PaperlayerView exact revision on arXiv

Source-linked AI summary

Diffusion Models for Adversarial Purification

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, Anima Anandkumar

arXiv:2205.07460v1cs.LGcs.CRcs.CV

TL;DR

Adversarial purification can defend pre-existing classifiers against unseen threats, but its performance has generally lagged behind adversarial training. DiffPure adds a small amount of diffusion noise to adversarial examples, reverses the diffusion process, and uses adjoint gradients for adaptive evaluation. Across three datasets and multiple classifier architectures, it achieves state-of-the-art robustness and outperforms prior adversarial training and purification methods, while remaining limited by slow purification and sensitivity to image colors.

  • Problem

    Adversarial purification supports unseen-threat defense without retraining, but its performance usually falls behind adversarial training, particularly against adaptive attacks.

  • Method

    DiffPure adds noise to adversarial examples through a forward diffusion process, recovers images through reverse denoising, and uses the adjoint method to compute full reverse-SDE gradients efficiently.

  • Results

    DiffPure achieves state-of-the-art performance across CIFAR-10, ImageNet, and CelebA-HQ with ResNet, WideResNet, and ViT classifiers, outperforming adversarial training and purification methods.

  • Takeaways & Limitations

    Diffusion models provide an adversarial purification defense that can be evaluated against strong adaptive attacks while improving robust accuracy across varied datasets, architectures, and attack settings.

  • Takeaways & Limitations

    Purification is too slow for real-time tasks, and diffusion models are sensitive to image colors, limiting defense against color-related corruptions.

Abstract

from arXiv · show

Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.

1. Introduction

Adversarial purification can defend pre-existing classifiers against unseen threats without retraining, but its performance has lagged behind adversarial training, especially against adaptive attacks. DiffPure uses diffusion-based purification and efficient full-gradient evaluation to improve robustness across datasets, classifiers, and attacks.

  • Adversarial training is effective but commonly targets specific trained attacks, while defenses for unseen threats can suffer performance drops and higher computational cost.
  • Adversarial purification uses generative models before classification and can defend unseen threats without retraining because purification models are independent of threat models and classifiers.
  • Diffusion models combine forward noising with reverse denoising, offering sample quality and mode coverage that motivate their use for adversarial purification.
  • DiffPure adds noise to adversarial examples at a small diffusion timestep, then solves the reverse SDE to recover images before classification.
  • Theoretical analysis balances noise sufficient to remove perturbations against noise that could destroy label semantics, while the adjoint method computes full reverse-SDE gradients with constant memory.
  • Up to +5.44% robust accuracy on CIFAR-10 and +7.68% on ImageNet were achieved against AutoAttack ℓ∞ compared with adversarial training methods.
  • Ablations confirm the importance of noise injection in both forward and reverse processes for adversarial robustness.

2. Background

Continuous-time diffusion models progressively transform data into noise through a forward SDE and generate data by reversing that process with a score-informed SDE. Their formulation uses time-dependent drift, diffusion, and score functions to describe the trajectory and denoising dynamics.

  • The forward diffusion process is an SDE that gradually transforms data from its distribution toward a noise distribution over the time horizon [0, 1].
  • The process uses a drift coefficient, diffusion coefficient, and standard Wiener process to model continuous-time stochastic dynamics.
  • With suitable f and g, the terminal state approximately follows a standard Gaussian distribution, and the paper uses a VP-SDE with a linear noise schedule by default.
  • Reverse-time sampling starts from Gaussian noise and solves an SDE backward from t=1 to t=0, progressively producing less-noisy data samples.
  • Ideally, the reverse trajectory has the same distribution as the forward trajectory while ending at the data distribution.
  • The reverse SDE requires the time-dependent score ∇x log p_t(x), commonly estimated with a parameterized neural network trained by weighted denoising score matching.

3. Method

DiffPure purifies adversarial images by briefly diffusing them and then recovering them through a reverse SDE. The method balances perturbation removal against semantic preservation and uses adjoint gradients for memory-efficient adaptive-attack evaluation.

  • Diffusion purification: DiffPure first diffuses an adversarial example with a small timestep, then recovers a purified image by solving the reverse SDE.The recovered image is passed to an external standard classifier.
  • Diffusion purification: Forward diffusion makes clean and adversarial data distributions closer, with their KL divergence monotonically decreasing over time.The theorem states that equality occurs only when the two distributions already match.
  • Diffusion purification: The timestep t∗ must balance removing local adversarial perturbations against preserving global label semantics.Larger t∗ removes more local structure but can also remove semantic information, while smaller t∗ better preserves the clean image.
  • Diffusion purification: Theoretical analysis characterizes how the diffusion timestep affects the distance between clean and purified images.The bound is stated with probability at least 1 −δ, and the relevant upper-bound terms increase with t∗.
  • Diffusion purification: Figure 2 illustrates purification with PGD ℓ∞(ϵ = 16/255) at t∗= 0.3, showing reverse-SDE outputs across timesteps and a final image matching the clean image.The adversarial examples target attribute classifiers.
  • Adaptive attack to diffusion purification: The adjoint method computes full gradients through the reverse SDE without storing intermediate operations, reducing memory cost to O(1).This addresses the poor memory scaling of ordinary backpropagation through the SDE solver under strong adaptive attacks.

4. Related work

The related work situates DiffPure among adversarial training, generative adversarial purification, and diffusion-model research. These lines of work differ in whether robustness comes from training classifiers, purifying inputs, or modeling image distributions.

  • Adversarial training: Adversarial training learns robust classifiers by training on adversarial examples generated during each weight update.It is described as one of the most successful neural-network defenses against adversarial attacks.
  • Adversarial purification: Adversarial purification uses generative models to purify adversarial images before classification.Prior approaches include GANs, autoregressive models, and energy-based models.
  • Diffusion models: Diffusion models are probabilistic generative models used for unsupervised modeling, image synthesis, and image-editing tasks.The passage highlights their sample quality and diversity in image synthesis.

5. Experiments

Experiments evaluate DiffPure across datasets, classifier architectures, threat models, and adaptive attacks. The method generally outperforms adversarial training and prior purification defenses, including against unseen threats.

  • Experimental setup: Experiments cover CIFAR-10, ImageNet, and CelebA-HQ with ResNet, WideResNet, and ViT classifiers.Evaluation uses standard and robust accuracy under strong adaptive attacks, including AutoAttack and StAdv.
  • Comparison with the state-of-the-art: 7.68% robust-accuracy and 7.13% standard-accuracy improvements are reported on ImageNet DeiT-S against AutoAttack ℓ∞.Robust-accuracy improvements are also reported for ResNet-50 and WideResNet-50-2.
  • Defense against unseen threats: DiffPure achieves significantly better standard and robust accuracies than state-of-the-art defenses across unseen ℓ∞, ℓ2, and StAdv attacks.Reported robust-accuracy improvements are 30%, 36%, and 5.4% for ℓ∞, ℓ2, and StAdv, respectively.
  • Ablation studies: DiffPure can be combined with adversarially trained classifiers to improve robust accuracy against AutoAttack ℓ∞ and ℓ2 threats.This combination feeds purified images to adversarially trained classifiers and can further improve pre-existing defenses.

6. Conclusions

DiffPure combines diffusion-based purification with adjoint gradients and is evaluated broadly against strong adaptive attacks. It reports large gains over prior approaches, while remaining limited by runtime and color sensitivity.

  • DiffPure purifies adversarial examples with diffusion models before classification and uses the adjoint method for full-gradient evaluation.
  • Extensive experiments span CIFAR-10, ImageNet, and CelebA-HQ with ResNet, WideResNet, and ViT classifiers.
  • DiffPure largely outperforms previous approaches against AutoAttack, StAdv, and BPDA+EOT adaptive attacks.
  • The purification process is too slow for real-time tasks because its runtime scales with the diffusion timestep.
  • Diffusion models’ sensitivity to image colors prevents DiffPure from defending against color-related corruptions.

A.1. Proof of Theorem 3.1

The appendix proves that forward diffusion reduces divergence between clean and adversarial distributions and analyzes purification error and gradient computation under stated assumptions.

  • Proof of Theorem 3.1: Theorem A.1 compares clean-data and adversarial-sample distributions after forward diffusion, denoted p_t and q_t.
  • Proof of Theorem 3.1: KL divergence between p_t and q_t decreases monotonically from t=0 to t=1, with equality only when p_t=q_t.
  • Proof of Theorem 3.1: The proof derives this monotonicity from the Fokker–Planck equation, integration by parts, and nonnegative Fisher divergence under smoothness and decay assumptions.
  • Proof of Theorem 3.2: The purification analysis writes the adversarial example as x_a=x+ϵ_a and bounds the distance between clean and purified images after forward and reverse SDEs.
  • Proof of Theorem 3.2: The linear reverse component is a time-varying Ornstein–Uhlenbeck process whose solution is Gaussian with mean and covariance obtained from differential equations.
  • Proof of Proposition 3.3: The augmented SDE computes gradients of the reverse generative process with respect to its input using the adjoint method.

B.2. Implementation details of adversarial attacks

The implementation evaluates DiffPure and alternatives across multiple attacks, purification models, sampling formulations, and numerical settings.

  • AutoAttack: AutoAttack uses both STANDARD and RAND versions, with the minimum robust accuracy reported as DiffPure’s final result.
  • StAdv: StAdv evaluates robustness to unseen threats beyond ℓ_p-norm attacks, using EOT to average stochastic gradients.
  • BPDA+EOT: BPDA+EOT is used because it is considered the default strong attack for stochastic adversarial purification methods.
  • Purification models on CelebA-HQ: CelebA-HQ purification comparisons include NVAE and StyleGAN2 with GAN+OPT, GAN+ENC, and GAN+ENC+OPT inversion methods.
  • LD-SDE: DiffPure conditionally samples clean images by forward-diffusing adversarial inputs and then applying reverse diffusion.
  • LD-SDE: The LD-SDE formulation balances attraction toward the adversarial image against the score function, with σ^2 controlling that balance.
  • Gradient computation: As the SDE solver step size decreases, adjoint-gradient numerical error monotonically decreases.

C.1. Robust accuracies of our method for standard attack and black-box attack

Additional evaluations test DiffPure against transferred standard attacks and the black-box Square Attack, emphasizing adaptive-attack comparisons and gradient-masking checks.

  • Standard attacks: Standard attacks are much less effective against DiffPure than adaptive attacks, while AutoAttack drives static-model robust accuracy to zero.
  • Black-box attacks: Square Attack produces higher robust accuracies for DiffPure than for the static model and higher values than AutoAttack.
  • Black-box attacks: Square Attack is evaluated separately because its black-box nature provides a direct check for insensitivity to gradient masking.
  • Evaluation tables: The reported tables compare robust accuracies under the specified attack-transfer settings and classifier architectures.

C.2. Robust accuracies of baselines obtained from RobustBench vs. from our experiments

The RobustBench comparison uses a 512-image subset because AutoAttack evaluation is computationally expensive. Baseline robust accuracies on this subset closely track whole-test-set results across datasets and architectures.

  • AutoAttack evaluation uses a randomly sampled subset of 512 test images because evaluating DiffPure is computationally expensive.The method typically requires 50–150 function evaluations per attack iteration.
  • Baseline robust accuracies differ by less than 1.5% between RobustBench whole-test-set results and experiments on the sampled subset.This comparison covers CIFAR-10 and ImageNet with ResNet and WideResNet architectures.
  • The relative performance ordering of different methods remains the same on the sampled subset and the full test set.

C.3. More results of comparison within adversarial purification on CelebA-HQ

On the harder CelebA-HQ smiling attribute task, DiffPure substantially outperforms other adversarial purification methods under BPDA+EOT evaluation.

  • DiffPure improves robust accuracy by at least +18.78% over all baselines on the CelebA-HQ smiling attribute classifier.Evaluation uses BPDA+EOT against ℓ∞ perturbations.
  • The smiling attribute is harder to classify than the eyeglasses attribute, resulting in lower robust accuracies for most defense methods.

C.4. More results of ablation studies

The ablations examine EOT, randomized diffusion timesteps, visual purification, inference cost, and attacks targeting the diffusion model. They show threat-model-dependent EOT behavior, a randomness–robustness trade-off, and increasing inference time with timestep.

  • Impact of EOT: EOT affects robust accuracy differently across ℓ∞, ℓ2, and StAdv threat models.Figure 6 evaluates WideResNet-28-10 on CIFAR-10 under all three threat models.
  • Randomizing diffusion timestep: Increasing timestep-randomization range monotonically decreases mean standard accuracy and increases robust-accuracy variance.A slightly small randomization range may improve robust accuracy on average.
  • Inference time: DiffPure’s inference time increases linearly with the diffusion timestep.The authors suggest fast diffusion sampling as a possible future way to reduce this cost.
  • Attacking the diffusion model: The study separately evaluates attacks against the diffusion model and attacks against the full defense system.These evaluations use APGD with ℓ∞ and ℓ2 attacks on CIFAR-10.
  • Purification examples: Visual examples show adversarial images being purified toward clean images across reverse-SDE timesteps.The examples include attribute-classifier attacks using PGD ℓ∞ perturbations with t*=0.3.
Loading 2205.07460v1…