Data to 7 Oct 2026

Adversarial purification with Score-based generative models

arXiv 2106.06041 ↗First posted 11 Jun 2021cs.LG cs.CRcited by 132

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

While adversarial training is considered as a standard defense method against adversarial attacks for image classifiers, adversarial purification, which purifies attacked images into clean images with a standalone purification model, has shown promises as an alternative defense method. Recently, an Energy-Based Model (EBM) trained with Markov-Chain Monte-Carlo (MCMC) has been highlighted as a purification model, where an attacked image is purified by running a long Markov-chain using the gradients of the EBM. Yet, the practicality of the adversarial purification using an EBM remains questionable because the number of MCMC steps required for such purification is too large. In this paper, we propose a novel adversarial purification method based on an EBM trained with Denoising Score-Matching (DSM). We show that an EBM trained with DSM can quickly purify attacked images within a few steps. We further introduce a simple yet effective randomized purification scheme that injects random noises into images before purification. This process screens the adversarial perturbations imposed on images by the random noises and brings the images to the regime where the EBM can denoise well. We show that our purification method is robust against various attacks and demonstrate its state-of-the-art performances.

Key facts. Cited by 132 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 34 of its 50 references that are in the map. First posted on arXiv 11 Jun 2021.

Builds on

34 of 50 references.

References · 34

2014Explaining and Harnessing Adversarial Examplescited by 7,287
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2013Intriguing properties of neural networkscited by 5,114
2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
2016Wide Residual Networkscited by 3,057
2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
2016Adversarial Machine Learning at Scalecited by 934
2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 897

22 more

2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
2020On Adaptive Attacks to Adversarial Example Defensescited by 547
2017Countering Adversarial Images using Input Transformationscited by 517
2016RefineNet: Multi-Path Refinement Networks for High-Resolution Semantic Segmentationcited by 463
2019Unlabeled Data Improves Adversarial Robustnesscited by 415
2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
2019Learning Non-Convergent Non-Persistent Short-Run MCMC Toward Energy-Based Modelcited by 147
2018Towards the first adversarially robust neural network model on MNISTcited by 104
2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
2021Online Adversarial Purification based on Self-Supervisioncited by 45
2020Randomization matters. How to defend against strong adversarial attackscited by 37
2020Towards Understanding Fast Adversarial Trainingcited by 32
2018Resisting Adversarial Attacks using Gaussian Mixture Variational Autoencoderscited by 26
2020Robust Image Classification Using A Low-Pass Activation Function and DCT Augmentationcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 4; 2022: 16; 2023: 44; 2024: 29; 2025: 26; 2026: 13.

132 papers.

Sort:

By area:

2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,107
2022Diffusion Models for Adversarial Purificationcited by 469
2023A Comprehensive Survey on Test-Time Adaptation under Distribution Shiftscited by 353
2023The Stable Signature: Rooting Watermarks in Latent Diffusion Modelscited by 289
2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
2022GENIE: Higher-Order Denoising Diffusion Solverscited by 127
2022Guided Diffusion Model for Adversarial Purificationcited by 90
2023TrojDiff: Trojan Attacks on Diffusion Models with Diverse Targetscited by 88
2023On the Generalization Properties of Diffusion Modelscited by 67
2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65

38 more

2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
2021Score-Based Generative Classifierscited by 53
2023Adversarial Prompt Tuning for Vision-Language Modelscited by 42
2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 37
2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
2022Guided Diffusion Model for Adversarial Purification from Random Noisecited by 34
2022Visual Prompting for Adversarial Robustnesscited by 33
2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
2024Evaluating the design space of diffusion-based generative modelscited by 25
2022Threat Model-Agnostic Adversarial Defense using Diffusion Modelscited by 24
2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
2025CLIP is Strong Enough to Fight Back: Test-time Counterattacks towards Zero-shot Adversarial Robustness of CLIPcited by 23
2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 22
2023Defending against Adversarial Audio via Diffusion Modelcited by 20
2023Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Scorecited by 20
2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
2022Improving Robustness against Real-World and Worst-Case Distribution Shifts through Decision Region Quantificationcited by 16
2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
2022Text Adversarial Purification as Defense against Adversarial Attackscited by 15
2023The Best Defense is a Good Offense: Adversarial Augmentation against Adversarial Attackscited by 15
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
2025AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defensescited by 14
2025Enhancing CLIP Robustness via Cross-Modality Alignmentcited by 14
2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomnesscited by 13
2024Efficient Availability Attacks against Supervised and Contrastive Learning Simultaneouslycited by 12
2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 12
2023DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Modelscited by 9
2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
2022Adversarial Purification with the Manifold Hypothesiscited by 8
2024Adversarial Text Purification: A Large Language Model Approach for Defensecited by 8
2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspectivecited by 8
2022Unsupervised Visual Defect Detection with Score-Based Generative Modelcited by 7

50 most cited of 132 All 132 (JSON)

Similar, not cited

Close in wording, no citation either way