Research map / Adversarial robustness and security / Attacks on text and graphs
Instant Adversarial Purification with Adversarial Consistency Distillation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OSCP, a one-step diffusion-based adversarial purification framework that LoRA-distills a latent consistency model on adversarial latents (GAND) and purifies with canny-edge ControlNet guidance (CAP), reaching 74.19% robust accuracy on ImageNet in ~0.1s.
Problem
Diffusion-based adversarial purification (e.g., DiffPure) is effective but requires many denoising steps, making it too slow for practical real-time defense.
Approach
Distill a latent consistency model with an adversarial-noise-aware objective (GAND) that treats adversarial perturbations as a shift of the Gaussian noise distribution, and purify in one U-Net step guided by a non-learnable canny edge map through ControlNet (CAP).
Key results
- OSCP reaches 74.19% robust accuracy under AutoAttack on ImageNet (ResNet-50, 500-image subset) with ~0.1s per purification on an NVIDIA F40 GPU.
- Under Diff-PGD-10 adaptive attack (8/255), OSCP improves ViT-B-16 robust accuracy from 16.6% (DiffPure) to 34.1%.
- On CelebA-HQ face recognition, OSCP achieves 86.8% robust accuracy against targeted PGD on ArcFace versus 17.3% for Das et al.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use OSCP instead of Wang et al. | ImageNet defense with ResNet-50 · ImageNet, untargeted PGD-100 | robust accuracy: 72.97% -> 73.89% | Helped |
| use OSCP instead of DiffPure | ImageNet defense with ResNet-50 · ImageNet, AutoAttack | robust accuracy: 73.02% -> 74.19% | Helped |
| use OSCP instead of Wang et al. | ImageNet defense with ResNet-152 · ImageNet, random-targeted PGD-40 | robust accuracy: 77.86% -> 78.78% | Helped |
| use OSCP instead of DiffPure | ImageNet purification · ImageNet purification | runtime: ∼11 -> ∼0.1 | Helped |
| use OSCP instead of DiffPure | ImageNet purification · ImageNet image quality | LPIPS: 0.2616 -> 0.2370 | Helped |
| add GAND (ablation) | LCM-LoRA baseline · ImageNet, PGD-100 (4/255), 500-image subset | robust accuracy: 72.4% -> 72.6% | Helped |
| add CAP (ablation) | LCM-LoRA baseline · ImageNet, PGD-100 (4/255), 500-image subset | robust accuracy: 72.4% -> 73.2% | Helped |
| combine GAND and CAP (ablation) | LCM-LoRA baseline · ImageNet, PGD-100 (4/255), 500-image subset | robust accuracy: 72.4% -> 75.0% | Helped |
| remove cskip(t)zt term (ablation) | OSCP · ImageNet, PGD-100 (8/255), t*=200 | robust accuracy: 66.0% -> 66.4% | Helped |
| train over U[1, (N−k)/2] instead of U[1, N − k] (ablation) | OSCP · ImageNet, AutoAttack (8/255), t*=200 | robust accuracy: 73.6% -> 74.3% | Helped |
| use GAND-trained weights rather than CAP without GAND (ablation) | CAP on CelebA-HQ · CelebA-HQ, targeted PGD-10 | robust accuracy: 83.4% -> 86.8% | Helped |
Surprising findings
- Removing the c_skip(t)z_t term from the LCM improves robust accuracy while standard accuracy is unchanged, because z_t retains adversarial noise.
Limitations
- Robust accuracy evaluations use only a 500-image subset for many experiments.
- Hybrid method also depends on adversarial training with PGD-10 against ResNet50 for latent adversarial noise generation.
- Purification reduces standard accuracy at larger t* (e.g., 76.6% at t*=250 vs 81.2% at t*=20).
Experimental setup
Datasets: ImageNet CelebA-HQ
Benchmarks: ImageNet CelebA-HQ
Metrics: standard accuracy robust accuracy attack success rate inference time LPIPS PSNR SSIM
Baselines: DiffPure Wang et al. (GDMP) Amini et al. Singh et al. Das et al. Gaussian blur
Builds on: Latent Consistency Models LCM-LoRA DiffPure ControlNet Consistency distillation
Closest papers by meaning
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.91)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.91)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.90)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.90)
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.90)
- Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.