Source-linked AI summary
Guided Diffusion Model for Adversarial Purification from Random Noise
Quanlin Wu, Hang Ye, Yuntian Gu
TL;DR
Adversarial perturbations can mislead neural classifiers, motivating defenses that withstand powerful attacks. The paper proposes guided diffusion purification and connects unguided diffusion purification to certified robustness, reporting strong empirical accuracy and improved certified accuracy at larger radii.
Problem
Adversarial perturbations imperceptible to humans can mislead trained neural networks, while adversarial training can fail against powerful unseen attacks and require greater training computation.
Source: §1 · p. 1Method
The paper guides diffusion purification with adversarial inputs, using a noise-forwarding and image-restoring process with time-dependent guidance strength.
Source: §3.1 · pp. 3–4, §5 · p. 7Results
89.62% robust accuracy against PGD under the ℓ∞ threat model (ϵ = 8/255); certified accuracy improves by about 5% for r ≥ 0.5.
Source: §4.1 · p. 6Takeaways & Limitations
The paper relates unguided diffusion purification to randomized smoothing, enabling a provable defense mechanism and application to certified robustness.
Source: §1 · p. 1Diffusion purification takes about 0.92s per 32 × 32 CIFAR-10 image at reverse step 50, and added guidance makes tight certified-radius bounds harder to present.
Source: §5 · p. 7
Abstract
from arXiv · showhide
In this paper, we propose a novel guided diffusion purification approach to provide a strong defense against adversarial attacks. Our model achieves 89.62% robust accuracy under PGD-L_inf attack (eps = 8/255) on the CIFAR-10 dataset. We first explore the essential correlations between unguided diffusion models and randomized smoothing, enabling us to apply the models to certified robustness. The empirical results show that our models outperform randomized smoothing by 5% when the certified L2 radius r is larger than 0.5.
1 Introduction
Adversarial attacks threaten DNN classifiers, while adversarial training can fail against powerful unseen attacks and require greater training computation. The paper proposes guided diffusion purification and connects unguided diffusion purification with randomized smoothing to support certified robustness.
1 Introduction
- Adversarial attacks can mislead DNN classifiers with imperceptible perturbations, and adversarial training may fail against powerful unseen attacks while requiring higher training computation.The paper frames these vulnerabilities as a security threat in real-world scenarios.Source: §1 · p. 1
- Diffusion purification uses a forward process that adds Gaussian noise and a reverse process that recovers clean images, with stochasticity providing a defense mechanism.The paper describes adversarial perturbations as gradually smoothed and dominated by the injected noise.Source: §1 · p. 1
- The paper proposes guided diffusion purification, relates unguided diffusion purification to randomized smoothing for provable defense, and studies DDIM's speed–robustness trade-off.The contributions also include theoretical analysis of the diffusion process.Source: §1 · p. 1
2 Backgrounds
The background contrasts adversarial training with generative-model purification, then introduces DDPM's forward and reverse processes and DDIM's faster sampling approach.
2.1 Adversarial Robustness
- Adversarial training uses adversarial examples during classifier training, whereas purification preprocesses inputs with independently trained generative models that can pair with standard classifiers and generalize to certified guarantees.Purification requires neither assumptions about attack form nor classifier architecture details and is described as less time-consuming than adversarial training.Source: §2.1 · p. 2
2.2 DDPM
- DDPMs approximate a target distribution by reversing gradual Gaussian diffusion: data loses distinguishable features and becomes random noise, while a learned reverse Markov process predicts slightly less-noised samples with neural-network mean and time-dependent constant variance.Source: §2.2 · p. 2
2.3 DDIM
- DDIM accelerates diffusion sampling by changing the reverse process to non-Markovian and sampling a subset of steps without retraining; η = 0 is deterministic, while η = 1 recovers DDPM.The background identifies slow iterative reversal as the motivation for acceleration.Source: §2.3 · pp. 2–3
3 Methods
The methods use guided diffusion purification to restore adversarial images, and connect unguided diffusion purification to randomized smoothing to obtain ℓ2 robustness guarantees. The analysis reports better certified results than randomized smoothing and identifies limits on what is certified.
3.1 Diffusion Purification
- The guided method starts reverse denoising from pure Gaussian noise and uses the adversarial image as guidance, balancing semantic recovery against retaining adversarial structure.The authors motivate this choice by suggesting that diffused adversarial inputs may preserve corrupted structures and lead the reverse process into local blind spots.Source: §3.1 · p. 3
- The guidance scale varies with time according to the relative magnitudes of Gaussian noise and the bounded adversarial perturbation; experiments use mean square error as the distance metric.The authors state that stronger guidance is appropriate as Gaussian noise increasingly dominates the perturbation.Source: §3.1 · p. 4
3.2 Certifying ℓ2 Robustness
- The certification analysis covers the unguided model; certifying the proposed guided diffusion model is left for future work.Source: §3.2 · p. 4
- For fixed r and ε, increasing diffusion length T and purification runs M decreases escape probability δ when δ > 0; the analysis also states that KL divergence strictly decreases as T and M increase.The theorem gives an ℓ2 robustness guarantee for perturbations smaller than radius R.Source: §3.2 · p. 5
- For certification, the paper treats forward diffusion as Gaussian noise addition and the reverse process plus classifier as randomized post-processing, extending randomized-smoothing guarantees to unguided purification.The overall randomized algorithm is decomposed as A = G ◦ R ◦ Q.Source: §3.2 · pp. 4–5
- Empirical studies report better certified results for diffusion purification than randomized smoothing; Table 2 evaluates approximate certified CIFAR-10 accuracy on 10% of test examples.The table compares settings of σ across ℓ2 radii.Source: §3.2 · p. 6, Table 2 · p. 6
4 Experiments
The experiments report robust accuracy for the guided diffusion method and improved certified accuracy over randomized smoothing. Ablations examine random-noise initialization, generation randomness, and time respacing.
4 Experiments
- Experiments use official diffusion-model code and a separately implemented guidance mechanism, with toy evaluations limited to ResNet-50 and PGD attacks.The authors attribute the limited experiments to time constraints.Source: §4 · p. 6
4.1 Evaluation Results
- 89.62% robust accuracy against PGD-ℓ∞ (ϵ = 8/255) with ResNet-50.The result is reported as very close to results in.Source: §4.1 · p. 6
- About 5% higher certified accuracy for r ≥ 0.5 than randomized smoothing.Approximate certified test accuracy counts correctly classified examples whose certified radius R exceeds r; the experiments use T = 2000.Source: §4.1 · p. 6
4.2 Ablation Studies
- Guidance from random noise produces better results than generating from the adversarial image itself.The ablations use the first 1,000 of 5,000 diffusion steps and PGD-ℓ2 with radius 8/255; the authors caution results may differ under PGD-ℓ∞.Source: §4.2 · pp. 6–7, Table 3 · p. 7
- Robust accuracy drops as η decreases, with η = 0 deterministic and η = 1 matching DDPMs.η controls generation randomness.Source: §4.2 · p. 7, Table 4 · p. 7
- Respace steps of 50 are considered optimal for balancing generation speed and accuracy.The diffusion model needs enough steps to generate a sensible image, while too many take too much time.Source: §4.2 · p. 7, Table 5 · p. 7
5 Conclusion
The paper proposes guided diffusion purification from random noise and generalizes unguided diffusion purification to certified robustness. It reports higher certified test accuracy than randomized smoothing, while noting speed and certification challenges.
5 Conclusion
- Guided generation from random noise using adversarial inputs as guidance is proposed as a purification approach.The authors argue this yields better purification effects than approaches that start from diffused adversarial inputs.Source: §5 · p. 7
- Unguided diffusion purification is generalized to certified learning and achieves higher certified test accuracy than randomized smoothing.The authors relate this to diffusion models being more noise-tolerant and more likely to obtain a larger certified radius.Source: §5 · p. 7
- Purification takes about 0.92 s for a 32 × 32 CIFAR-10 image at 50 reverse steps, and higher resolution or longer diffusion length makes inference unbearably slow.The paper also says extra guidance information makes a tight certified-radius bound more difficult to present.Source: §5 · p. 7
A: Proofs of Theorem 1
The proof models forward diffusion of clean and adversarial inputs as Gaussian distributions with a shared covariance and shifted means. It bounds the probability of a bad event, then applies post-processing to establish the stated robustness guarantee.
A: Proofs of Theorem 1
- The bad-event bound yields an (ϵ, δ)-robustness guarantee for the randomized algorithm under ℓ2 radius r.The theorem gives δ = Φ(r√ᾱ_T / √(2(1−ᾱ_T)) − ϵ√ᾱ_T / r).Source: A: Proofs of Theorem 1 · p. 10
- The forward-diffused clean and adversarial inputs are Gaussian with shared covariance and means separated by the scaled perturbation.Their covariance is (1−ᾱ_T)I and their means are √ᾱ_T x_0 and √ᾱ_T(x_0 + Δx).Source: A: Proofs of Theorem 1 · p. 10
- Defining bad events by q(x) ≥ e^ϵ p(x), the proof bounds their probability using the ℓ2 perturbation constraint.The bound uses ∥Δx∥_2 < r and the Gaussian distributions produced by forward diffusion.Source: A: Proofs of Theorem 1 · p. 10
- Post-processing extends the forward-process probability inequality to any event for the randomized algorithm.The proof then chooses the event that the algorithm's output differs from the label.Source: A: Proofs of Theorem 1 · p. 10
B: Proofs of Theorem 2
The proof argues that forward diffusion does not increase the escape probability, while post-processing preserves the robustness guarantee. Thus, for fixed radius r and ϵ, increasing diffusion length T and purification iterations M strictly decreases δ when δ is positive.
B: Proofs of Theorem 2
- For fixed radius r and ϵ, increasing T and M strictly decreases escape probability δ when δ > 0.The theorem states this decrease provides a stronger robustness guarantee.Source: B: Proofs of Theorem 2 · p. 10
- The proof reduces the argument to showing that each forward-process step improves robustness, since reverse-process post-processing cannot reduce it.The resulting probability bound is nonincreasing at each step, with equality possible only when the bad-event set has zero probability.Source: B: Proofs of Theorem 2 · pp. 10–11
- The forward step convolves the clean and adversarial distributions with Gaussian noise, yielding the stepwise robustness comparison.The proof names the densities before and after the step and invokes the convolution theorem.Source: B: Proofs of Theorem 2 · p. 10
C: Proofs of Theorem 3
The theorem states that the KL divergence between the algorithm's clean-input and adversarial-input output distributions strictly decreases as diffusion length T and purification runs M increase. The proof invokes a continuous diffusion formulation and relates KL change to Fisher divergence.
C: Proofs of Theorem 3
- The diffusion lemma relates decreasing KL divergence to Fisher divergence, which is zero exactly when the two distributions agree.The stated KL term strictly decreases as T and M increase.Source: C: Proofs of Theorem 3 · p. 11
- The KL divergence between the output distributions for clean and adversarial inputs strictly decreases as T and M increase.The theorem identifies p and q as the output densities of A(x_0) and A(x′_0).Source: C: Proofs of Theorem 3 · p. 11
- For sufficiently large T, the proof approximates the forward and reverse processes as continuous processes.It introduces continuous-process descriptions for both directions of diffusion.Source: C: Proofs of Theorem 3 · p. 11