mlsanityData to 14 Oct 2026

Adversarial Examples are Misaligned in Diffusion Model Manifolds

arXiv 2401.06637 ↗First posted 12 Jan 2024cs.CV cs.CRcited by 1

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

In recent years, diffusion models (DMs) have drawn significant attention for their success in approximating data distributions, yielding state-of-the-art generative results. Nevertheless, the versatility of these models extends beyond their generative capabilities to encompass various vision applications, such as image inpainting, segmentation, adversarial robustness, among others. This study is dedicated to the investigation of adversarial attacks through the lens of diffusion models. However, our objective does not involve enhancing the adversarial robustness of image classifiers. Instead, our focus lies in utilizing the diffusion model to detect and analyze the anomalies introduced by these attacks on images. To that end, we systematically examine the alignment of the distributions of adversarial examples when subjected to the process of transformation using diffusion models. The efficacy of this approach is assessed across CIFAR-10 and ImageNet datasets, including varying image sizes in the latter. The results demonstrate a notable capacity to discriminate effectively between benign and attacked images, providing compelling evidence that adversarial instances do not align with the learned manifold of the DMs.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 61 of its 75 references that are in the map. First posted on arXiv 12 Jan 2024.

Builds on

61 of 75 references.

Closest ancestors · 6

Same direction, newest first

  1. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing28 Aug
  2. 2023Robust Classification via a Single Diffusion Model24 May
  3. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attack14 May
  4. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  5. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  6. 2022Diffusion Models for Adversarial Purification16 May

Other references · 55

  1. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  2. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  3. 2020Denoising Diffusion Implicit Modelscited by 9,781
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2013Intriguing properties of neural networkscited by 5,155
  9. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  12. 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
38 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  5. 2022Null-text Inversion for Editing Real Images using Guided Diffusion Modelscited by 1,179
  6. 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,114
  7. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  8. 2022DiffEdit: Diffusion-based semantic image editing with mask guidancecited by 647
  9. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  10. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  11. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  12. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  13. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  14. 2023DIRE for Diffusion-Generated Image Detectioncited by 390
  15. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  16. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  17. 2018Certified Defenses against Adversarial Examplescited by 306
  18. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
  19. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  20. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  21. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  22. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  23. 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 146
  24. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  25. 2022Towards the Detection of Diffusion Model Deepfakescited by 111
  26. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  27. 2021RobustART: Benchmarking Robustness on Architecture Design and Training Techniquescited by 79
  28. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  29. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  30. 2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
  31. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  32. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
  33. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  34. 2022Visual Prompting for Adversarial Robustnesscited by 34
  35. 2021Attacking Adversarial Attacks as A Defensecited by 32
  36. 2021SpectralDefense: Detecting Adversarial Attacks on CNNs in the Fourier Domaincited by 30
  37. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  38. 2021AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defensecited by 10

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year

Citing papers per year: 2024: 1.

1 paper.

  1. 2024Deciphering the Definition of Adversarial Robustness for post-hoc OOD Detectorscited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2024Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Think
  2. 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities
  3. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  4. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey
  5. 2025Diffusion Models are Robust Pretrainers
  6. 2025Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Models
  7. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry
  8. 2025Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifier