Embracing Adaptation: An Effective Dynamic Defense Strategy Against Adversarial Examples

Authors: shenglin  yin
kelu  yao
zhen  xiao
jieyi  long
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-27 08:38:54

Abstract: Existing defense methods against adversarial examples are static, meaning that they remain unchanged once trained, regardless of changes in the attack. Consequently, static defense methods are highly vulnerable to adaptive attacks. We contend that in order to defend against more powerful attacks, the model should continuously adapt to cope with various attack methods. We propose a novel dynamic defense approach that optimizes the input by generating pseudo-labels. Subsequently, it utilizes information maximization and enhanced average prediction as optimization objectives, followed by hierarchical optimization methods to effectively counteract adversarial examples through model parameter optimization. Importantly, our approach is implemented during the inference phase and does not necessitate model retraining. It can be readily applied to existing adversarially trained models, significantly enhancing the robustness of various models against white-box, black-box, and adaptive attacks across diverse datasets. We have conducted extensive experiments to validate the state-of-the-art of our proposed method.

Main paper: 
 introduction: 
 Deep Neural Networks (DNNs) have achieved significant success in both academic and industrial applications, including image classification [18] , face recognition [48] , time series forecast [52] and resource scheduling [53, 54] . However, DNNs are vulnerable to the threat of adversarial examples. The attacker and the defender are two players in game theory, and when they are both deterministic, there is no Nash Equilibrium between them [37] . This gives rise to a recurring phenomenon in contemporary deep learning-based adversarial defenses. Adversarial learning research engages in a cat-and-mouse game between the attacker and defender, where a new attack is proposed, followed by a subsequent defense to mitigate it. This cycle continues as the attacker devises new attacks that exploit vulnerabilities in the previous defense, perpetuating an ongoing pattern. To effectively counter more potent adaptive attacks, defenders must dynamically adapt their defenses in response to the attacker's evolving strategies, thereby enabling victory in the game. However, the majority of existing defense methods remain static [4, 9, 14, 30, 32] , meaning that they do not alter the model's parameters post-training and are unable to adapt to evolving attacker tactics (see Figure 1 (a) ).In recent years, researchers have been investigating dynamic defense techniques. However, many of these approaches have inherent limitations. Some research [8, 25] efforts focus on adapting model structures so that they can autonomously modify their network states during the inference phase. Additionally, there are approaches [34, 41] that employ extra purification modules during inference to transform inputs and lessen the effects of adversarial disturbances. However, these methods may not always be practical. A primary issue is their reliance on original training data, which poses challenges due to privacy concerns. For example, in sectors like healthcare, federated learning is used to maintain data security during model training. In such scenarios, accessing the complete training dataset is not feasible, and techniques like adversarial training may not ensure model robustness. Furthermore, retraining models or training new purification modules with large datasets can be resource-intensive. The Dent [46] optimizes models and inputs by reducing input entropy, while the Anti [1] introduces disturbances to inputs to thwart attackers. Notably, neither method requires the original training set. These self-training methods have been effective with data from static domains. However, their stability is compromised when facing adversarial examples from continuously evolving attackers [38, 49] . This instability is due to increased pseudo-label noise and miscalibration caused by attacks [16] , leading to shifts in the attack distribution. Consequently, early predictive errors are more likely to accumulate [6] , resulting in defense failures. Moreover, these solutions address issues in a single dimension, which can harm the stability of the methods and their effectiveness against adaptive attacks.To address these issues, this paper proposes a dynamic defense method that is training-data-agnostic and model-agnostic, addressing the limitations of existing technologies through input and model optimization. As shown in Figure 1 (b), the goal is to start from a ready-made pre trained model and always protect the model from the impact of constantly changing adversarial examples. For input optimization, we use Gaussian Mixture Model (GMM) to extract input structural information at the feature layer and combine this information with model prediction information to generate pseudo labels. Subsequently, projection gradient descent is used to move the input as much as possible towards the correct region. As for model optimization, considering significant distribution differences between adversarial examples and raw data, a weighted average teacher model is adopted to enhance prediction accuracy. Specifically, we perform multiple stochastic augmentations of the inputs and predict the augmented inputs using the teacher model, and then average the multiple predictions. At the same time, in order to reduce the accumulation of errors caused by model prediction errors, adaptive sample weights were introduced to guide the training of student models, and a hierarchical optimization method was used to stabilize the entire optimization process. Furthermore, it should be noted that input optimization and model optimization may involve excessive forward and backward propagation, resulting in additional time consumption. To alleviate this situation, we propose a sample efficient optimization strategy that excludes highly confident samples and redundant samples from the model during optimization. In this case, the total number of reverse updates in the test data stream is appropriately reduced (improving efficiency), and the performance of the model on adversarial examples is also improved. The contributions of our work are as follows:• We propose a dynamic defense strategy that adjusts inputs themselves and model parameters during the inference phase in response to the current inputs of the model. [5] proposed the C&W attack method for the defense distillation network proposed by Hinton et al. [20] .The C&W method is divided into three categories according to the attack target category: random targets, the easiest category to attack, and the hardest category to attack, and the perturbation is optimized by restricting the 𝑙 0 ,𝑙 2 ,𝑙 ∞ parametrization. Croce et al. [13] first proposes two extensions of the PGD attack to overcome failures due to problems with suboptimal step sizes and objective functions, and then combines the new attacks with two complementary existing attacks to form a parameter-free, computationally tolerable and user-independent combination of attacks to test the robustness of the adversarial. This approach is called AutoAttack. 
adversarial training: 
 Adversarial training is one of the most effective ways to counteract adversarial examples [33] . Athalye et al. [3] show that most defense methods are ineffective against gradient mask-based adaptive adversarial attacks, and that adversarial training is the only defense Shi et al. [41] additionally design a self-supervised task during the training phase of the model to clean up adversarial perturbations by minimizing auxiliary losses during inference. Mao et al. [34] point out that images contain intrinsic structure that can reverse adversarial attacks. They used a self-supervised task trained in advance to purify the input, and the representation exploited the intermediate activation of a pre-trained static model. Yoon Jongmin et al. [55] preprocess the input to the classifier, train it with an energy-based model (EBM) and use denoised score matching (DSM) to learn a score function to denoise the scrambled images. Hwang et al. [21] propose the use of a discriminator to cleanse the input of a pre-trained classifier. The discriminator is trained to distinguish between adversarial perturbations and cleaned inputs. However, these methods require access to the original training dataset, which is not applicable in many cases. When the amount of data is large, additional training aids or retraining the entire model is very time consuming as well as wasteful of resources. Dent [46] links adversarial defense to domain adaptation, which uses defense updates to counter attack updates. As the adversary optimizes across the decision boundary, entropy minimization optimizes the distance between the prediction and the decision boundary, thus disrupting the attack. Anti [1] uses the model's predictions as pseudo-labels and adds perturbations to inputs using projected gradient descent to move inputs away from the decision boundary, thus defending against attackers. Although both methods do not rely on training data, the pseudo-labels they generate lack credibility and can result in error accumulation, ultimately compromising the effectiveness of the defense. Most of these methods were defeated by the adaptive attack devised by Croce Francesco et al. [11] . 
method 3.1 preliminary: 
 Let x ∈ R 𝑑 be the input image and 𝑦 ∈ R 𝐶 be the label. Given the model 𝑓 𝜃 (•) : R 𝑑 → R 𝐶 parameterized by 𝜃 and a clean image x, the goal of attacker is to create an adversarial image x 𝑎𝑑𝑣 = x + 𝜹 that is similar to clean image but confuses 𝑓 𝜃 (•):EQUATIONwhere 𝑑 (•, •) is the distance function between the clean image and the adversarial image. 𝜖 is the perturbation scale and is usually set to a small number to obtain an almost imperceptible difference between x 𝑎𝑑𝑣 and x.In dynamic defense, we have access to a pre-trained model 𝑓 𝜃 (•) with parameters 𝜃 trained by adversarial training on a clean dataset. Without loss of generality, our goal is to improve the robustness of the model against various types of attacks in an online fashion during the inference. At time step 𝑡, the unlabeled test data x 𝑡 is provided as input. We first adjust x 𝑡 and then the model 𝑓 𝜃 𝑡 (•) needs to adjust itself according to the adjusted 𝑇 𝑡 +1 (x 𝑡 ),where 𝑇 (•) is the method of adjusting the input, and finally adjusted model 𝑓 𝜃 𝑡 +1 (•) needs to make prediction 𝑓 𝜃 𝑡 +1 (𝑇 𝑡 +1 (x 𝑡 )). The overall process of the proposed method is shown in Figure 2 .The goal of an attacker is to maximize the loss function of the input x by moving it closer to the decision boundary, which results in a prediction with less confidence in the correct label. Thus, it is crucial to move as many samples as possible back to the correct region before making predictions on them. However, this is difficult to do accurately without labels.Motasem Alfarra et al.[1] proposed a method that uses the model's predictions as pseudo-labels and applies projected gradient descent to generate a new input (x + δ) that moves x away from the decision boundary, which can defend against attackers. However, relying solely on model predictions as pseudo-labels is unreliable, particularly when it comes to adversarial examples. Additionally, accumulating prediction errors can affect the overall effectiveness of the model [24] .We draw inspiration from pseudo-label generation methods in unsupervised domain adaptation and employ spatial feature clustering to generate more reliable pseudo-labels. Specifically, we utilize GMM to cluster the input features and assign pseudo-labels to the inputs. Compared to other clustering methods, GMM outperforms other clustering methods in terms of confidence because it offers soft labels for the inputs, which are probabilities assigned to the data structure [28, 29] . Therefore, we add the data structure information obtained through the GMM to the model prediction results to improve the reliability of the pseudo-label. EQUATIONwhere 𝛾 is the hyperparameter used to weigh the structural information. After obtaining pseudo-labels, we follow the PGD approach [32] and adjust inputs.Optimizing a model during inference without input labels presents a challenging task. We have observed a notable distribution difference between adversarial examples and original samples (see Figure 3(b) ). As a result, we approach the problem from a different perspective: How can we reduce the discrepancy between adversarial and original examples? One solution, proposed by Dent, involves reducing the model's entropy. However, relying solely on entropy reduction for model optimization may not be entirely reliable.We draw inspiration from the success of test-time augmentation [42] in improving model robustness and the superior accuracy of weight-averaged models over final models [44, 49] . To improve our model's robustness, we augment inputs and leverage the weightaveraged teacher model to generate pseudo-labels, which we use to guide the student model during tuning (see Figure 2 ). At time . Furthermore, if we can mitigate the distribution differences between adversarial examples and original samples, the classification output of an unlabeled sample should be similar to that of the original sample, but each class should still be distinct [31] . We achieve this by employing information maximization (IM) loss [26, 31, 45] , which ensures that the target output is both individually deterministic and globally diverse.In practice, we minimize the following two loss functions, 𝐿 𝑆 -𝑇 and 𝐿 𝐼 𝑀 , which together comprise the final loss for tuning the student model:EQUATIONEQUATIONwhere p = 𝑓 𝜃 (x). 𝑆 𝑐 (a) = 𝑒𝑥𝑝 (𝑎 𝑘 )𝑖 𝑒𝑥𝑝 (𝑎 𝑖 ) denotes the c-th element in softmax output of a C-dimensional a, p = E[𝑆 (p)] is the mean output embedding of the input domain.While DIO can provide high-quality pseudo-labels, it still has some limitations. According to the clustering assumption [15] , data in the same cluster should be assigned the same label. However, the decision boundary of the model may not conform to the clustering assumption [28] . As shown in Figure 3(c) , some clusters may contain samples with different ground truth labels. Assigning the same pseudo-label to all samples in a cluster based on the clustering assumption can result in incorrect pseudo-labels, which can negatively impact model optimization results. To learn robustly under samples with incorrect pseudo-labels, we need to suppress samples with low confidence in their pseudo-labels during model optimization.To solve this problem, we assign a weight to each input. We calculate the 𝐷𝐼 𝐹 𝐹 (x 𝑡 ) = 𝑝 (𝐻 (x 𝑡 )) 𝑚𝑎𝑥 -𝑝 (𝐻 (x 𝑡 )) 𝑚𝑒𝑎𝑛 for each sample, where 𝑝 (𝐻 (x 𝑡 )) is obtained from the GMM. Here, 𝑝 (𝐻 (x 𝑡 )) 𝑚𝑎𝑥 is the largest value in 𝑝 (𝐻 (x 𝑡 )), and 𝑝 (𝐻 (x 𝑡 )) 𝑚𝑒𝑎𝑛 is the mean value of the sum of the probabilities of the other regions. We calculate the weight 𝑊 for each sample using the following equation:EQUATIONwhere 𝐷𝐼 𝐹 𝐹 max is the maximum value in each batch and 𝛼 is the threshold value. For the input far from the GMM-based decision boundary, 𝑊 will have a high value. Conversely, for the input at the decision boundary, 𝑊 will have a small value. We weight the loss calculated by 𝑊 for the input using Eq. 3 and Eq. 4, and thus obtain the final optimization objective. using Eq. 8, we update the weights of the teacher model by taking a weighted average of the student model weights. We use an Exponential Moving Average (EMA) to compute the weighted average and use a smoothing factor 𝜆 to control the trade-off between the teacher and student models. Finally, we use the teacher model for the final prediction.EQUATIONEQUATIONTo effectively adapt to test time and avoid the accumulation of errors in the model optimization process, we introduced an active sample identification strategy for selecting samples during the backpropagation process. This strategy involves assigning a selection score 𝐼 (x) to each sample. By setting 𝐼 (x) = 0, samples that do not participate in backpropagation are eliminated, thereby reducing unnecessary backward calculations during test time adaptation and enhancing prediction efficiency. Overconfident samples. In the face of adversarial attacks, even with the optimization of inputs using high-quality pseudo labels, some samples may still cross classification boundaries. In an unlabeled test environment, input optimization guided by incorrect pseudo labels can lead to error accumulation, causing samples to deviate from the correct classification boundary. This deviation makes the model overly confident in its predictions, which may actually be incorrect (as shown in Figure 4 ). To prevent the model from optimizing using such samples, we propose an entropy-based scheme for identifying reliable samples. Formally, the entropy-based scheme is given by:EQUATIONwhere Redundant samples. Eq. 10 eliminates some unreliable samples, but there may be redundancy in the remaining test samples. For example, if the predictive entropy of two similar test samples is lower than 𝐸 0 , it is still necessary to perform backpropagation with Eq. 9 for each sample. However, this may be redundant because similar samples produce similar gradients [35] . To improve efficiency, we recommend using samples that produce different gradients for model adaptation. Recall that since the true labels are not available in the inference phase, Eq. 9 relies only on the final output of the model (i.e., classification logits). We further filter the samples by ensuring that the model outputs of the remaining samples are dissimilar. Specifically, for one of the 𝑁 outputs, we find the most similar from the remaining 𝑁 -1 elements, generate 𝑁 × (𝑁 -1) 2 similarity pairs, and remove the elements that occur more than 𝐾 times in these pairs. When the number of samples in a batch is large, the time complexity of computing the similarity between features is high and usually unacceptable in practical applications.𝐼 {• } (•)To reduce the complexity, we use the Ball-Tree algorithm to compute the nearest neighbors of each element, which can be easily achieved by sklearn's NearestNeighbors1 .EQUATIONwhere {x 𝑖 } 𝑁 𝑖=1 is the input batch of 𝑁 samples, and {m 𝑖 } 𝑁 𝑖=1 is each sample corresponding to the sample with which it is most similar. 𝐶𝑜𝑢𝑛𝑡 (•) is a count of the number of times each sample in m appears.The overall sample-filtering is then given by:EQUATIONwhich incorporates both the entropy-based filtering Eq. 10 and the diversity-based filtering Eq. 11 The efficiency of the algorithm is further improved since we only perform gradient backpropagation on test samples with 𝐼 (x) = 1.Remark. Given a batch containing 𝑁 test samples 𝐷 𝑡𝑒𝑠𝑡 = {x 𝑖 } 𝑁 𝑖=1 , the total number of reduced inverse computations is given byEQUATIONwhich is jointly determined by the distribution of test data 𝐷 𝑡𝑒𝑠𝑡 , the entropy threshold 𝐸 0 , and the number of repetitions 𝐾.During the process of optimizing the model parameters, typically the parameters of all layers are adjusted simultaneously. However, the effect of adversarial perturbations on each layer of the model is different, becoming more severe with increasing depth of the layers (see Figure 3 (a) and (b)). If adversarial perturbations can be mitigated in the earlier layers, then the features can be better recovered for the later layers. Therefore, adjusting all layers at the same time can potentially harm the learning of features in the later layers. To address this issue, we propose a hierarchical layer-wise training strategy. Specifically, we first train only the parameters of the first layer for several epochs, and then gradually allow the parameters of the subsequent layers to be trained until the parameters of the final layer are also trained. This approach helps to ensure that the later layers can learn robust features based on the earlier layers' learned robust features. 
experiments: 
 We evaluate proposed method against white-box, black-box, and adaptation attacks using various adversarial training methods and datasets. For attacks, we used PGD (PGD-20 and PGD-50) [32] , C&W [5] , RayS [7] , adaptive attacks designed for the proposed method, and AutoAttack [13] . AutoAttack includes four types of attacks, including white-box attacks (APGD and FAB [12] ) and blackbox attack (Square attack [2] ). For datasets, we use CIFAR10/CIFAR-100 [27] , which are often used in studies of adversarial robustness. More exploratory experimental results can be found in the Appendix.To evaluate the effectiveness of our proposed method, we conducted a comparison with the current mainstream benchmark methods, namely Dent [46] and Anti [1] . We specifically chose these two methods because they share a consistent setup with ours: they do not require access to a training dataset or modification of the model's training method, and can be directly applied to the pretrained model. It is important to note that most other dynamic defense methods do not meet these criteria. In instances where no defense method was used, we denote it as "None".Throughout our experiments, we set the hyperparameters of our method to the following values: number of sample optimization iterations 𝑁 𝐷𝐼𝑂 = 2, step size 𝜁 = 0.15, trade-off parameter 𝛾 = 0.05, number of model optimization iterations 𝑁 𝐷𝑀𝑂 = 2, trade-off parameter 𝜆 = 0.01, threshold values 𝛼 = 0.1, 𝛽 = 0.8, entropy threshold 𝐸 0 = 0.5 and the number of repetitions 𝐾 = 2. We use SGD as an optimizer with a learning rate of 1e-3. For comparison methods used in our experiments, we followed the settings outlined in their respective papers. We established a maximum perturbation strength of 8/255 for all attack methods under 𝐿 ∞ . For PGD, we implemented a step size of 2/255. For C&W, we utilized the acceleration optimization suggested by Zhang et al. [56] . Finally, for RayS, we randomly selected 3000 samples from CIFAR10/100 and executed 1000 queries per sample.We present the accuracy results of various defense methods on both clean and different adversarial examples. Additionally, we utilize weighted robust accuracy [17] as an evaluation metric to measure the trade-off between the accuracy of clean samples and that of different adversarial examples. This metric is defined as follows:EQUATIONwhere 𝛾 0 = 𝛾 1 = 1 𝑁 +2 . 𝐴𝑐𝑐 𝑐𝑙𝑒𝑎𝑛 represents the accuracy on clean samples and (𝐴𝑐𝑐 𝑎𝑑𝑣 0 , ..., 𝐴𝑐𝑐 𝑎𝑑𝑣 𝑁 ) represent the accuracy under different attacks, respectively. It means that both the accuracy of clean samples and the accuracy of different adversarial examples as equally important for assessing the overall performance of the model. This approach emphasizes the importance of developing defense methods that are effective against multiple types of attacks, rather than solely focusing on one or a few attacks.We conducted experiments on the CIFAR-10 and CIFAR-100 datasets using different methods and models. Table 1 presents the results of our experiments, indicating that our method effectively enhances the model's robustness against various attacks on both datasets. For instance, our method resulted in a 24.27% improvement in robustness under PGD-50 attack for the ResNet-18 model on the CIFAR-10 dataset compared to the undefended model. It also yielded a 6.78% improvement over the Dent method. On the CIFAR-100 dataset, our method displayed a significant enhancement in robustness as well. Our method achieved the best results in terms of average robust accuracy, demonstrating its ability to maintain strong performance even when faced with different types of attacks. More importantly, Anti decreased the robustness of the model when exposed to the RayS attack. Additionally, Dent's performance on small model (ResNet-18) also suffered, resulting in a reduction of the overall robustness of the model. In contrast, our method consistently enhances the robustness of the model on both large and small models, without any adverse effects observed. 2 , where we can see that our method significantly improves the model's robustness on AutoAttack and outperforms other dynamic defense methods overall. Specifically, on the CIFAR-10 dataset under the APGD-t attack, our method is 9% more robust than Dent, with an average robustness that is 8.66% higher. On the CIFAR-100 dataset, while Anti is more robust than Dent on APGD-CE, APGD-t, and FAB-t, it is ineffective against Square attack, even reducing the original model's robustness (from 28.75% to 28.40%). In contrast, our method not only outperforms Anti on the first three attacks, but also effectively defends against Square attack.Continuous transformation attack (CTA). Dynamic defense is a technique that adjusts itself dynamically based on the input of the current batch. If an attacker continuously attacks the model within the same batch, it is possible that the model will be deflected. Continuous transformation attack is when an attacker continuously attacks the same batch of samples using different methods to shift the model as much as possible. We performed a total of 500 iterations using different attacks: PGD-100→CW-30→PGD-50→CW-50→PGD-20→PGD-50→CW-50→PGD-50→PGD-100. Mixed batch attack (MBA). Optimizing dynamic defense involves applying the same transformation to samples within the same batch. However, this strategy may be undermined if the batch contains perturbations from different types of attacks. A mixed batch attack uses more than two types of attacks simultaneously, creating multiple types of adversarial samples within the same batch. To address this, we split the samples within a batch into three groups: 30% use PGD-20, 30% use C&W, and the remaining 40% are not attacked.Expectation over transformation attack (EOTA). While the main goal of our method is not to improve robustness by causing gradient confusion in the model, it does result in gradient updates for both the input and model optimization. This renders it impossible for an attacker to obtain deterministic gradients, thus causing the attack to fail. To confirm the robustness of our method, we conducted experiments using EoT [3] in combination with PGD-20.The experimental results are shown in Figure 5 . From the experiments, we can see that our proposed method is robust to various types of adaptive attacks and can guarantee the robustness of the model under different adaptive attacks.Impact of DIO, DMO and SF on results. Our investigation focuses on the individual contributions of DIO, DMO and SF. We conducted experiments on the CIFAR-10 dataset using adversarial trained ResNet-18. The results of the experiments are shown in Figure 6 , showing five scenarios: without any defense (none), DIO only (w/ DIO), DMO only (w/ DMO), without SF (w/o SF) and the proposed method. Experimental results show that DIO is particularly effective against white-box attacks such as APGD, while DMO is more successful against black-box attacks such as Square. Combining these two approaches can produce better results in terms of enhancing the robustness of the model against various types of attacks. Also, SF reduces the accumulation of errors and improves the robustness of the model.This subsection presents the time consumption of various methods. For the comparison methods we use ResNet-34-10, Dent (with ResNet-18), and Anti (with ResNet-18). Our method utilizes ResNet-18. The experiments were performed on CIFAR-10. Table 3 shows the accuracy of various methods under AA attack and the time required for inference per batch. Each batch contains 512 samples. The experimental results indicate that while our proposed method incurs additional time consumption, the processing time for multiple samples remains within acceptable limits and does not impose significant delays. For example, our method is not only less timeconsuming than Dent, but it also achieves a 8.54% higher accuracy compared to the Dent method. This is because Dent requires iterative optimization six times, whereas our method achieves good results with fewer optimizations. In terms of time consumption, our method incurs an additional 0.242s compared to Anti, but it achieves a 5.85% higher accuracy under AA attack. Importantly, Anti exhibits instability. It even reduces the robustness of the original model when facing black-box attacks (Square and RayS). Compared to the adversary-trained WideResNet-34-10, our method is in the same order of magnitude as it in terms of time consumption, but its accuracy is 10.12% higher.4.9 Comparison with Test Time Adaptation (TTA) methods.Our approach is very similar to that of TTA in that both adaptively adjust the model parameters during the inference phase. Therefore, we verify whether TTA's approach is effective in resisting adversarial examples. In our experiments, we applied Tent [47] , Cotta [50] , SAR [36] and T3A [22] to Sehwag Vikash et al. (ResNet-18) [40] 's proposed methods. We evaluated the effectiveness of these methods against PGD-20, C&W, and AutoAttack as attack methods. Table 4 displays the experimental results. The experimental results indicate that the majority of TTA methods can enhance a model's resistance to adversarial examples to some degree. However, such improvement is limited and may even decrease the model's robustness against certain attacks. While TTA methods account for the reduction in model accuracy caused by distribution bias, adversarial attacks can generate malicious bias that surpasses the adaptive capacity of TTA methods. This can lead to TTA methods failing to defend against adversarial attacks. 
conclusion: 
 In this paper, we introduce a dynamic defense strategy that improves model robustness by optimizing samples through pseudolabel generation. Furthermore, it guides the optimization of the student model using the average augmented predictions from the teacher model. Additionally, we propose a hierarchical optimization approach in model optimization to enhance stability and robustness.Extensive experiments illustrate the effectiveness and applicability of our approach in enhancing model robustness across diverse AT methods, network architectures, and datasets. Although our proposed method substantially enhances model robustness, the computational cost during the inference process escalates due to multiple iterations between attack and defense. In future research, we intend to tackle this issue by investigating cost-effective methods that preserve or enhance robustness. 
 
 Appendix: https://scikit-learn.org/stable/modules/generated/sklearn.neighbors. NearestNeighbors.html#sklearn.neighbors.NearestNeighbors 


Decision: The paper proposes a novel dynamic defense approach to counter adversarial attacks on machine learning models. After the rebuttal period, it receives mixed final ratings. Two of three reviewers tend to accept this paper, while Reviewer X9nn believes this paper has flaws and is not ready for publication in its current state. 

After carefully checking the paper, reviews, and rebuttal document, I decide to accept this paper. Reviewer X9nn also pointed out that the paper could be significantly improved with revisions. The authors are required to revise this paper to address Reviewer X9nn's concerns in the final version.

Reviews: review: paper_summary: paper_summary: The paper "Embracing Adaptation: An Effective Dynamic Defense Strategy Against Adversarial Examples" presents a novel dynamic defense approach to counter adversarial attacks on machine learning models. The proposed method utilizes Gaussian Mixture Models (GMM) for structural data information and pseudo-labels to optimize inputs and model parameters during inference. This training-data-agnostic and model-agnostic strategy significantly enhances model resilience against various adversarial attacks.
strength_weakness: strength_weakness: - Dynamic Adaptation: The method dynamically adjusts inputs and model parameters during inference, improving resilience against evolving adversarial strategies.
- Training-Data and Model Agnostic: It can be applied to pre-trained models without requiring access to training data or retraining.
- Comprehensive Evaluation: Extensive experiments demonstrate the method's superior performance across different types of attacks and datasets.
- Efficiency Improvements: The sample-efficient optimization strategy reduces the number of samples needed for reverse updates, enhancing computational efficiency.
limitations: limitations: I don't quite agree with some of the assumptions about dynamic attacks, and I'd like to know some results. For Mixed batch attacks, will different attacks appear in the same batch and conflict with each other, resulting in reduced attack effectiveness? For example, will a mixed attack (e.g. A 20% + B30%) be worse than a single attack (A50% or B50%) on an undefended model? Regarding the Continuous transformation attack, why should we assume such a cycle? If the type of attack is different from what was predicted, will it be impossible to defend against?
paper_summary: paper_summary: This paper presents a novel adversarial attack method. Unlike previous works that only operate on samples, the authors shift the focus to the model itself and propose a dynamic adversarial attack method. Experimental results demonstrate that fine-tuning the model parameters during the attack process is effective.
strength_weakness: strength_weakness: - The idea of updating model parameters during the adversarial attack is innovative.
- The paper provides a detailed analysis of the motivation and methodology, along with comprehensive experimental results that prove the feasibility of the proposed approach.
limitations: limitations: - It would be better to include experiments on other types of datasets. Although conducting experiments on ImageNet is challenging, results from datasets like Tiny-ImageNet could be supplemented.
- The authors could provide a comparison of the attack time and memory usage to comprehensively analyze the method's strengths and weaknesses.
- Would the proposed method still be applicable in a black-box scenario?
paper_summary: paper_summary: The paper presents a novel dynamic defense approach against adversarial examples in the context of deep learning models. The authors argue that static defense methods are insufficient against adaptive attacks and propose a method that adapts to various attack methods in real-time. The paper utilizes Gaussian Mixture Models (GMM) to obtain structural information of the model, which is combined with model prediction information to generate pseudo-labels for optimizing inputs. Subsequently, it employs information maximization and enhanced mean predictions as optimization objectives, utilizing a hierarchical optimization approach to refine the model. The method is designed to be training-data-agnostic and model-agnostic, making it applicable to a wide range of pre-trained models without the need for retraining.
strength_weakness: strength_weakness: 1. Novelty: The paper introduces a dynamic defense strategy that is a significant departure from static defense methods, addressing a critical need in the field of adversarial machine learning.
2. Theoretical Approach: The use of GMM to obtain structural information about the data and optimize the inputs, combined with a hierarchical optimization approach to improve the model, and a more detailed theoretical explanation of the approach, is a theoretically sound and innovative technique.
3. Technical Correctness: The paper provides a detailed explanation of the proposed method, including the mathematical formulation and pseudo-code, which indicates a high level of technical correctness.
4. Adequate Evaluation: The authors conducted extensive experiments comparing their method with state-of-the-art defense methods and various adversarial attacks, as well as ablation experiments, which were critical in determining the effectiveness of the method.
5. Applications: The proposed method's agnosticism to training data and model architecture suggests broad applicability across different models.
limitations: limitations: The dynamic defense strategy proposed in the paper adjusts the input itself and the model parameters according to the current inputs of the model in the inference phase. Does the practice of adjusting model parameters during the inference phase introduce a new attack surface? The authors could briefly discuss this.