Research map / Adversarial robustness and security / Attacks on text and graphs
Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes contrastive-guided diffusion purification: a partially noised adversarial input is denoised with the reverse SDE steered by the gradient of a contrastive (InfoNCE/HNM) loss, with a theoretical Gaussian-mixture analysis motivating the noise level and guidance.
Problem
Adversarial purification with diffusion models removes adversarial perturbations but purified images remain poorly class-separable, and DiffPure's noise level and guidance are not theoretically tuned; the paper asks whether contrastive guidance can steer purification toward the clean distribution.
Approach
Derives, under a Gaussian mixture model, the forward noise level t* for purification and shows that a contrastive loss gradient in the reverse process boosts the signal direction; then adds the gradient of a contrastive loss (InfoNCE or hard-negative-mining) between the anchor and its positive pair to the score during reverse diffusion, without changing diffusion training.
Key results
- On CIFAR-10 under AutoAttack l-inf (eps=8/255) with WideResNet-28-10, robust accuracy reaches 82.81% vs 70.64% for DiffPure.
- On GTSRB under AutoAttack l-inf (eps=8/255), robust accuracy is 69.53% vs 42.19% for DiffPure.
- On unseen threat models with ResNet-50 on CIFAR-10, robust accuracy is 73.44% (l-inf) and 79.12% (l2) vs 70.00% and 70.90% for DiffPure.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use contrastive-guided diffusion purification instead of DiffPure | CIFAR-10 with WideResNet-28-10 · CIFAR-10, AutoAttack ℓ∞ (ϵ = 8/255) | robust accuracy: 70.64 -> 82.81 | Helped |
| use contrastive-guided diffusion purification instead of DiffPure | CIFAR-10 with WideResNet-70-16 · CIFAR-10, AutoAttack ℓ∞ (ϵ = 8/255) | robust accuracy: 71.29 -> 82.81 | Helped |
| use contrastive-guided diffusion purification instead of the strongest listed baseline | CIFAR-10 with WideResNet-28-10 · CIFAR-10, AutoAttack ℓ2 (ϵ = 0.5) | robust accuracy: 83.68 -> 84.38 | Helped |
| use contrastive-guided diffusion purification instead of DiffPure | CIFAR-10 with ResNet-50 · CIFAR-10, unseen AutoAttack ℓ2 (ϵ = 1) | robust accuracy: 70.90 -> 79.12 | Helped |
| use contrastive-guided diffusion purification instead of DiffPure | GTSRB with ResNet-18 · GTSRB, AutoAttack ℓ∞ (ϵ = 8/255) | robust accuracy: 42.19 -> 69.53 | Helped |
| use contrastive-guided diffusion purification instead of DiffPure | GTSRB with ResNet-18 · GTSRB, BPDA+EOT ℓ∞ (ϵ = 8/255) | robust accuracy: 61.43 -> 61.25 | No clear effect |
| use VP-SDE rather than VP-ODE (ablation) | contrastive-guided diffusion purification · CIFAR-10, AutoAttack ℓ∞ (ϵ = 8/255) | robust accuracy: 69.79 -> 82.81 | Helped |
| add contrastive guidance to diffusion purification (ablation) | diffusion purification on CIFAR-100 · CIFAR-100, AutoAttack ℓ∞ (ϵ = 8/255) | robust accuracy: 8.60 -> 24.22 | Helped |
| add contrastive guidance to diffusion purification (ablation) | diffusion purification on CIFAR-100 · CIFAR-100, AutoAttack ℓ∞ (ϵ = 8/255) | standard accuracy: 62.50 -> 57.82 | Hurt |
Surprising findings
- On CIFAR-100, contrastive guidance lowers standard accuracy (62.50% to 57.82%) while raising robust accuracy (8.60% to 24.22%).
- On CIFAR-10 l2 (eps=0.5) with WideResNet-70-16, the method's robust accuracy (82.82%) is only slightly above the baseline's and its standard accuracy (90.63%) is below DiffPure's 92.68%.
Limitations
- Authors note the approach may need optimization for high-dimensional data.
- Computational cost in resource-constrained settings is a potential limitation.
- Trade-off between standard and robust accuracy remains unsolved; the method favors stronger attacks and weaker classifiers.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 GTSRB ImageNet
Benchmarks: CIFAR-10 CIFAR-100 GTSRB ImageNet
Metrics: standard accuracy robust accuracy
Baselines: DiffPure Adversarial training methods from RobustBench Hill et al. 2021 EBM purification Yoon et al. 2021 DSM purification DensePure
Builds on: DiffPure Lu et al. 2023 contrastive energy guidance Ouyang et al. 2023 contrastive guided diffusion InfoNCE hard negative mining
Closest papers by meaning
- MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · similarity 0.91)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.91)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.91)
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.90)
- ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification (ICLR 2025 · similarity 0.90)
- Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.