Research map / Adversarial robustness and security / Certified and empirical robustness
Augmentation and diffusion purification
Use mixup, augmentation and diffusion models to purify or robustify inputs.
30 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2025) · an approach in Certified and empirical robustness, keyword cluster “cifar · 10 · imagenet”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Quiet None of the tracked benchmarks has a report from 2025–26.
13 papers in 2023–24 and 3 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 4.3% to 1.3%.
No longer reported by papers here: ImageNet-C (mCE, last in 2023).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · mixup: Beyond Empirical Risk Minimization (ICLR 2018 · 4,723 citations)
- 2019 · Self-Routing Capsule Networks (NeurIPS 2019 · 52 citations)
- 2020 · Adversarial AutoAugment (ICLR 2020 · 87 citations)
- 2021 · StyleMix: Separating Content and Style for Enhanced Data Augmentation (CVPR 2021 · 109 citations)
- 2022 · Pyramid Adversarial Training Improves ViT Performance (CVPR 2022 · 43 citations)
- 2023 · Better Diffusion Models Further Improve Adversarial Training (ICML 2023 · 52 citations)
- 2024 · MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · 18 citations)
- 2025 · Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · 0 citations)
Earliest papers here
- mixup: Beyond Empirical Risk Minimization (ICLR 2018 · 4,723 citations)
- Self-Routing Capsule Networks (NeurIPS 2019 · 52 citations)
- Retrieval-Augmented Convolutional Neural Networks Against Adversarial Examples (CVPR 2019 · 8 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
ImageNet-C · mCE (lower is better)
4 papers, 2021–2023 · not reported since 2023
| Year | Best so far | Set by |
|---|---|---|
| 2021 | 82.56 | AugMax: Adversarial Composition of Random Augmentations for Robust Training (NeurIPS 2021 · 16 citations) |
| 2022 | 41.42 | Pyramid Adversarial Training Improves ViT Performance (CVPR 2022 · 43 citations) |
What has been tried
28 papers here report 335 measured changes (a component added, removed or swapped, compared with a baseline): helped 63%, no clear effect 6%, hurt 25%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use only long-range guidance with ℓ2 distance instead of both ℓ1 guidance terms and the sampling strategy | CIFAR-10, AutoAttack ℓ∞ (ϵ = 8/255) · robust accuracy | 92.60 -> 16.7 | Hurt | MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · 18 citations) |
| Add likelihood maximization before diffusion classification | CIFAR-10 test, ℓ∞, ε=8/255 · robust accuracy | 35.94 -> 75.67 | Helped | Robust Classification via a Single Diffusion Model (ICML 2024 · 4 citations) |
| Use SR-guided dynamic sparsity instead of alternating ZO-GraSP and sparse training (M1) or pruning before training (M2) | Pruning performance across pruning ratios · accuracy | Helped | DeepZero: Scaling Up Zeroth-Order Optimization for Deep Model Training (ICLR 2024 · 3 citations) | |
| use repeated alternating EBM and DDPM purification instead of PureDDPM | CIFAR-10, Narcissus epsilon 8, poison rate 10% · Avg Poison Success (%) | 6.38 (5.16) -> 3.75 (2.28) | Helped | PureGen: Universal Data Purification for Train-Time Poison Defense via Generative Model Dynamics (NeurIPS 2024 · 2 citations) |
| Use a single score norm instead of EPS norm | CIFAR-10, PGD+EOT ℓ∞ (ε = 8/255) · robust accuracy | 47.98±0.64 -> 47.20±1.22; 36.72±1.05 -> 34.24±1.45; 56.05±1.11 -> 55.47±1.15 | Hurt | Sample-specific Noise Injection for Diffusion-based Adversarial Purification (ICML 2025 · 0 citations) |
| Add SalUn parameter masking to AMUN | CIFAR-10 random forget 10% · Avg. Gap | 1.94 ±0.13 -> 1.77 ±0.06 | Helped | Not All Wrong is Bad: Using Adversarial Examples for Unlearning (ICML 2025) |
What reviewers will expect
Datasets and baselines named in the 8 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 7 of 8 papers
- CIFAR-100 · 2 of 8 papers
- ImageNet · 2 of 8 papers
- Tiny ImageNet · 2 of 8 papers
Baselines
- DiffPure · 2 of 8 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 16 papers; from OpenAlex and the papers' affiliations).
- Shanghai Jiao Tong University · 2 papers
- University of Illinois, Urbana Champaign · 2 papers
Use it
Download BibTeX of 25 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial training recipes (68 papers)
- Regularized defenses against attacks (40 papers)
- Adversarial training with feature consistency (135 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Decision-boundary geometry of robustness (61 papers)
- Theory of adversarial risk (59 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).