mlsanityData to 7 Oct 2026

Robust Evaluation of Diffusion-Based Adversarial Purification

arXiv 2303.09051 ↗First posted 16 Mar 2023cs.CV cs.CR cs.LGcited by 65

Not on the map. Why?

Cited by 27 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We question the current evaluation practice on diffusion-based purification methods. Diffusion-based purification methods aim to remove adversarial effects from an input data point at test time. The approach gains increasing attention as an alternative to adversarial training due to the disentangling between training and testing. Well-known white-box attacks are often employed to measure the robustness of the purification. However, it is unknown whether these attacks are the most effective for the diffusion-based purification since the attacks are often tailored for adversarial training. We analyze the current practices and provide a new guideline for measuring the robustness of purification methods against adversarial attacks. Based on our analysis, we further propose a new purification strategy improving robustness compared to the current diffusion-based purification methods.

Key facts. Cited by 65 papers in the map (data through 7 Oct 2026). Builds on 36 of its 42 references that are in the map. First posted on arXiv 16 Mar 2023.

Builds on

36 of 42 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2020Denoising Diffusion Implicit Modelscited by 9,655
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2016Wide Residual Networkscited by 3,057
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
24 more
  1. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  2. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  3. 2022Diffusion Models for Adversarial Purificationcited by 469
  4. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  5. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  6. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  7. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  8. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  9. 2021Improving Robustness using Generated Datacited by 233
  10. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  11. 2021Data Augmentation Can Improve Robustnesscited by 193
  12. 2021Adversarial purification with Score-based generative modelscited by 132
  13. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  14. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  15. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  16. 2022Guided Diffusion Model for Adversarial Purificationcited by 90
  17. 2020Adaptive Checkpoint Adjoint Method for Gradient Estimation in Neural ODEcited by 76
  18. 2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
  19. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 73
  20. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  21. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  22. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  23. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  24. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 11; 2024: 20; 2025: 26; 2026: 8.

65 papers.

Sort:

By area:

  1. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  2. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 59
  3. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 37
  4. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 26
  5. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  6. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  7. 2024Text-Guided Attention is All You Need for Zero-Shot Robustness in Vision-Language Modelscited by 23
  8. 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
  9. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Modelcited by 18
  10. 2023Survey on Adversarial Attack and Defense for Medical Image Analysis: Methods and Challengescited by 16
  11. 2024Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalizationcited by 15
  12. 2025Mirage in the Eyes: Hallucination Attack on Multi-modal Large Language Models with Only Attention Sinkcited by 15
38 more
  1. 2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
  2. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purificationcited by 7
  3. 2024Defending LVLMs Against Vision Attacks through Partial-Perception Supervisioncited by 7
  4. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  5. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 7
  6. 2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7
  7. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 7
  8. 2025StyleGuard: Preventing Text-to-Image-Model-based Style Mimicry Attacks by Style Perturbationscited by 7
  9. 2023Diffusion models meet image counter-forensicscited by 6
  10. 2024Adversarially Robust Out-of-Distribution Detection Using Lyapunov-Stabilized Embeddingscited by 6
  11. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  12. 2023Universal Adversarial Defense in Remote Sensing Based on Pre-trained Denoising Diffusion Modelscited by 5
  13. 2025Enhancing Certified Robustness via Block Reflector Orthogonal Layers and Logit Annealing Losscited by 5
  14. 2025Diffusion models under low-noise regimecited by 5
  15. 2025BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editingcited by 5
  16. 2023Investigating the Adversarial Robustness of Density Estimation Using the Probability Flow ODEcited by 4
  17. 2025LISArD: Learning Image Similarity to Defend Against Gray-box Adversarial Attackscited by 3
  18. 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
  19. 2025World Model Robustness via Surprise Recognitioncited by 3
  20. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2
  21. 2024Efficient Image-to-Image Diffusion Classifier for Adversarial Robustnesscited by 2
  22. 2025Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreakingcited by 2
  23. 2025FlowPure: Continuous Normalizing Flows for Adversarial Purificationcited by 2
  24. 2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
  25. 2025De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attackscited by 2
  26. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  27. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  28. 2024CloudFort: Enhancing Robustness of 3D Point Cloud Classification Against Backdoor Attacks via Spatial Partitioning and Ensemble Predictioncited by 1
  29. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  30. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  31. 2024Random Sampling for Diffusion-based Adversarial Purificationcited by 1
  32. 2025Gradient-Free Adversarial Purification with Diffusion Modelscited by 1
  33. 2025Defending Against Frequency-Based Attacks with Diffusion Modelscited by 1
  34. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometrycited by 1
  35. 2025Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defensecited by 1
  36. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
  37. 2025MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purificationcited by 1
  38. 2026Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstructioncited by 1

50 most cited of 65 All 65 (JSON)