Enhancing Adversarial Robustness through Self-Supervised Confidence-Based Denoising

Deep Neural Networks (DNNs) have been found to be susceptible to adversarial examples, prompting the investigation of strategies aimed at enhancing their robustness against such attacks. Despite the proposition of preprocessing methods designed to mitigate the impact of adversarial perturbations, their adaptability to continuously evolving attack strategies remains a significant challenge. In response to this, we introduce a novel methodology, termed Self-Supervised Confidence-based Perturbation Denoising (SCPD). This approach capitalizes on self-supervised adversarial training to remove adversarial perturbations and restore natural examples. SCPD exploits the association between natural and adversarial examples, utilizing confidence as a guidance in the generation of adversarial features that are effectively generalizable. Specifically, adversarial examples are constructed by maximizing the distortion of confidence, without ground-truth labels. Subsequently, a denoising network is trained with the aim of projecting adversarial examples closer to their natural counterparts. Through a series of comprehensive experiments, we provide evidence that SCPD surpasses existing adversarial training and preprocessing methodologies in terms of robustness against both unseen and adaptive attacks.