mlsanityData to 7 Oct 2026

Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness

arXiv 2310.18762 ↗First posted 28 Oct 2023cs.LG cs.CRcited by 13

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial attacks can mislead neural network classifiers. The defense against adversarial attacks is important for AI safety. Adversarial purification is a family of approaches that defend adversarial attacks with suitable pre-processing. Diffusion models have been shown to be effective for adversarial purification. Despite their success, many aspects of diffusion purification still remain unexplored. In this paper, we investigate and improve upon three limiting designs of diffusion purification: the use of an improved diffusion model, advanced numerical simulation techniques, and optimal control of randomness. Based on our findings, we propose Purify++, a new diffusion purification algorithm that is now the state-of-the-art purification method against several adversarial attacks. Our work presents a systematic exploration of the limits of diffusion purification methods.

Key facts. Cited by 13 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 64 of its 77 references that are in the map. First posted on arXiv 28 Oct 2023.

Builds on

64 of 77 references.

Closest ancestors · 7

Same direction, newest first

  1. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  2. 2022Threat Model-Agnostic Adversarial Defense using Diffusion Models17 Jul
  3. 2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
  4. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  5. 2022Guided Diffusion Model for Adversarial Purification30 May
  6. 2022Diffusion Models for Adversarial Purification16 May
  7. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 57

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2022Scalable Diffusion Models with Transformerscited by 5,931
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2014Fully Convolutional Networks for Semantic Segmentationcited by 4,845
  10. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  11. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  12. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
38 more
  1. 2016Wide Residual Networkscited by 3,057
  2. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  3. 2013Rich feature hierarchies for accurate object detection and semantic segmentationcited by 2,160
  4. 2022DPM-Solver: A Fast ODE Solver for Diffusion Probabilistic Model Sampling in Around 10 Stepscited by 1,961
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2020DiffWave: A Versatile Diffusion Model for Audio Synthesiscited by 1,339
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2021Variational Diffusion Modelscited by 1,145
  11. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,036
  12. 2016Adversarial Machine Learning at Scalecited by 934
  13. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  14. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  15. 2022Pseudo Numerical Methods for Diffusion Models on Manifoldscited by 695
  16. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  17. 2021Maximum Likelihood Training of Score-Based Diffusion Modelscited by 670
  18. 2022Equivariant Diffusion for Molecule Generation in 3Dcited by 666
  19. 2022Fast Sampling of Diffusion Models with Exponential Integratorcited by 526
  20. 2020Overfitting in adversarially robust deep learningcited by 504
  21. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  22. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
  23. 2019Sliced Score Matching: A Scalable Approach to Density and Score Estimationcited by 381
  24. 2021Knowledge Distillation in Iterative Generative Models for Improved Sampling Speedcited by 344
  25. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  26. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  27. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  28. 2021Improving Robustness using Generated Datacited by 233
  29. 2021Score-Based Generative Modeling with Critically-Damped Langevin Diffusioncited by 230
  30. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  31. 2021Gotta Go Fast When Generating Data with Score-Based Modelscited by 218
  32. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  33. 2022Learning Fast Samplers for Diffusion Models by Differentiating Through Sample Qualitycited by 181
  34. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  35. 2021Learning to Efficiently Sample from Diffusion Probabilistic Modelscited by 129
  36. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  37. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  38. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103

50 most cited of 57 All 57 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 7; 2025: 5; 2026: 1.

13 papers.

Sort:

By area:

  1. 2024One-Step Diffusion Distillation through Score Implicit Matchingcited by 68
  2. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  3. 2024Diff-Instruct++: Training One-step Text-to-image Generator Model to Align with Human Preferencescited by 30
  4. 2024Flow Generator Matchingcited by 26
  5. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  6. 2024David and Goliath: Small One-step Model Beats Large Diffusion with Score Post-trainingcited by 8
  7. 2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7
  8. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  9. 2025Beyond Textual CoT: Interleaved Text-Image Chains with Deep Confidence Reasoning for Image Editingcited by 6
  10. 2024Efficient Image-to-Image Diffusion Classifier for Adversarial Robustnesscited by 2
  11. 2025Dive3D: Diverse Distillation-based Text-to-3D Generation via Score Implicit Matchingcited by 1
  12. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
1 more
  1. 2026VocalBridge: Latent Diffusion-Bridge Purification for Defeating Perturbation-Based Voiceprint Defensescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
  2. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
  3. 2024Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Information
  4. 2026NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification
  5. 2024Diffusion-based Adversarial Purification for Intrusion Detection
  6. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
  7. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry
  8. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification