mlsanityData to 7 Oct 2026

Defending against Adversarial Audio via Diffusion Model

arXiv 2303.01507 ↗First posted 2 Mar 2023cs.SD cs.CR cs.LGcited by 20

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Deep learning models have been widely used in commercial acoustic systems in recent years. However, adversarial audio examples can cause abnormal behaviors for those acoustic systems, while being hard for humans to perceive. Various methods, such as transformation-based defenses and adversarial training, have been proposed to protect acoustic systems from adversarial attacks, but they are less effective against adaptive attacks. Furthermore, directly applying the methods from the image domain can lead to suboptimal results because of the unique properties of audio data. In this paper, we propose an adversarial purification-based defense pipeline, AudioPure, for acoustic systems via off-the-shelf diffusion models. Taking advantage of the strong generation ability of diffusion models, AudioPure first adds a small amount of noise to the adversarial audio and then runs the reverse sampling step to purify the noisy audio and recover clean audio. AudioPure is a plug-and-play method that can be directly applied to any pretrained classifier without any fine-tuning or re-training. We conduct extensive experiments on speech command recognition task to evaluate the robustness of AudioPure. Our method is effective against diverse adversarial attacks (e.g. L2 or L_∞-norm). It outperforms the existing methods under both strong adaptive white-box and black-box attacks bounded by L2 or L_∞-norm (up to +20% in robust accuracy). Besides, we also evaluate the certified robustness for perturbations bounded by L2-norm via randomized smoothing. Our pipeline achieves a higher certified accuracy than baselines.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 65 of its 77 references that are in the map. First posted on arXiv 2 Mar 2023.

Builds on

65 of 77 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  2. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  3. 2022Diffusion Models for Adversarial Purification16 May
  4. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 61

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2020Denoising Diffusion Implicit Modelscited by 9,655
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  8. 2016Densely Connected Convolutional Networkscited by 6,691
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  12. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
38 more
  1. 2016Wide Residual Networkscited by 3,057
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  6. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2018Speech Commands: A Dataset for Limited-Vocabulary Speech Recognitioncited by 741
  9. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  11. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  12. 2019Adversarial Training for Free!cited by 638
  13. 2020WaveGrad: Estimating Gradients for Waveform Generationcited by 620
  14. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  15. 2015Deep Speech 2: End-to-End Speech Recognition in English and Mandarincited by 449
  16. 2018Conv-TasNet: Surpassing Ideal Time-Frequency Magnitude Masking for Speech Separationcited by 400
  17. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  18. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  19. 2020Scalable Gradients for Stochastic Differential Equationscited by 264
  20. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  21. 2018Adversarial Audio Synthesiscited by 222
  22. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  23. 2018Spatially Transformed Adversarial Examplescited by 195
  24. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  25. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  26. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  27. 2021On Fast Sampling of Diffusion Probabilistic Modelscited by 170
  28. 2018Speaker Recognition from Raw Waveform with SincNetcited by 166
  29. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  30. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  31. 2019Robust Learning with Jacobian Regularizationcited by 127
  32. 2019Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognitioncited by 123
  33. 2019Lingvo: a Modular and Scalable Framework for Sequence-to-Sequence Modelingcited by 86
  34. 2016Very Deep Convolutional Neural Networks for Raw Waveformscited by 68
  35. 2019Who is Real Bob? Adversarial Attacks on Speaker Recognition Systemscited by 66
  36. 2019Adversarial Objects Against LiDAR-Based Autonomous Driving Systemscited by 62
  37. 2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 48
  38. 2021Online Adversarial Purification based on Self-Supervisioncited by 45

50 most cited of 61 All 61 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 5; 2025: 5; 2026: 5.

20 papers.

Sort:

By area:

  1. 2024I Can Hear You: Selective Robust Training for Deepfake Audio Detectioncited by 12
  2. 2023MASTERKEY: Practical Backdoor Attack Against Speaker Verification Systemscited by 8
  3. 2023Diffusion models meet image counter-forensicscited by 6
  4. 2024SongBsAb: A Dual Prevention Approach against Singing Voice Conversion based Illegal Song Coverscited by 5
  5. 2025SafeSpeech: Robust and Universal Voice Protection Against Malicious Speech Synthesiscited by 5
  6. 2024Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Imagescited by 4
  7. 2023DistriBlock: Identifying adversarial audio samples by leveraging characteristics of the output distributioncited by 3
  8. 2024Consistency Purification: Effective and Efficient Diffusion Purification towards Certified Robustnesscited by 2
  9. 2024Detecting and Defending Against Adversarial Attacks on Automatic Speech Recognition via Diffusion Modelscited by 2
  10. 2025De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attackscited by 2
  11. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometrycited by 1
  12. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Modelscited by 1
8 more
  1. 2023Adversarial defense based on distribution transfercited by 0
  2. 2023Diffusion-C: Unveiling the Generative Challenges of Diffusion Models through Corrupted Datacited by 0
  3. 2025Are Deep Speech Denoising Models Robust to Adversarial Noise?cited by 0
  4. 2026VocalBridge: Latent Diffusion-Bridge Purification for Defeating Perturbation-Based Voiceprint Defensescited by 0
  5. 2026Precision-Varying Prediction (PVP): Robustifying ASR systems against adversarial attackscited by 0
  6. 2026Beyond Waveform Robustness: Robust Feature-Vocoder Adversarial Attacks on Automatic Speech Recognitioncited by 0
  7. 2026Psychoacoustically Aligned Latent Smoothing for Adversarial Robustness of Full-Duplex Speech-to-Speech Dialogue Modelscited by 0
  8. 2026LogiC-Diff: Embedding Security Properties Into AI-Enabled Cyber-Physical Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Diffusion-Based Adversarial Purification for Speaker Verification
  2. 2025Defending Against Frequency-Based Attacks with Diffusion Models
  3. 2024Diffusion Models for Audio Restoration
  4. 2025MDD: a Mask Diffusion Detector to Protect Speaker Verification Systems from Adversarial Perturbations ↗
  5. 2024Adversarial Attacks and Robust Defenses in Speaker Embedding based Zero-Shot Text-to-Speech System
  6. 2026NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification
  7. 2025When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs
  8. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification