mlsanityData to 7 Oct 2026

Enhancing Adversarial Robustness via Score-Based Optimization

arXiv 2307.04333 ↗First posted 10 Jul 2023cs.LG cs.AI cs.CRcited by 19

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce a novel adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. We conduct comprehensive experiments on multiple datasets, including CIFAR10, CIFAR100 and ImageNet. Our experimental results demonstrate that our approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 64 of its 72 references that are in the map. First posted on arXiv 10 Jul 2023.

Builds on

64 of 72 references.

Closest ancestors · 8

Same direction, newest first

  1. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  2. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  3. 2022Threat Model-Agnostic Adversarial Defense using Diffusion Models17 Jul
  4. 2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
  5. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  6. 2022Guided Diffusion Model for Adversarial Purification30 May
  7. 2022Diffusion Models for Adversarial Purification16 May
  8. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 56

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2020Denoising Diffusion Implicit Modelscited by 9,655
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  11. 2014Going Deeper with Convolutionscited by 4,231
  12. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
38 more
  1. 2016Wide Residual Networkscited by 3,057
  2. 2022DreamFusion: Text-to-3D using 2D Diffusioncited by 3,006
  3. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  4. 2013Rich feature hierarchies for accurate object detection and semantic segmentationcited by 2,160
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  8. 2022Magic3D: High-Resolution Text-to-3D Content Creationcited by 1,285
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2016Adversarial Machine Learning at Scalecited by 934
  11. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  12. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  13. 2022Equivariant Diffusion for Molecule Generation in 3Dcited by 666
  14. 2021Score-based Generative Modeling in Latent Spacecited by 634
  15. 2022Score Jacobian Chaining: Lifting Pretrained 2D Diffusion Models for 3D Generationcited by 597
  16. 2022Latent-NeRF for Shape-Guided Generation of 3D Shapes and Texturescited by 506
  17. 2020Overfitting in adversarially robust deep learningcited by 504
  18. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  19. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
  20. 2019Sliced Score Matching: A Scalable Approach to Density and Score Estimationcited by 381
  21. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  22. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  23. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  24. 2021Improving Robustness using Generated Datacited by 233
  25. 2022Diffusion models as plug-and-play priorscited by 230
  26. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  27. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  28. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  29. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  30. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  31. 2018Towards the first adversarially robust neural network model on MNISTcited by 104
  32. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  33. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  34. 2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
  35. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  36. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  37. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  38. 2020Efficient Learning of Generative Models via Finite-Difference Score Matchingcited by 49

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 9; 2025: 7; 2026: 2.

19 papers.

Sort:

By area:

  1. 2024One-Step Diffusion Distillation through Score Implicit Matchingcited by 68
  2. 2023Enhancing Deep Reinforcement Learning: A Tutorial on Generative Diffusion Models in Network Optimizationcited by 56
  3. 2024Diff-Instruct++: Training One-step Text-to-image Generator Model to Align with Human Preferencescited by 30
  4. 2024Schedule On the Fly: Diffusion Time Prediction for Faster and Better Image Generationcited by 29
  5. 2024Flow Generator Matchingcited by 26
  6. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  7. 2024Self-Guidance: Boosting Flow and Diffusion Generation on Their Owncited by 22
  8. 2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 12
  9. 2024Variational Schr"odinger Diffusion Modelscited by 9
  10. 2024David and Goliath: Small One-step Model Beats Large Diffusion with Score Post-trainingcited by 8
  11. 2025VideoPure: Diffusion-based Adversarial Purification for Video Recognitioncited by 5
  12. 2025Improved Diffusion-based Generative Model with Better Adversarial Robustnesscited by 3
7 more
  1. 2025FlowPure: Continuous Normalizing Flows for Adversarial Purificationcited by 2
  2. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  3. 2025Dive3D: Diverse Distillation-based Text-to-3D Generation via Score Implicit Matchingcited by 1
  4. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
  5. 2025Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifiercited by 0
  6. 2026TARO: Temporal Adversarial Rectification Optimization Using Diffusion Models as Purifierscited by 0
  7. 2026Unbiased Diffusion Variational Inversion via Principled Posterior Matchingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
  2. 2023Assessing Robustness via Score-Based Adversarial Image Generation
  3. 2023Raising the Bar for Certified Adversarial Robustness with Diffusion Models
  4. 2026A Low-Rank Defense Method for Adversarial Attack on Diffusion Models
  5. 2025Towards more transferable adversarial attack in black-box manner
  6. 2023DiffDefense: Defending against Adversarial Attacks via Diffusion Models
  7. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
  8. 2023Adversarial defense based on distribution transfer