{"id":"c603da28-306f-498b-b8fb-add2badb09ab","arxiv_id":"2411.18956","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A maximally random variant of DDIM sampling, combined with guidance applied to the predicted clean image, yields a diffusion purification defense (DiffAP) that outperforms prior methods on CIFAR-10.","lead":"This paper proposes a new sampling strategy for diffusion-based defenses against adversarial attacks, where each denoising step re-samples from a maximally random noise distribution rather than following the standard stable trajectory. The authors report large robustness gains over prior diffusion purification methods, with up to 10x faster sampling.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"With only 5 EOT samples, the stochasticity in Eq. (5) may mask the attack; DiffAP's robustness gain could vanish under stronger adaptive attacks, so the headline claim is not yet settled.","rationale":"The reader identified the mediator guidance balance as the weakest assumption and issued CONDITIONAL. My stress-test focuses on a different, more decisive vulnerability of the central claim: the evaluation of a highly stochastic defense with only 5 EOT samples. The paper's mechanism is that fresh Gaussian noise at every reverse step (Eq. 5) makes the sampling trajectory unpredictable and therefore robust. But an adaptive attacker can average over this randomness with EOT, and 5 samples is a small Monte Carlo size for a defense that injects near-maximal noise at each of 10-100 steps. If the attack improves with more EOT samples, the reported robustness advantage may shrink or disappear, directly falsifying the headline claim of significant SOTA improvement. This is not an ad hominem or a consensus disagreement; it is a concrete correctness risk tied to the paper's own evaluation protocol. The mediator guidance concern raised by the reader is real, but it is secondary: even if guidance is heuristic, the empirical claim could still hold under a proper attack; the EOT undersampling question must be settled before the empirical claim is credible. For this reason I keep the reader's CONDITIONAL verdict (reported as UNCHANGED) but attach a concrete test that should gate acceptance.","tokens_in":13942,"tokens_out":8679,"duration_ms":84052,"concrete_test":"Rerun the PGD+EOT evaluation of Table 1 (L_infty, eps=8/255) and Table 2 with EOT sample counts 5, 20, 50, and 100, holding all other settings fixed: same 512-image subset, same denoising steps, same guidance hyperparameters, and same random seed protocol. If DiffAP's robust accuracy at EOT=100 drops substantially (e.g., more than 10 points) or falls below MimicDiffusion at EOT=100, then the claimed stochasticity advantage is an artifact of undersampling the defense's randomness.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that random sampling's stochasticity improves robustness. But the evaluation uses PGD+EOT with only 5 EOT samples (Sec. 4.1), while the defense is highly stochastic: at every denoising step, Eq. (5) draws an independent Gaussian of variance (1 - alpha_bar_{t-1}), so the purified output is a random function of the input. With finite EOT, the attack gradient is a noisy Monte Carlo estimate of the expectation over this randomness. The reported 9-10% normal-attack gain and the >20% asynchronous-attack gain may reflect the attacker's failure to optimize through this randomness rather than genuine removal of the adversarial perturbation. This is especially load-bearing because the mediator guidance (Eqs. 7-8) pulls the predicted clean image toward the input; if the attack cannot see through the stochastic trajectory, guidance can trivially preserve input-like predictions. The appendix's own unconditional results (Fig. 7) also show that random sampling is not uniformly more robust than DDIM, so the claimed advantage depends on an interaction between guidance and stochasticity that the 5-sample EOT evaluation does not adequately probe.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a new sampling scheme, called random sampling, for diffusion-based adversarial purification: within the DDIM-family update, the stochastic noise coefficient is set to its maximum value (σ_t = sqrt(1 - ᾱ_{t-1})), so that each reverse step re-samples from a fresh noisy space rather than from a space adjacent to the previous sample. To maintain prediction consistency under this highly stochastic schedule, the paper introduces mediator guidance, which applies gradient descent on the predicted clean image x̃_{0,t} toward the input, performed every k-th step. The combined method, DiffAP, is evaluated on CIFAR-10 with a WideResNet-28-10 classifier using PGD+EOT attacks, including a newly proposed asynchronous attack where the attacker's number of forward steps differs from the defender's. The paper reports that DiffAP significantly outperforms DiffPure, GDMP, and MimicDiffusion in both standard and robust accuracy, and that it retains high robustness with 10× fewer denoising steps.","tokens_in":1922,"tokens_out":1775,"duration_ms":86811,"significance":"If the results hold, the paper makes a useful and simple contribution: replacing the commonly used stable sampling with maximally stochastic sampling in the DDIM family, combined with a strong conditioning mechanism, could improve both robustness and speed of diffusion-based purification. The proposed mediator guidance is an interpretable heuristic that appears to stabilize prediction consistency in the authors' experiments, and the paper's exploration of sampling schedules and forward-step configurations adds useful empirical data to the guided-purification literature. The core method is not circular: random sampling is a concrete choice of σ_t in the existing DDIM family, and the evaluation is internally consistent and inexpensive to reproduce. However, the strength of the claims depends critically on several evaluation and reporting choices—most notably the number of EOT samples, the unreported value of the guidance factor R_t, and the relationship between the guided results and the unconditional results in the appendix—so the general claim of a large, robust advantage is not yet fully established.","major_comments":[{"comment":"The paper never specifies the value (or schedule) of the guidance factor R_t, although it is a central hyperparameter in Eq. (8) and Algorithm 1. The sentence in Sec. 3.3 that R_t 'could be calculated directly without additional constraints' is not followed by a formula or numerical value, and neither the main text nor the appendix reports the R_t used for Tables 1–3. Because the mediator update moves x̃_{0,t} toward the (possibly adversarial) input, the method's behavior depends heavily on this coefficient; without reporting it, the experiments are not reproducible and the sensitivity of DiffAP to this choice is unknown. The authors should state the exact R_t (and any t-dependence) and provide a sensitivity study over R_t and the guidance modulus k.","section":"Sec. 3.3 and Algorithm 1"},{"comment":"The paper states that 'the randomness of the sampling process is almost proportional to the robustness of the sampling method' and presents Fig. 1 as evidence. However, the unconditional results in Appendix Fig. 7 show the opposite ordering at large forward steps: at 200 forward steps, random (maximally stochastic) sampling has slightly lower robust accuracy than DDIM, and the text explicitly acknowledges that 'the final robust accuracy is slightly lower' for random sampling. This contradicts the unqualified proportionality claim and indicates that the benefit of random sampling is specific to the mediator-guided setting, not a general property of the sampling scheme. The central motivation in the abstract and introduction should be adjusted to reflect this, or the authors should explain why guidance reverses the ordering.","section":"Sec. 3.2 and Appendix Sec. 8 (Fig. 7)"},{"comment":"The defense is highly stochastic: at each of the M denoising steps, Eq. (5) draws an independent Gaussian with variance 1−ᾱ_{t-1}, so the purified output is a random function of the input. The attack, however, uses only 5 EOT samples (Sec. 4.1). With finite EOT, the estimated attack gradient is a noisy approximation of the expected gradient over this randomness, and the reported robust accuracies—especially the >20% advantage in Table 2—may partly reflect the attacker's inability to optimize through the stochastic trajectory rather than genuine removal of the adversarial perturbation. The authors should evaluate with larger EOT values (e.g., 20, 50) and/or an adaptive attack such as BPDA+EOT, and report whether the robustness gains persist.","section":"Sec. 4.1 and Eq. (5)"},{"comment":"The mediator guidance is motivated as avoiding the 'gradient bias' of GDMP and DPS, but the update x̃_{0,t} ← x̃_{0,t} − R_t ∇d(x̃_{0,t}, x_adv) moves the predicted clean image directly toward the input, which can in principle reintroduce the adversarial perturbation. The paper does not analyze this trade-off, nor does it provide a theoretical or diagnostic argument that the gradient step improves prediction consistency without re-introducing adversarial structure. The choice of R_t and the partial guidance (every k-th step) are defended only by the empirical results in Sec. 4.2. To substantiate the claimed mechanism, the authors should provide an analysis or at least a measurement of how the distance between the purified x̃_0 and the clean image evolves during the reverse process for different R_t and attack strengths.","section":"Sec. 3.3 Eqs. (7)–(8)"}],"minor_comments":[{"comment":"The word 'futher' in the sentence introducing the experiments should be 'further'.","section":"Sec. 5 (Introduction)"},{"comment":"The standard accuracy for DiffAP is reported as 95.90 ± 1.20 at 100 denoising steps and 95.90 ± 1.24 at 10 denoising steps. It is suspicious that the values are identical to two decimal places; please clarify whether this is a coincidence, a typo, or due to a shared random seed that makes the standard-accuracy evaluation identical across denoising steps.","section":"Tables 1 and 3"},{"comment":"The paper would benefit from stating explicitly that the choice σ_t = √(1−ᾱ_{t-1}) in Eq. (5) corresponds to k_t=1 in the reparameterization of Eq. (4), i.e., the maximum allowed stochasticity in the DDIM family, which would make the connection to Eq. (3) clearer.","section":"Sec. 3.2"},{"comment":"The phrase 'with theoretical guarantee, DiffPure preliminarily demonstrated' is misleading if the guarantee refers only to SDE discretization error rather than to adversarial robustness; the nature of the guarantee should be stated more precisely.","section":"Sec. 2.1"},{"comment":"The conceptual trajectory figure is hard to interpret; the caption should explain what the different colored points and circles represent (e.g., ideal DDIM points, actual sampling points, and the noise level of the sampling space).","section":"Fig. 2"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely problem and the core idea is interesting, but the current evidence does not support the strength of the advertised claims. The missing R_t value is a straightforward but necessary fix, and the EOT evaluation must be strengthened before the claimed robustness advantage can be taken at face value. I also recommend that the authors reconcile the contradiction between Fig. 1 and Appendix Fig. 7, since the paper's motivation rests on a general 'randomness implies robustness' statement that the unconditional experiments do not support. The paper is within the scope of the journal, and the issues are fixable, so I lean toward major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. First, the sampling scheme in Eq. (5) is the maximum-stochasticity corner of the DDIM joint distribution family: it is the sigma_t = sqrt(1 - alpha_bar_{t-1}) special case, so the core equation is already present in Song et al.'s DDIM paper. The novelty is applying that corner to adversarial purification and adding a mediator guidance that back-propagates through the predicted clean image x~0,t rather than the noisy sample. Second, the reported gains are large, but the broad claim that randomness is proportional to robustness is contradicted by the paper's own appendix: Fig. 7 shows that unconditional random sampling ends with slightly lower robust accuracy than DDIM at high forward steps. The advantage appears only when mediator guidance is added, and the interaction is not theoretically explained.\n\nWhat the paper does well: it runs a systematic sweep over random noise ratio, forward steps, and guidance variants, with standard deviations over five runs. The mediator guidance is a sensible heuristic; the appendix's bias decomposition for GDMP and DPS is concrete and useful. The asynchronous attack finding is a genuine observation: attackers can do better by choosing forward steps different from the defender's. If the robustness numbers hold, this is a practical baseline.\n\nThe soft spots are real. The stress-test concern about EOT is the most serious: with only 5 EOT samples, the attacker is optimizing through a very noisy Monte Carlo estimate of the stochastic purification. The reported gains, especially the >20% asynchronous attack advantage, could be an artifact of the attacker failing to see through the randomness rather than genuine perturbation removal. The paper needs BPDA-style attacks with many more EOT samples, full gradients through the sampling process, or at least a gradient variance analysis, before I'd believe the robustness numbers. Hyperparameters R_t and k are selected without a documented validation procedure, and the abstract's 'guarantee' language for consistency is not supported by any formal argument. The authors do acknowledge uncertainty in the conclusion, which is honest.\n\nThe math is simple and correct as a special case, the data are internally consistent, and the citation pattern is appropriate.\n\nWho is this for? People working on diffusion-based purification or robustness evaluation should read it as a data point and a possible baseline. But the robustness claim is not settled.\n\nRecommendation: I'd send it to review, but I'd require a much stronger adaptive attack evaluation and softened claims before acceptance. Don't cite the robustness numbers as established.","headline":"A simple, fast diffusion purifier that is really just the maximum-stochasticity DDIM corner plus a DPS-style mediator guidance; the headline robustness gains are not yet credible because the EOT evaluation is too weak.","tokens_in":14715,"tokens_out":4572,"would_cite":false,"duration_ms":38878,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that replacing stable DDPM/DDIM reverse sampling with maximally random sampling, guided by a mediator variable, makes diffusion-based adversarial purification both faster and substantially more robust, outperforming prior…","keywords":["adversarial purification","diffusion models","random sampling","DDIM","DDPM","mediator guidance","adversarial robustness","score-based generative models"],"falsifier":"Run the same DiffAP defense under an adaptive attack that is allowed to backpropagate through the full random sampling trajectory with the defender's exact noise draws: if robust accuracy drops to the level of DDIM sampling, the asserted benefit of extra randomness is an artifact of non-adaptive evaluation rather than a property of the sampler. A simpler check is to vary R_t over a wide range on a held-out set and show that the reported accuracy is not a knife-edge peak.","tokens_in":13684,"feed_emoji":"🎲","tokens_out":5267,"duration_ms":45453,"temperature":0.7,"pith_summary":"The paper argues that the sampling schedule used to reverse a diffusion process should be optimized for adversarial purification, not for stable image generation. Standard DDPM and DDIM sampling keep the trajectory close to the forward noising path, which an attacker can exploit; the paper proposes random sampling, which at each reverse step draws from a fresh noisy space by setting the DDIM variance term to its maximum. To keep purified images faithful, it adds mediator guidance, a gradient correction applied to the predicted clean image rather than to the noisy sample. With both ingredients, a method named DiffAP reports higher standard and robust accuracy than prior diffusion purifiers, and maintains its advantage when the number of denoising steps is cut tenfold. A sympathetic reader would care because this suggests a simple, training-free change to the sampler, not a new model, can substantially improve a test-time defense.","feed_headline":"Random sampling makes diffusion purification faster and stronger","feed_subtitle":"Maximal-noise sampling plus mediator guidance beats prior purifiers by over 20% under strong attacks.","key_machinery":"The load-bearing object is the DDIM family of reverse samplers indexed by noise coefficient σ_t; random sampling is the extreme member σ_t = sqrt(1 - ᾱ_t), which discards the previous noisy point and re-samples from an independent Gaussian at every step. The second object is the mediator variable x~0,t, the score model's one-step estimate of the clean image at time t, defined as (x_t - sqrt(1 - ᾱ_t) ε_θ(x_t,t)) / sqrt(ᾱ_t). Mediator guidance applies gradient descent on a distance d(x~0,t, x_adv/clean) to this estimate, rather than to the noisy x_t itself, which the paper argues avoids the gradient bias of earlier guided methods. Together they turn the diffusion purifier into a stochastic denoiser whose randomness is maximized while prediction consistency is pinned to the input.","core_discovery":"The central discovery is that the amount of stochasticity in the reverse sampler is a first-order robustness knob for diffusion-based purification, and that this knob can be turned to its maximum without destroying output quality if guidance is applied to the right variable. Parameterizing the DDIM joint distribution family with a noise rate k_t, the paper observes that robust accuracy rises monotonically as k_t goes from 0 (DDIM) to 1 (random sampling). Random sampling sets σ_t = sqrt(1 - ᾱ_t), making x_{t-1} independent of the previous noisy sample except through the score model's prediction of the clean image. Mediator guidance then nudges that predicted clean image x~0,t toward the input by gradient descent on a distance metric, applied intermittently (every k steps) to save computation and avoid collapse. The combined method DiffAP is reported to outperform state-of-the-art purifiers on CIFAR-10 against PGD+EOT ℓ∞ and ℓ2 attacks, with the biggest margins under an asynchronous attack where the defender uses more forward steps than the attacker.","pith_inferences":["An implication left implicit is that the monotone dependence of robust accuracy on the sampling noise rate k_t provides a single dial for tuning the robustness-speed trade-off of any diffusion purifier, not just the endpoints the paper tests.","A natural extension would be to test whether the same random-sampling-plus-mediator recipe transfers to score models trained on other modalities, such as audio or tabular data, where adversarial purification is less explored.","The paper's evaluation assumes the attacker does not have access to the defender's exact random draws; an adaptive attacker who backpropagates through the full stochastic trajectory could reveal whether the randomness benefit is intrinsic or partly an artifact of the evaluation protocol."],"forward_implications":["Setting the reverse-sampling noise rate to its maximum yields strictly higher robust accuracy than DDPM or DDIM sampling under PGD+EOT attacks, with the gap growing as attacks get stronger.","Guidance applied to the predicted clean image keeps standard accuracy near the clean classifier accuracy even as the number of forward steps grows, where unconditional purification degrades.","DiffAP maintains robust accuracy above 80% when the number of denoising steps is reduced from 100 to 10, a tenfold speedup that makes other conditional purifiers collapse.","Random sampling is the main reason DiffAP retains its advantage under asynchronous attacks, where the attacker uses fewer forward steps than the defender."],"supporting_citations":[{"why":"Supplies the DDPM forward and reverse processes and the trained diffusion model used as the purification backbone.","marker":"[15]"},{"why":"Defines the DDIM joint distribution family and the σ_t parameter that random sampling takes to its extreme.","marker":"[26]"},{"why":"Provides the DiffPure baseline and the standard protocol for evaluating diffusion-based purification.","marker":"[23]"},{"why":"Introduces the gradient-based guidance on noisy samples that mediator guidance is designed to replace.","marker":"[31]"},{"why":"Proposes MimicDiffusion, the conditional guidance baseline whose trajectory-mimicking objective is compared against mediator guidance.","marker":"[27]"},{"why":"Supplies the PGD+EOT attack setup, step-count recommendations, and the observation that unconditional robustness grows with forward steps.","marker":"[18]"},{"why":"The pretrained score-based model used in all purification experiments to estimate noise and gradients.","marker":"[29]"},{"why":"Describes the DPS gradient guidance whose instability at large time steps motivates the mediator design.","marker":"[6]"}],"fun_headline_variants":["Random sampling outperforms stable sampling for diffusion purification","Max-noise sampling boosts diffusion purification robustness by 20%","Diffusion purification: random sampling beats DDIM and DDPM","Mediator-guided random sampling strengthens diffusion purification","Random sampling: the hidden lever for diffusion adversarial defense"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method rests on the heuristic that gradient descent on the predicted clean image toward the input removes the adversarial perturbation without pulling the purifier back onto it; the guidance weight R_t and guidance interval k are chosen experimentally, and no proof guarantees this balance holds.","fun_headline_variants_meta":{"raw":{"variants":["Random sampling outperforms stable sampling for diffusion purification","Max-noise sampling boosts diffusion purification robustness by 20%","Diffusion purification: random sampling beats DDIM and DDPM","Mediator-guided random sampling strengthens diffusion purification","Random sampling: the hidden lever for diffusion adversarial defense"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000669,"raw_usage":{"total_tokens":3072,"prompt_tokens":987,"completion_tokens":2085,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":603,"completion_tokens_details":{"reasoning_tokens":2009}},"tokens_in":603,"tokens_out":2085,"duration_ms":16396,"temperature":1.0,"reasoning_tokens":2009,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:42:02.938764+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same DiffAP defense under an adaptive attack that is allowed to backpropagate through the full random sampling trajectory with the defender's exact noise draws: if robust accuracy drops to the level of DDIM sampling, the asserted benefit of extra randomness is an artifact of non-adaptive evaluation rather than a property of the sampler. A simpler check is to vary R_t over a wide range on a held-out set and show that the reported accuracy is not a knife-edge peak.","supporting_citations":[{"cited_title":"Denois- ing diffusion implicit models","cited_arxiv_id":null,"evidence_quote":"Defines the DDIM joint distribution family and the σ_t parameter that random sampling takes to its extreme."},{"cited_title":"Mimicd- iffusion: Purifying adversarial perturbation via mimicking clean diffusion model, 2023","cited_arxiv_id":null,"evidence_quote":"Proposes MimicDiffusion, the conditional guidance baseline whose trajectory-mimicking objective is compared against mediator guidance."},{"cited_title":"Robust evaluation of diffusion-based adversarial purification, 2023","cited_arxiv_id":null,"evidence_quote":"Supplies the PGD+EOT attack setup, step-count recommendations, and the observation that unconditional robustness grows with forward steps."},{"cited_title":"Score-based generative modeling through stochastic differential equa- tions","cited_arxiv_id":null,"evidence_quote":"The pretrained score-based model used in all purification experiments to estimate noise and gradients."},{"cited_title":"Diffusion pos- terior sampling for general noisy inverse problems","cited_arxiv_id":null,"evidence_quote":"Describes the DPS gradient guidance whose instability at large time steps motivates the mediator design."}],"review_version":1}