Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification
Not on the map. Why?
Abstract (arXiv)
Diffusion-based purification (DBP) methods aim to remove adversarial noise from the input sample by first injecting Gaussian noise through a forward diffusion process, and then recovering the clean example through a reverse generative process. In the above process, how much Gaussian noise is injected to the input sample is key to the success of DBP methods, which is controlled by a constant noise level t^* for all samples in existing methods. In this paper, we discover that an optimal t^* for each sample indeed could be different. Intuitively, the cleaner a sample is, the less the noise it should be injected, and vice versa. Motivated by this finding, we propose a new framework, called Sample-specific Score-aware Noise Injection (SSNI). Specifically, SSNI uses a pre-trained score network to estimate how much a data point deviates from the clean data distribution (i.e., score norms). Then, based on the magnitude of score norms, SSNI applies a reweighting function to adaptively adjust t^* for each sample, achieving sample-specific noise injections. Empirically, incorporating our framework with existing DBP methods results in a notable improvement in both accuracy and robustness on CIFAR-10 and ImageNet-1K, highlighting the necessity to allocate distinct noise levels to different samples in DBP methods. Our code is available at: https://github.com/tmlr-group/SSNI.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 41 of its 48 references that are in the map. First posted on arXiv 6 Jun 2025.
Builds on
41 of 48 references.
References · 41
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
- 2020Denoising Diffusion Implicit Modelscited by 9,781
- 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
- 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2018A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attackscited by 1,485
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
29 more
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
- 2022Diffusion Models for Adversarial Purificationcited by 476
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
- 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
- 2020Scalable Gradients for Stochastic Differential Equationscited by 271
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
- 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
- 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
- 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 175
- 2021Neural SDEs as Infinite-Dimensional GANscited by 161
- 2021Adversarial purification with Score-based generative modelscited by 134
- 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
- 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
- 2022Guided Diffusion Model for Adversarial Purificationcited by 92
- 2023Robust Classification via a Single Diffusion Modelcited by 79
- 2020Adaptive Checkpoint Adjoint Method for Gradient Estimation in Neural ODEcited by 76
- 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
- 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
- 2020Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Modelscited by 58
- 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
- 2020Maximum Mean Discrepancy Test is Aware of Adversarial Attackscited by 44
- 2017Synthesizing Robust Adversarial Examplescited by 39
- 2020A General Framework For Detecting Anomalous Inputs to DNN Classifierscited by 24
- 2023Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Scorecited by 20
- 2021Two Coupled Rejection Metrics Can Tell Adversarial Examples Apartcited by 14
- 2024Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Trainingcited by 6
- 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.