Pith. sign in

REVIEW 4 major objections 5 minor 39 references

Random Sampling for Diffusion-based Adversarial Purification

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that replacing stable DDPM/DDIM reverse sampling with maximally random sampling, guided by a mediator variable, makes diffusion-based adversarial purification both faster and substantially more robust, outperforming prior…

desk verdict A simple, fast diffusion purifier that is really just the maximum-stochasticity DDIM corner plus a DPS-style mediator guidance; the headline robustness gains are not yet credible because the EOT evaluation is too weak. read the letter →

arxiv 2411.18956 v1 pith:CM3SFDNJ submitted 2024-11-28 cs.CV cs.AIcs.LG

Jiancheng Zhang , Peiran Dong , Yongyong Chen , Yin-Ping Zhao , Song Guo This is my paper · ORCID
classification cs.CVcs.AIcs.LG
keywords adversarialpurificationdiffusionmodelsrandomsamplingDDIMDDPMmediatorguidancerobustnessscore-basedgenerative
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that the sampling schedule used to reverse a diffusion process should be optimized for adversarial purification, not for stable image generation. Standard DDPM and DDIM sampling keep the trajectory close to the forward noising path, which an attacker can exploit; the paper proposes random sampling, which at each reverse step draws from a fresh noisy space by setting the DDIM variance term to its maximum. To keep purified images faithful, it adds mediator guidance, a gradient correction applied to the predicted clean image rather than to the noisy sample. With both ingredients, a method named DiffAP reports higher standard and robust accuracy than prior diffusion purifiers, and maintains its advantage when the number of denoising steps is cut tenfold. A sympathetic reader would care because this suggests a simple, training-free change to the sampler, not a new model, can substantially improve a test-time defense.

What carries the argument

The load-bearing object is the DDIM family of reverse samplers indexed by noise coefficient σ_t; random sampling is the extreme member σ_t = sqrt(1 - ᾱ_t), which discards the previous noisy point and re-samples from an independent Gaussian at every step. The second object is the mediator variable x~0,t, the score model's one-step estimate of the clean image at time t, defined as (x_t - sqrt(1 - ᾱ_t) ε_θ(x_t,t)) / sqrt(ᾱ_t). Mediator guidance applies gradient descent on a distance d(x~0,t, x_adv/clean) to this estimate, rather than to the noisy x_t itself, which the paper argues avoids the gradient bias of earlier guided methods. Together they turn the diffusion purifier into a stochastic denoiser whose randomness is maximized while prediction consistency is pinned to the input.

What would settle it

Run the same DiffAP defense under an adaptive attack that is allowed to backpropagate through the full random sampling trajectory with the defender's exact noise draws: if robust accuracy drops to the level of DDIM sampling, the asserted benefit of extra randomness is an artifact of non-adaptive evaluation rather than a property of the sampler. A simpler check is to vary R_t over a wide range on a held-out set and show that the reported accuracy is not a knife-edge peak.

Watch

Extended reading notes

Core claim

The central discovery is that the amount of stochasticity in the reverse sampler is a first-order robustness knob for diffusion-based purification, and that this knob can be turned to its maximum without destroying output quality if guidance is applied to the right variable. Parameterizing the DDIM joint distribution family with a noise rate k_t, the paper observes that robust accuracy rises monotonically as k_t goes from 0 (DDIM) to 1 (random sampling). Random sampling sets σ_t = sqrt(1 - ᾱ_t), making x_{t-1} independent of the previous noisy sample except through the score model's prediction of the clean image. Mediator guidance then nudges that predicted clean image x~0,t toward the input by gradient descent on a distance metric, applied intermittently (every k steps) to save computation and avoid collapse. The combined method DiffAP is reported to outperform state-of-the-art purifiers on CIFAR-10 against PGD+EOT ℓ∞ and ℓ2 attacks, with the biggest margins under an asynchronous attack where the defender uses more forward steps than the attacker.

Load-bearing premise

The method rests on the heuristic that gradient descent on the predicted clean image toward the input removes the adversarial perturbation without pulling the purifier back onto it; the guidance weight R_t and guidance interval k are chosen experimentally, and no proof guarantees this balance holds.

Editorial extensions

If this is right

  • Setting the reverse-sampling noise rate to its maximum yields strictly higher robust accuracy than DDPM or DDIM sampling under PGD+EOT attacks, with the gap growing as attacks get stronger.
  • Guidance applied to the predicted clean image keeps standard accuracy near the clean classifier accuracy even as the number of forward steps grows, where unconditional purification degrades.
  • DiffAP maintains robust accuracy above 80% when the number of denoising steps is reduced from 100 to 10, a tenfold speedup that makes other conditional purifiers collapse.
  • Random sampling is the main reason DiffAP retains its advantage under asynchronous attacks, where the attacker uses fewer forward steps than the defender.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication left implicit is that the monotone dependence of robust accuracy on the sampling noise rate k_t provides a single dial for tuning the robustness-speed trade-off of any diffusion purifier, not just the endpoints the paper tests.
  • A natural extension would be to test whether the same random-sampling-plus-mediator recipe transfers to score models trained on other modalities, such as audio or tabular data, where adversarial purification is less explored.
  • The paper's evaluation assumes the attacker does not have access to the defender's exact random draws; an adaptive attacker who backpropagates through the full stochastic trajectory could reveal whether the randomness benefit is intrinsic or partly an artifact of the evaluation protocol.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a new sampling scheme, called random sampling, for diffusion-based adversarial purification: within the DDIM-family update, the stochastic noise coefficient is set to its maximum value (σ_t = sqrt(1 - ᾱ_{t-1})), so that each reverse step re-samples from a fresh noisy space rather than from a space adjacent to the previous sample. To maintain prediction consistency under this highly stochastic schedule, the paper introduces mediator guidance, which applies gradient descent on the predicted clean image x̃_{0,t} toward the input, performed every k-th step. The combined method, DiffAP, is evaluated on CIFAR-10 with a WideResNet-28-10 classifier using PGD+EOT attacks, including a newly proposed asynchronous attack where the attacker's number of forward steps differs from the defender's. The paper reports that DiffAP significantly outperforms DiffPure, GDMP, and MimicDiffusion in both standard and robust accuracy, and that it retains high robustness with 10× fewer denoising steps.

Significance. If the results hold, the paper makes a useful and simple contribution: replacing the commonly used stable sampling with maximally stochastic sampling in the DDIM family, combined with a strong conditioning mechanism, could improve both robustness and speed of diffusion-based purification. The proposed mediator guidance is an interpretable heuristic that appears to stabilize prediction consistency in the authors' experiments, and the paper's exploration of sampling schedules and forward-step configurations adds useful empirical data to the guided-purification literature. The core method is not circular: random sampling is a concrete choice of σ_t in the existing DDIM family, and the evaluation is internally consistent and inexpensive to reproduce. However, the strength of the claims depends critically on several evaluation and reporting choices—most notably the number of EOT samples, the unreported value of the guidance factor R_t, and the relationship between the guided results and the unconditional results in the appendix—so the general claim of a large, robust advantage is not yet fully established.

major comments (4)
  1. [Sec. 3.3 and Algorithm 1] The paper never specifies the value (or schedule) of the guidance factor R_t, although it is a central hyperparameter in Eq. (8) and Algorithm 1. The sentence in Sec. 3.3 that R_t 'could be calculated directly without additional constraints' is not followed by a formula or numerical value, and neither the main text nor the appendix reports the R_t used for Tables 1–3. Because the mediator update moves x̃_{0,t} toward the (possibly adversarial) input, the method's behavior depends heavily on this coefficient; without reporting it, the experiments are not reproducible and the sensitivity of DiffAP to this choice is unknown. The authors should state the exact R_t (and any t-dependence) and provide a sensitivity study over R_t and the guidance modulus k.
  2. [Sec. 3.2 and Appendix Sec. 8 (Fig. 7)] The paper states that 'the randomness of the sampling process is almost proportional to the robustness of the sampling method' and presents Fig. 1 as evidence. However, the unconditional results in Appendix Fig. 7 show the opposite ordering at large forward steps: at 200 forward steps, random (maximally stochastic) sampling has slightly lower robust accuracy than DDIM, and the text explicitly acknowledges that 'the final robust accuracy is slightly lower' for random sampling. This contradicts the unqualified proportionality claim and indicates that the benefit of random sampling is specific to the mediator-guided setting, not a general property of the sampling scheme. The central motivation in the abstract and introduction should be adjusted to reflect this, or the authors should explain why guidance reverses the ordering.
  3. [Sec. 4.1 and Eq. (5)] The defense is highly stochastic: at each of the M denoising steps, Eq. (5) draws an independent Gaussian with variance 1−ᾱ_{t-1}, so the purified output is a random function of the input. The attack, however, uses only 5 EOT samples (Sec. 4.1). With finite EOT, the estimated attack gradient is a noisy approximation of the expected gradient over this randomness, and the reported robust accuracies—especially the >20% advantage in Table 2—may partly reflect the attacker's inability to optimize through the stochastic trajectory rather than genuine removal of the adversarial perturbation. The authors should evaluate with larger EOT values (e.g., 20, 50) and/or an adaptive attack such as BPDA+EOT, and report whether the robustness gains persist.
  4. [Sec. 3.3 Eqs. (7)–(8)] The mediator guidance is motivated as avoiding the 'gradient bias' of GDMP and DPS, but the update x̃_{0,t} ← x̃_{0,t} − R_t ∇d(x̃_{0,t}, x_adv) moves the predicted clean image directly toward the input, which can in principle reintroduce the adversarial perturbation. The paper does not analyze this trade-off, nor does it provide a theoretical or diagnostic argument that the gradient step improves prediction consistency without re-introducing adversarial structure. The choice of R_t and the partial guidance (every k-th step) are defended only by the empirical results in Sec. 4.2. To substantiate the claimed mechanism, the authors should provide an analysis or at least a measurement of how the distance between the purified x̃_0 and the clean image evolves during the reverse process for different R_t and attack strengths.
minor comments (5)
  1. [Sec. 5 (Introduction)] The word 'futher' in the sentence introducing the experiments should be 'further'.
  2. [Tables 1 and 3] The standard accuracy for DiffAP is reported as 95.90 ± 1.20 at 100 denoising steps and 95.90 ± 1.24 at 10 denoising steps. It is suspicious that the values are identical to two decimal places; please clarify whether this is a coincidence, a typo, or due to a shared random seed that makes the standard-accuracy evaluation identical across denoising steps.
  3. [Sec. 3.2] The paper would benefit from stating explicitly that the choice σ_t = √(1−ᾱ_{t-1}) in Eq. (5) corresponds to k_t=1 in the reparameterization of Eq. (4), i.e., the maximum allowed stochasticity in the DDIM family, which would make the connection to Eq. (3) clearer.
  4. [Sec. 2.1] The phrase 'with theoretical guarantee, DiffPure preliminarily demonstrated' is misleading if the guarantee refers only to SDE discretization error rather than to adversarial robustness; the nature of the guarantee should be stated more precisely.
  5. [Fig. 2] The conceptual trajectory figure is hard to interpret; the caption should explain what the different colored points and circles represent (e.g., ideal DDIM points, actual sampling points, and the noise level of the sampling space).

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the sampling scheme is a defined extreme of the known DDIM family and the robustness gains are evaluated empirically; no predicted quantity reduces to a fitted parameter or to a self-citation.

full rationale

The paper's derivation chain is self-contained rather than circular. Random sampling is explicitly defined as the maximum-noise extreme of the DDIM joint distribution family (Sec. 3.1-3.2, Eq. 4-5), and the paper acknowledges that this is a special case of the DDIM framework. The claim that more randomness improves robustness is supported by varying the noise-rate parameter k_t and measuring robust accuracy (Fig. 1, Sec. 4.3-4.4); it is an empirical finding, not a quantity that is forced by definition. Mediator guidance (Sec. 3.3, Eq. 7-8) applies gradient-based steering to the predicted clean image, but the final purified image is not defined to equal the input, and the reported standard/robust accuracy is measured by an external classifier under PGD+EOT, so the consistency result is not a tautology. The hyperparameters R_t and k are chosen experimentally, which is standard configuration rather than fitting a prediction to a target metric. There are no same-author citations used as load-bearing evidence, and no uniqueness theorem is imported from the authors' prior work. The appendix's Fig. 7 and the conclusion's uncertainty note are honest limitations: unconditional random sampling is not uniformly better than DDIM, so the headline advantage depends on the mediator interaction; this weakens the breadth of the empirical claim but does not indicate circular reasoning.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a known sampling family (DDIM), a pretrained diffusion model, and two heuristic design choices (mediator guidance and its hyperparameters). No new physical or mathematical entities are introduced. The free parameters (k_t, R_t, k, T, M) are all chosen experimentally or by design, which adds a fitting burden but does not make the derivation circular.

free parameters (4)
  • Random noise ratio k_t = 1
    Set to the maximum value (1) to maximize sampling randomness; chosen based on the trend in Fig. 1 (Sec. 3.2).
  • Guidance factor R_t = Fixed constant (value not specified in text)
    Controls the strength of mediator guidance in Eq. (7); selected experimentally as a fixed constant (Sec. 3.3).
  • Guidance frequency modulus k = 2
    Determines the subsequence of denoising steps where guidance is applied; chosen for stable and effective guidance with very few denoising steps (Sec. 3.3).
  • Number of forward steps T and denoising steps M = T=1000, M=100 or M=10
    Configurable evaluation settings; the M=10 case gives the 10x acceleration claim. These are chosen based on the evaluation in Sec. 4 and 5.
assumptions (4)
  • standard math The DDIM joint distribution family (Eq. 3) with any sigma_t maintains the same marginals q(x_t | x_0) as the forward process.
    Taken from DDIM [26]; used to justify that the random sampling update is a valid reverse process even at maximum stochasticity.
  • domain assumption The pretrained score-based SDE diffusion model [29] provides accurate score estimates on CIFAR-10 for all time steps used.
    The method relies on the pretrained model's ability to estimate the mediator variable x~0,t accurately under highly stochastic sampling; not verified in this paper.
  • ad hoc to paper Gradient descent on the mediator variable x~0,t toward the input improves prediction consistency without reintroducing adversarial perturbations.
    This heuristic is the basis of mediator guidance (Sec. 3.3, Eqs. 7-8); no theoretical guarantee is provided, and the guidance weight must be tuned to avoid collapse.
  • ad hoc to paper The chosen guidance subset (every k-th step) is sufficient for both consistency and efficiency.
    Justified only by experimental stability; no analysis of the interaction between guidance frequency and sampling method is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Random Sampling for Diffusion-based Adversarial Purification." pith.science (2026). https://pith.science/paper/CM3SFDNJ

@misc{pith2026241118956,
  author       = {Pith},
  title        = {Pith review of: Random Sampling for Diffusion-based Adversarial Purification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CM3SFDNJ}},
  note         = {Machine review of arXiv:2411.18956}
}
abstract

Denoising Diffusion Probabilistic Models (DDPMs) have gained great attention in adversarial purification. Current diffusion-based works focus on designing effective condition-guided mechanisms while ignoring a fundamental problem, i.e., the original DDPM sampling is intended for stable generation, which may not be the optimal solution for adversarial purification. Inspired by the stability of the Denoising Diffusion Implicit Model (DDIM), we propose an opposite sampling scheme called random sampling. In brief, random sampling will sample from a random noisy space during each diffusion process, while DDPM and DDIM sampling will continuously sample from the adjacent or original noisy space. Thus, random sampling obtains more randomness and achieves stronger robustness against adversarial attacks. Correspondingly, we also introduce a novel mediator conditional guidance to guarantee the consistency of the prediction under the purified image and clean image input. To expand awareness of guided diffusion purification, we conduct a detailed evaluation with different sampling methods and our random sampling achieves an impressive improvement in multiple settings. Leveraging mediator-guided random sampling, we also establish a baseline method named DiffAP, which significantly outperforms state-of-the-art (SOTA) approaches in performance and defensive stability. Remarkably, under strong attack, our DiffAP even achieves a more than 20% robustness advantage with 10$\times$ sampling acceleration.

Figures

Figures reproduced from arXiv: 2411.18956 by the authors.

Figure 1
Figure 1. Standard and robust accuracy as we change the rate of [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Conceptual illustration of the sampling trajectory of three different diffusion processes. The orange center area represents the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Standard accuracy as we change the number of defense’s [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 6
Figure 6. Figure 6: Robust accuracy rate as we change the number of at [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 5
Figure 5. Figure 5: Standard and robust accuracy rate as we change the num [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 7
Figure 7. Figure 7: Standard and robust accuracy rate of unconditional cases [PITH_FULL_IMAGE:figures/full_fig_p011_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 24 canonical work pages

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. 1

    2016

  2. [2]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 ,

    arXiv

  3. [3]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Inter- national Conference on Machine Learning, 2017. 5

    work page 2017

  4. [4]

    Security and Privacy Issues in Deep Learning

    Ho Bae, Jaehee Jang, Dahuin Jung, Hyemi Jang, Heonseok Ha, Hyungyu Lee, and Sungroh Yoon. Security and privacy issues in deep learning. arXiv preprint arXiv:1807.11655 ,

    work page Pith review arXiv

  5. [5]

    A survey of deep learning methods for cyber security

    Daniel S Berman, Anna L Buczak, Jeffrey S Chavis, and Cherita L Corbett. A survey of deep learning methods for cyber security. Information, 10(4):122, 2019. 1

    work page 2019

  6. [6]

    Diffusion pos- terior sampling for general noisy inverse problems

    Hyungjin Chung, Jeongsol Kim, Michael Thompson Mc- cann, Marc Louis Klasky, and Jong Chul Ye. Diffusion pos- terior sampling for general noisy inverse problems. In Pro- ceedings of the International Conference on Learning Rep- resentations, 2023. 4, 5, 6, 1

    work page 2023

  7. [7]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on ma- chine learning, pages 2206–2216. PMLR, 2020. 1, 7

    work page 2020

  8. [8]

    Robustbench: a standardized adversarial robustness benchmark

    Francesco Croce, Maksym Andriushchenko, Vikash Se- hwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adversarial robustness benchmark. In Thirty- fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2021. 2, 5

    work page 2021

Show all 39 references
  1. [9]

    Re- sisting adversarial attacks using gaussian mixture variational autoencoders

    Partha Ghosh, Arpan Losalka, and Michael J Black. Re- sisting adversarial attacks using gaussian mixture variational autoencoders. In Proceedings of the AAAI conference on ar- tificial intelligence, pages 541–548, 2019. 2

    2019

  2. [10]

    Improv- ing robustness using generated data

    Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy Mann. Improv- ing robustness using generated data. In Neural Information Processing Systems, 2021. 1

    2021

  3. [11]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 1

    2016

  4. [12]

    Stochas- tic security: Adversarial defense using long-run dynamics of energy-based models

    Mitch Hill, Jonathan Mitchell, and Song-Chun Zhu. Stochas- tic security: Adversarial defense using long-run dynamics of energy-based models. arXiv preprint arXiv:2005.13525,

    2005 arXiv

  5. [13]

    Stochastic security: Adversarial defense using long-run dy- namics of energy-based models

    Mitch Hill, Jonathan Craig Mitchell, and Song-Chun Zhu. Stochastic security: Adversarial defense using long-run dy- namics of energy-based models. In Proceedings of the Inter- national Conference on Learning Representations, 2021. 1, 7

    2021

  6. [14]

    DISCO: Adversarial defense with local implicit functions

    Chih-Hui Ho and Nuno Vasconcelos. DISCO: Adversarial defense with local implicit functions. In Advances in Neural Information Processing Systems, 2022. 1

    2022

  7. [15]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In NeurIPS, pages 6840–6851,

  8. [16]

    Sta- ble neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks

    Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Sta- ble neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks. Advances in Neural Information Processing Systems, 34:14925–14937, 2021. 1

    2021

  9. [17]

    Imagenet classification with deep convolutional neural net- works

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural net- works. Advances in neural information processing systems , 25, 2012. 1

    2012

  10. [18]

    Robust evaluation of diffusion-based adversarial purification, 2023

    Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification, 2023. 1, 2, 3, 4, 5, 6, 7, 8

    2023

  11. [19]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 1

    2021

  12. [20]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ArXiv, abs/1706.06083, 2017. 1

    2017 arXiv

  13. [21]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations ,

  14. [22]

    Learn- ing in implicit generative models

    Shakir Mohamed and Balaji Lakshminarayanan. Learn- ing in implicit generative models. arXiv preprint arXiv:1610.03483, 2016. 3

    2016 arXiv

  15. [23]

    Diffusion models for ad- versarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for ad- versarial purification. ArXiv, abs/2205.07460, 2022. 1, 2, 3, 5, 7, 8

    2022 arXiv

  16. [24]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural information...

    2022

  17. [25]

    Defense-gan: Protecting classifiers against adversarial at- tacks using generative models

    Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adversarial at- tacks using generative models. ArXiv, abs/1805.06605,

    arXiv

  18. [26]

    Denois- ing diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denois- ing diffusion implicit models. In International Conference on Learning Representations, 2020. 1, 3, 5

    2020

  19. [27]

    Mimicd- iffusion: Purifying adversarial perturbation via mimicking clean diffusion model, 2023

    Kaiyu Song, Hanjiang Lai, Yan Pan, and Jian Yin. Mimicd- iffusion: Purifying adversarial perturbation via mimicking clean diffusion model, 2023. 1, 2, 3, 4, 5, 6, 7, 8

    2023

  20. [28]

    Pixeldefend: Leveraging genera- tive models to understand and defend against adversarial ex- 9 amples

    Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Er- mon, and Nate Kushman. Pixeldefend: Leveraging genera- tive models to understand and defend against adversarial ex- 9 amples. In International Conference on Learning Represen- tations, 2018. 2

    2018

  21. [29]

    Score-based generative modeling through stochastic differential equa- tions

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equa- tions. In International Conference on Learning Represen- tations, 2021. 1, 2, 4, 5

    2021

  22. [30]

    Robustifying models against adversarial attacks by langevin dynamics

    Vignesh Srinivasan, Csaba Rohrer, Arturo Marban, Klaus- Robert M ¨uller, Wojciech Samek, and Shinichi Nakajima. Robustifying models against adversarial attacks by langevin dynamics. Neural Networks, 137:1–17, 2021. 2

    2021

  23. [31]

    Guided diffusion model for adversarial purification

    Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. ArXiv, abs/2205.14969, 2022. 1, 2, 3, 4, 5, 6, 7, 8

    2022 arXiv

  24. [32]

    Deep face recognition: A survey

    Mei Wang and Weihong Deng. Deep face recognition: A survey. Neurocomputing, 429:215–244, 2021. 1

    2021

  25. [33]

    Adversar- ial purification with score-based generative models

    Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversar- ial purification with score-based generative models. In In- ternational Conference on Machine Learning, pages 12062– 12072. PMLR, 2021. 1, 2

    2021

  26. [34]

    Freedom: Training-free energy-guided condi- tional diffusion model

    Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang. Freedom: Training-free energy-guided condi- tional diffusion model. arXiv:2303.09833, 2023. 4

    2023 arXiv

  27. [35]

    Wide residual net- works

    Sergey Zagoruyko and Nikos Komodakis. Wide residual net- works. ArXiv, abs/1605.07146, 2016. 5

    2016 arXiv

  28. [36]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In In- ternational Conference on Machine Learning, 2019. 1 10 Appendix This document supplies more detailed der...

    2019

  29. [37]

    Analysis of Different Condition Guidance To reveal the gradient bias introduced by the previous guid- ance method, we adopt M SEas the distance index d(∗, ∗) for analysis. From the view of our mediator guidance, the xt could be decomposed into the following form: xt = √¯αt ˜x0...

  30. [38]

    Unconditional Sampling Comparison To comprehensively show the difference between differ- ent sampling methods, we supplemented the results without condition guidance as Fig. 7. The number of forward steps varies from 10 to 200, which results in changes of total vari- ance rang...

  31. [39]

    Thus, asynchronous attacks are in- troduced to challenge existing diffusion-based purification methods

    Discussion As demonstrated in [8], finding the worst case is important for defense methods. Thus, asynchronous attacks are in- troduced to challenge existing diffusion-based purification methods. Until now, diffusion-based adversarial purifica- tion methods have had no negativ...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.