Research map / Adversarial robustness and security / Attacks on text and graphs
ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ADBM, a diffusion bridge that fine-tunes a pretrained diffusion model to reverse-bridge from diffused adversarial data to clean data for adversarial purification, evaluated with a stronger full-gradient adaptive attack.
Problem
Diffusion-based purification (DiffPure) is suboptimal because pretrained diffusion models are not designed for purification, creating a trade-off between noise removal and data recovery, and its prior robustness evaluations rely on weak adaptive attacks.
Approach
Construct a reverse diffusion bridge that starts from the diffused adversarial distribution and ends at clean data, obtained by fine-tuning a pretrained diffusion checkpoint with an adversarial-noise-aware loss where adversarial noise is generated via PGD against a frozen classifier.
Key results
- On CIFAR-10 under reliable adaptive attacks (l_inf, l_1, l_2), ADBM reaches 53.5% average robust accuracy versus 49.1% for DiffPure, a 4.4% gain with comparable clean accuracy (91.9% vs 92.5%).
- On SVHN under black-box attacks, ADBM keeps average robust accuracy at 93.21% versus 92.20% for DiffPure and 81.38% for the best AT baseline.
- ADBM with a single DDIM reverse step retains 52.8% average robust accuracy on CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace DiffPure with ADBM | WRN-70-16 classifier · CIFAR-10, adaptive attacks average | robust accuracy: 49.1 ± 1.7 -> 53.5 ± 2.1 | Helped |
| replace DiffPure with ADBM | WRN-70-16 classifier · CIFAR-10, adaptive l∞ attack | robust accuracy: 42.2 ± 2.1 -> 47.7 ± 2.2 | Helped |
| replace DiffPure with ADBM | WRN-70-16 classifier · CIFAR-10, adaptive l1 attack | robust accuracy: 44.3 ± 1.3 -> 49.6 ± 2.2 | Helped |
| replace DiffPure with ADBM | WRN-70-16 classifier · CIFAR-10, adaptive l2 attack | robust accuracy: 60.8 ± 2.3 -> 63.3 ± 1.9 | Helped |
| replace DiffPure with ADBM | WRN-28-10 classifier · SVHN, black-box attacks average | robust accuracy: 92.20 -> 93.21 | Helped |
| reduce reverse sampling steps from 5 to 2 (ablation) | ADBM · CIFAR-10, adaptive attacks average | robust accuracy: 53.5 -> 53.3 | No clear effect |
| reduce reverse sampling steps from 5 to 1 (ablation) | ADBM · CIFAR-10, adaptive attacks average | robust accuracy: 53.5 -> 52.8 | Hurt |
| remove classifier-guided adversarial noise generation (ablation) | ADBM · CIFAR-10, adaptive attacks average | robust accuracy: 53.5 -> 50.1 | Hurt |
| remove fixed-t training design (ablation) | ADBM · CIFAR-10, adaptive attacks average | robust accuracy: 53.5 -> 50.2 | Hurt |
| remove fixed-x training design (ablation) | ADBM · CIFAR-10, adaptive attacks average | robust accuracy: 53.5 -> 50.2 | Hurt |
| increase DiffPure adaptive-evaluation EOT samples from 20 to 40 | DiffPure · CIFAR-10, l∞ attack | robust accuracy: 45.83 ± 1.27 -> 45.64 ± 1.14 | No clear effect |
| increase DiffPure adaptive-evaluation PGD steps from 200 to 400 | DiffPure · CIFAR-10, l∞ attack | robust accuracy: 45.83 ± 1.27 -> 46.16 ± 1.33 | No clear effect |
Surprising findings
- Under the stronger PGD with EOT evaluation, DiffPure's reported robustness drops from 71.29% to 45.83% on CIFAR-10, suggesting prior results were overestimated.
- Increasing reverse steps for DiffPure with DDPM sampling sharply reduces clean accuracy, while robustness is largely unaffected by reverse steps under the DDIM sampler.
Limitations
- UNet diffusion models are large, adding computational parameters versus adversarial training.
- Fine-tuning adds extra training cost relative to using pretrained DiffPure directly.
- Adaptive attack evaluation with full gradients through reverse process is very costly (about 400,000 model queries per image at 100 reverse steps).
Experimental setup
Datasets: SVHN CIFAR-10 Tiny-ImageNet ImageNet-100
Benchmarks: CIFAR-10 SVHN Tiny-ImageNet ImageNet-100
Metrics: clean accuracy robust accuracy
Baselines: DiffPure DiffPure+Guide Diff+ScoreOpt DiffPure+Langevin AToP Augment w/ Diff MLP purifier AutoAttack-based AT methods RayS Square SPSA
Builds on: DiffPure DDPM DDIM Score SDE Expectation over Transformation AToP
Closest papers by meaning
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.91)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.91)
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.90)
- Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance (ICML 2024 · similarity 0.90)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.90)
- Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.