mlsanityData to 7 Oct 2026

Better Diffusion Models Further Improve Adversarial Training

arXiv 2302.04638 ↗First posted 9 Feb 2023cs.CV cs.AI cs.CRcited by 207

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

It has been recognized that the data generated by the denoising diffusion probabilistic model (DDPM) improves adversarial training. After two years of rapid development in diffusion models, a question naturally arises: can better diffusion models further improve adversarial training? This paper gives an affirmative answer by employing the most recent diffusion model which has higher efficiency (~ 20 sampling steps) and image quality (lower FID score) compared with DDPM. Our adversarially trained models achieve state-of-the-art performance on RobustBench using only generated data (no external datasets). Under the ℓ_∞-norm threat model with ε=8/255, our models achieve 70.69% and 42.67% robust accuracy on CIFAR-10 and CIFAR-100, respectively, i.e. improving upon previous state-of-the-art models by +4.58% and +8.03%. Under the ℓ2-norm threat model with ε=128/255, our models achieve 84.86% on CIFAR-10 (+4.44%). These results also beat previous works that use external data. We also provide compelling results on the SVHN and TinyImageNet datasets. Our code is available at https://github.com/wzekai99/DM-Improves-AT.

Key facts. Cited by 207 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 89 of its 112 references that are in the map. First posted on arXiv 9 Feb 2023.

Builds on

89 of 112 references.

Closest ancestors · 5

Same direction, newest first

  1. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  2. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  3. 2022Guided Diffusion Model for Adversarial Purification30 May
  4. 2022Diffusion Models for Adversarial Purification16 May
  5. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 84

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2020Denoising Diffusion Implicit Modelscited by 9,655
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  12. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
38 more
  1. 2016Gaussian Error Linear Units (GELUs)cited by 3,431
  2. 2016Wide Residual Networkscited by 3,057
  3. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  4. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  5. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  6. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  7. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  8. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  9. 2016Understanding deep learning requires rethinking generalizationcited by 1,657
  10. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2017Accurate, Large Minibatch SGD: Training ImageNet in 1 Hourcited by 1,479
  13. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  14. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
  15. 2021Variational Diffusion Modelscited by 1,145
  16. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  17. 2019When Does Label Smoothing Help?cited by 985
  18. 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 919
  19. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  20. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  21. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  22. 2019Adversarial Training for Free!cited by 638
  23. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  24. 2020Overfitting in adversarially robust deep learningcited by 504
  25. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  26. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  27. 2022Analytic-DPM: an Analytic Estimate of the Optimal Reverse Variance in Diffusion Probabilistic Modelscited by 331
  28. 2018Why ReLU networks yield high-confidence predictions far away from the training data and how to mitigate the problemcited by 323
  29. 2018Adversarially Robust Generalization Requires More Datacited by 318
  30. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  31. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  32. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  33. 2021Improving Robustness using Generated Datacited by 233
  34. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  35. 2019Improving Adversarial Robustness via Promoting Ensemble Diversitycited by 213
  36. 2020Understanding and Improving Fast Adversarial Trainingcited by 213
  37. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  38. 2020Bag of Tricks for Adversarial Trainingcited by 199

50 most cited of 84 All 84 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 49; 2024: 76; 2025: 57; 2026: 25.

207 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  3. 2023Robust Classification via a Single Diffusion Modelcited by 79
  4. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  5. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  6. 2024One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Modelscited by 48
  7. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  8. 2024Adversarial Robustness Limits via Scaling-Law and Human-Alignment Studiescited by 38
  9. 2023Diffusion Models and Semi-Supervised Learners Benefit Mutually with Few Labelscited by 37
  10. 2024Self-Consuming Generative Models with Curated Data Provably Optimize Human Preferencescited by 35
  11. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
  12. 2024Revisiting Adversarial Training at Scalecited by 33
38 more
  1. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 26
  2. 2023Toward Understanding Generative Data Augmentationcited by 25
  3. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  4. 2024An End-to-End Robust Point Cloud Semantic Segmentation Network with Single-Step Conditional Diffusion Modelscited by 22
  5. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  6. 2024MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsificationcited by 20
  7. 2023The Devil's Advocate: Shattering the Illusion of Unexploitable Data using Diffusion Modelscited by 19
  8. 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
  9. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
  10. 2024MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifierscited by 16
  11. 2023Wasserstein distributional robustness of neural networkscited by 15
  12. 2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
  13. 2024AttackBench: Evaluating Gradient-based Attacks for Adversarial Examplescited by 14
  14. 2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
  15. 2023Adversarial Training Should Be Cast as a Non-Zero-Sum Gamecited by 13
  16. 2024Revisiting Adversarial Training under Long-Tailed Distributionscited by 13
  17. 2023MIMIR: Masked Image Modeling for Mutual Information-based Adversarial Robustnesscited by 12
  18. 2024Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspectivecited by 12
  19. 2024Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Datacited by 12
  20. 2024DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domaincited by 12
  21. 2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 12
  22. 2023Mitigating Adversarial Vulnerability through Causal Parameter Estimation by Adversarial Double Machine Learningcited by 11
  23. 2025Enhancing Robust Fairness via Confusional Spectral Regularizationcited by 11
  24. 2024Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifierscited by 10
  25. 2023An Extended Study of Human-like Behavior under Adversarial Trainingcited by 9
  26. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  27. 2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
  28. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspectivecited by 8
  29. 2023Raising the Bar for Certified Adversarial Robustness with Diffusion Modelscited by 7
  30. 2023Benchmark Generation Framework with Customizable Distortions for Image Classifier Robustnesscited by 7
  31. 2024Boosting Adversarial Training via Fisher-Rao Norm-based Regularizationcited by 7
  32. 2024PartImageNet++ Dataset: Scaling up Part-based Models for Robust Recognitioncited by 7
  33. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purificationcited by 7
  34. 2023AROID: Improving Adversarial Robustness Through Online Instance-Wise Data Augmentationcited by 6
  35. 2023Assessing Robustness via Score-Based Adversarial Image Generationcited by 6
  36. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  37. 2024Adversarial Training: A Surveycited by 6
  38. 2024Decoupled Data Augmentation for Improving Image Classificationcited by 6

50 most cited of 207 All 207 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry
  2. 2025Diffusion Models are Robust Pretrainers
  3. 2023Denoising Diffusion Probabilistic Models as a Defense against Adversarial Attacks
  4. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  5. 2021Improved Denoising Diffusion Probabilistic Models
  6. 2025ADT: Tuning Diffusion Models with Adversarial Supervision
  7. 2026A Low-Rank Defense Method for Adversarial Attack on Diffusion Models
  8. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey