Efficient Preemptive Robustification with Image Sharpening

1. Problem Statement

Deep Neural Networks (DNNs) are highly vulnerable to imperceptible adversarial perturbations, even in transfer scenarios (black-box attacks). Existing defense strategies generally fall into two categories, both of which have significant limitations:

• Training-time defenses (e.g., adversarial training, robust architecture design): Often sacrifice standard accuracy for robustness and require expensive retraining.
• Post-attack defenses (e.g., input purification, adversarial detection): Introduce substantial inference-time computational overhead and may have limited effectiveness.

Preemptive Robustification is a newer paradigm that modifies benign samples before an attack occurs to proactively resist perturbations. However, existing methods in this domain suffer from three critical drawbacks:

1. Surrogate Dependency: They require well-trained surrogate models to generate robustness priors, which are unavailable in specialized domains (e.g., medical imaging).
2. Computational Overhead: They rely on iterative optimization or trained generators, making them unsuitable for real-time systems.
3. Lack of Interpretability: The generated perturbations are often unexplainable, hindering reliability.

The authors aim to develop a surrogate-free, optimization-free, generator-free, and human-interpretable preemptive robustification method that is computationally efficient.

2. Methodology

The core hypothesis of the paper is that image sharpening alone can serve as an efficient preemptive robustification mechanism. This is based on the observation that robust samples tend to possess stronger semantic textures, and adversarial perturbations are often concentrated in mid-to-high frequency components.

The Proposed Approach: Laplacian Sharpening

Instead of using complex neural networks or iterative optimization, the authors apply a classical Laplacian sharpening operator to benign images.

• Process: Given a benign image $x$, a texture map is generated by convolving $x$ with an 8-neighbor Laplacian operator ($K_{Laplacian}$). The robustified image $x_r$ is constructed by adding this scaled texture map back to the original image:
  $$x_r = x + \alpha \cdot (K_{Laplacian} * x)$$
  Where $\alpha$ is a sharpening strength coefficient ($\alpha > 0$).
• Constraints: The method is designed to be surrogate-free (no target or surrogate model needed), generator-free (no learned generator), and optimization-free (single convolution operation).
• Theoretical Justification:
  • DNNs rely heavily on texture features.
  • Samples with stronger semantic textures lie farther from the decision boundary.
  • By enhancing textures, sharpening pushes benign samples further from the decision boundary, requiring a significantly larger perturbation ($\epsilon_a$) to cause misclassification.

3. Key Contributions

1. Novel Paradigm: The first proposal of image sharpening as a preemptive robustification method, distinct from existing optimization or generation-based approaches.
2. Efficiency and Accessibility: The method is surrogate-free, optimization-free, and generator-free, making it applicable even when surrogate models are unavailable. It requires only a single convolution, offering negligible computational cost.
3. Interpretability: The process is human-interpretable (simple image enhancement), unlike "black-box" generated perturbations.
4. Comprehensive Evaluation: Extensive experiments across diverse attacks (gradient-based, transformation-based, ensemble-based), tasks (classification, segmentation, detection), and datasets.

4. Experimental Results

The authors evaluated the method on the NIPS 2017 Adversarial Competition dataset (classification), Cityscapes (segmentation), and MS COCO (detection).

• Black-Box Transferability (Classification):
  • Using a ResNet-50 surrogate with a perturbation budget $\epsilon = 10/255$, a modest sharpening strength ($\alpha = 0.15$) improved the average classification accuracy of adversarial examples across 17 black-box models from 41.3% to 56.0%.
  • The method showed particularly strong gains in transfer-based settings, which represent the dominant real-world threat.
• White-Box Performance:
  • Significant robustness gains were also observed in white-box scenarios, especially under smaller perturbation budgets.
• Targeted Attacks:
  • The method provided strong defense against targeted attacks (e.g., SU, Logit Margin, CFM), reducing Attack Success Rates (ASR) significantly.
• Ensemble Attacks:
  • Effective against ensemble-based attacks (e.g., Ens, AdaEA, CWA) using multiple surrogate models.
• Integration with Adversarial Training:
  • When combined with adversarially trained models (e.g., ARES, RATI), Laplacian sharpening provided synergistic improvements, further boosting robustness.
• Standard Accuracy:
  • The method has no significant impact on the standard accuracy of benign images. While very high $\alpha$ values cause slight degradation due to out-of-distribution issues, moderate values (e.g., $\alpha \le 0.15$) maintain high standard accuracy.
• Robustness to Post-Processing:
  • The robustification gains remain stable even after JPEG compression (factors Q=40 and Q=70).
• Other Tasks:
  • Semantic Segmentation: Improved mIoU on Cityscapes.
  • Object Detection: Improved mAP on MS COCO, though gains were more modest compared to classification due to lower transferability of detection-specific attacks.

5. Significance and Conclusion

This work reveals a fundamental property of deep learning security: traditional image sharpening acts as a powerful, low-cost defense.

• Practical Applicability: Because it requires only a single CPU and no model training, it is highly deployable in resource-constrained or real-time industrial settings (e.g., medical imaging, edge devices).
• Theoretical Insight: It bridges the gap between classical image processing and modern adversarial defense, suggesting that enhancing semantic texture is a critical factor in moving samples away from decision boundaries.
• Future Directions: The authors note that extending this approach to other modalities (audio, text) and optimizing the sharpening operator further are promising avenues for future research.

In summary, the paper demonstrates that a simple, interpretable, and computationally trivial operation (Laplacian sharpening) can serve as a highly effective, universal preemptive defense against a wide spectrum of adversarial attacks.