mlsanityData to 14 Oct 2026

DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification

arXiv 2311.16124 ↗First posted 27 Oct 2023cs.CR cs.AIcited by 36

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Diffusion-based purification defenses leverage diffusion models to remove crafted perturbations of adversarial examples and achieve state-of-the-art robustness. Recent studies show that even advanced attacks cannot break such defenses effectively, since the purification process induces an extremely deep computational graph which poses the potential problem of gradient obfuscation, high memory cost, and unbounded randomness. In this paper, we propose a unified framework DiffAttack to perform effective and efficient attacks against diffusion-based purification defenses, including both DDPM and score-based approaches. In particular, we propose a deviated-reconstruction loss at intermediate diffusion steps to induce inaccurate density gradient estimation to tackle the problem of vanishing/exploding gradients. We also provide a segment-wise forwarding-backwarding algorithm, which leads to memory-efficient gradient backpropagation. We validate the attack effectiveness of DiffAttack compared with existing adaptive attacks on CIFAR-10 and ImageNet. We show that DiffAttack decreases the robust accuracy of models compared with SOTA attacks by over 20% on CIFAR-10 under ℓ_∞ attack (ε=8/255), and over 10% on ImageNet under ℓ_∞ attack (ε=4/255). We conduct a series of ablations studies, and we find 1) DiffAttack with the deviated-reconstruction loss added over uniformly sampled time steps is more effective than that added over only initial/final steps, and 2) diffusion-based purification with a moderate diffusion length is more robust under DiffAttack.

Key facts. Cited by 36 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 50 of its 61 references that are in the map. First posted on arXiv 27 Oct 2023.

Builds on

50 of 61 references.

Closest ancestors · 6

Same direction, newest first

  1. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  2. 2022Threat Model-Agnostic Adversarial Defense using Diffusion Models17 Jul
  3. 2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
  4. 2022Guided Diffusion Model for Adversarial Purification30 May
  5. 2022Diffusion Models for Adversarial Purification16 May
  6. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  11. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  12. 2013Intriguing properties of neural networkscited by 5,155
32 more
  1. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  2. 2016Wide Residual Networkscited by 3,070
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  4. 2021Image Super-Resolution via Iterative Refinementcited by 1,511
  5. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  6. 2021Palette: Image-to-Image Diffusion Modelscited by 1,300
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  8. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  9. 2016Training Deep Nets with Sublinear Memory Costcited by 848
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  11. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  12. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  13. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
  14. 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 405
  15. 2019Sliced Score Matching: A Scalable Approach to Density and Score Estimationcited by 384
  16. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  17. 2020Scalable Gradients for Stochastic Differential Equationscited by 271
  18. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  19. 2021Improving Robustness using Generated Datacited by 234
  20. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  21. 2017The Reversible Residual Network: Backpropagation Without Storing Activationscited by 217
  22. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  23. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  24. 2023Content-based Unrestricted Adversarial Attackcited by 73
  25. 2017Reversible Architectures for Arbitrarily Deep Residual Neural Networkscited by 70
  26. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  27. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  28. 2018Logit Pairing Methods Can Fool Gradient-Based Attackscited by 27
  29. 2021Indicators of Attack Failure: Debugging and Improving Optimization of Adversarial Examplescited by 23
  30. 2021Automated Discovery of Adaptive Attacks on Adversarial Defensescited by 22
  31. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  32. 2022Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusioncited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 18; 2025: 10; 2026: 7.

36 papers.

Sort:

By area:

  1. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 38
  2. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Surveycited by 32
  3. 2024C-RAG: Certified Generation Risks for Retrieval-Augmented Language Modelscited by 27
  4. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  5. 2025Mirage in the Eyes: Hallucination Attack on Multi-modal Large Language Models with Only Attention Sinkcited by 15
  6. 2024COLEP: Certifiably Robust Learning-Reasoning Conformal Prediction via Probabilistic Circuitscited by 9
  7. 2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
  8. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspectivecited by 8
  9. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purificationcited by 7
  10. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  11. 2026CtrlAttack: A Unified Attack on World-Model Control in Diffusion Modelscited by 7
  12. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
24 more
  1. 2025My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swappingcited by 5
  2. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  3. 2024Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Imagescited by 4
  4. 2025Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generationcited by 3
  5. 2024Large Generative Graph Modelscited by 2
  6. 2024Efficient Image-to-Image Diffusion Classifier for Adversarial Robustnesscited by 2
  7. 2024Combining Machine Learning Defenses without Conflictscited by 2
  8. 2024UVCG: Leveraging Temporal Consistency for Universal Video Protectioncited by 2
  9. 2025FlowPure: Continuous Normalizing Flows for Adversarial Purificationcited by 2
  10. 2025Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognitioncited by 2
  11. 2025De-AntiFake: Rethinking the Protective Perturbations Against Voice Cloning Attackscited by 2
  12. 2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
  13. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  14. 2024Diffusion-based Adversarial Purification for Intrusion Detectioncited by 1
  15. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  16. 2024Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attackscited by 1
  17. 2025VoiceCloak: A Multi-Dimensional Defense Framework against Unauthorized Diffusion-based Voice Cloningcited by 1
  18. 2025SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examplescited by 1
  19. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  20. 2026Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Drivingcited by 0
  21. 2026Memory Efficient Full-gradient Attacks (MEFA) Framework for Adversarial Defense Evaluationscited by 0
  22. 2026TARO: Temporal Adversarial Rectification Optimization Using Diffusion Models as Purifierscited by 0
  23. 2026USAD: Uncertainty-aware Statistical Adversarial Detectioncited by 0
  24. 2026Generative AI and Federated Learning for Intrusion Detection Systems: A Surveycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purification
  2. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness
  3. 2025Towards more transferable adversarial attack in black-box manner
  4. 2025Defending Against Frequency-Based Attacks with Diffusion Models
  5. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
  6. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
  7. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  8. 2024Instant Adversarial Purification with Adversarial Consistency Distillation