Research map / Adversarial robustness and security / Attacks on text and graphs
Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FreqPure, a diffusion-based adversarial purification method that, at each reverse step, keeps low-frequency amplitude from the adversarial input and projects low-frequency phase into a range of the input's phase, motivated by a frequency analysis showing perturbation damage grows with frequency.
Problem
Diffusion-based adversarial purification drowns perturbations in isotropic noise, which also destroys clean image semantics, especially low-frequency content and structure.
Approach
Decompose images into amplitude and phase spectra; at each reverse-diffusion step, replace low-frequency amplitude of the estimated clean image with that of the adversarial input and project its low-frequency phase into a range around the adversarial input's phase, so that less-damaged frequencies guide restoration.
Key results
- On CIFAR-10 WRN-28-10 under l_inf 8/255 AutoAttack, the method reports 77.35% robust accuracy and 92.19% standard accuracy, versus 77.08% for the best prior purification baseline.
- On ImageNet (ResNet-50, PGD l_inf 4/255), robust accuracy reaches 59.77% versus 56.54% for the next best method, with standard accuracy 71.88%.
- Under BPDA+EOT l_inf 8/255 on CIFAR-10 WRN-28-10, robust accuracy is 89.07% versus 88.43% for the next best.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FreqPure instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, ℓ∞ 8/255, PGD | robust accuracy: 56.84±0.59 -> 59.39±0.79 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, ℓ∞ 8/255, AutoAttack | robust accuracy: 77.08 -> 77.35±2.14 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, ℓ∞ 8/255, PGD | robust accuracy: 56.88±1.06 -> 62.50±2.73 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, ℓ∞ 8/255, AutoAttack | robust accuracy: 79.10 -> 78.13±1.95 | Hurt |
| Use FreqPure instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, ℓ2 0.5, PGD | robust accuracy: 86.13 -> 87.89±1.17 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, ℓ2 0.5, AutoAttack | robust accuracy: 86.48±0.38 -> 89.06±0.43 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, ℓ2 0.5, PGD | robust accuracy: 84.37 -> 87.89±1.17 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, ℓ2 0.5, AutoAttack | robust accuracy: 85.59±0.61 -> 89.84±1.56 | Helped |
| Use FreqPure instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, ℓ∞ 8/255, BPDA+EOT | robust accuracy: 88.43±0.83 -> 89.07±0.79 | Helped |
| Use FreqPure instead of the strongest listed baseline | ResNet-50 · ImageNet, ℓ∞ 4/255, PGD | robust accuracy: 56.54 -> 59.77 | Helped |
| Add amplitude spectrum exchange and phase spectrum projection (ablation) | FreqPure · CIFAR-10, ℓ∞ 8/255, WideResNet-28-10 | average accuracy: 81.73 -> 84.77 | Helped |
| Add phase spectrum projection (ablation) | FreqPure with amplitude spectrum exchange · CIFAR-10, ℓ∞ 8/255, WideResNet-28-10 | average accuracy: 83.21 -> 84.77 | Helped |
Surprising findings
- Standard accuracy of the ImageNet baseline DiffPure-style method falls from 73.96% at t*=0.2 to 61.71% at t*=0.4, which the authors take as evidence that existing purification destroys semantics as t grows.
Limitations
- Gradient computation for adaptive attacks is hard, and the authors note this makes defense evaluation difficult.
- Several hyperparameters (D_A, D_P, delta) are tuned, with best values chosen via sensitivity analysis on CIFAR-10.
Experimental setup
Datasets: CIFAR-10 SVHN ImageNet
Benchmarks: CIFAR-10 SVHN ImageNet RobustBench
Metrics: standard accuracy robust accuracy DINO similarity CLIP similarity
Baselines: DiffPure REAP CGAP GDMP WRN-based adversarial training methods Gibbs Update EBM+LD DSM+LD
Builds on: DiffPure DDPM EDM Gibbs/score-based purification (Yoon et al.)
Closest papers by meaning
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.92)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.91)
- MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · similarity 0.90)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.89)
- Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.89)
- Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.