Progressive Residual Tensor Networks for Adversarial Purification

ICLR 2026 Conference Submission24193 Authors

Keywords: adversarial attacks, adversarial training, adversarial purification

Abstract: Adversarial perturbations remain a critical threat to modern vision systems, and tensor network–based purification is a promising direction thanks to its low-rank priors. Yet these methods face a fundamental reconstruction–denoising conflict: preserving pixel fidelity risks recovering adversarial residues, whereas aggressive suppression sacrifices semantic detail. We address this trade-off with a Laplacian pyramid–inspired framework that performs progressive residual reconstruction across scales. At coarse levels, the rank is kept relatively unconstrained to capture global semantic structure, while a monotonically decreasing rank schedule constrains capacity at finer levels, preventing the accumulation of fine-scale perturbations. In addition, we introduce a wavelet-based residual regularization that penalizes the energy of reconstructed high-frequency subbands, discouraging residuals from absorbing adversarial noise without undermining semantic recovery. Extensive experiments on CIFAR-10, CIFAR-100, and ImageNet show that our method preserves strong reconstruction quality on clean images while substantially improving robustness under diverse attacks, demonstrating the effectiveness of a frequency-aware, progressive tensor-network purifier.

Primary Area: other topics in machine learning (i.e., none of the above)

Submission Number: 24193