mlsanityData to 14 Oct 2026

Guided Diffusion Model for Adversarial Purification

arXiv 2205.14969 ↗First posted 30 May 2022cs.CV cs.AIcited by 92

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

With wider application of deep neural networks (DNNs) in various algorithms and frameworks, security threats have become one of the concerns. Adversarial attacks disturb DNN-based image classifiers, in which attackers can intentionally add imperceptible adversarial perturbations on input images to fool the classifiers. In this paper, we propose a novel purification approach, referred to as guided diffusion model for purification (GDMP), to help protect classifiers from adversarial attacks. The core of our approach is to embed purification into the diffusion denoising process of a Denoised Diffusion Probabilistic Model (DDPM), so that its diffusion process could submerge the adversarial perturbations with gradually added Gaussian noises, and both of these noises can be simultaneously removed following a guided denoising process. On our comprehensive experiments across various datasets, the proposed GDMP is shown to reduce the perturbations raised by adversarial attacks to a shallow range, thereby significantly improving the correctness of classification. GDMP improves the robust accuracy by 5%, obtaining 90.1% under PGD attack on the CIFAR10 dataset. Moreover, GDMP achieves 70.94% robustness on the challenging ImageNet dataset.

Key facts. Cited by 92 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 30 of its 39 references that are in the map. First posted on arXiv 30 May 2022.

Builds on

30 of 39 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  5. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2014Going Deeper with Convolutionscited by 4,241
  8. 2013Auto-Encoding Variational Bayescited by 4,053
  9. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  10. 2016Wide Residual Networkscited by 3,070
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  12. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
17 more
  1. 2017Countering Adversarial Images using Input Transformationscited by 520
  2. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  3. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 405
  4. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  5. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  6. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 278
  7. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  8. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  9. 2021Are Transformers More Robust Than CNNs?cited by 187
  10. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  11. 2019Adversarial Robustness through Local Linearizationcited by 146
  12. 2018Towards the first adversarially robust neural network model on MNISTcited by 104
  13. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  14. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  15. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  16. 2021Online Adversarial Purification based on Self-Supervisioncited by 46
  17. 2018Resisting Adversarial Attacks using Gaussian Mixture Variational Autoencoderscited by 26

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2022: 5; 2023: 29; 2024: 26; 2025: 20; 2026: 12.

92 papers.

Sort:

By area:

  1. 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,114
  2. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  3. 2023Generative Diffusion Prior for Unified Image Restoration and Enhancementcited by 199
  4. 2023Robust Classification via a Single Diffusion Modelcited by 79
  5. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 76
  6. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  7. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  8. 2022DiffusionInst: Diffusion Model for Instance Segmentationcited by 49
  9. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 38
  10. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
  11. 2022Guided Diffusion Model for Adversarial Purification from Random Noisecited by 35
  12. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
38 more
  1. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  2. 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
  3. 2023Binary Latent Diffusioncited by 18
  4. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
  5. 2023Unlearnable Examples Give a False Sense of Security: Piercing through Unexploitable Data with Learnable Examplescited by 17
  6. 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
  7. 2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
  8. 2023Accelerating Guided Diffusion Sampling with Splitting Numerical Methodscited by 13
  9. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomnesscited by 13
  10. 2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 13
  11. 2023Semantic Adversarial Attacks via Diffusion Modelscited by 12
  12. 2023Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Modelscited by 12
  13. 2024Trustworthy Federated Learning: Privacy, Security, and Beyondcited by 11
  14. 2022Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusioncited by 8
  15. 2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
  16. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspectivecited by 8
  17. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 8
  18. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purificationcited by 7
  19. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  20. 2022Game Theoretic Mixed Experts for Combinational Adversarial Machine Learningcited by 6
  21. 2023Diffusion models meet image counter-forensicscited by 6
  22. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  23. 2024A Financial Time Series Denoiser Based on Diffusion Modelcited by 6
  24. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  25. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  26. 2024Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Informationcited by 5
  27. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  28. 20233DifFusionDet: Diffusion Model for 3D Object Detection with Robust LiDAR-Camera Fusioncited by 4
  29. 2023Adversarial Estimation of Topological Dimension with Harmonic Score Mapscited by 4
  30. 2024Light-weight Fine-tuning Method for Defending Adversarial Noise in Pre-trained Medical Vision-Language Modelscited by 4
  31. 2024CausalDiff: Causality-Inspired Disentanglement via Diffusion Model for Adversarial Defensecited by 4
  32. 2023DiffWA: Diffusion Models for Watermark Attackcited by 3
  33. 2023Diffusion Sampling with Momentum for Mitigating Divergence Artifactscited by 3
  34. 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
  35. 2025Towards Robust Defense against Customization via Protective Perturbation Resistant to Diffusion-based Purificationcited by 3
  36. 2023DiffDefense: Defending against Adversarial Attacks via Diffusion Modelscited by 2
  37. 2023Asymmetric Diffusion Based Channel-Adaptive Secure Wireless Semantic Communicationscited by 2
  38. 2024CosalPure: Learning Concept from Group Images for Robust Co-Saliency Detectioncited by 2

50 most cited of 92 All 92 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2022Diffusion Models for Adversarial Purification
  2. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
  3. 2023Language Guided Adversarial Purification
  4. 2023Denoising Diffusion Probabilistic Models as a Defense against Adversarial Attacks
  5. 2025Towards more transferable adversarial attack in black-box manner
  6. 2024Adv-KD: Adversarial Knowledge Distillation for Faster Diffusion Sampling
  7. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  8. 2025VideoPure: Diffusion-based Adversarial Purification for Video Recognition