mlsanityData to 14 Oct 2026

DiffBreak: Is Diffusion-Based Purification Robust?

arXiv 2411.16598 ↗First posted 25 Nov 2024cs.CR cs.CV cs.LGcited by 6

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Diffusion-based purification (DBP) has become a cornerstone defense against adversarial examples (AEs), regarded as robust due to its use of diffusion models (DMs) that project AEs onto the natural data manifold. We refute this core claim, theoretically proving that gradient-based attacks effectively target the DM rather than the classifier, causing DBP's outputs to align with adversarial distributions. This prompts a reassessment of DBP's robustness, attributing it to two critical flaws: incorrect gradients and inappropriate evaluation protocols that test only a single random purification of the AE. We show that with proper accounting for stochasticity and resubmission risk, DBP collapses. To support this, we introduce DiffBreak, the first reliable toolkit for differentiation through DBP, eliminating gradient flaws that previously further inflated robustness estimates. We also analyze the current defense scheme used for DBP where classification relies on a single purification, pinpointing its inherent invalidity. We provide a statistically grounded majority-vote (MV) alternative that aggregates predictions across multiple purified copies, showing partial but meaningful robustness gain. We then propose a novel adaptation of an optimization method against deepfake watermarking, crafting systemic perturbations that defeat DBP even under MV, challenging DBP's viability.

Key facts. Cited by 6 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 47 of its 58 references that are in the map. First posted on arXiv 25 Nov 2024.

Builds on

47 of 58 references.

Closest ancestors · 14

Same direction, newest first

  1. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective22 Apr
  2. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model8 Dec
  3. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomness28 Oct
  4. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification27 Oct
  5. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing28 Aug
  6. 2023Robust Classification via a Single Diffusion Model24 May
  7. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  8. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  9. 2022Improving Adversarial Robustness by Contrastive Guided Diffusion Process18 Oct
  10. 2022Guided Diffusion Model for Adversarial Purification from Random Noise22 Jun
  11. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  12. 2022Guided Diffusion Model for Adversarial Purification30 May
2 more
  1. 2022Diffusion Models for Adversarial Purification16 May
  2. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 33

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  5. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  10. 2013Intriguing properties of neural networkscited by 5,155
  11. 2016Wide Residual Networkscited by 3,070
  12. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
21 more
  1. 2016Adversarial examples in the physical worldcited by 1,769
  2. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  3. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  6. 2016Training Deep Nets with Sublinear Memory Costcited by 848
  7. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  8. 2021Score-based Generative Modeling in Latent Spacecited by 636
  9. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  10. 2017Countering Adversarial Images using Input Transformationscited by 520
  11. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  12. 2020Scalable Gradients for Stochastic Differential Equationscited by 271
  13. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  14. 2018Spatially Transformed Adversarial Examplescited by 195
  15. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  16. 2019ME-Net: Towards Effective Adversarial Robustness with Matrix Estimationcited by 65
  17. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  18. 2019Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attackscited by 54
  19. 2019Enhancing Adversarial Defense by k-Winners-Take-Allcited by 51
  20. 2024UnMarker: A Universal Attack on Defensive Image Watermarkingcited by 24
  21. 2023Randomness in ML Defenses Helps Persistent Attackers and Hinders Evaluatorscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 4.

6 papers.

  1. 2026Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoningcited by 5
  2. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometrycited by 1
  3. 2025Training-Free Adversarial Robustness in Computational MRIcited by 0
  4. 2026Auto-ART: Structured Literature Synthesis and Automated Adversarial Robustness Testingcited by 0
  5. 2026Memory Efficient Full-gradient Attacks (MEFA) Framework for Adversarial Defense Evaluationscited by 0
  6. 2026TARO: Temporal Adversarial Rectification Optimization Using Diffusion Models as Purifierscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification
  2. 2024Watch the Watcher! Backdoor Attacks on Security-Enhancing Diffusion Models
  3. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purification
  4. 2023DiffDefense: Defending against Adversarial Attacks via Diffusion Models
  5. 2024Classifier Guidance Enhances Diffusion-based Adversarial Purification by Preserving Predictive Information
  6. 2024LoRID: Low-Rank Iterative Diffusion for Adversarial Purification
  7. 2026Universal Adversarial Purification with DDIM Metric Loss for Stable Diffusion
  8. 2024Adversarial Guided Diffusion Models for Adversarial Purification