CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defense
This addresses the vulnerability of neural networks to adversarial attacks, which is a critical security issue in AI applications, by proposing a novel causality-inspired approach that enhances robustness against unseen attacks.
The paper tackles the problem of defending neural classifiers from adversarial attacks, especially unseen ones, by modeling label generation with essential causative factors and discriminating perturbations as non-causative factors, resulting in an average robustness improvement of up to +4.93% on benchmarks like CIFAR-10 and GTSRB.
Despite ongoing efforts to defend neural classifiers from adversarial attacks, they remain vulnerable, especially to unseen attacks. In contrast, humans are difficult to be cheated by subtle manipulations, since we make judgments only based on essential factors. Inspired by this observation, we attempt to model label generation with essential label-causative factors and incorporate label-non-causative factors to assist data generation. For an adversarial example, we aim to discriminate the perturbations as non-causative factors and make predictions only based on the label-causative factors. Concretely, we propose a casual diffusion model (CausalDiff) that adapts diffusion models for conditional data generation and disentangles the two types of casual factors by learning towards a novel casual information bottleneck objective. Empirically, CausalDiff has significantly outperformed state-of-the-art defense methods on various unseen attacks, achieving an average robustness of 86.39% (+4.01%) on CIFAR-10, 56.25% (+3.13%) on CIFAR-100, and 82.62% (+4.93%) on GTSRB (German Traffic Sign Recognition Benchmark). The code is available at https://github.com/CAS-AISafetyBasicResearchGroup/CausalDiff.