Research map / Adversarial robustness and security / Certified and empirical robustness
Sample-specific Noise Injection for Diffusion-based Adversarial Purification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SSNI, which adapts the forward-diffusion noise level per sample using score norms (via expected perturbation score) to boost clean and robust accuracy of diffusion-based purification methods on CIFAR-10 and ImageNet-1K.
Problem
Diffusion-based adversarial purification uses a single constant noise level t* for all inputs, but the optimal level varies per sample, leading to a poor accuracy-robustness trade-off.
Approach
Use the score norm (expected perturbation score from a pre-trained score network) as a proxy for how far a sample is from the clean data distribution, and reweight the shared t* with a linear or sigmoid function so cleaner samples receive less noise and perturbed samples receive more.
Key results
- SSNI-N improves DiffPure standard accuracy on CIFAR-10 (PGD+EOT l_inf 8/255, WRN-28-10) from 89.71 to 93.29 with robust accuracy rising from 47.98 to 48.63.
- On ImageNet-1K (PGD+EOT l_inf 4/255, RN-50), SSNI-N raises GDMP robust accuracy from 30.34 to 33.66 and GNS robust accuracy from 42.45 to 43.48.
- Under BPDA+EOT on CIFAR-10, SSNI-N with GDMP improves robust accuracy from 36.72 to 40.95 under PGD+EOT and standard accuracy by 1.63 points.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add sample-specific noise injection using SSNI-N | DiffPure, GDMP, and GNS · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | standard accuracy: +3.58%; +1.63%; +3.45% | Helped |
| Add sample-specific noise injection using SSNI-N | DiffPure, GDMP, and GNS · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | robust accuracy: +0.65%; +4.23%; +0.40% | Mixed |
| Add sample-specific noise injection using SSNI-N | DiffPure, GDMP, and GNS · ImageNet-1K, PGD+EOT ℓ∞ (ε = 4/255) | robust accuracy: +3.32; +4.82; +1.03 | Helped |
| Add sample-specific noise injection using SSNI-N | DiffPure, GDMP, and GNS · CIFAR-10, PGD+EOT ℓ₂ (ε = 0.5) | robust accuracy: -0.06; +0.20; +0.39 | Mixed |
| Use a single score norm instead of EPS norm (ablation) | SSNI-N · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | robust accuracy: 47.98±0.64 -> 47.20±1.22; 36.72±1.05 -> 34.24±1.45; 56.05±1.11 -> 55.47±1.15 | Hurt |
| Replace DDPM sampling with DDIM (ablation) | DiffPure · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | robust accuracy: 47.98±0.64 -> 37.50±0.80 | Hurt |
| Replace DDPM sampling with sdeint solver (ablation) | DiffPure · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | robust accuracy: 47.98±0.64 -> 47.72±0.24 | Hurt |
| Vary temperature coefficient τ in SSNI-N (ablation) | SSNI-N · CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) | robust accuracy | Mixed |
| Increase bias term b (ablation) | SSNI reweighting function · CIFAR-10 and ImageNet-1K | robust accuracy | Helped |
| Increase bias term b (ablation) | SSNI reweighting function · CIFAR-10 and ImageNet-1K | standard accuracy | Hurt |
Surprising findings
- Single score norms improve standard accuracy but reduce robust accuracy, suggesting sensitivity to purification noise levels.
- SSNI-N slightly decreases robust accuracy for some DBP baselines under l2 PGD and BPDA attacks (e.g., -1.10 for GNS under BPDA).
Limitations
- The maximum noise level t^S for EPS is shared across samples and may not be optimal.
- The linear and sigmoid reweighting functions are hand-designed and may not be the best functional forms.
- Adds extra inference cost from the score network reweighting step.
Experimental setup
Datasets: CIFAR-10 ImageNet-1K
Benchmarks: CIFAR-10 ImageNet-1K AutoAttack DiffAttack Diff-PGD
Metrics: standard accuracy robust accuracy
Baselines: DiffPure GDMP GNS SSNI-L
Builds on: DiffPure GDMP GNS expected perturbation score DDPM
Closest papers by meaning
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.92)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.91)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.90)
- Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.89)
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.89)
- Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.