Research map / Adversarial robustness and security / Attacks on text and graphs

DiffBreak: Is Diffusion-Based Purification Robust?

NeurIPS 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Diffusion-based adversarial purification · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that diffusion-based purification (DBP) defenses are far less robust than reported once gradients through the purifier are computed correctly (DiffGrad toolkit) and evaluation uses multi-purification majority voting; also proposes a low-frequency optimizable-filter attack that defeats DBP under majority vote.

Problem

Diffusion-based purification is widely regarded as a robust defense against adversarial examples, but prior robustness estimates may be inflated by inaccurate backpropagation through the stochastic purifier and by single-purification evaluation protocols.

Approach

Provides a checkpointing-based gradient module (DiffGrad) that fixes time inconsistency, noise reproduction, guidance gradients and surrogate misuse; replaces single-purification classification with majority vote over K purified copies; and adapts UnMarker-style optimizable low-frequency filters with an LPIPS constraint to craft perturbations robust to stochastic purification.

Key results

• On CIFAR-10 WideResNet-70-16, DiffHammer-DiffGrad reaches Wor.Rob 10.16% and Full-DiffGrad 17.19% for DiffPure, versus substantially higher robustness claimed by prior implementations.
• Under majority vote, the low-frequency attack reduces DiffPure robust accuracy to 0.00% on ImageNet WideResNet-50-2 and DeiT-S and 2.73-3.13% on CIFAR-10.
• MimicDiffusion's reported 92.67% robust accuracy drops to 2.73% (WRN-28-10) under corrected gradients and Wor.Rob evaluation.

Measured effects reported in the paper

Surprising findings

• Correcting backpropagation alone lowers DBP one-shot robust accuracy substantially (e.g., DiffPure from 62.11% to 48.05%), showing prior robustness was partly a gradient artifact.
• MimicDiffusion, which reports SOTA adaptive robustness, collapses to near zero under proper gradients and evaluation.

Limitations

• No error bars or confidence intervals are reported due to computational cost; evaluation uses only 256 test samples per dataset.
• Low-frequency attack uses an LPIPS threshold as the perceptual constraint, which is not norm-bounded and lacks calibrated user studies for other metrics.
• Majority vote offers no formal guarantees and attacks are evaluated only in the white-box setting.

Experimental setup

Datasets: CIFAR-10 ImageNet

Benchmarks: CIFAR-10 ImageNet

Metrics: clean accuracy robust accuracy worst-case robustness majority-vote robustness

Baselines: DiffPure GDMP DiffAttack DiffHammer BPDA MimicDiffusion StAdv

Builds on: DiffPure AutoAttack UnMarker DiffHammer GDMP

Closest papers by meaning

• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.94)
• DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.92)
• LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.89)
• ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification (ICLR 2025 · similarity 0.89)
• Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · similarity 0.89)
• Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.88)