mlsanityData to 7 Oct 2026

MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model

arXiv 2312.04802 ↗First posted 8 Dec 2023cs.CVcited by 18

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to adversarial perturbation, where an imperceptible perturbation is added to the image that can fool the DNNs. Diffusion-based adversarial purification focuses on using the diffusion model to generate a clean image against such adversarial attacks. Unfortunately, the generative process of the diffusion model is also inevitably affected by adversarial perturbation since the diffusion model is also a deep network where its input has adversarial perturbation. In this work, we propose MimicDiffusion, a new diffusion-based adversarial purification technique, that directly approximates the generative process of the diffusion model with the clean image as input. Concretely, we analyze the differences between the guided terms using the clean image and the adversarial sample. After that, we first implement MimicDiffusion based on Manhattan distance. Then, we propose two guidance to purify the adversarial perturbation and approximate the clean diffusion model. Extensive experiments on three image datasets including CIFAR-10, CIFAR-100, and ImageNet with three classifier backbones including WideResNet-70-16, WideResNet-28-10, and ResNet50 demonstrate that MimicDiffusion significantly performs better than the state-of-the-art baselines. On CIFAR-10, CIFAR-100, and ImageNet, it achieves 92.67%, 61.35%, and 61.53% average robust accuracy, which are 18.49%, 13.23%, and 17.64% higher, respectively. The code is available in the supplementary material.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 39 of its 43 references that are in the map. First posted on arXiv 8 Dec 2023.

Builds on

39 of 43 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  2. 2022Guided Diffusion Model for Adversarial Purification30 May
  3. 2022Diffusion Models for Adversarial Purification16 May
  4. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 35

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2016Wide Residual Networkscited by 3,057
  7. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2022Diffusion Posterior Sampling for General Noisy Inverse Problemscited by 1,375
  11. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  12. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
23 more
  1. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  2. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  3. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 315
  4. 2023FreeDoM: Training-Free Energy-Guided Conditional Diffusion Modelcited by 290
  5. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  6. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  7. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  8. 2021Improving Robustness using Generated Datacited by 233
  9. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  10. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  11. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  12. 2023Diffuse, Attend, and Segment: Unsupervised Zero-Shot Segmentation using Stable Diffusioncited by 131
  13. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  14. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  15. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  16. 2021Stable Neural ODE with Lyapunov-Stable Equilibrium Points for Defending Against Adversarial Attackscited by 91
  17. 2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
  18. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  19. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  20. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  21. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  22. 2021Online Adversarial Purification based on Self-Supervisioncited by 45
  23. 2021ℓ_∞-Robustness and Beyond: Unleashing Efficient Adversarial Trainingcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 11; 2026: 3.

18 papers.

Sort:

By area:

  1. 2025Diffusion-based Adversarial Purification from the Perspective of the Frequency Domaincited by 7
  2. 2024Adversarially Robust Out-of-Distribution Detection Using Lyapunov-Stabilized Embeddingscited by 6
  3. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  4. 2025LISArD: Learning Image Similarity to Defend Against Gray-box Adversarial Attackscited by 3
  5. 2025Adversarial-Guided Diffusion for Multimodal LLM Attackscited by 3
  6. 2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
  7. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  8. 2024Random Sampling for Diffusion-based Adversarial Purificationcited by 1
  9. 2025Gradient-Free Adversarial Purification with Diffusion Modelscited by 1
  10. 2025A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detectioncited by 1
  11. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
  12. 2025Enhancing Adversarial Transferability by Balancing Exploration and Exploitation with Gradient-Guided Samplingcited by 1
6 more
  1. 2026OTI: A Model-free and Visually Interpretable Measure of Image Attackabilitycited by 1
  2. 2025Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifiercited by 0
  3. 2025What is Adversarial Training for Diffusion Models?cited by 0
  4. 2025NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbationscited by 0
  5. 2026Advantage-based Temporal Attack in Reinforcement Learningcited by 0
  6. 2026What Makes VLMs Robust? Towards Reconciling Robustness and Accuracy in Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness
  2. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
  3. 2026NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification
  4. 2024Adversarial Guided Diffusion Models for Adversarial Purification
  5. 2025Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
  6. 2025ADT: Tuning Diffusion Models with Adversarial Supervision
  7. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry
  8. 2023Adversarial Diffusion Distillation