[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82820-en":3,"doc-seo-82820-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82820,5909877438554,"Maeve","https://ap-avatar.wpscdn.com/avatar/5600025385ad2bf12a7?_k=1778553567797529272",8,"Research & Report","AMRM-Pure Semantic-Preserving Adversarial Purification","Adversarial purification uses generative models to remove adversarial perturbations, yet existing approaches often reduce feature-space discrepancies while ignoring within-sample semantic correlations. This work studies purification as semantic relationship preservation among image patches. An Attentive Mask Reconstruction Model (AMRM) is introduced with superior results. Analysis shows AMRM is highly sensitive to adversarial noise because it disrupts patch relationships, motivating AMRM-Pure to denoise inputs via patch-level semantic preservation, formulated as tractable optimization.","AMRM-Pure: Semantic-Preserving Adversarial Purification  \nZhihao Dou 1 ,2 ,∗ Zhiqiang Gao 1 ,∗ ,† Dongfei Cui3 Weida Wang4 Qinjian Zhao 1 Dinggen Zhang 1 Jun Yan5 ,† Zeke Xie6 Shufei Zhang7 ,†  \n1 Wenzhou-Kean University; 2 Case Western Reserve University; 3 Northeast Electric Power University; 4 Fudan University; 5 Shanghai Ocean University; 6 HKUST (Guangzhou); 7 Shanghai AI Lab  \n∗ Equal contribution. †Corresponding authors  \narXiv :2607 .04474v 1 [ cs .CR] 5 Jul 2026  \nAbstract  \nAdversarial purification is a defense technique that employs generative models to remove adversarial perturbations. Current methods often rely on powerful generators, typically diffusion models, and focus on reducing the gap between adversarial and clean samples in the feature space, while overlooking semantic correlation within a single sample. To address this issue, we explore adversarial purification from the perspective of preserving semantic relationships among image patches. We employ an Attentive Mask Reconstruction Model (AMRM), which shows superior performance.  \nOur theoretical and experimental analysis reveals that AMRM is highly sensitive to adversarial noise, as such noise significantly distorts patch relationships. Based on this observation, we propose AMRM-Pure, a purification framework that denoises adversarial inputs by preserving patch-level semantics, and formulate this process as a tractable optimization problem with respect to the input. To further enhance robustness, we finetune AMRM-Pure with classification loss to strengthen semantic consistency. We apply our insight to two AMRM architectures, including Mask Autoencoder (MAE) and MaskDiT. Extensive experiments confirm the effectiveness of our method, establishing new state-of-the-art performance across multiple benchmarks.  \n1 INTRODUCTION  \nDeep Neural Networks (DNNs) are vulnerable to adversarial examples (Carlini and Wagner, 2017; Song et al. ,  \nProceedings of the 29th International Conference on Artificial Intelligence and Statistics (AISTATS) 2026, Tangier, Morocco. PMLR: Volume 300 . Copyright 2026 by the author(s) .  \n2018; Fischer et al., 2017; Lyu et al., 2015), which are imperceptible to humans. However, these inputs with the malicious perturbations can cause DNNs to make erroneous predictions. Adversarial training (Madry et al. , 2018; Zhang et al., 2019) is the state-of-the-art method for defending against adversarial attacks. However, the trade-off between generalization and robustness remains a concern (Zhang et al., 2019), especially against unseen adversarial examples. Furthermore, adversarial training incurs significantly higher computational costs compared to standard training.  \nAlternatively, another notable defense strategy is adversarial purification, which attracts widespread attention. Adversarial purification can be broadly classified into two categories, including purification with generative models (Yoon et al., 2021; Nie et al., 2022; Linet al., 2024; Bai et al., 2024; Zhang et al., 2024) and adaptation-based purification (Shi et al., 2021) . Generative model-based approaches are the most widely used methods in adversarial purification, typically harnessing the powerful capabilities of generative models (e.g. , diffusion) to transform the distribution of adversarial examples to that of clean samples (Nie et al., 2022) . Future efforts will aim to further enhance the denoising capabilities of the purification model through various approaches. These include leveraging contrastive guidance to steer diffusion models (Bai et al. , 2024), integrating classifier confidence guidance into the denoising process (Zhang et al., 2024), and fine-tuning the purification model with adversarial loss for robust optimization (Lin et al., 2024) .  \nThe aforementioned methods primarily focus on aligning adversarial examples with the semantic distribution of clean samples, but neglect the semantic relationships among different patches within a sample. To fill this ga","cbCaiszHgibC2AYw","https://ap.wps.com/l/cbCaiszHgibC2AYw","pdf",6126742,1,28,"English","en",105,"# Introduction\n## Adversarial examples and defense challenges\n## Adversarial purification: generative and adaptation-based methods\n## Semantic relationships among image patches\n## Proposed AMRM-Pure approach","[{\"question\":\"What problem does the paper address in existing adversarial purification methods?\",\"answer\":\"Existing methods mainly align adversarial samples to the clean semantic distribution in feature space, but they neglect semantic relationships among different patches within the same image.\"},{\"question\":\"What is AMRM-Pure and how does it perform purification?\",\"answer\":\"AMRM-Pure denoises adversarial inputs by preserving patch-level semantic relationships. The process is formulated as a tractable optimization problem with respect to the input, and the model is fine-tuned to strengthen semantic consistency.\"},{\"question\":\"Which architectures and benchmarks are used to validate the method?\",\"answer\":\"The paper applies the insight to two AMRM architectures, Mask Autoencoder (MAE) and MaskDiT. Extensive experiments on multiple benchmarks confirm state-of-the-art performance.\"}]",1784183189,71,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"amrm-pure-semantic-preserving-adversarial-purification","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/amrm-pure-semantic-preserving-adversarial-purification/82820/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address in existing adversarial purification methods?","Question",{"text":75,"@type":76},"Existing methods mainly align adversarial samples to the clean semantic distribution in feature space, but they neglect semantic relationships among different patches within the same image.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"What is AMRM-Pure and how does it perform purification?",{"text":80,"@type":76},"AMRM-Pure denoises adversarial inputs by preserving patch-level semantic relationships. The process is formulated as a tractable optimization problem with respect to the input, and the model is fine-tuned to strengthen semantic consistency.",{"name":82,"@type":73,"acceptedAnswer":83},"Which architectures and benchmarks are used to validate the method?",{"text":84,"@type":76},"The paper applies the insight to two AMRM architectures, Mask Autoencoder (MAE) and MaskDiT. Extensive experiments on multiple benchmarks confirm state-of-the-art performance.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]