Research map / Adversarial robustness and security / Attacks on text and graphs
Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Argues that stochasticity in diffusion-based purification (not forward noise washout alone) drives robustness, introduces a deterministic white-box attack setting, and proposes ADDT with RBGM to adversarially fine-tune diffusion purifiers.
Problem
Diffusion-based purification (DBP) is commonly credited to forward-diffusion Gaussian noise washing out adversarial perturbations, but the actual source of its robustness is unclear, and DBP evaluations under stochastic models may be unreliable.
Approach
Shows DBP robustness relies largely on stochasticity by introducing a Deterministic White-Box (DW-box) attack where the attacker knows the noise; then trains diffusion models adversarially (ADDT) by injecting classifier-guided perturbations mapped to Gaussian-like noise via rank-based mapping (RBGM).
Key results
- ADDT raises DP-DDPM robust accuracy under PGD20+EoT10 on CIFAR-10 (l_inf) from 47.27% to 51.46%, and DiffPure from 55.96% to 62.11%.
- Deterministic white-box attack on DP-DDPM drops robust accuracy from 47.27% (conventional white-box) to 16.80% (DW-Both), while DW-Fwd only reaches 45.41%.
- Fixing a bug in AutoAttack's Rand version lowers DiffPure l_inf robust accuracy from 62.11% to 56.25%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Fine-tune DiffPure with ADDT | DiffPure · CIFAR-10 | ℓ∞ robust accuracy: 55.96 -> 62.11 | Helped |
| Fine-tune DP_DDPM with ADDT | DP_DDPM · CIFAR-10 | ℓ∞ robust accuracy: 47.27 -> 51.46 | Helped |
| Fine-tune DP_DDIM with ADDT | DP_DDIM · CIFAR-10 | ℓ∞ robust accuracy: 42.19 -> 46.48 | Helped |
| Fine-tune DP_EDM with ADDT | DP_EDM · CIFAR-10 | ℓ∞ robust accuracy: 62.50 -> 66.41 | Helped |
| Fine-tune DP_DDPM with ADDT | DP_DDPM · Tiny-ImageNet | ℓ∞ robust accuracy: 11.82 -> 13.57 | Helped |
| Fine-tune the ImageNet-1k DBP model with ADDT | DBP model · ImageNet-1k | PGD20+EoT10 robust accuracy: 46.92 -> 48.02 | Helped |
| Remove RBGM and use ℓ∞ perturbations during fine-tuning (ablation) | ADDT · CIFAR-10 | FID: 5.190 -> 13.608 | Hurt |
| Use classifier-guided CGPO perturbations instead of MSE-guided samples (ablation) | DP_DDPM · CIFAR-10, 100 NFEs | ℓ∞ robust accuracy: 46.97 -> 51.46 | Helped |
| Use classifier-guided CGPO perturbations instead of MSE-guided samples (ablation) | DP_DDIM · CIFAR-10, 10 NFEs | ℓ∞ robust accuracy: 40.92 -> 47.85 | Helped |
| Expose the forward-process noise to the attacker | DP_DDPM · CIFAR-10 | ℓ∞ robust accuracy: 47.27 -> 45.41 | Hurt |
| Expose the reverse-process noise to the attacker | DP_DDPM · CIFAR-10 | ℓ∞ robust accuracy: 47.27 -> 35.25 | Hurt |
| Expose both forward- and reverse-process noise to the attacker | DP_DDPM · CIFAR-10 | ℓ∞ robust accuracy: 47.27 -> 16.80 | Hurt |
Surprising findings
- DiffPure's robust accuracy under AutoAttack's Rand version was overestimated; the authors report a bug in the official code that inflated robustness claims.
- Knowing only the forward-process noise (DW-Fwd) barely reduces robustness, whereas knowing the reverse-process noise (DW-Rev) or both causes large drops, contrary to the forward wash-out explanation.
Limitations
- ADDT gains are modest on complex datasets such as Tiny-ImageNet and ImageNet-1k.
- Strong EoT-based attacks are computationally expensive, limiting evaluation scale.
- Robustness gains from ADDT drop about 5 points under stronger PGD200+EoT20 attacks.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet-1k
Benchmarks: CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet-1k AutoAttack
Metrics: clean accuracy robust accuracy FID
Baselines: DiffPure GDMP COUP DP-DDPM DP-DDIM AutoAttack
Builds on: DiffPure adversarial training DDPM DDIM EDM
Closest papers by meaning
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.94)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.92)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.92)
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.92)
- Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · similarity 0.91)
- Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance (ICML 2024 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.