Real-Time Adversarial Defense via Buffer-Aware Reinforcement Learning

Abstract

Real-time systems built on deep neural networks cannot afford a single, fixed adversarial defense: maximal purification of every input exceeds latency and compute budgets, while no defense leaves the system exposed. We present ATDS-BARL, an Adaptive Tiered Defense System in which a Proximal Policy Optimization (PPO) agent selects, per input, among four defense tiers ranging from pass-through to learned denoising, guided by a reward that jointly penalizes misclassification, buffer occupancy, and latency. A reference-free attribution network estimates attack type and perturbation strength from a single image, and a delayed-label mechanism uses confidence-gated pseudo-labels when ground truth arrives late. We evaluated ATDS-BARL on CIFAR-10 and CIFAR-100 over five seeds against FGSM, PGD (<inline-formula> <tex-math notation="LaTeX">$k=7$ </tex-math></inline-formula>–40), C&W, AutoAttack, BPDA, and EOT. The policy routed inputs adaptively rather than converging on a fixed defense: on CIFAR-10, 66.5%, 23.9%, and 9.6% of inputs went to pass-through, lightweight transformation, and the two strongest tiers (71.2%, 22.4%, and 6.5% on CIFAR-100). PGD robust accuracy reached <inline-formula> <tex-math notation="LaTeX">$3.16\% \pm 0.96\%$ </tex-math></inline-formula> and <inline-formula> <tex-math notation="LaTeX">$1.61\% \pm 0.94\%$ </tex-math></inline-formula> (95% confidence intervals). Attribution accuracy was 26.7% and 33.8%, above the 25% four-class chance level. Average latency was 0.44 ms per sample versus 0.34 ms undefended, avoiding the overhead of static maximum-strength defense. Ablations show that reward shaping, particularly the balance between tier-cost penalties and robustness gains, is the primary factor governing the learned policy and the clearest direction for improving robustness.