Research map / Adversarial robustness and security / Attacks on text and graphs
Diffusion-based adversarial purification
Purify or generate adversarial examples using diffusion models.
78 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2017–2026) · an approach in Attacks on text and graphs, keyword cluster “generative · purification · diffusion”
State History Tried Baselines Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
22 papers in 2023–24 and 37 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic held steady, from 7.9% to 7.6%.
Open questions the data points to
- Papers report TIP-IM on CelebA-HQ (ASR (Facenet)) anywhere from 14.46 to 40.74: comparisons against it depend on whose number you take.
- Papers report TIP-IM on CelebA-HQ (ASR (Mobileface)) anywhere from 48.72 to 65.36: comparisons against it depend on whose number you take.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2017 · Towards Principled Methods for Training Generative Adversarial Networks (ICLR 2017 · 349 citations)
- 2019 · Multi-Adversarial Discriminative Deep Domain Generalization for Face Presentation Attack Detection (CVPR 2019 · 420 citations)
- 2020 · Learning Efficient Representations for Fake Speech Detection (AAAI 2020 · 38 citations)
- 2021 · LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition (ICLR 2021 · 66 citations)
- 2022 · Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-Robust Makeup Transfer (CVPR 2022 · 141 citations)
- 2023 · TrojDiff: Trojan Attacks on Diffusion Models With Diverse Targets (CVPR 2023 · 60 citations)
- 2024 · Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · 35 citations)
- 2025 · Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · 12 citations)
- 2026 · IO-RAE: Information-Obfuscation Reversible Adversarial Example for Audio Privacy Protection (AAAI 2026 · 1 citation)
Earliest papers here
- Towards Principled Methods for Training Generative Adversarial Networks (ICLR 2017 · 349 citations)
- End-to-End Differentiable Adversarial Imitation Learning (ICML 2017 · 57 citations)
- Multi-Adversarial Discriminative Deep Domain Generalization for Face Presentation Attack Detection (CVPR 2019 · 420 citations)
What has been tried
62 papers here report 649 measured changes (a component added, removed or swapped, compared with a baseline): helped 68%, no clear effect 6%, hurt 23%, mixed 3%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| add adaptive strength | CelebA-HQ, IR152 · ASR | 71.11 -> 53.43 | Hurt | Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · 35 citations) |
| Add reference EEG editing rather than generating EEG from random vectors | DEAP · accuracy (valence) | 95.07 -> 96.33 | Helped | Beyond Mimicking Under-Represented Emotions: Deep Data Augmentation with Emotional Subspace Constraints for EEG-Based Emotion Recognition (AAAI 2024 · 27 citations) |
| add GAND | ImageNet, PGD-100 (4/255), 500-image subset · robust accuracy | 72.4% -> 72.6% | Helped | Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · 12 citations) |
| Add the ID encryptor | CelebA-HQ, face verification · average ASR (%) | 56.04 -> 79.28 | Helped | Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attacks (CVPR 2025 · 9 citations) |
| add Robust Protection, Perturbation Module, and Adv Net to Basic | pSp-mix with randomly selected perturbations and levels · SR | 0.8741 -> 0.9600 | Helped | Adversarial Robust Safeguard for Evading Deep Facial Manipulation (AAAI 2024 · 7 citations) |
| Use most-vulnerable-step targeting instead of uniform step sampling | Inpainting, Random Mask Thick · FID | 33.4 -> 52.5 | Helped | Step Vulnerability Guided Mean Fluctuation Adversarial Attack against Conditional Diffusion Models (AAAI 2024 · 6 citations) |
| Increase BERT configuration from Tiny to Medium | BERT model comparison · MUM accuracy | 0.844 -> 0.905 | Helped | DiffuPac: Contextual Mimicry in Adversarial Packets Generation via Diffusion Model (NeurIPS 2024 · 6 citations) |
| Add data augmentation | CelebA-Identity and KID-F, MobileFace and FaceNet · ASR (%) | 64.31 -> 73.10; 40.55 -> 42.26; 55.50 -> 65.57; 36.77 -> 39.64 | Helped | Transferable Adversarial Face Attack with Text Controlled Attribute (AAAI 2025 · 5 citations) |
| remove encoder block E1 from attention-mask construction | CIFAR-10, WideResNet-28-10 · standard accuracy | 93.16±0.21 -> 92.77 | Hurt | Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification (CVPR 2025 · 5 citations) |
| Set T=100 instead of T=1000 | Transferability from ResNet-50 to MobileNetV2 · ASR (%) | 18.3 -> 23.5 | Helped | AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · 5 citations) |
| Add the latent-target objective to ACE | CelebA-HQ SDEdit · MS-SSIM | 0.73 -> 0.69 | Helped | Targeted Attack Improves Protection against Unauthorized Diffusion Customization (ICLR 2025 · 4 citations) |
| increase text sampling steps from 0 to 25 | Wikiart · FID | 386.4 -> 462.8 | Helped | Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Models (NeurIPS 2024 · 4 citations) |
Baseline numbers that disagree
The same baseline on the same benchmark and metric, reported more than 5% apart by different papers here. Training budgets, data splits and reimplementations differ, so state which number you compare with.
| Baseline | Benchmark | Metric | Reported | Papers |
|---|---|---|---|---|
| TIP-IM | CelebA-HQ | ASR (Facenet) | 14.46 – 40.74 | 2 papers, e.g. CVPR 2023 and CVPR 2022 |
| TIP-IM | CelebA-HQ | ASR (Mobileface) | 48.72 – 65.36 | 2 papers, e.g. CVPR 2022 and CVPR 2023 |
What reviewers will expect
Datasets and baselines named in the 25 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CelebA-HQ · 11 of 25 papers
- CIFAR-10 · 10 of 25 papers
- ImageNet · 6 of 25 papers
- CIFAR-100 · 4 of 25 papers
- VGGFace2 · 4 of 25 papers
- Tiny-ImageNet · 3 of 25 papers
- LFW · 3 of 25 papers
- SVHN · 3 of 25 papers
Baselines
- DiffPure · 7 of 25 papers
- AdvDM · 5 of 25 papers
- PGD · 4 of 25 papers
- MI-FGSM · 3 of 25 papers
- TIP-IM · 3 of 25 papers
- Mist · 3 of 25 papers
- SDS(+) · 3 of 25 papers
- GDMP · 3 of 25 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 59 papers; from OpenAlex and the papers' affiliations).
- City University of Hong Kong · 3 papers
- Georgia Institute of Technology · 3 papers
- Sun Yat-sen University · 3 papers
- Chinese Academy of Sciences · 3 papers
- Tencent · 2 papers
- Zhongguancun Laboratory · 2 papers
- Tsinghua University · 2 papers
- Xi’an Jiaotong University · 2 papers
- The University of Sydney · 2 papers
- Peking University · 2 papers
Use it
Download BibTeX of 37 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Defenses against universal perturbations (97 papers)
- Attacks and defenses in sequential settings (96 papers)
- Graph neural network robustness (71 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- LLM jailbreak and injection defense (113 papers)
- Adversarial prompts for language models (98 papers)
- Vision-language model robustness (96 papers)
- Biologically inspired robust vision (77 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
- Neural network watermarking (53 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).