@inproceedings{
zhou2024pair,
title={{PAIR}: Pre-denosing Augmented Image Retrieval Model for Defending Adversarial Patches},
author={Ziyang Zhou and Pinghui Wang and Zi Liang and Ruofei Zhang and Haitao Bai},
booktitle={ACM Multimedia 2024},
year={2024},
url={https://openreview.net/forum?id=RYtwNywxPf}
}
Deep neural networks are widely used in retrieval systems. However, they are notoriously vulnerable to attack. Among the various forms of adversarial attacks, the patch attack is one of the most threatening forms. This type of attack can introduce cognitive biases into the retrieval system by inserting deceptive patches into images. Despite the seriousness of this threat, there are still no well-established solutions for image retrieval systems. In this paper, we propose the Pre-denosing Augmented Image Retrieval (PAIR) model, a new approach designed to protect image retrieval systems against adversarial patch attacks. The core strategy of PAIR is to dynamically and randomly reconstruct entire images based on their semantic content. This purifies well-designed patch attacks while preserving the semantic integrity of the images. Furthermore, we present a novel training strategy that incorporates a semantic discriminator. This discriminator significantly improves PAIR's ability to capture real semantics and reconstruct images. Experiments show that PAIR significantly outperforms existing defense methods. It effectively reduces the success rate of two state-of-the-art patch attack methods to below 5\%, achieving a 14\% improvement over current leading methods. Moreover, in defending against other forms of attack, such as global perturbation attacks, PAIR also achieves competitive results.  The codes are available at: https://anonymous.4open.science/r/PAIR-8FD2.
PAIR: Pre-denosing Augmented Image Retrieval Model for Defending Adversarial Patches
Ziyang Zhou Pinghui Wang Zi Liang Ruofei Zhang Haitao Bai