mlsanityData to 14 Oct 2026

Diffusion or Non-Diffusion Adversarial Defenses: Rethinking the Relation between Classifier and Adversarial Purifier

arXiv 2501.16904 ↗First posted 28 Jan 2025cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial defense research continues to face challenges in combating against advanced adversarial attacks, yet with diffusion models increasingly favoring their defensive capabilities. Unlike most prior studies that focus on diffusion models for test-time defense, we explore the generalization loss in classifiers caused by diffusion models. We compare diffusion-based and non-diffusion-based adversarial purifiers, demonstrating that non-diffusion models can also achieve well performance under a practical setting of non-adaptive attack. While non-diffusion models show promising adversarial robustness, they particularly excel in defense transferability and color generalization without relying on additional data beyond the training set. Notably, a non-diffusion model trained on CIFAR-10 achieves state-of-the-art performance when tested directly on ImageNet, surpassing existing diffusion-based models trained specifically on ImageNet.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 35 of its 41 references that are in the map. First posted on arXiv 28 Jan 2025.

Builds on

35 of 41 references.

Closest ancestors · 5

Same direction, newest first

  1. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model8 Dec
  2. 2023Enhancing Adversarial Robustness via Score-Based Optimization10 Jul
  3. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  4. 2022Diffusion Models for Adversarial Purification16 May
  5. 2021Adversarial purification with Score-based generative models11 Jun

Other references · 30

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  9. 2016Wide Residual Networkscited by 3,070
  10. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  11. 2016Adversarial examples in the physical worldcited by 1,769
  12. 2017Enhanced Deep Residual Networks for Single Image Super-Resolutioncited by 1,552
18 more
  1. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  2. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  4. 2018Learning Implicit Fields for Generative Shape Modelingcited by 1,060
  5. 2019Adversarial Training for Free!cited by 643
  6. 2022Diffusion Art or Digital Forgery? Investigating Data Replication in Diffusion Modelscited by 424
  7. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  8. 2021Data Augmentation Can Improve Robustnesscited by 194
  9. 2022Back to the Source: Diffusion-Driven Test-Time Adaptationcited by 71
  10. 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
  11. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  12. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  13. 2021Combating Adversaries with Anti-Adversariescited by 27
  14. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  15. 2022Denoising Masked AutoEncoders Help Robust Classificationcited by 21
  16. 2023Improving Adversarial Robustness of Masked Autoencoders via Test-time Frequency-domain Promptingcited by 12
  17. 2023Beyond Pretrained Features: Noisy Image Modeling Provides Adversarial Defensecited by 7
  18. 2023Test-time Detection and Repair of Adversarial Samples via Masked Autoencodercited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds
  2. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  3. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  4. 2026A Low-Rank Defense Method for Adversarial Attack on Diffusion Models
  5. 2026A Survey on Adversarial Attacks and Defenses for Diffusion Models Across Multiple Modalities
  6. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks
  7. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
  8. 2026Expanding the Role of Diffusion Models for Robust Classifier Training