Research map / Adversarial robustness and security / Attacks on text and graphs

Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification

CVPR 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Diffusion-based adversarial purification · 5 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a heterogeneous diffusion-based adversarial purification method that adds high-intensity noise to classifier-attended regions and low-intensity noise elsewhere, with a two-stage denoising process and single-step resampling for adaptive attacks.

Problem

Diffusion-based adversarial purification applies uniform noise across all pixels, which either leaves adversarial perturbations intact (low noise) or destroys semantic content (high noise), causing misclassification.

Approach

Build an attention mask from the classifier's per-block activation maps to impose spatially heterogeneous noise levels in the forward process, then denoise with an inpainting-style two-stage sampler; replace multi-step resampling with a single DDIM-based resampling step to make adaptive gradient attacks tractable.

Key results

• On CIFAR-10 with WideResNet-28-10 under AutoAttack l∞ (8/255), the method reaches 80.45% robust accuracy versus 77.08% for the best prior purification baseline (Bai et al.).
• On ImageNet with ResNet-50 under PGD+EOT l∞ (8/255), it reports 74.51% standard and 60.06% robust accuracy, vs 56.54% robust for Geigh et al.
• Single-step resampling reduces time cost and GPU memory by about 90% compared with multi-step resampling, per the paper's claim.

Measured effects reported in the paper

Surprising findings

• Under BPDA+EOT on CIFAR-10 (WideResNet-28-10), the method's robust accuracy (86.72%) is below Song et al. (88.43%) and Lee et al. (88.40%), so it does not lead on that attack.

Limitations

• Robust accuracy under BPDA+EOT lags some diffusion baselines (Song et al., Lee et al.).
• Attention-mask hyperparameters (tau, tl, ts) are tuned on the evaluation setting via sensitivity analysis.
• Robust evaluation uses a fixed random subset of 512 test images due to computational cost.

Experimental setup

Datasets: CIFAR-10 SVHN ImageNet

Benchmarks: CIFAR-10 SVHN ImageNet RobustBench

Metrics: standard accuracy robust accuracy

Baselines: Nie et al. (DiffPure-style) Bai et al. Lee et al. Lin et al. Geigh et al. Song et al. Yoon et al. Gowal et al. Rebuffi et al.

Builds on: DiffPure Nie et al. diffusion purification (t*) RePaint-style inpainting DDIM BPDA+EOT

Closest papers by meaning

• LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.92)
• Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · similarity 0.92)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.92)
• Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.92)
• Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.91)
• ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification (ICLR 2025 · similarity 0.90)