Pith. sign in

REVIEW 16 cited by

Diffusion Models for Adversarial Purification

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2205.07460 v1 pith:HB56JZHR submitted 2022-05-16 cs.LG cs.CRcs.CV

Weili Nie , Brandon Guo , Yujia Huang , Chaowei Xiao , Arash Vahdat , Anima Anandkumar This is my paper · ORCID
classification cs.LGcs.CRcs.CV
keywords adversarialmethodspurificationdiffusiongenerativemethodprocessdiffpure
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 16 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TRAIL: Transferable Robust Adversarial Images via Latent diffusion

    cs.CV 2025-05 conditional novelty 7.0 of 10

    TRAIL adapts a latent diffusion model to a target image during the attack, then uses the adapted model to generate transferable adversarial images with minimal visual change.

  2. Any-OPD: Heterogeneous On-Policy Distillation for Flow-Matching Models via Representation-Space Bridging

    cs.LG 2026-08 conditional novelty 6.0 of 10

    A distillation method that supervises a student on its own samples using teacher refinements compared in a frozen DINOv2 feature space, reporting preference-metric gains on a FLUX.1-dev to SD3.5-Medium transfer.

  3. Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking

    cs.RO 2026-08 conditional novelty 6.0 of 10

    AGSD patches make OpenVLA fail on all LIBERO suites; SARF fine-tuning cuts that failure rate from 100% to 28.6% average while preserving clean performance and improving real-robot success.

  4. Adversarially Guided Diffusion for LiDAR Range Image Synthesis

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Adversarial guidance during latent DDIM sampling of a LiDAR diffusion model yields unrestricted range-image examples that degrade RangeNet++ and CENet while staying near the real-data manifold.

  5. A unifying Bayesian framework for adversarial robustness

    stat.ML 2025-10 conditional novelty 6.0 of 10

    A Bayesian model of adversarial perturbations yields reactive and proactive defenses, with adversarial training and randomized smoothing as limiting cases.

  6. Encapsulated Composition of Text-to-Image and Text-to-Video Models for High-Quality Video Synthesis

    cs.CV 2025-07 conditional novelty 6.0 of 10

    EVS combines a text-to-image and a text-to-video diffusion model in a single denoising pass, improving frame quality and temporal consistency without retraining.

  7. Diffusion models under low-noise regime

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Diffusion models trained on disjoint data converge at high noise but diverge near the data manifold, and they fail to denoise very small perturbations accurately.

  8. Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generation

    cs.GR 2025-06 conditional novelty 6.0 of 10

    Silencer adds a nearly invisible disturbance to portraits that makes LDM-based talking-head models keep the mouth silent, and it survives several image-purification countermeasures.

  9. SuperPure: Efficient Purification of Localized and Distributed Adversarial Patches via Super-Resolution GAN Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    SuperPure is an iterative GAN-super-resolution masking defense that reports higher robustness than PatchCleanser against localized and distributed adversarial patches at a small fraction of the compute.

  10. VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks

    cs.RO 2026-08 conditional novelty 5.0 of 10

    APFT fine-tuning reduces OpenVLA failure under attention-hijacking patches from 100% to 25.9% in simulation and raises real-world success from 23.0% to 67.4%.

  11. DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Models

    cs.CV 2026-07 reject novelty 5.0 of 10

    DiffAttack uses per-pair LoRA optimization in Stable Diffusion's latent space to generate photorealistic adversarial faces that impersonate a target identity, reporting 84.86% average ASR, though only 62.63% on the he...

  12. Enhancing Adversarial Robustness with Signed Distance Fields for Harmonizing Geometric Invariance and Texture

    cs.CV 2026-02 reject novelty 5.0 of 10

    A classifier trained with SDF-based shape guidance and stochastic appearance debiasing is claimed to reach 81.64% robust accuracy under AutoAttack on ImageNet, but the evaluation protocol inflates the result.

  13. NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations

    cs.CV 2025-10 conditional novelty 5.0 of 10

    By modeling the attack as a known transformation with unknown parameters, NAPPure jointly recovers the clean image and the perturbation through likelihood maximization, beating additive-only purification baselines on ...

  14. Diffusion-based Cumulative Adversarial Purification for Vision Language Models

    cs.CV 2025-06 conditional novelty 5.0 of 10

    DiffCAP purifies adversarial images for vision-language models by injecting cumulative Gaussian noise until embeddings stabilize, then denoising, and outperforms prior defenses on captioning, VQA, and classification b...

  15. Towards Effective and Efficient Adversarial Defense with Diffusion Models for Robust Visual Tracking

    cs.CV 2025-05 conditional novelty 5.0 of 10

    A diffusion-based input purification module with pixel, semantic, and structural losses restores most tracking performance lost to a white-box adversarial attack, tested on three trackers.

  16. First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge

    cs.CV 2025-08 conditional novelty 4.0 of 10

    A competition-winning pipeline removes 95.7% of StegaStamp and TreeRing watermarks on the NeurIPS 2024 benchmark by combining VAE fine-tuning, diffusion purification, and translation tricks.

Pith tools