Research map / Adversarial robustness and security / Certified and empirical robustness

MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model

CVPR 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Augmentation and diffusion purification · 18 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MimicDiffusion, a guided-diffusion adversarial purification method that uses Manhattan (l1) guidance plus a super-resolution-based short-range guidance to approximate the reverse trajectory of the clean image, reaching large robust-accuracy gains on CIFAR-10/100 and ImageNet.

Problem

Diffusion-based adversarial purification is itself affected by adversarial perturbation, since the guidance term in the reverse diffusion process depends on the adversarial input, causing the trajectory to deviate from that of the clean image.

Approach

Replace the l2 guidance distance with l1 (Manhattan) so the gradient becomes sign-based and equals the clean-image gradient when the generated image is far from the clean image (long-range); for the short-range case, apply a bicubic x4 super-resolution mapping to both the estimate and adversarial sample to push distances into the long-range regime; guidance is applied only in a middle interval of

Key results

• On CIFAR-10 under AutoAttack (l-inf, 8/255) with WideResNet-28-10, MimicDiffusion reaches 92.67% robust accuracy, versus 71.18% for GDPM and 71.03% for Nie et al.
• On CIFAR-100 with WideResNet-28-10, robust accuracy is 61.35%, and the abstract reports an average 13.23% improvement.
• Ablation on CIFAR-10 shows l1 guidance raises robust accuracy substantially over l2 (e.g., 57.07% to 89.10% with both guidances), and combining long- and short-range guidance with sampling strategy reaches 92.60%.

Measured effects reported in the paper

Limitations

• Two guidances require gradient computation, increasing computation cost.
• Relies on assumption that adversarial perturbations are imperceptible and bounded (||phi||_inf < xi), and the short-range case is only heuristically handled.
• Reported standard deviations are large (e.g., ±3 to ±6 points), and evaluation uses a fixed 512-image subset for BPDA+EOT.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 ImageNet

Benchmarks: CIFAR-10 CIFAR-100 ImageNet RobustBench

Metrics: standard accuracy robust accuracy

Baselines: Nie et al. (DiffPure) GDPM Yong et al. (DSM+LD) Hill et al. (EBM+LD) Song et al. (Gibbs Update) RobustBench adversarial training methods

Builds on: DPS DiffPure GDPM EDM AutoAttack

Closest papers by meaning

• Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance (ICML 2024 · similarity 0.91)
• LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.90)
• Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.90)
• Revisiting Diffusion Models: From Generative Pre-training to One-Step Generation (ICML 2025 · similarity 0.90)
• Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.90)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.89)