Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Information

arXiv 2408.05900 ↗First posted 12 Aug 2024cs.CVcited by 5

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial purification is one of the promising approaches to defend neural networks against adversarial attacks. Recently, methods utilizing diffusion probabilistic models have achieved great success for adversarial purification in image classification tasks. However, such methods fall into the dilemma of balancing the needs for noise removal and information preservation. This paper points out that existing adversarial purification methods based on diffusion models gradually lose sample information during the core denoising process, causing occasional label shift in subsequent classification tasks. As a remedy, we suggest to suppress such information loss by introducing guidance from the classifier confidence. Specifically, we propose Classifier-cOnfidence gUided Purification (COUP) algorithm, which purifies adversarial examples while keeping away from the classifier decision boundary. Experimental results show that COUP can achieve better adversarial robustness under strong attack methods.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 44 of its 54 references that are in the map. First posted on arXiv 12 Aug 2024.

Builds on

44 of 54 references.

Closest ancestors · 8

Same direction, newest first

2023Robust Classification via a Single Diffusion Model24 May
2023Better Diffusion Models Further Improve Adversarial Training9 Feb
2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
2022(Certified!!) Adversarial Robustness for Free!21 Jun
2022Guided Diffusion Model for Adversarial Purification30 May
2022Diffusion Models for Adversarial Purification16 May
2021Adversarial purification with Score-based generative models11 Jun

Other references · 36

2020Denoising Diffusion Probabilistic Modelscited by 20,851
2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
2014Explaining and Harnessing Adversarial Examplescited by 7,287
2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2022Classifier-Free Diffusion Guidancecited by 5,717
2022Generative Adversarial Networkscited by 5,603
2013Intriguing properties of neural networkscited by 5,114
2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442

24 more

2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
2020Fast is better than free: Revisiting adversarial trainingcited by 723
2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
2020On Adaptive Attacks to Adversarial Example Defensescited by 547
2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
2019Sliced Score Matching: A Scalable Approach to Density and Score Estimationcited by 381
2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
2019SMART: Robust and Efficient Fine-Tuning for Pre-trained Natural Language Models through Principled Regularized Optimizationcited by 253
2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
2021Improving Robustness using Generated Datacited by 233
2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
2019Adversarial Robustness through Local Linearizationcited by 146
2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
2020Adversarial Robustness on In- and Out-Distribution Improves Explainabilitycited by 73
2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
2022Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidancecited by 33
2018Defense-VAE: A Fast and Accurate Defense against Adversarial Attackscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 4; 2026: 1.

5 papers.

2025CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classificationcited by 12
2025Robustness Feature Adapter for Efficient Adversarial Trainingcited by 2
2025Model-Free Adversarial Purification via Coarse-To-Fine Tensor Network Representationcited by 0
2025NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbationscited by 0
2026NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purificationcited by 0

Similar, not cited

Close in wording, no citation either way