Research map / Adversarial robustness and security / Certified and empirical robustness
PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PureGen, a preprocessing defense that purifies poisoned training images by running short Langevin dynamics of trained energy-based models and/or limited-step DDPMs, defending against train-time poisons without attack- or classifier-specific knowledge.
Problem
Train-time data poisoning attacks (triggered and triggerless, e.g., Narcissus, Bullseye Polytope, Gradient Matching) implant backdoors or misclassifications during training; existing defenses often hurt natural accuracy, are attack-specific, or are computationally expensive.
Approach
Treat purification as a stochastic transform Psi(x) realized by mid-run MCMC Langevin dynamics of an EBM trained on public out-of-distribution data, or by a DDPM trained only on the first 250 steps of the noise schedule, so that poison perturbations are washed out while class-relevant content is kept; the purified dataset is then used to train a standard classifier.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use EBM purification instead of Friends | ResNet-18 · CIFAR-10, from-scratch Gradient Matching-1% | Avg Nat Acc (%): 91.15$_{0.4}$ -> 92.98$_{0.2}$ | Helped |
| use DDPM purification instead of Friends | ResNet-18 · CIFAR-10, from-scratch Gradient Matching-1% | Poison Success (%): 0.00 vs 0.00 | No clear effect |
| use EBM purification instead of Friends | ResNet-18 · CINIC-10, from-scratch Narcissus-1% | Avg Poison Success (%): 11.17$_{0.25}$ -> 7.73$_{0.08}$ | Helped |
| use DDPM purification instead of Friends | ResNet-18 · CINIC-10, from-scratch Narcissus-1% | Avg Poison Success (%): 11.17$_{0.25}$ -> 4.76$_{2.37}$ | Helped |
| use EBM purification instead of Friends | ResNet-34 · Tiny ImageNet, from-scratch Gradient Matching-0.25% | Avg Nat Acc (%): 42.74$_{7.5}$ -> 63.27$_{0.4}$ | Helped |
| use DDPM purification instead of JPEG | ResNet-18 · CIFAR-10, transfer fine-tune Bullseye Polytope-10% | Avg Nat Acc (%): 90.40$_{0.44}$ -> 91.53$_{0.15}$ | Helped |
| use repeated alternating EBM and DDPM purification instead of PureDDPM (ablation) | ResNet-18 · CIFAR-10, Narcissus epsilon 8, poison rate 10% | Avg Poison Success (%): 6.38$_{5.16}$ -> 3.75$_{2.28}$ | Helped |
| apply EBM then DDPM purification once instead of PureDDPM (ablation) | ResNet-18 · CIFAR-10, Narcissus epsilon 8, poison rate 10% | Avg Poison Success (%): 6.38$_{5.16}$ -> 10.43$_{8.58}$ | Hurt |
| alternate EBM and DDPM purification repeatedly instead of PureDDPM (ablation) | ResNet-18 · CIFAR-10, Narcissus epsilon 16, poison rate 10% | Avg Poison Success (%): 69.38$_{16.73}$ -> 53.79$_{17.14}$ | Helped |
| filter high-energy samples before selective purification instead of PureDDPM (ablation) | ResNet-18 · CIFAR-10, Narcissus epsilon 16, poison rate 1% | Avg Nat Acc (%): 86.16$_{0.19}$ -> 90.52$_{0.18}$ | Helped |
| train the DDPM on 250 rather than higher forward-process steps up to 1000 (ablation) | PureDDPM · Poison purification | Poison defense | Helped |
Experimental setup
Datasets: CIFAR-10 CINIC-10 Tiny-ImageNet ImageNet (70k subset of CINIC-10) Caltech-256 CIFAR-100 Flowers-102 LFW
Benchmarks: CIFAR-10 CINIC-10 Tiny-ImageNet CIFAR-100 NTGA data availability attack
Metrics: poison success rate (%) natural accuracy (%) max poison success (%) FID
Baselines: EPIC Friends JPEG AVATAR
Builds on: Energy-based models (convergent learning) DDPM EPIC Friends (friendly noise) JPEG compression
Closest papers by meaning
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.87)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.87)
- From Trojan Horses to Castle Walls: Unveiling Bilateral Data Poisoning Effects in Diffusion Models (NeurIPS 2024 · similarity 0.87)
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.87)
- Machine Unlearning Fails to Remove Data Poisoning Attacks (ICLR 2025 · similarity 0.87)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.