decompositions for signal processing applications: From two-way to multiway component analysis. IEEE signal processing magazine , 32(2):145-163, 2015.

Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pp. 2206-2216. PMLR, 2020.

Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2) , 2021.

Croce, F., Gowal, S., Brunner, T., Shelhamer, E., Hein, M., and Cemgil, T. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Machine Learning , pp. 4421-4435. PMLR, 2022.

Cui, J., Tian, Z., Zhong, Z., QI, X., Yu, B., and Zhang, H. Decoupled kullback-leibler divergence loss. In The Thirty-eighth Annual Conference on Neural Information Processing Systems , 2024.

Dai, T., Feng, Y., Wu, D., Chen, B., Lu, J., Jiang, Y., and Xia, S.-T. Dipdefend: Deep image prior driven defense against adversarial examples. In Proceedings of the 28th ACM International Conference on Multimedia , MM'20, pp. 1404-1412, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781450379885. doi: 10.1145/3394171.3413898. URL https://doi.org/10.1145/3394171.3413898 .

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

Dai, T., Feng, Y., Chen, B., Lu, J., and Xia, S.-T. Deep image prior based defense against adversarial examples. Pattern Recognition , 122:108249, 2022.

Debenedetti, E., Sehwag, V., and Mittal, P. A light recipe to train robust vision transformers. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) , pp. 225-253. IEEE, 2023.

Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition , pp. 248-255. Ieee, 2009.

Ding, G. W., Sharma, Y., Lui, K. Y. C., and Huang, R. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations , 2019.

Dolatabadi, H. M., Erfani, S., and Leckie, C. l-inf robustness and beyond: Unleashing efficient adversarial training. In European Conference on Computer Vision , pp. 467-483. Springer, 2022.

Entezari, N. and Papalexakis, E. E. Tensorshield: Tensor-based defense against adversarial attacks on images. In MILCOM 2022-2022 IEEE Military Communications Conference (MILCOM) , pp. 999-1004. IEEE, 2022.

Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. International Conference on Learning Representations , 2015.

Gowal, S., Qin, C., Uesato, J., Mann, T., and Kohli, P. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 , 2020.

Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T. A. Improving robustness using generated data. Advances in Neural Information Processing Systems , 34:42184233, 2021.

Grzenda, W. and Zieba, W. Conditional central limit theorem. In Int. Math. Forum , volume 3, pp. 1521-1528, 2008.

He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 770-778, 2016.

He, K., Chen, X., Xie, S., Li, Y ., Dollár, P., and Girshick, R. Masked autoencoders are scalable vision learners. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pp. 16000-16009, 2022.

Hendrycks, D., Lee, K., and Mazeika, M. Using pre-training can improve model robustness and uncertainty. In International conference on machine learning , pp. 2712-2721. PMLR, 2019.

Hore, A. and Ziou, D. Image quality metrics: Psnr vs. ssim. In 2010 20th international conference on pattern recognition , pp. 2366-2369. IEEE, 2010.

Hubig, C., McCulloch, I., and Schollwöck, U. Generic construction of efficient matrix product operators. Physical Review B , 95(3):035129, 2017.

Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. Advances in neural information processing systems , 32, 2019.

Jia, X., Zhang, Y., Wu, B., Ma, K., Wang, J., and Cao, X. Las-at: adversarial training with learnable attack strategy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pp. 13398-13408, 2022.

Khoromskij, B. N. O (d log n)-quantics approximation of n-d tensors in high-dimensional numerical modeling. Constructive Approximation , 34:257-280, 2011.

Kolda, T. G. and Bader, B. W. Tensor decompositions and applications. SIAM review , 51(3):455-500, 2009.

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

467

468

469

470

471

472

473

474

475

476

477

478

479

480

481

482

483

484

485

486

487

488

489

490

491

492

493

494

495

496

Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. Technical Report , 2009.

Laidlaw, C., Singla, S., and Feizi, S. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations (ICLR) , 2021.

Lee, M. and Kim, D. Robust evaluation of diffusion-based adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , pp. 134-144, October 2023.

Lin, G., Li, C., Zhang, J., Tanaka, T., and Zhao, Q. Adversarial training on purification (atop): Advancing both robustness and generalization. arXiv preprint arXiv:2401.16352 , 2024a.

Lin, G., Tao, Z., Zhang, J., Tanaka, T., and Zhao, Q. Robust diffusion models for adversarial purification. arXiv preprint arXiv:2403.16067 , 2024b.

Loeschcke, S. B., Wang, D., Leth-Espensen, C. M., Belongie, S., Kastoryano, M., and Benaim, S. Coarse-to-fine tensor trains for compact visual representations. In Forty-first International Conference on Machine Learning , 2024.

Lubasch, M., Moinier, P., and Jaksch, D. Multigrid renormalization. Journal of Computational Physics , 372:587-602, 2018.

Lyu, W., Wu, M., Yin, Z., and Luo, B. Maedefense: An effective masked autoencoder defense against adversarial attacks. In 2023 Asia Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) , pp. 1915-1922. IEEE, 2023.

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

McCulloch, I. P. Infinite size density matrix renormalization group, revisited. arXiv preprint arXiv:0804.2509 , 2008.

Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion models for adversarial purification. International Conference on Machine Learning , 2022.

Oseledets, I. V . Tensor-train decomposition. SIAM Journal on Scientific Computing , 33(5):2295-2317, 2011.

Pang, T., Lin, M., Yang, X., Zhu, J., and Yan, S. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning , pp. 17258-17277. PMLR, 2022.

Phan, A.-H., Cichocki, A., Uschmajew, A., Tichavsk` y, P., Luta, G., and Mandic, D. P. Tensor networks for latent variable analysis: Novel algorithms for tensor train approximation. IEEE transactions on neural networks and learning systems , 31(11):4622-4636, 2020.

Phan, H., Yin, M., Sui, Y., Yuan, B., and Zonouz, S. Cstar: towards compact and structured deep neural networks with adversarial robustness. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 37, pp. 2065-2073, 2023.

Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946 , 2021.

Rudkiewicz, T., Ouerfelli, M., Finotello, R., Chaouai, Z., and Tamaazousti, M. Robustness of tensor decomposition-based neural network compression. In 2024 IEEE International Conference on Image Processing (ICIP) , pp. 221-227. IEEE, 2024.

Salman, H., Ilyas, A., Engstrom, L., Kapoor, A., and Madry, A. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:3533-3545, 2020.

Shi, C., Holtz, C., and Mishne, G. Online adversarial purification based on self-supervision. International Conference on Learning Representations , 2021.

Song, M., Choi, J., and Han, B. A training-free defense framework for robust learned image compression. arXiv preprint arXiv:2401.11902 , 2024.

497

498

499

500

501

502

503

504

505

506

507

508

509

510

511

512

513

514

515

516

517

518

519

520

521

522

523

Srinivasan, V., Rohrer, C., Marban, A., Müller, K.-R., Samek, W., and Nakajima, S. Robustifying models against adversarial attacks by langevin dynamics. Neural Networks , 137:1-17, 2021.

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. International Conference on Learning Representations , 2014.

Tack, J., Yu, S., Jeong, J., Kim, M., Hwang, S. J., and Shin, J. Consistency regularization for adversarial robustness. In Proceedings of the AAAI Conference on Artificial Intelligence , pp. 8414-8422, 2022.

Tramer, F., Carlini, N., Brendel, W., and Madry, A. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems , 33:1633-1645, 2020.

Ulyanov, D., Vedaldi, A., and Lempitsky, V. Deep image prior. In Proceedings of the IEEE conference on computer vision and pattern recognition , pp. 9446-9454, 2018.

Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations , 2019.

Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., and Yan, S. Better diffusion models further improve adversarial training. International conference on machine learning , 2023.

Yang, Y., Zhang, G., Katabi, D., and Xu, Z. Me-net: Towards effective adversarial robustness with matrix estimation. International Conference on Machine Learning , 2019.

Yoon, J., Hwang, S. J., and Lee, J. Adversarial purification with score-based generative models. In International Conference on Machine Learning , pp. 12062-12072. PMLR, 2021.

Zagoruyko, S. and Komodakis, N. Wide residual networks. In Procedings of the British Machine Vision Conference 2016 . British Machine Vision Association, 2016.

Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pp. 7472-7482. PMLR, 2019.

Zhang, M., Li, J., Chen, W., Guo, J., and Cheng, X. Classifier guidance enhances diffusion-based adversarial purification by preserving predictive information, 2024. URL https://openreview. net/forum?id=qvLPtx52ZR .

Zhao, Q., Zhou, G., Xie, S., Zhang, L., and Cichocki, A. Tensor ring decomposition. arXiv preprint 524 arXiv:1606.05535 , 2016. 525

526

527

528

529

530

531

532

533

534

535

536

537

538

539

540

541

542

543

544

Appendix

A Influence of different sampling methods

To support our hypothesis of using the average pooling, we test it with stride sampling, which selects pixels with constant strides. In principle, the stride sampling would not change the distribution of perturbations. Therefore, it serves as a baseline to compare the influence of distributions.

We test four types of noise distributions: (1) Gaussian N (0 , 0 . 3 2 ) , (2) Mixture of Gaussian (MoG), 0 . 5 · N ( -1 . 0 , 0 . 5 2 ) + 0 . 5 · N (1 . 0 , 0 . 5 2 ) , (3) Beta distribution, Beta (0 . 5 , 0 . 5) -0 . 5 , and (4) Uniform distribution, Uniform ( -0 . 5 , 0 . 5) . For MoG, Beta and uniform noises, we scale them to have the same signal-to-noise ratio with the Gaussian distribution. We add the noises on the Girl image (Loeschcke et al., 2024) with resolution 1024 × 1024 . First, we show the noise distributions in Figure 5. As can be seen, the Avg Pooling strategy transforms the non-Gaussian noises into Gaussian-like noises, while the Stride sampling would not. Second, we run the PuTT algorithm with different sampling methods for 100 times. The violin plot of denoising results are shown in Figure 6. In Gaussian distribution, the Stride sampling is better than AvgPooling. While for non-Gaussian noises, the AvgPooling is more robust and better than Stride. The denoising results indicate that the average pooling can handle different types of noises, which is consistent with our hypothesis. However, as we introduced, this might not be enough, since we need to deal with the original image and noises in the final stage.

(b) MoG with Stride Sampling

(d) Beta with Stride Sampling

(f) Uniform with Stride Sampling

600

400

300

200

200

500

Original

05Z

200

150

oet

50

Downsampled 2x

60

20

Downsampled 4x

29

15

19

Downsampled 8x

700

600

500

400

300

200

100

Original

250

200

150-

100

50

Downsampled 2x

30

20

50

40

00

Dowtriampled4x

15

19

Downsampled 8x

9T-

0.5

0.0

0.5

1.0

-0.2

0.0

0.2

0.4

-2

2000

4000

G000

200

250

150

100

50

4

25

20

15

10

5000

4000-

3000

2000

1000

1000

600

200

800

400

200

150

100

50

60

50

40

30

29

70

19

0.4

-02

D.O

0.4

C'0=

-0.3 -0.2 -0.10.00.1020.3

9.4

0.4

2'0

D.4

d0

0.2

D.4

d0

D.4

300

206

400

250

150

100

50

100

80

20

25

20

15

19

300

200

100

400

120

100

80

60

40

20

小

30

20

00

12

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.2

0.3.456.7

0.35

0.400.456.500.550.60

d.65

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

0.8

1.0

0.0

0.2

0.4

0.6

d.8

1.0

0.0

6.2

0.4

0.6

0.8

9T

(a) PSNR

(b) SSIM

23

22

PSNR

21

20

Sampling Method

19

Stride

MoG

Beta

Uniform

Distributions

0.54

0.52

0.50

WISS

0.48

0.46

0.44

0.42

Sampling Method

0.40

Stride

MoG

Beta

Uniform

Distributions

B Tensor network decomposition

B.1 Matrix Product Operators

A matrix product operator (MPO) (McCulloch, 2008; Hubig et al., 2017) is the TN representation of 545 a linear operator acting on a TT format, which makes it highly efficient to handle large operators. 546

Namely, a linear operator A : R I 1 × ... × I D → R J 1 × ... × J D . Namely, if Y = AX , then each entry of 547 Y is given as 548

B.2 Prolongation Operator 549

550

551

This work uses a specific MPO, known as the prolongation operator P d (Lubasch et al., 2018), to upsample a QTT format of an image from resolution d -1 to d .

552

553

Consider a one-dimensional vector x d ∈ R 2 d . The matrix P 2 d → 2 d +1 upsamples x d to x d +1 by linear interpolation between adjacent points. For example, for d = 2 ,

The matrix P 2 d → 2 d +1 can be written as an MPO P d +1 entry-wise 554

The entries are given explicitly (Lubasch et al., 2018) as 555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

and other entries are zero.

The prolongation operator described above applies to the QTT format of one-dimensional vectors. In general, this operator is the tensor product of the one-dimensional operators on each dimension: P (2) d = P d ⊗P d for 2-dimensions (images) and P (3) d = P d ⊗P d ⊗P d for 3-dimensions (3D objects). For simplicity, since this work concerns only images, the superscript is omitted, denoting the prolongation operator as P d .

Ultimately, for a resolution d image x d , and X d = Q( x d ) , the upsampled image is resolution d +1 , given as P d ( x d ) = Q -1 ( P d X d ) , where the linear function P d ( · ) acts on the image level.

B.3 Recap of PuTT

A 2 D × 2 D image, denoted as x D , can be quantized in to a D th order tensor X D = Q ( x D ) . Firstly, x D is downsampled by average pooling to x D -l , correspondingly possesing a quantization X D -l . Then, D -l QTT cores of X D -l can be optimized by backpropagation, returning Y D -l . The QTT cores of next resolution X D -l +1 can be optimized similarly, initialized by the prologation P D -l +1 ( y D -l ) . Repeat the process until the original resolution. (Loeschcke et al., 2024) demonstrates impressive reconstruction capability of PuTT thanks to the QTT structure and coarse-to-fine approach. The pseudocode is given in Algorithm 2.

572

573

574

575

576

577

578

579

580

581

582

583

584

585

586

587

588

589

590

591

592

593

594

595

596

597

598

599

600

601

602

603

604

605

606

607

608

609

610

611

Algorithm 2 PuTT (Loeschcke et al., 2024)

However, while PuTT aims to obtain better initialization by downsampling for better optimization and reconstruction, it does not account for adversarial examples or analyze the impact of downsampling on perturbations. Additionally, PuTT also minimizes the reconstruction loss on the input image, which inevitably results in the reconstruction of the perturbations. In contrast, we focus on the perturbations and propose a new optimization process introduced in the next section, aiming to reconstruct clean examples.

C Implementation details of adversarial attacks

We evaluate our method of defending against AutoAttack (Croce & Hein, 2020) and compare with the state-of-the-art methods as listed RobustBench benchmark (https://robustbench.github.io). For a comprehensive evaluation, we conduct experiments under all adversarial attack settings. Specifically, we set ϵ = 8 / 255 and ϵ = 0 . 5 / 1 . 0 for AutoAttack l inf and AutoAttack l 2 threats on CIFAR-10. On CIFAR-100, we set ϵ = 8 / 255 for AutoAttack l inf . On ImageNet, we set ϵ = 4 / 255 for AutoAttack l inf . We evaluate our method of defending against PGD+EOT (Madry et al., 2018; Athalye et al., 2018b) and present the comparisons of AT methods, AP methods, and our method. Following the guidelines of (Lee & Kim, 2023), we set ϵ = 8 / 255 for PGD+EOT l inf threats on CIFAR-10, where the update iterations of PGD is 200 with 20 EOT samples.

Considering the potential robustness overestimation (Athalye et al., 2018a) caused by obfuscated gradients of purifier model, we utilize BPDA as an adaptive attack (Tramer et al., 2020; Croce et al., 2022), following the setting by (Yang et al., 2019; Lin et al., 2024a), which treats the purification step as an identity mapping during the backward pass, effectively bypassing its effect when computing gradients. In all experiments, the attacker has knowledge of both the purifier (TNP) and the classifier (Cls). The target of the attack is a new model F , i.e., F ( x ) = Cls ( TNP ( x )) . The reason we chose BPDA is that the existing full gradient attacks are not applicable in TN-based AP due to the memory explosion issues associated with attacking TN optimization. In contrast to diffusion-based AP, TN is a model-free technique that does not rely on a fixed model or any parameters for gradient computation. Additionally, the iterative process in TN is a gradual optimization procedure, rather than the fixed inference iterations employed in diffusion-based methods, resulting in surrogate attacks that are difficult to apply to TN-based AP. Therefore, we empirically validated the effectiveness of our method through the existing adaptive attacks, e.g., BPDA.

Remark: Unlike conventional AP methods that rely on a specific trained model for purification, TNP is a model-free technique without any parameters or the static network architecture for gradient computation, which is an inference-time optimization strategy. Additionally, the iterative process in TNP is a dynamic, gradual optimization procedure, in contrast to the fixed-step inference in DiffPure. This dynamic nature further hinders the applicability of the gradient checkpointing technique, as there is no static computational graph or predetermined set of parameters to track and store during intermediate steps. In other words, there is no well-defined checkpoint for storing intermediate gradients, thus the gradient checkpointing technique cannot be directly applied to TNP. This is also an inherent advantage of TN-based AP, which significantly increases the difficulty of developing adaptive attacks against TNP. Our paper is the first work to introduce a model-free optimization based method. We look forward that, building on the foundation established in this work, future research

612

613

614

615

616

617

618

619

620

621

622

623

624

625

626

627

628

629

630

631

632

633

634

635

636

637

638

639

640

641

642

643

644

645

646

647

648

649

650

will explore adaptive attack strategies specifically tailored to TN-based AP, thereby advancing and refining the defense mechanisms of TN-based AP methods.

D More details of experimental settings

D.1 Implementation details of our method

For CIFAR-10, CIFAR-100 with resolution 32 × 32 and ImageNet with resolution 224 × 224 , we first upsample them into resolution 2 D × 2 D image x D . Based on the initial experimental results, we set D = 8 , l = 1 , α = 0 . 1 , inital β = 0 . 008 and N = 1 for the following experiments. For the scale hyperparameter η , we set η = 0 . 1 in all our experiments without knowing the specific attack norm. Since adversarial perturbations are very small, a fixed η = 0 . 1 already exceeds the scale of most attacks. Moreover, choosing a larger η can introduce excessive noise, leading to lower-quality reconstructions. Based on our preliminary experiments, η = 0 . 1 offers a suitable balance and thus serves as our default setting. The table results presented in the paper are conducted under these hyperparameters. This trick creates a large enough image to downsample until the perturbations are well mixed into Gaussian noise. Furthermore, without this initial step, the semantic information can become almost indistinguishable after several downsampling steps, especially for low-resolution images. For example, if a 32 × 32 image is reduced with the factor of 8, the resolution 4 × 4 image is of poor quality. Additionally, to more clearly observe the denoising effects in visualization results, we upsample the images to resolution D = 11 with α = 0 . 05 , η = 0 . 1 and N = 3 for the experiments in Figure 4, and comparisons in different downsampled images in Figure 1. The code will be available upon acceptance, with more details provided in the configuration files.

D.2 Implementation details of evaluation metrics

We evaluate the performance of defense methods using multiple metrics: Standard accuracy and robust accuracy (Szegedy et al., 2014) on classification tasks. For denoising tasks, we measure the Normalized Root Mean Squared Error (NRMSE, Botchkarev, 2018), Structural Similarity Index Measure (SSIM, Hore & Ziou, 2010), Peak Signal-to-Noise Ratio (PSNR) metrics between a reference image x and its reconstruction y , where pixel values are in [0 , 1] .

Normalized Root Mean Squared Error

Structural Similarity Index Measure

where: µ x and µ y are the mean pixel values of images x and y . σ 2 x and σ 2 y are the variances of x and y . σ xy is the covariance between x and y . C 1 and C 2 are small constants to stabilize the division.

NRMSE, SSIM and PSNR evaluate reconstructed image quality from error, structural-similarity, and signal-to-noise perspectives, making them particularly suitable and comprehensive for assessing reconstruction performance. In traditional denoising and reconstruction tasks, generally a lower NRMSE, a higher SSIM, and a higher PSNR generally indicate better performance.

E Comparison

E.1 Adversarial defense methods

In the development of adversarial defense methods, with the emergence of adversarial attacks, numerous methods have been proposed, including adversarial training (AT) and adversarial purification

651

652

653

654

655

656

657

658

659

660

661

662

663

664

665

666

667

668

669

670

671

672

673

674

675

676

677

678

(AP). As research in this area progresses, researchers have gradually moved beyond defenses tailored to specific attacks and begun developing more general defense techniques that enhance model robustness and generalization against unseen attacks and datasets.

As mentioned before, AT predominantly consists of retraining the model on a finite set of adversarial examples, thereby conferring robustness primarily against those known perturbations. However, this process closely resembles a form of overfitting: the classifier becomes highly specialized to the attack patterns learned during training, at the expense of its performance on clean examples. As a result, standard accuracy typically degrades, and the robustness to withstand previously unseen attacks remains severely limited, as shown in Table 5.

Another class of defense methods is AP, which leverages pre-trained generative models trained on clean examples, thus can effectively defend against all types of attacks. However, AP is constrained by the specific dataset used during training, making it difficult to transfer effectively to new tasks or data distributions. As shown in Table 6, when applying the diffusion model trained on CIFAR-10 to CIFAR-100 evaluation, the standard accuracy dropped by 35.76% compared with AT.

Therefore, both mainstream defense methods face significant generalization challenges. To address this, one possible solution is to re-train the robust classifier to defend against new attacks or train a new generator on new datasets. However, such strategies incur substantial computational overhead and training costs, making them impractical for deployment in adversarial environments characterized by continuously emerging attacks, as summarized in Table 8.

To tackle these challenges with the framework of AT and AP, we propose a novel defense technique based on tensor network representation, which eliminates the need for training a powerful generative model or relying on specific dataset distributions, making it a general-purpose adversarial purification. In the experiments, TNP has shown great advantages in these challenges: 26.45% improvement in average robust accuracy over AT across different norm threats; 9.39% improvement over AP across multiple attacks; 6.47% improvement over AP across different datasets. Remarkably, TNP achieves these benefits with zero additional training cost, offering an efficient solution for adversarial purification.

E.2 Inference time cost

680

which is measured on a single image. We leverage the parallelization to further improve the computa-

tional efficiency of TNP and conducted experiments on a single A5000 GPU. Specifically, AP method 681 purifies CIFAR data at a resolution of 32 × 32 and ImageNet data at 256 × 256 , whereas our method 682 operates at a resolution of 256 × 256 across all datasets, which inevitably increases inference cost on 683 CIFAR-10 and CIFAR-100. In a comparison at the same resolution of ImageNet, the diffusion-based 684 AP method require 5.11 seconds, whereas our method only takes 3.13 seconds. Although this over685 head is already lower than that of diffusion-based AP methods, it still lacks sufficient flexibility in 686 real-world applications. We leave the study of integrating our TN-based AP technique with more 687 advanced and faster optimization strategies for future research. 688

689

E.3 Zero-shot adversarial defense

AT and AP methods depend heavily on external training dataset, overlooking the potential internal 690 priors in the input itself. Among adversarial defense techniques, untrained neural networks such 691 as deep image prior (DIP, Ulyanov et al., 2018) and masked autoencoder (MAE, He et al., 2022) 692 have been utilized to avoid the need of extra training data (Dai et al., 2020, 2022; Lyu et al., 2023). 693 However, although such deep learning models achieve high-quality reconstruction results, they 694 have been shown to be susceptible to revive also the adversarial noise. This section compares two 695 representative untrained models DIP and MAE. 696

697

698

699

700

701

Table 10 shows that although DIP and MAE have achieved remarkable standard accuracy and reconstruction quality, they deteriorate significantly under attack.

E.4 More experiments

To ensure a fair and consistent comparison, we consider employing a robust classifier for diffusionbased AP method in Table 11.

Using a robust classifier on CIFAR-10 for diffusion-based AP leads to a slight improvement in robust 702 accuracy. Meanwhile, our method with AT consistently maintains state-of-the-art performance. 703

Recently, Lee & Kim (2023) conducted a thorough investigation and proposed a robust evaluation 704 guideline using PGD+EOT. To undertake a more comprehensive evaluation, we further evaluate 705 our method following the guidelines in this part. Table 12 shows the results on CIFAR-10, and 706

707

708

709

710

711

712

713

714

715

716

717

718

719

720

721

the observations are basically consistent with the existing experiments, supporting our method as a powerful defense technique and more effective than existing AT or AP methods.

F More discussion

As we all know, the adversarial challenge of attack and defense is endless. This contradiction arises from the fundamental difference between adversarial attacks and defenses. Attacks are inherently destructive, whereas defenses are protective. This adversarial relationship places the attacker in an active position, while the defender remains passive. As a result, attackers can continually explore new attack strategies against a fixed model to degrade its predictive performance, ultimately leading to the failure of conventional defenses. The introduction of TNP has the potential to address this issue. As a model-free technique, TNP generates tensor representations solely based on the input information. These representations dynamically change with each input, preventing attackers from exploiting a fixed model to generate effective adversarial examples. This defensive mechanism allows TNP to maintain a more proactive stance in the ongoing competition between adversarial attacks and defenses.

G Histogram, kernel density estimation results, and visualization

Figure 7 shows the histogram and kernel density estimation of adversarial perturbations on 10 722 images. The distribution of those perturbations progressively aligns with that of Gaussian noise as 723 the downsampling process progresses. 724

MuW

Clean examples

中

Adversarial examples

Reconstructed examples

中

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The paper has accurately stated the generalization challenges in adversarial tasks and the corresponding technical issues in the abstract and introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The paper has included a "Limitations" section in the main body and provided further related discussions in the Appendix.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [NA]

Justification: The paper does not include theoretical results.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The paper fully disclose all the information needed to reproduce the main experimental results of the paper. The code will be available upon acceptance.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: The code will be available upon acceptance.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: The paper specify all the experiment details.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [NA]

Justification: N/A.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: All experiments presented in the paper are conducted by NVIDIA RTX A5000 with 24GB GPU memory, CUDA v11.7 and cuDNN v8.5.0 in PyTorch v1.13.11.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: The research conducted in the paper conforms with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We aim to enhance the generalization against emerging attacks, which has a positive societal impacts.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: N/A.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have cited and properly respected the existing assets in the paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

985

986

987

988

989

990

991

992

993

994

995

996

997

998

999

1000

1001

1002

1003

1004

1005

1006

1007

1008

1009

1010

1011

1012

1013

1014

1015

1016

1017

1018

1019

1020

1021

1022

1023

1024

1025

1026

1027

1028

1029

1030

1031

1032

1033

1034

1035

1036

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: N/A.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: N/A.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: N/A.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
The paper proposes Tensor Network Purification (TNP), a new model-free method to defend against adversarial attacks without relying on pretrained generative models. It leverages coarse-to-fine tensor decomposition and adversarial optimization to reconstruct clean images. Experiments on CIFAR-10, CIFAR-100, and ImageNet show strong robustness and impressive generalization across attacks and datasets.

STRENGTHS AND WEAKNESSES:
Strengths:
Clear motivation and strong technical execution.
Model-free design significantly improves generalization.
Consistently outperforms existing methods on multiple datasets.
Weaknesses:
Computational Cost: Inference-time optimization introduces significant overhead, limiting practicality for real-time or resource-constrained scenarios.
Reconstruction Quality: Slightly worse reconstruction fidelity for clean images compared to classical methods.
Evaluation Scope: Primarily focuses on classification tasks; generalization to other vision tasks (e.g., detection, segmentation) is not evaluated.

QUESTIONS:
•  Could inference time be practically reduced through faster tensor decompositions or approximations?
•  Is it feasible to balance robustness and clean-image reconstruction quality via adaptive weighting or additional loss terms?
•  Does TNP generalize well to other vision tasks like object detection or segmentation?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 2
IMPACT: 2
ORIGINALITY: 3
DATE: 2025-06-30

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors proposed a model-free adversarial purification framework that can enhance the robustness of any pre-trained image classification model without requiring access to the model architecture or gradients. The method leverages a generator trained using adversarial samples and a carefully crafted purification loss to restore clean image features from perturbed inputs. The key contribution is the compatibility of the purification module with any off-the-shelf model, eliminating the need for retraining or white-box access. Experimental results across five backbone classifiers and four datasets demonstrate improvements in adversarial robustness against various attacks. Ablation studies and comparisons to baselines are provided to support the method’s generalizability and effectiveness.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\n\n1. The proposed work attempts to solve the problem in black-box adversarial defense, which is applicable to a wide range of pre-trained models without fine-tuning.\n2. It is a plug-in module as a general and lightweight solution.\n3. Comprehensive experiments are conducted and show performance across various popular datasets.\n\nMy major concerns are below:\n\n1. The experimental comparison and performance benchmarking is limited, especially to those recent state-of-the-art black-box purification methods (e.g., diffusion purification, score-based models).\n2. The proposed method utilized multiple terms in the training loss (some of which are a bit incremental and used in prior works), while the ablation study is very limited. A more comprehensive quantitative study is recommended, including how the hyper-parameters influence the results.\n3. As NeurIPS is a machine learning conference, authors may need a bit more insight on the theoretical aspects, i.e., behaviour analysis of the proposed algorithm, generalization to other adaptive attacks.\n\nOverall, the work is interesting and potential valuable for the AI security community. However, more works and justifications are needed to improve the paper quality.\n\nQUESTIONS:\nSee the weakness.\n\nLIMITATIONS:\nAs NeurIPS is a machine learning conference, authors may need a bit more insight on the theoretical aspects, i.e., behaviour analysis of the proposed algorithm, generalization to other adaptive attacks.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper propose a training free defence that can remove adversarial perturbations by tensor network reconstruction. It average-pool inputs to lower resolutions to view perturbations as Gaussian then upsample back. In addition, it also adds a an auxiliary variable $\\delta$ to control the coarse-to-fine procedure. Empirically, it handles CIFAR and ImageNet and outperforms adversarial training baselines.\n\nSTRENGTHS AND WEAKNESSES:\n- **Motivation**. The design of of down sampling + CLT argument motivates Gaussian style noise at coarse scales. The auxiliary $\\delta$ also prevent perturbation re-fitting. If I am understand it correctly, when you move from a coarse TN to a finer one, the optimizer gets many new degrees of freedom. If you only re-optimize the fine scale TN to match the raw high resolution input, those extra parameters can memorize the perturbation that you washed out. \n\nCan the authors clarify the motivation of adding $\\delta$? \n\n- **Empirical**. Adversarial training can be bad when their diffusion models are trained on different dataset. TNP designs the optimization per input but also avoid costly retraining. \n\nHowever, per image gradient optimization is also slower than a single forward pass. The authors listed the inference time cost in E.2. It shows that TNP is slower than other baselines for CIFAR but is faster than baselines for ImageNet, can the authors explain why TNP can be faster than baselines for high resolution ImageNet? Also, I think the community has moved from low resolution data to high resolution data much, it is good to start from CIFAR, can you provide more ImageNet examples/visualization?\n\n- **Theory**. Overall the empirical results are good, however, it lacks certification guarantees. The $\\delta$ optimization used a fixed radius $\\eta$, sensitivity to $\\eta$ or adaptive choices are not discussed. Have you tried scheduling or learning $\\eta$? I understand this is a empirical work for adversarial purification, but I feel more ablation study on this can make the paper more solid. \n\nOverall, TNP is an interesting work for adversarial purification literature, however, lack of adaptive evaluation and I think it might be better to focus on ImageNet instead of CIFAR. With additional evidence on attack adaptivity and scalability, TNP would ba a solid contribution.\n\nQUESTIONS:\nSee above.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes Tensor Network Purification (TNP), a novel model-free optimization-based adversarial purification framework that uses tensor network decomposition to defend against adversarial attacks. Unlike existing adversarial training (AT) methods that require retraining models or adversarial purification (AP) methods that rely on pre-trained generative models, TNP operates solely on individual input examples without requiring any training or dataset-specific models. The key innovation lies in leveraging progressive downsampling to transform adversarial perturbations into Gaussian-like distributions, combined with a novel adversarial optimization objective that prevents the reconstruction of adversarial perturbations while recovering clean examples.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. Good theoretical motivation: The connection between downsampling and the Central Limit Theorem provides solid theoretical grounding for why adversarial perturbations become more Gaussian-like at coarser resolutions, making them amenable to tensor network methods.\n2. Comprehensive evaluation: The experimental evaluation is thorough, testing across multiple datasets (CIFAR-10, CIFAR-100, ImageNet), various attack types (AutoAttack, PGD+EOT, BPDA), and different threat models\n3. Novel method: The paper introduces a novel defense mechanism that does not rely on pre-trained models or require retraining, addressing fundamental limitations of existing AT and AP methods. \n\nWeaknesses:\n1. Computational overhead: The inference time (2.45s for CIFAR-10, 3.13s for ImageNet) is significantly higher than AT methods and comparable to diffusion-based AP methods.\n2. Hyperparameter discussion: The method involves multiple hyperparameters whose selection criteria and sensitivity analysis are not thoroughly discussed.\n3. Method design: The method assumes adversarial perturbations are high-frequency, but low-frequency universal perturbations exist.\n\nQUESTIONS:\n1. How sensitive is the method to the choice of hyperparameters? What guidelines exist for selecting these in practice?\n2. Can the optimization process be accelerated using techniques like momentum or adaptive learning rates without compromising defense effectiveness?\n3. What happens when the input image already has low-frequency adversarial perturbations that survive downsampling?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}