Research map / Adversarial robustness and security / Attacks on text and graphs
LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes LoRID, a Markov-based (DDPM) adversarial purification method that loops diffusion-denoising at early time-steps and applies Tucker decomposition, with theoretical error bounds, reaching SOTA robustness on CIFAR-10/100, CelebA-HQ and ImageNet.
Problem
Diffusion-based adversarial purification removes adversarial noise but a large diffusion time-step damages semantics and clean accuracy, while attackers can exploit small time-steps; the inherent purification error of Markov-based (DDPM) purifiers is not theoretically characterized.
Approach
Theoretically bound DDPM purification error via MMSE of a Gaussian channel, show that looping L diffusion-denoising steps at time t/L reduces the error bound versus a single step at t, and combine this with Tucker decomposition to remove adversarial noise in high-noise regimes.
Key results
- On CIFAR-10 under L-inf AutoAttack (8/255) with WideResNet-28-10, LoRID (39,5) reaches 88.39% robust accuracy in the black-box setting versus 65.24% for the best prior baseline.
- On ImageNet under white-box PGD+EOT (4/255), LoRID (5,30) achieves 56.54% robust accuracy versus 44.39% for the best baseline.
- At high noise (epsilon 32/255) with Tucker decomposition, LoRID reaches 78.04% black-box robust accuracy on CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use LoRID (39,5) instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, L∞ AutoAttack, black-box | robust accuracy: 65.24 -> 88.39 | Helped |
| use LoRID (20,24) instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, L∞ AutoAttack, white-box | robust accuracy: 46.88 -> 59.14 | Helped |
| use LoRID (60,10) instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, L∞ AutoAttack, black-box | robust accuracy: 68.56 -> 70.87 | Helped |
| use LoRID (25,20) instead of the strongest listed baseline | WideResNet-70-16 · CIFAR-10, L∞ AutoAttack, white-box | robust accuracy: 45.31 -> 66.40 | Helped |
| use LoRID (39,4) instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, L2 AutoAttack, black-box | robust accuracy: 83.68 -> 89.69 | Helped |
| use LoRID (15,30) instead of the strongest listed baseline | WideResNet-28-10 · CIFAR-10, L2 AutoAttack, white-box | robust accuracy: 73.32 -> 77.9 | Helped |
| use LoRID (5,30) instead of the strongest listed baseline | WideResNet-28-10 · ImageNet, L∞ PGD+EOT, white-box | robust accuracy: 44.39 -> 56.54 | Helped |
| use LoRID (100,15) instead of the strongest listed baseline | Eyeglasses attribute classifier · CelebA-HQ, L∞ BPDA+EOT | robust accuracy: 90.63 -> 97.80 | Helped |
| add Tucker decomposition (ablation) | LoRID · CIFAR-10, L∞ AutoAttack, ε=8/255 | robust accuracy: 88.39 -> 88.12 | Hurt |
| add Tucker decomposition (ablation) | LoRID · CIFAR-10, L∞ AutoAttack, ε=16/255 | robust accuracy: 85.86 -> 86.23 | Helped |
| add Tucker decomposition (ablation) | LoRID · CIFAR-10, L∞ AutoAttack, ε=32/255 | robust accuracy: 69.87 -> 78.04 | Helped |
| increase the LoRID parameters from (10,40) to (25,20) (ablation) | WideResNet-70-16 · CIFAR-10, L∞ AutoAttack, white-box | robust accuracy: 59.20 -> 66.40 | Helped |
Surprising findings
- Selecting (t, L) to maximize clean accuracy degrades robust accuracy, since reduced model complexity compromises robustness.
Limitations
- Code is not yet released (under organizational review).
- Exact white-box gradients infeasible on large datasets, so surrogate gradient approximations are used for CelebA-HQ and ImageNet.
- Theoretical bounds rely on an assumption that the DDPM reconstruction error is bounded by delta_DDPM(t), and MMSE has no closed form.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 CelebA-HQ ImageNet
Benchmarks: CIFAR-10 CIFAR-100 CelebA-HQ ImageNet
Metrics: standard accuracy robust accuracy
Baselines: DiffPure DensePure Guided-DDPM purification RobustBench adversarial training models score-based purification
Builds on: DDPM DiffPure DensePure Tucker decomposition AutoAttack
Closest papers by meaning
- Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · similarity 0.92)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.92)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.91)
- Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain (ICML 2025 · similarity 0.91)
- ADBM: Adversarial Diffusion Bridge Model for Reliable Adversarial Purification (ICLR 2025 · similarity 0.91)
- Diffusion Models Demand Contrastive Guidance for Adversarial Purification to Advance (ICML 2024 · similarity 0.91)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.