# PuVAE: A Variational Autoencoder to Purify Adversarial Examples

arXiv: https://arxiv.org/abs/1903.00585 · HTML: https://mlsanity.com/paper/1903.00585/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Mar 2019.

## Built on by (most cited first, 28 of 28)

- [Online Adversarial Purification based on Self-Supervision](https://mlsanity.com/paper/2101.09387/) (2021)
- [Reveal of Vision Transformers Robustness against Adversarial Attacks](https://mlsanity.com/paper/2106.03734/) (2021)
- [Fusion of Federated Learning and Industrial Internet of Things: A Survey](https://mlsanity.com/paper/2101.00798/) (2021)
- [Enhancing Adversarial Robustness via Score-Based Optimization](https://mlsanity.com/paper/2307.04333/) (2023)
- [MirrorCheck: Efficient Adversarial Defense for Vision-Language Models](https://mlsanity.com/paper/2406.09250/) (2024)
- [Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization](https://mlsanity.com/paper/2401.16352/) (2024)
- [Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness](https://mlsanity.com/paper/2310.18762/) (2023)
- [Impact of Spatial Frequency Based Constraints on Adversarial Robustness](https://mlsanity.com/paper/2104.12679/) (2021)
- [Adversarial Purification with the Manifold Hypothesis](https://mlsanity.com/paper/2210.14404/) (2022)
- [Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM](https://mlsanity.com/paper/2403.11448/) (2024)
- [Exploring Adversarial Attacks on Neural Networks: An Explainable Approach](https://mlsanity.com/paper/2303.06032/) (2023)
- [Frequency Centric Defense Mechanisms against Adversarial Examples](https://mlsanity.com/paper/2110.13935/) (2021)
- [An integrated Auto Encoder-Block Switching defense approach to prevent adversarial attacks](https://mlsanity.com/paper/2203.10930/) (2022)
- [NoiseCAM: Explainable AI for the Boundary Between Noise and Adversarial Attacks](https://mlsanity.com/paper/2303.06151/) (2023)
- [Adversarial Purification for Data-Driven Power System Event Classifiers with Diffusion Models](https://mlsanity.com/paper/2311.07110/) (2023)
- [Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustness](https://mlsanity.com/paper/2405.16036/) (2024)
- [Chaotic Variational Auto encoder-based Adversarial Machine Learning](https://mlsanity.com/paper/2302.12959/) (2023)
- [Defense Against Adversarial Attacks using Convolutional Auto-Encoders](https://mlsanity.com/paper/2312.03520/) (2023)
- [Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attacks](https://mlsanity.com/paper/2412.03453/) (2024)
- [ARMOR: Robust Reinforcement Learning-based Control for UAVs under Physical Attacks](https://mlsanity.com/paper/2506.22423/) (2025)
- [Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense](https://mlsanity.com/paper/2507.03427/) (2025)
- [Detecting Adversaries, yet Faltering to Noise? Leveraging Conditional Variational AutoEncoders for Adversary Detection in the Presence of Noisy Images](https://mlsanity.com/paper/2111.15518/) (2021)
- [Btech thesis report on adversarial attack detection and purification of adverserially attacked images](https://mlsanity.com/paper/2205.07859/) (2022)
- [Blending adversarial training and representation-conditional purification via aggregation improves adversarial robustness](https://mlsanity.com/paper/2306.06081/) (2023)
- [Adversarial Examples: Generation Proposal in the Context of Facial Recognition Systems](https://mlsanity.com/paper/2404.17760/) (2024)
- [VERITAS: Verification and Explanation of Realness in Images for Transparency in AI Systems](https://mlsanity.com/paper/2507.05146/) (2025)
- [TopoReformer: Mitigating Adversarial Attacks Using Topological Purification in OCR Models](https://mlsanity.com/paper/2511.15807/) (2025)
- [Defending Quantum Classifiers against Adversarial Perturbations through Quantum Autoencoders](https://mlsanity.com/paper/2604.28176/) (2026)

## Abstract (arXiv)

Deep neural networks are widely used and exhibit excellent performance in many areas. However, they are vulnerable to adversarial attacks that compromise the network at the inference time by applying elaborately designed perturbation to input data. Although several defense methods have been proposed to address specific attacks, other attack methods can circumvent these defense mechanisms. Therefore, we propose Purifying Variational Autoencoder (PuVAE), a method to purify adversarial examples. The proposed method eliminates an adversarial perturbation by projecting an adversarial example on the manifold of each class, and determines the closest projection as a purified sample. We experimentally illustrate the robustness of PuVAE against various attack methods without any prior knowledge. In our experiments, the proposed method exhibits performances competitive with state-of-the-art defense methods, and the inference time is approximately 130 times faster than that of Defense-GAN that is the state-of-the art purifier model.