LightPure: Realtime Adversarial Image Purification for Mobile Devices Using Diffusion Models

Abstract

Autonomous mobile systems increasingly rely on deep neural networks for perception and decision-making. While effective, these systems are vulnerable to adversarial machine learning attacks where small perturbations in the input could significantly impact the outcome of the system. Common countermeasures include leveraging adversarial training and/or data or network transformation. Although widely used, the main drawback of these countermeasures is that they require full and invasive access to the classifiers, which are typically proprietary. Additionally, the cost of training or retraining is often prohibitively expensive for large models. To tackle this, purification models have recently been proposed. The aim is to incorporate a "purification"layer before classification, thereby eliminating the necessity to modify the classifier. Despite their effectiveness, state-of-the-art purification methods are compute-intensive, rendering them unsuitable for mobile systems where resources are constrained and large latency is not desired.This paper presents a new approach, LightPure, that enhances the purification of adversarial images. It improves the accuracy of the current leading purification methods while also providing notable enhancements in speed and computational efficiency, making it suitable for mobile devices with limited resources. Our approach uses a two-step diffusion and one-shot Generative Adversarial Network (GAN) framework for purification, prioritizing latency without compromising robustness. We propose several new techniques in designing our model to achieve a reasonable balance between classification accuracy and adversarial robustness while maintaining a desired latency. We design and implement a proof-of-concept on a Jetson Nano board and evaluate our method using several attack scenarios and datasets. Our results show that LightPure can outperform existing purification methods by up to 10x in terms of latency while achieving higher accuracy and robustness for various black-, gray-, and white-box attack scenarios. The fusion of speed and robust defense mechanisms positions our method as a significant advancement in the field of adversarial image purification, offering a scalable and effective solution for real-world mobile systems.