Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry

Recent studies suggest that diffusion models significantly improve the empirical adversarial robustness of deep neural network models. While intuitive explanations have been proposed, the mechanisms underlying diffusion-based robustness remain largely unclear. This work aims to demystify how diffusion models improve adversarial robustness. We observe that diffusion models surprisingly increase the ℓp distance to clean samples, thus rejecting the hypothesis that purification denoises perturbed images closer to the clean ones. Next, we provide a unifying account of the robustness improvement in diffusion-based purification by decomposing it into two sources: (i) gradient masking induced by randomness; (ii) compression of the image space. First, we find that the purified images are heavily influenced by the internal randomness of diffusion models. This randomness leads to gradient masking that cannot be removed by the previously proposed remedy, i.e., expectation-over-transformation (EOT). The improvement in robustness due to randomness is determined by the cosine similarity of the optimal vs. empirical attack directions, as predicted by a hyperspherical cap model of the adversarial regions. Second, we find that, when fixing the randomness, diffusion models substantially compress the image space. Importantly, we discover a lawful relationship between the model's ability to compress the image space and the genuine adversarial robustness gain. Further theoretical analyses show that convergent score fields encoded in diffusion models explain these compression effects. Our findings reveal new insights into the mechanisms underlying diffusion-based purification, and offer guidance for developing more effective and principled adversarial purification systems.