Diffusion Models for Adversarial Purification

Abstract

Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.

(Certified!!) Adversarial Robustness for Free!

“…The work of [15] first studied this problem-however they do not obtain significant accuracy improvements, likely due to the fact that diffusion models available at the time that work was done were not good enough. Separately, [18] suggest that diffusion models might be able to provide strong empirical robustness to adversarial examples, as evaluated by robustness under adversarial attacks computed using existing attack algorithms; this is orthogonal to our results.…”

RobArch: Designing Robust Architectures against Adversarial Attacks

“…The robustness continues to scale with model capacity, and RobArch-L achieves the new SOTA AA accuracy on the Robust-Bench leaderboard. It is important to note that ResNet-50+DiffPure [39] designed a novel AT method via using diffusion models [22] for adversarial purification. Although the method improves the AA accuracy by 5.97 percentage points, our architecture modifications show stronger robustness even without finetuning the Standard-AT method.…”

Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples

“…Existing research has explored the adversarial example for different generative models yet no proper frameworks have been formulated. Diffusion models are used to improve the adversarial robustness of classifiers (Nie et al, 2022). Kos (Kos et al, 2018).…”

“…Furthermore, the training objective of diffusion models is optimized indirectly through a variational bound and thus is not applicable in the optimization of the adversarial example. For these reasons, existing research only considers diffusion models as assists to improve the robustness of classifiers (Nie et al, 2022), leaving a blank in the formulation of adversarial examples for diffusion models.…”