mlsanityData to 7 Oct 2026

Diffusion Models for Adversarial Purification

arXiv 2205.07460 ↗First posted 16 May 2022cs.LG cs.CR cs.CVcited by 469

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.

Key facts. Cited by 469 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 55 of its 70 references that are in the map. First posted on arXiv 16 May 2022.

Builds on

55 of 70 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
  11. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  12. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
38 more
  1. 2019Analyzing and Improving the Image Quality of StyleGANcited by 3,580
  2. 2016Wide Residual Networkscited by 3,057
  3. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2021Palette: Image-to-Image Diffusion Modelscited by 1,296
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2021Variational Diffusion Modelscited by 1,145
  10. 2020Encoding in Style: a StyleGAN Encoder for Image-to-Image Translationcited by 727
  11. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  12. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  13. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  14. 2020NVAE: A Deep Hierarchical Variational Autoencodercited by 635
  15. 2021Score-based Generative Modeling in Latent Spacecited by 634
  16. 2021ILVR: Conditioning Method for Denoising Diffusion Probabilistic Modelscited by 634
  17. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  18. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
  19. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  20. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  21. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  22. 2020Scalable Gradients for Stochastic Differential Equationscited by 264
  23. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  24. 2021Improving Robustness using Generated Datacited by 233
  25. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  26. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  27. 2018Spatially Transformed Adversarial Examplescited by 195
  28. 2021Are Transformers More Robust Than CNNs?cited by 187
  29. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  30. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  31. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
  32. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  33. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  34. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  35. 2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
  36. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  37. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  38. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 31; 2023: 110; 2024: 133; 2025: 113; 2026: 82.

469 papers.

Sort:

By area:

  1. 2022Imagic: Text-Based Real Image Editing with Diffusion Modelscited by 1,172
  2. 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,107
  3. 2022Diffusion Models in Vision: A Surveycited by 1,008
  4. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 921
  5. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  6. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  7. 2022PhysDiff: Physics-Guided Human Motion Diffusion Modelcited by 365
  8. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  9. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  10. 2022Diffusion models as plug-and-play priorscited by 230
  11. 2023I2SB: Image-to-Image Schr"odinger Bridgecited by 214
  12. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
38 more
  1. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  3. 2022Fast Sampling of Diffusion Models via Operator Learningcited by 173
  4. 2023Fast Training of Diffusion Models with Masked Transformerscited by 172
  5. 2023Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examplescited by 163
  6. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
  7. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  8. 2023Text-to-Image Diffusion Models are Zero-Shot Classifierscited by 140
  9. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  10. 2023Editing Implicit Assumptions in Text-to-Image Diffusion Modelscited by 128
  11. 2022GENIE: Higher-Order Denoising Diffusion Solverscited by 127
  12. 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
  13. 2024Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advancescited by 105
  14. 2023DiffiT: Diffusion Vision Transformers for Image Generationcited by 104
  15. 2023DiffCollage: Parallel Generation of Large Content with Diffusion Modelscited by 100
  16. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  17. 2024WAVES: Benchmarking the Robustness of Image Watermarkscited by 89
  18. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  19. 2023Score-based Diffusion Models in Function Spacecited by 80
  20. 2023Robust Classification via a Single Diffusion Modelcited by 79
  21. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  22. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attackscited by 75
  23. 2023Content-based Unrestricted Adversarial Attackcited by 73
  24. 2024An Overview of Diffusion Models: Applications, Guided Generation, Statistical Rates and Optimizationcited by 72
  25. 2022Back to the Source: Diffusion-Driven Test-Time Adaptationcited by 71
  26. 2023Image Denoising: The Deep Learning Revolution and Beyond -- A Survey Paper --cited by 71
  27. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  28. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  29. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  30. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  31. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  32. 2022DiffusionInst: Diffusion Model for Instance Segmentationcited by 49
  33. 2023Adversarial Counterfactual Visual Explanationscited by 47
  34. 2023Customizing 360-Degree Panoramas through Text-to-Image Diffusion Modelscited by 47
  35. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  36. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  37. 2022JPEG Artifact Correction using Denoising Diffusion Restoration Modelscited by 45
  38. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44

50 most cited of 469 All 469 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
  2. 2022Guided Diffusion Model for Adversarial Purification
  3. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
  4. 2026Universal Adversarial Purification with DDIM Metric Loss for Stable Diffusion
  5. 2025VideoPure: Diffusion-based Adversarial Purification for Video Recognition
  6. 2022Text Adversarial Purification as Defense against Adversarial Attacks
  7. 2023Mist: Towards Improved Adversarial Examples for Diffusion Models
  8. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off