{"id":"ab73b917-808f-40bb-ae71-35a3862c1800","arxiv_id":"2505.22839","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Diffusion models improve adversarial robustness mainly by compressing the input space, while the large gains reported earlier mostly come from evaluation randomness.","lead":"Diffusion-based purification of adversarial images does not pull images back toward their clean originals, and its apparent robustness is largely an artifact of internal randomness. The paper proposes fixing the randomness during evaluation and shows that a simple compression measure predicts the true remaining robustness.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The fixed-randomness protocol (Sec. 4) is the load-bearing assumption: the paper's own transfer numbers (77.4% on CIFAR-10) show the same attack fails against a mismatched seed, so 23.7% may measure an overfitting artifact rather than the stochastic defense's true robustness.","rationale":"The reader's weakest assumption is exactly the point I find most load-bearing: fixing xi_attack = xi_test may give the attacker a stationary target and thereby underestimate the robustness of a stochastic purification system. I agree with that assessment, and the paper's own Table 4 strengthens it. A transfer attack across different fixed random configurations achieves 77.4% robust accuracy on CIFAR-10, nearly the clean accuracy of 85.8%. That is direct evidence that the attack which produces 23.7% under a shared seed is strongly overfit to one realization and does not transfer to the defense actually deployed with fresh randomness. This threatens the headline quantitative decomposition: if the protocol is measuring a worst-case deterministic instantiation rather than the stochastic defense, then 'stochasticity accounts for most of the gain' is an artifact of the evaluation choice. I am not claiming the paper's observations are wrong; the distance-increasing behavior, the large internal variance, and the compression-rate correlation are valuable and mostly independent of the protocol critique. The compression mechanism is still plausible, but the paper's first two contributions are framed around the 23.7% number, so the framing needs revision. Because the concern is addressable by a clear evaluation check and by reframing the claims as applying to a deterministic realization, the existing CONDITIONAL verdict remains appropriate; I do not see grounds to reject the paper outright. The paper also deserves credit for transparently listing limitations, including the inability to run full ImageNet gradients and possible gradient masking at high timesteps. My recommendation is therefore to keep the conditional verdict, with the fixed-randomness protocol and its interpretation as the primary required revision.","tokens_in":16717,"tokens_out":7218,"duration_ms":80059,"concrete_test":"Run one controlled comparison on the CIFAR-10 DDPM setup with the same attack budget and step count: (i) PGD with the same seed at attack and test, reproducing the 23.7% result; (ii) PGD optimized against one fixed seed but evaluated over, say, 50 independently sampled test seeds per image; (iii) PGD-EOT with at least 100 noise samples per gradient step, evaluated over 50 fresh test seeds. If (ii) or (iii) gives robust accuracy substantially above 23.7%, e.g., near the 77.4% transfer value in Table 4, then the fixed-seed number is not the robustness of the stochastic defense, and the paper must reframe its 'net gain' claim. Reporting the distribution over test seeds would also show whether 23.7% is an extreme realization rather than a representative one.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim decomposes observed robustness into stochasticity plus deterministic compression. The decomposition rests on treating xi_attack = xi_test in Sec. 4 as the correct way to remove stochasticity. This is not a neutral control: it hands the attacker the exact realization of the defense. A deployed stochastic purification system draws xi_test fresh at test time, so an attacker optimizing against a fixed xi can overfit that specific function. The resulting 23.7% is therefore a robustness estimate for one deterministic realization, not the 'net' robustness of the stochastic defense. The paper's own Table 4 shows how much the seed mismatch matters: an attack computed under one fixed configuration, evaluated under a different configuration, gives 77.4% +/- 0.36% on CIFAR-10, close to the 85.8% clean accuracy. Thus the same PGD attack that yields 23.7% when the seed is shared is nearly harmless against a defense using an unknown seed. With fresh test-time randomness, stochasticity is not merely an evaluation artifact to be subtracted; it is part of the defense surface. Unless the protocol is explicitly defended as measuring a worst-case deterministic instantiation, the quantitative claim that the net adversarial robustness gain drops to 23.7%, and the associated split into stochasticity versus compression, are not established for the stochastic purification systems the paper discusses.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper investigates why diffusion-model-based adversarial purification appears to improve robustness and how large that improvement really is. The authors report three main findings: (1) diffusion purification pushes perturbed images farther from, rather than closer to, clean images, contradicting a simple \"denoising\" intuition; (2) the internal randomness of the diffusion process dominates the output, and once randomness is fixed during both attack and test, robust accuracy on CIFAR-10 drops to about 23.7%, far below the roughly 70% originally reported; and (3) the remaining robustness gain is strongly correlated with a simple ``compression rate'' of the purification mapping, which is claimed to be a reliable, gradient-free predictor of robustness. The paper includes extensive experiments on CIFAR-10 and ImageNet, full-gradient attacks on CIFAR-10, and a detailed appendix with implementation details and distance measurements.","tokens_in":16982,"tokens_out":5434,"duration_ms":64391,"significance":"If the central claims hold, the paper would make an important conceptual contribution: it would separate the stochastic component of diffusion-based purification from a deterministic compression effect, and it would provide a cheap, gradient-free statistic (compression rate) for predicting robustness. The paper is unusually transparent about its limitations, including the inability to run full-gradient attacks on ImageNet and possible gradient masking at large timesteps. The empirical observation that diffusion models increase Lp distance to clean inputs is a useful counterpoint to common intuition, and the proposal of a falsifiable compression-robustness relation is a valuable starting point. However, the quantitative headline claim (the 23.7% ``net'' robustness and the associated stochasticity/compression split) rests on an evaluation protocol whose interpretation is questionable, and the compression-robustness ``law'' is supported by a small, post-hoc fitted dataset. The paper's significance is therefore real but currently overstated; it could become a solid contribution after substantial reframing and additional validation.","major_comments":[{"comment":"The fixed-randomness protocol (xi_attack = xi_test) is not a neutral control for the stochastic defense; it deliberately hands the attacker the exact test-time realization of the purification function. Table 4 shows that the same PGD attack evaluated under a different fixed configuration yields 77.4% accuracy on CIFAR-10, close to the 85.8% clean accuracy, so with fresh test-time randomness the attack becomes nearly ineffective. Consequently, the 23.7% figure measures the robustness of one deterministic instantiation against an attack optimized for that exact instantiation, not the \"net\" robustness of the stochastic purification system. The paper's central decomposition of the robustness gain into stochasticity versus compression is therefore not established unless the protocol is explicitly defended as a worst-case analysis over random seeds, and the conclusions should be reframed accordingly.","section":"Sec. 4, Eq. (8)-(9) and Table 4"},{"comment":"The compression-robustness ``law'' is a sigmoid fitted post hoc to a small dataset: roughly seven timesteps for each of two samplers (DDPM and Reverse) on CIFAR-10, with no error bars reported for the PGD robustness values in Table 7 and no holdout validation. The claim that compression rate is a ``reliable robustness indicator'' is too strong given this support. The authors should provide repeated runs with confidence intervals, evaluate the fitted relation on held-out configurations (e.g., different attack budgets, different base classifiers, or ImageNet compression-rate measurements), and include uncertainty quantification for the extrapolation to clean accuracy.","section":"Sec. 5, Table 7 and Fig. 3b"},{"comment":"The ImageNet result of 29.5% robust accuracy is obtained with BPDA without full gradients, as the authors acknowledge in Sec. 6. Because the paper's main contribution is to correct overestimated robustness, an evaluation method that is known to be susceptible to gradient masking cannot support the generalization claim to ImageNet. The authors should either run stronger attacks (e.g., more EOT samples, partial full-gradient attacks, or transfer attacks with multiple fixed seeds) or explicitly downgrade the ImageNet result to a preliminary observation. As written, the ImageNet numbers do not carry the same weight as the CIFAR-10 results in the paper's argument.","section":"Sec. 6 and Sec. 4 (ImageNet results)"},{"comment":"The dismissal of PGD-EOT as merely a ``transfer attack'' is too categorical. With enough samples, EOT directly approximates the gradient of the expected loss, which is the standard adaptive attack for stochastic defenses. The paper's claim that PGD-EOT remains suboptimal is based on a low correlation (0.1682) between EOT gradients and the fixed-seed optimal gradient, but a low correlation between gradients of different objectives does not by itself imply that EOT is a weak attack. Moreover, the paper's own PGD-EOT robustness (59.3% on CIFAR-10) is substantially higher than the 46.8% reported by Lee and Kim (2023) under similar full-gradient EOT; this discrepancy is not explained and should be addressed for the comparison with prior work to be meaningful.","section":"Sec. 4, paragraph on EOT"}],"minor_comments":[{"comment":"There are several typos and grammatical slips, e.g., ``stochasiticity'', ``casued'', ``paramter'', ``neibourhood'', ``sigmoidal'', and ``denoise smoothing''; these should be corrected.","section":"Throughout"},{"comment":"The axis labels in Fig. 1c appear to have a missing superscript (\"2 distance\" rather than \"L2 distance\"), and Fig. 3b and 3c lack axis labels or units, making the sigmoid fit hard to interpret.","section":"Fig. 1c and Fig. 3"},{"comment":"The PGD-EOT entry for the fixed-randomness row is empty; if the experiment was not run, state that explicitly rather than leaving a blank cell.","section":"Table 2"},{"comment":"The statement that the fitted curve extrapolates ``smoothly to clean accuracies at the y-intercept'' needs a precise specification of what quantity is being predicted (e.g., which point corresponds to zero compression) and how the extrapolation error is estimated.","section":"Sec. 5, extrapolation claim"},{"comment":"The code is promised for the camera-ready version; for a journal submission, a public repository at submission time would help reproducibility, especially given the heavy computational requirements and the importance of the exact seed-hashing scheme in Eq. (12)-(13).","section":"Appendix D"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a question of current interest and is transparent about its computational constraints. The main risk is that the headline quantitative claim (23.7% net robustness) is presented as measuring the stochastic defense's true robustness, when it actually measures a fixed-seed deterministic realization under a tailored attack. This is fixable by reframing the claims and adding a standard adaptive evaluation (e.g., EOT with sufficient samples) as a reference point. The compression-rate relation is promising but needs stronger empirical support before being called a law. I would not reject the paper, but the revision must confront the fixed-randomness issue head-on. The fit with the journal's scope is good if the journal welcomes empirical/mechanistic studies of robustness."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper has one genuinely new observation and one practically useful idea. The push-away effect — diffusion purification increasing, not decreasing, ℓp distance to clean images — is solid, reproducible, and challenges a common intuition. The compression-rate predictor for robustness is also a good practical tool: if it holds up, it gives a cheap, gradient-free way to tune diffusion-based defenses. The experiments are extensive and the authors are transparent about their limitations (no full ImageNet gradients, possible gradient masking at high timesteps). I'd send this to a serious referee without hesitation.\n\nThe soft spot is the central quantitative claim. The 23.7% figure comes from setting the attack's randomness equal to the defense's randomness (ξ_attack = ξ_test). That hands the attacker the exact realization of the defense. A deployed stochastic purification system draws fresh randomness at test time, so the attack is optimizing against a specific deterministic function, not the stochastic system. The paper's own transfer numbers show how much this matters: a PGD attack generated under one seed, evaluated under another, gives 77.4% on CIFAR-10, close to the 85.8% clean accuracy. That attack is nearly harmless against a mismatched seed, which means stochasticity is not an evaluation artifact to be subtracted — it is part of the defense surface. So the decomposition into 'stochasticity' vs. 'compression' is not established for the stochastic systems the paper discusses. The 23.7% is a valid robustness estimate for a deterministic realization, but the authors overreach when they present it as the net or actual robustness gain.\n\nThe compression-robustness 'law' is also weaker than the language suggests. The sigmoid is fit post hoc to roughly 15 points on CIFAR-10, with no error bars in Table 7. It's a suggestive correlation, not a law. The idea is still worth reporting, but the word 'reliable indicator' should be softened.\n\nThese issues are addressable. Reframe the fixed-randomness protocol as a worst-case deterministic analysis, or as a lower bound for the stochastic system, and the paper becomes accurate and still interesting. The compression-rate predictor does not depend on the flawed decomposition and is worth preserving. I'd advise the authors to revise carefully rather than reconsider the paper's existence.\n\nFor you: this paper is worth a reading-group slot to debate the evaluation protocol. I'd cite the compression-rate idea if I were working on purification. And yes, it deserves peer review — the referee should focus on the semantics of the fixed-randomness evaluation.","headline":"Real observations and a useful compression-rate predictor, but the headline 'net robustness drops to 24%' overreaches because the fixed-randomness protocol measures a deterministic instantiation, not the stochastic defense as deployed.","tokens_in":17524,"tokens_out":2458,"would_cite":true,"duration_ms":27677,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Diffusion-model purification improves adversarial robustness through two mechanisms: stochasticity that confuses gradient attacks, and a deterministic compression of image space that a gradient-free compression rate predicts.","keywords":["adversarial purification","diffusion models","stochasticity","compression rate","gradient masking","robustness evaluation","anchor points","CIFAR-10"],"falsifier":"Compute CIFAR-10 robust accuracy under the same fixed-seed protocol but with an attack that can also choose the seed, or with 1000 PGD steps instead of 40; if accuracy falls well below 23.7%, the claim that 23.7% is the intrinsic non-stochastic robustness is falsified. Alternatively, find a sampler with compression rate below 0.2 whose robust accuracy lies far off the fitted sigmoid curve.","tokens_in":16465,"feed_emoji":"🛡️","tokens_out":8228,"duration_ms":86679,"temperature":0.7,"pith_summary":"The paper sets out to explain how diffusion-model-based adversarial purification actually works, and how well it works once randomness is no longer allowed to hide the defense. It shows that diffusion models do not denoise adversarial images back toward their clean originals; instead they push them to anchor points that are farther from the clean image, while compressing the local image space around those anchor points. The dominant component of reported robustness is the diffusion model's internal randomness: when the same random configuration is used for both attack and testing, the robustness gain on CIFAR-10 drops from roughly 70% (or 46% with expectation-over-transformation) to 23.7%. The remaining gain is explained by a compression rate, a gradient-free quantity that follows a sigmoid law with robust accuracy, which the paper offers as a practical robustness indicator and a design target for purification systems.","feed_headline":"Diffusion defense accuracy drops to 24% when randomness is fixed","feed_subtitle":"The 70% boost was mostly stochastic confusion; a gradient-free compression rate predicts the rest.","key_machinery":"The carrying machinery is the first-order Taylor decomposition of the purification map around the clean image, which separates the map into an anchor point and a local linear transformation. The compression rate, defined as the norm of the output difference divided by the norm of the input difference, quantifies how much the adversarial ball shrinks under the diffusion model; the paper shows that this rate predicts robust accuracy through a sigmoid curve that matches the base classifier's robustness under reduced attack budgets. A second piece of machinery is the variance decomposition of the purification output into input variability and internal-randomness variability, whose ratio defines the signal-to-noise ratio and proves that stochasticity dominates.","core_discovery":"On its own terms, the paper's central discovery is that the empirically observed robustness of diffusion-based purification decomposes into two sources: stochasticity and a deterministic compression effect. The stochasticity is not a minor detail; the signal-to-noise ratio of purification is about 6 times 10 to the minus 3, meaning internal noise dominates input variations roughly 170-fold. Concretely, when the same noise configuration is used for both attack and testing, CIFAR-10 PGD robust accuracy is 23.7%, compared with roughly 70% reported by the original DiffPure evaluation and roughly 46% under PGD-EOT, while ImageNet BPDA accuracy is 29.5%. The residual robustness follows a lawful relationship with the compression rate, the ratio of the purification output difference to the input difference, which can be measured without any gradient computation and which extrapolates to the clean accuracy at zero compression.","pith_inferences":["The fixed-seed protocol may be optimistic in the opposite direction: if an attacker is allowed to choose or optimize the random seed, the 23.7% figure could drop further, meaning the paper's number is an upper bound under its specific attack budget rather than a certificate against adversarially chosen randomness.","The compression-rate theory should transfer to other generative purification maps such as GANs, VAEs, or autoencoders; any map with accurate anchor points and strong Jacobian compression should show the same sigmoid robustness law, a claim that can be tested without diffusion-specific machinery.","The push-away of clean images suggests clean images are not local modes of the learned prior, and the observed switch from expansion to shrinkage for larger perturbations hints that a scale-dependent purification schedule, compressing hard for small perturbations and denoising for large ones, may outperform a single fixed timetable."],"forward_implications":["Reported DiffPure robustness numbers that do not fix randomness should be read as transfer-attack performance rather than intrinsic robustness: they mix a genuine compression effect with a stochasticity-induced failure of the attack to converge.","The compression rate offers a gradient-free way to tune purification systems: searching diffusion timesteps and samplers for lower compression rates predicts higher robustness, as seen with reverse-only models reaching 46.5% at larger timesteps.","Because the compression-robustness curve traces the base classifier's behavior under smaller attack budgets, compression acts like an effective reduction of the adversarial budget, tying diffusion purification to classical budget-robustness tradeoffs.","A purification system designed around the two criteria of high clean accuracy at anchor points and strong compression around them should achieve robustness without relying on stochasticity, pointing toward compression-based purification rather than random-noise defenses."],"supporting_citations":[{"why":"Supplies the DiffPure method and the original ~70% robustness claim that the paper re-evaluates.","marker":"Nie et al., 2022"},{"why":"Supplies the stronger PGD-EOT evaluation (~46.84%) that motivates the paper's fixed-randomness protocol.","marker":"Lee & Kim, 2023"},{"why":"Provides another independent robustness estimate (~45.83%) and the ADBM bridge-model baseline.","marker":"Li et al., 2025"},{"why":"Establishes EOT, BPDA, and the notion of stochastic or obfuscated gradients, the theoretical lens for why randomness misleads evaluation.","marker":"Athalye et al., 2018"},{"why":"Defines the DDPM forward and reverse processes and the randomness equations used in the analysis.","marker":"Ho et al., 2020"},{"why":"Defines DDIM, the deterministic sampler used to test the compression effect without reverse-process noise.","marker":"Song et al., 2020a"}],"fun_headline_variants":["Diffusion robustness mostly comes from randomness, not purification","Fixing randomness drops diffusion defense to 24% on CIFAR-10","Gradient-free compression rate predicts diffusion defense gains","Diffusion defense's 70% boost shrinks to 24% without stochasticity","Why diffusion robustness is a mirage: stochasticity inflates gains"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The decomposition into stochasticity plus compression assumes that fixing the random seed during both attack and test measures the diffusion model's intrinsic robustness; if the fixed seed is merely a stationary target that is easier to attack than the real stochastic system, the 23.7% figure would understate the defense's actual robustness.","fun_headline_variants_meta":{"raw":{"variants":["Diffusion robustness mostly comes from randomness, not purification","Fixing randomness drops diffusion defense to 24% on CIFAR-10","Gradient-free compression rate predicts diffusion defense gains","Diffusion defense's 70% boost shrinks to 24% without stochasticity","Why diffusion robustness is a mirage: stochasticity inflates gains"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000217,"raw_usage":{"total_tokens":1421,"prompt_tokens":913,"completion_tokens":508,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":529,"completion_tokens_details":{"reasoning_tokens":417}},"tokens_in":529,"tokens_out":508,"duration_ms":6140,"temperature":1.0,"reasoning_tokens":417,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:59:05.268164+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute CIFAR-10 robust accuracy under the same fixed-seed protocol but with an attack that can also choose the seed, or with 1000 PGD steps instead of 40; if accuracy falls well below 23.7%, the claim that 23.7% is the intrinsic non-stochastic robustness is falsified. Alternatively, find a sampler with compression rate below 0.2 whose robust accuracy lies far off the fitted sigmoid curve.","supporting_citations":[],"review_version":1}