RevINN：用于可逆对抗样本生成的端到端可逆神经网络
RevINN: An End-to-End Invertible Neural Network for Reversible Adversarial Examples Generation
用可逆神经网络在小波频域直接生成可逆对抗样本，把「加扰动」和「可恢复」合成单阶段，对做对抗攻击/防御、以及需要可逆变换（如可逆水印、隐私保护图像发布）的视觉工作提供了可复用的端到端可逆架构与频域调制思路。
原文依据 we propose a novel end-to-end Invertible Neural Network for Reversible Adversarial Examples Generation (RevINN)
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论近期研究表明，可逆对抗样本（RAE）能够误导未授权的深度神经网络，同时对授权用户仍保持可用，从而有效防止图像数据泄露。现有 RAE 方法依赖将扰动信息可逆地嵌入原始对抗样本中以实现恢复。然而，这种两阶段流程往往导致生成的 RAE 在攻击有效性和视觉质量上均劣于原始版本。为解决这些挑战，我们提出了一种新颖的端到端可逆神经网络用于可逆对抗样本生成（RevINN），它通过扰乱图像的内在频率信息，在一个阶段内直接生成 RAE。具体而言，我们的 RevINN 由跨频调制攻击（CFMA）模块和高频扰动增强（HFPE）模块组成。CFMA 在低频与高频小波分量之间选择性地交换判别性信息以实现对抗性。为充分改变高频语义，HFPE 创新性地采用三分支结构，在高频子带之间进行细粒度调制，从而增强扰动强度。最后，修改后的分量通过逆小波变换重组为 RAE。我们的 RevINN 采用对抗损失、感知损失和可逆损失进行优化，并可基于小波操作与网络模块的可逆性恢复图像。大量实验表明，我们的 RevINN 达到了最优的 RAE 生成质量。代码见：https://github.com/WongJaylen/RevINN。
英文原文摘要 1623 字符
Recent studies have shown that Reversible Adversarial Examples (RAE) can mislead unauthorized deep neural networks while remaining usable for authorized users, effectively preventing image data leakage. Existing RAE methods rely on reversibly embedding perturbation information into the original adversarial examples to enable restoration. However, this two-stage process often results in RAEs with inferior attack effectiveness and visual quality compared to the original versions. To solve these challenges, we propose a novel end-to-end Invertible Neural Network for Reversible Adversarial Examples Generation (RevINN), which directly generates RAEs in one stage by scrambling the intrinsic frequency information of images. Specifically, our RevINN consists of the Cross-Frequency Modulation Attack (CFMA) module and the High-Frequency Perturbation Enhancement (HFPE) module. CFMA selectively exchanges discriminative information between low- and high-frequency wavelet components to achieve adversariality. To fully alter high-frequency semantics, HFPE innovatively employs a tri-branch structure for fine-grained modulation among high-frequency subbands, enhancing perturbation strength. Finally, the modified components are recomposed into RAEs via the inverse wavelet transform. Our RevINN is optimized with adversarial, perceptual, and invertible losses, and can restore images based on the reversibility of the wavelet operations and network modules. Extensive experiments demonstrate that our RevINN achieves state-of-the-art RAE generation quality. The code is available at: https://github.com/WongJaylen/RevINN.