Paper: IRAD: Implicit Representation-driven Image Resampling against Adversarial Attacks (ICLR-2024)

Reviewer comment (Theory):
It is not clear why resampling can effectively defend adversarial examples. Especially, image resampling via bilinear or nearest interpolation might be not effective enough to eliminate adversarial perturbation.

Author response:
**W1. It is not clear why resampling can effectively defend adversarial examples. Especially, image resampling via bilinear or nearest interpolation might be not effective enough to eliminate adversarial perturbation.**

Thank you for the comments. We propose to leverage image resampling to enhance the adversarial robustness of DNNs against adversarial perturbations. To achieve this goal, we need to address two key questions: 1. how to construct the clean continuous scene based on the input adversarial example? 2. how to estimate the pixel shifting that can further eliminate the influence of adversarial perturbation effectively? **Our method can enhance adversarial robustness significanly since we properly address the two key questions:** First, we build the implicit continuous representation for the first question, which enables us to eliminate the adversarial perturbation while preserving or reconstructing clean details. The reconstruction methods based on bilinear and near interpolations do not have such a capability, thus is not effective to eliminate the adversarial perturbations. Second, we introduce SampleNet, which automatically generates pixel-wise shifts for resampling in response to different inputs, making the reconstructed image have similar semantic features with ground truth category.

To better understand our method, we clarify the effectiveness from two perspectives:

### A. The effectiveness of implicit representation reconstruction

In this part, we employ four metrics to assess the reconstruction of the implicit representation: PSNR [1], SSIM [2], loss of low frequency and high frequency FFT (Fast Fourier Transform) [3], and LPIPS [4].

1. PSNR: As shown in Table 4.1a, the PSNR value is higher for implicit representation reconstructed images (36.01) compared to adversarial images (32.1). This indicates that the reconstructed adversarial images have higher fidelity and less distortion compared to the clean images after reconstruction.
2. SSIM: The SSIM value is higher for reconstructed adversarial images (0.9973) compared to adversarial images (0.9936). This suggests that the reconstructed adversarial images better preserve the structural details of the original images.
3. FFT: Both FFT Low Loss and FFT High Loss are lower for reconstructed adversarial images compared to clean images. This implies that less information is lost in frequency domains during the reconstruction of adversarial images.
4. LPIPS: The LPIPS value is significantly lower for reconstructed adversarial images (0.0169) compared to adversarial images (0.0771). This suggests that the reconstructed adversarial images are more perceptually similar to the original images compared to the adversarial images.

Overall, the table suggests that the reconstructed versions of adversarial images tend to exhibit better quality and closer resemblance to the original images across multiple metrics. This also implies that the implicit representation does not sacrifice meaningful information in the raw image when eliminating adversarial perturbations. This demonstrates the effectiveness of using implicit continuous representation to represent images within a continuous coordinate space.
In Bilinear and Nearest RECONS methods, they rely on the original pixel point as their starting point for representation, meaning they can still be affected by the adversarial patterns present in the adversarial images.

Table 4.1a: Image quality results on CIFAR 10.

|                        | Clean Images and Adversarial Images | Clean Images and Reconstructed Adversarial Images |
| ---------------------- | :-----------------------------------:| :-------------------------------------------------: |
| PSNR                   | 32.10                                | 36.01                                             |
| SSIM                   | 0.9936                              | 0.9973                                            |
| Low Frequency FFT Loss | 0.0626                              | 0.0506                                            |
| High Frequency FFT Loss | 0.3636                              | 0.2489                                            |
| LPIPS                  | 0.0771                              | 0.0169                                            |

[1] Hore, Alain, and Djemel Ziou. "Image quality metrics: PSNR vs. SSIM." 2010 20th international conference on pattern recognition. IEEE, 2010.

[2] Wang, Zhou, et al. "Image quality assessment: from error visibility to structural similarity." IEEE transactions on image processing 13.4 (2004): 600-612.

[3] Cooley, James W., and John W. Tukey. "An algorithm for the machine calculation of complex Fourier series." Mathematics of computation 19.90 (1965): 297-301.

[4] Zhang, Richard, et al. "The unreasonable effectiveness of deep features as a perceptual metric." Proceedings of the IEEE conference on computer vision and pattern recognition. 2018.

Reviewer comment (Evaluation):
How can you guarantee that SampleNet is not attacked? As a result, in Table 5, IRAD cannot exhibit robustness when SampleNet is attacked simultaneously.

Author response:
**W2. How can you guarantee that SampleNet is not attacked? As a result, in Table 5, IRAD cannot exhibit robustness when SampleNet is attacked simultaneously.**

Thank you for the comments. SampleNet could also be attacked when attackers have full knowledge of defense methods and models. We have discussed this in the original submission in Sec.6.1 with Table 5. Specifically, our initially designed IRAD exhibits vulnerability to white-box attacks while Diffpure exhibits strong robustness under such settings. However, DiffPure’s high performance comes at the expense of significant computational resources. Therefore, we suggest a hybrid approach that capitalizes on the strengths of both DiffPure and IRAD. When we combined IRAD with DiffPure (See Sec. 5), our IRAD+DiffPure (t=20) method achieved comparable SA and RA with DiffPure, and it’s about five times faster.
We also conduct experiments to explore the integration of IRAD with various steps of DiffPure in Table 4.2. The results show that the hybrid surpasses DiffPure (t=100) in terms of SA, RA, Avg., and time efficiency, demonstrating significant improvements.

Table 4.2: Comparing different steps in the integration of IRAD and DiffPure.

|                      | SA    | RA    | Avg.  | Cost (ms) |
| -------------------- | :-----: | :-----: | :-----: | :---------: |
| DiffPure (t=100)            | 89.73 | 75.12 | 82.42 | 132.80     |
| DISCO                | 89.25 | 0     | 44.63 | 0.38      |
| IRAD                 | 91.70 | 0     | 45.85 | 0.68      |
| DiffPure (t=20)      | 93.66 | 8.01  | 50.83 | 27.25     |
| IRAD+DiffPure (t=20) | 93.42 | 74.05 | 83.73 | 27.70     |
| DiffPure (t=25)      | 93.55 | 18.28 | 55.92 | 31.93     |
| IRAD+DiffPure (t=25) | 91.42 | 77.71 | 84.57 | 32.41     |
| DiffPure (t=30)      | 92.85 | 36.28 | 64.57 | 37.62     |
| IRAD+DiffPure (t=30) | 92.33 | 82.85 | 87.59 | 38.37     |
| DiffPure (t=35)      | 93.50  | 48.75 | 71.13 | 44.18     |
| IRAD+DiffPure (t=35) | 89.14 | 84.57 | 86.86 | 44.86     |
| DiffPure (t=40)      | 93.71 | 59.42 | 76.57 | 51.78     |
| IRAD+DiffPure (t=40) | 90.57 | 86.00    | 88.29 | 52.33     |

Reviewer comment (Experiments):
In my opinion, such a resampling method cannot effectively defend against white-box attacks. However, it might be effective in defending against black-box attacks, especially transfer-based attacks [1,2,3]. I suggest you add such a comparison.

Author response:
**W3. In my opinion, such a resampling method cannot effectively defend against white-box attacks. However, it might be effective in defending against black-box attacks, especially transfer-based attacks [1,2,3]. I suggest you add such a comparison.**

**[1] Zhang et al. Patch-wise attack for fooling deep neural network. ECCV 2020.**

**[2] Wang et al. Enhancing the transferability of adversarial attacks through variance tuning. CVPR 2021.**

**[3] Wang et al. Admix: Enhancing the transferability of adversarial attacks. ICCV 2021.**

Thank you for your valuable comments and for providing the meaningful attack methods. We have followed your advice and conducted experiments on the two most recent works [1][2], which include three attack methods (i.e., VmiFgsm, VniFgsm, and Admix). Our results demonstrate that our method significantly outperforms DISCO when facing all three attacks. In comparison to DiffPure, IRAD exhibits notably superior SA and RA when subjected to the VmiFgsm and VniFgsm attacks. While DiffPure slightly surpasses IRAD in RA under the Admix attack, it is worth mentioning that the inference process of DiffPure is approximately 200 times slower than IRAD as shown in Table 5 in our manuscript.

We have added the experiments into our manuscripts (Appendix A.4) and the other attack the reviewer mentioned into the related work.

Table 4.3a: WRN28-10 against VmiFgsm attack on CIFAR10.

| Defense          | SA    | RA    | Avg.  |
| ---------------- | :-----: | :-----: | :-----: |
| No Defense       | 94.77 | 0     | 47.39 |
| DISCO            | 89.24 | 50.51 | 69.88 |
| DiffPure (t=100) | 89.21 | 85.55 | 87.38 |
| IRAD             | 91.70  | 86.22 | 88.96 |



Table 4.3b: WRN28-10 against VniFgsm attack on CIFAR10.

| Defense          | SA    | RA    | Avg.  |
| ---------------- | :-----: | :-----: | :-----: |
| No Defense       | 94.77 | 0     | 47.39 |
| DISCO            | 89.24 | 52.76 | 71.00    |
| DiffPure (t=100) | 89.21 | 85.49 | 87.35 |
| IRAD             | 91.70  | 87.65 | 89.68 |

Table 4.3c: WRN28-10 against Admix attack on CIFAR10.

| Defense          | SA    | RA    | Avg.  |
| ---------------- | :-----: | :-----: | :-----: |
| No Defense       | 94.77 | 3.82  | 49.30  |
| DISCO            | 89.24 | 65.91 | 77.58 |
| DiffPure (t=100) | 89.21 | 85.23 | 87.22 |
| IRAD             | 91.70  | 82.39 | 87.05 |


[1] Wang, Xiaosen, and Kun He. "Enhancing the transferability of adversarial attacks through variance tuning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

[2] Wang, Xiaosen, et al. "Admix: Enhancing the transferability of adversarial attacks." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021.

Reviewer comment (Experiments):
Since image resampling pre-processes the input image before the model, it is similar to a purifier that eliminates adversarial perturbation [4]. I think it is necessary to compare with such baselines.

Author response:
**W4 Since image resampling pre-processes the input image before the model, it is similar to a purifier that eliminates adversarial perturbation [4]. I think it is necessary to compare with such baselines.**

**[4] Naseer et al. A self-supervised approach for adversarial robustness. CVPR 2020.**

Thank you for providing the baseline methods. We conduct evaluation on NRP [1] under the AutoAttack and BPDA attack. Compared with other defense methods, NRP is a purifier network that tries to minimize the perceptual feature difference between clean and Self Supervised Perturbations (SSP) generated adversary. As shown in their work, they use NRP trained on MS-COCO dataset to successfully defend ImageNet models.

Table 4.4: Results of NRP under AutoAttack and BPDA.

| Dataset  | Attack     | SA    | RA   | Avg.  |
| -------- | ---------- | :-----: | :----: | :-----: |
| cifar10  | AutoAttack | 92.89 | 3.82 | 46.58 |
|          | BPDA       | 92.89 | 0.27 | 48.36 |
| cifar100 | AutoAttack | 77.05 | 6.82 | 41.94 |
|          | BPDA       | 77.05 | 0.59 | 38.82 |
| Imagenet | AutoAttack | 72.52 | 20.40 | 46.46 |
|          | BPDA       | 72.52 | 0.02 | 36.27 |

Our analysis reveals that, in comparison with our method and other baseline approaches, the NRP demonstrates lower effectiveness, particularly in terms of its Robust Accuracy (RA) performance. We think this might be caused by NRP's emphasis on cross-task protection, which encompasses areas such as segmentation, object detection, and similar tasks.

We have added the experiments into our manuscript (Section 6.1).

[1] Naseer, Muzammal, et al. "A self-supervised approach for adversarial robustness." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

Reviewer comment (Presentation):
There's room for optimization in the placement of tables and figures to enhance readability and presentation.

Author response:
Thank you for your guidance. We have meticulously refined the arrangement of figures and tables, making concerted efforts to ensure their proximity to the corresponding text in our manuscript.

Reviewer comment (Experiments):
One important ablation study is lacking. Table 8 verifies the effectiveness of the SampleNet. However, the usefulness of RECONS is not proven. How about the performance of bilinear interpolation with SampletNet?

Author response:
**W1. One important ablation study is lacking. Table 8 verifies the effectiveness of the SampleNet. However, the usefulness of RECONS is not proven. How about the performance of bilinear interpolation with SampletNet?**

Thank you for the helpful advice.

We conducted an ablation study to integrate various RECONS methods with SampleNet. It's important to note that SampleNet is an MLP that takes the features of pixel \[i,j\] and the coordinate values as input, predicting their shifting directly. Since the Nearest and Bilinear RECONS methods could not generate the pixel features as the implicit representations do, we directly utilize the encoder from the implicit representations for a fair comparison. The experimental results are shown in Table 1.1.

Table 1.1: Comparing different reconstruction methods.

| RECONS                  | SA    | RA    | Avg.  |
| ----------------------- | ----- | ----- | ----- |
| Nearest                 | 93.46 | 0.96  | 47.21 |
| Bilinear                | 92.61 | 79.20  | 85.91 |
| Implicit Representation | 91.70  | 89.72 | 90.71 |


As depicted in the table, despite having a high SA, Nearest RECONS lack the capability to defend against adversarial attacks. This limitation arises from its ability to acquire only the pixel values originally sampled from the images. The Bilinear RECONS exhibit superior RA in comparison to the Nearest RECONS and outperform basic image resampling methods under Bilinear RECONS showcased in Table 1 of the paper, highlighting the effectiveness of SampleNet. Compared to these two RECONS, the implicit representation RECONS achieves an even higher RA and Avg., demonstrating their superiority over these two RECONS. Overall, the data from the table suggests that Nearest and Bilinear RECONS are less effective than implicit representation-based methods when integrated with SampleNet.

We have added the discussion to our manuscript (Appendix A.6).

Reviewer comment (Evaluation):
Are there any severe distortions in the shift map?

Author response:
**Q1. Are there any severe distortions in the shift map?**

Thank you for your comments. We assess distortions from both visual and semantic perspectives.

As highlighted in the 'More Visualization Results' section of Appendix A.9, our visual examination reveals that the resampled images closely resemble the clean images, with no significant distortions due to the shift map.

Additionally, as detailed in our answer to W2, we investigate the impact of the shift map on the features in the middle layer and the decision-making process in image classification. Our findings demonstrate that our method successfully reconstructs images without causing major semantic distortions. The details of these semantic evaluations are presented in Appendices A.7 and A.8.