Research map / Adversarial robustness and security / Attacks on text and graphs
DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DiffHammer, a selective EM-based attack with gradient grafting and N-evaluation in the attack loop, showing diffusion-based purifications are substantially less robust than prior EOT-based evaluations suggest.
Problem
Diffusion-based adversarial purification may appear robust because EOT-based attacks are ineffective against its stochasticity (a gradient dilemma), and 1-evaluation underestimates the risk of resubmission attacks against stochastic defenses.
Approach
Treats the set of stochastic purifications as having shared vs. unshared vulnerabilities, uses EM to identify the shared-vulnerability subset (E-step) and aggregates gradients only from it (M-step), approximates purification gradients via gradient grafting so only one full backpropagation is needed, and integrates N-evaluation into the attack loop to estimate M-resubmit robustness.
Key results
- On CIFAR10 at l_inf 8/255, DiffHammer reduces DiffPure Avg.Rob to 42.54% vs 52.73% for PGD and 57.60% for DA/AA, reaching near-optimal results in about 20 iterations.
- Under 10-evaluation, DiffPure's 10-resubmit robustness is overestimated by 17.9% by 1-evaluation (41.7% MLE vs 59.6%).
- Most purification defenses drop below 50% robustness under 10 resubmits, and purification can weaken TRADES/AWP robust classifiers by 11.7%-24.8% in resubmit risk.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DiffHammer instead of DA/AA | Attack evaluation of DiffPure · CIFAR10, ℓ∞: 8/255 | Avg.Rob: 57.60 -> 42.54 | Helped |
| Use DiffHammer instead of PGD | Attack evaluation of GDMP · CIFAR10, ℓ∞: 8/255 | Avg.Rob: 49.41 -> 41.64 | Helped |
| Use DiffHammer instead of PGD | Attack evaluation of LM · CIFAR10, ℓ∞: 8/255 | Avg.Rob: 17.99 -> 16.15 | Helped |
| Use DiffHammer instead of DA/AA | Attack evaluation of DiffPure · ImageNette, ℓ∞: 4/255 | Avg.Rob: 53.12 -> 38.36 | Helped |
| Use DiffHammer instead of DA/AA | Attack evaluation of GDMP · ImageNette, ℓ∞: 4/255 | Avg.Rob: 46.64 -> 33.98 | Helped |
| Use DiffHammer instead of BPDA | Attack evaluation of LM · ImageNette, ℓ∞: 4/255 | Avg.Rob: 28.28 -> 26.25 | Helped |
| Replace the grafted gradient with the selective approximate gradient E(qϕ∇ϕLϕ) (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, DiffPure | Avg.Rob difference from default: +27.44 | Hurt |
| Replace the grafted gradient with the selective approximate gradient E(qϕ∇ϕLϕ) (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, GDMP | Avg.Rob difference from default: +30.02 | Hurt |
| Replace the grafted gradient with the selective approximate gradient E(qϕ∇ϕLϕ) (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, LM | Avg.Rob difference from default: +41.29 | Hurt |
| Use the full gradient E(qϕ∇xLϕ) instead of the grafted gradient (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, DiffPure | Avg.Rob difference from default: -3.52 | Helped |
| Set α = 0.2 instead of α = 0.5 (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, DiffPure | Avg.Rob difference from default: +2.19 | Hurt |
| Set N = 5 instead of N = 10 (ablation) | DiffHammer · CIFAR10, ℓ∞: 8/255, DiffPure | Avg.Rob difference from default: +1.44 | Hurt |
Surprising findings
- Robust adversarially trained classifiers mitigate the gradient dilemma, so most attacks perform similarly on them.
- Transfer-based attacks such as VMI and SVRE perform worse than simpler baselines, attributed to the gradient dilemma.
Limitations
- Underlying reasons for the gradient dilemma are not fully understood.
- Experiments limited to image classification.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNette
Benchmarks: CIFAR10 CIFAR100 ImageNette
Metrics: Avg.Rob Wor.Rob iterations to 90% best attack effect
Baselines: BPDA PGD AutoAttack DiffAttack DMI TMI VMI SVRE Adjoint method Score attack Full attack
Builds on: EOT BPDA AutoAttack DiffAttack DiffPure
Closest papers by meaning
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.92)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.92)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.91)
- ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification (ICLR 2025 · similarity 0.91)
- Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.90)
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.