mlsanityData to 13 Oct 2026

DIFFender: Diffusion-Based Adversarial Defense against Patch Attacks

arXiv 2306.09124 ↗First posted 15 Jun 2023cs.CV cs.AI cs.CRcited by 15

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial attacks, particularly patch attacks, pose significant threats to the robustness and reliability of deep learning models. Developing reliable defenses against patch attacks is crucial for real-world applications. This paper introduces DIFFender, a novel defense framework that harnesses the capabilities of a text-guided diffusion model to combat patch attacks. Central to our approach is the discovery of the Adversarial Anomaly Perception (AAP) phenomenon, which empowers the diffusion model to detect and localize adversarial patches through the analysis of distributional discrepancies. DIFFender integrates dual tasks of patch localization and restoration within a single diffusion model framework, utilizing their close interaction to enhance defense efficacy. Moreover, DIFFender utilizes vision-language pre-training coupled with an efficient few-shot prompt-tuning algorithm, which streamlines the adaptation of the pre-trained diffusion model to defense tasks, thus eliminating the need for extensive retraining. Our comprehensive evaluation spans image classification and face recognition tasks, extending to real-world scenarios, where DIFFender shows good robustness against adversarial attacks. The versatility and generalizability of DIFFender are evident across a variety of settings, classifiers, and attack methodologies, marking an advancement in adversarial patch defense strategies.

Key facts. Cited by 15 papers in the map (data through 13 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 42 of its 56 references that are in the map. First posted on arXiv 15 Jun 2023.

Builds on

42 of 56 references.

Closest ancestors · 2

Same direction, newest first

  1. 2022Guided Diffusion Model for Adversarial Purification30 May
  2. 2022Diffusion Models for Adversarial Purification16 May

Other references · 40

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,950
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,043
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,952
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,777
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,082
  6. 2020Denoising Diffusion Implicit Modelscited by 9,718
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,336
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,023
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  10. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,457
  11. 2013Intriguing properties of neural networkscited by 5,137
  12. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,992
28 more
  1. 2021Learning to Prompt for Vision-Language Modelscited by 2,276
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,316
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,265
  4. 2022DiffEdit: Diffusion-based semantic image editing with mask guidancecited by 645
  5. 2017Adversarial Patchcited by 516
  6. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  7. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  8. 2019Understanding Straight-Through Estimator in Training Activation Quantized Neural Netscited by 228
  9. 2016A study of the effect of JPG compression on adversarial imagescited by 197
  10. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 151
  11. 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 124
  12. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  13. 2023Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Drivingcited by 113
  14. 2020Certified Defenses for Adversarial Patchescited by 101
  15. 2022Shadows can be Dangerous: Stealthy and Effective Physical-world Adversarial Attack by Natural Phenomenoncited by 101
  16. 2021Adversarial Sticker: A Stealthy Attack Method in the Physical Worldcited by 93
  17. 2018Local Gradients Smoothing: Defense against localized adversarial attackscited by 86
  18. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  19. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  20. 2019Defending Against Physically Realizable Attacks on Image Classificationcited by 66
  21. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  22. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  23. 2023Understanding the Robustness of 3D Object Detection with Bird's-Eye-View Representations in Autonomous Drivingcited by 37
  24. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  25. 2021Generative Dynamic Patch Attackcited by 19
  26. 2022A Tale of HodgeRank and Spectral Method: Target Attack Against Rank Aggregation Is the Fixed Point of Adversarial Gamecited by 16
  27. 2021Poisoning Attack against Estimating from Pairwise Comparisonscited by 14
  28. 2023Revisiting the Trade-off between Accuracy and Robustness via Weight Distribution of Filterscited by 4

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2023: 1; 2024: 5; 2025: 6; 2026: 3.

15 papers.

Sort:

By area:

  1. 2025A Survey on Diffusion Models for Anomaly Detectioncited by 13
  2. 2023Adversarial Examples in the Physical World: A Surveycited by 10
  3. 2024Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigationcited by 6
  4. 2024Real-world Adversarial Defense against Patch Attacks based on Diffusion Modelcited by 5
  5. 2025Don't Lag, RAG: Training-Free Adversarial Detection Using RAGcited by 5
  6. 2025Can MLLMs Read the Room? A Multimodal Benchmark for Assessing Deception in Multi-Party Social Interactionscited by 5
  7. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  8. 2024DiffPAD: Denoising Diffusion-based Adversarial Patch Decontaminationcited by 2
  9. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2
  10. 2025IAP: Invisible Adversarial Patch Attack through Perceptibility-Aware Localization and Perturbation Optimizationcited by 1
  11. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  12. 2024AS-FIBA: Adaptive Selective Frequency-Injection for Backdoor Attack on Deep Face Restorationcited by 0
3 more
  1. 2026The Unseen Adversaries: Robust and Generalized Defense Against Adversarial Patchescited by 0
  2. 2026Physical Adversarial Examples for Person Detectors in Thermal Images Based on 3D Modelingcited by 0
  3. 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policiescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models
  2. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
  3. 2023DiffDefense: Defending against Adversarial Attacks via Diffusion Models
  4. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  5. 2025Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifier
  6. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Models
  7. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection
  8. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds