Diffusion Models for Adversarial Purification

By Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, Anima Anandkumar. International Conference on Machine Learning, 2022

722 citations recorded by the source corpus.

Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Molecular Biology

View Paper: https://www.semanticscholar.org/paper/9b41d745fe3a76443bd0420bc5f2df28be2bd65f

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Molecular Biology

Citations in the corpus

Better Diffusion Models Further Improve Adversarial Training (2023, background): “Diffusion models have recently gained popularity in adversarial purification (Yoon et al., 2021; Nie et al., 2022; Wang et al., 2022; Xiao et al., 2022), demonstrating promising robust accuracy against AutoAttack.”
Baseline Defenses for Adversarial Attacks Against Aligned Language Models (2023, methodology): “For example, the pre-processing defense of (Nie et al., 2022) has not been broken so far, even though analysis in Zimmermann et al.”
Visual Adversarial Examples Jailbreak Aligned Large Language Models (2023, methodology): “Interestingly, we find that DiffPure can neutralize our visual adversarial examples and prevent jailbreak-ing (see our Appendix).”
PhysDiff: Physics-Guided Human Motion Diffusion Model (2022, background): “Score-based denoising diffusion models [75, 25, 77, 76] have achieved great successes in various applications such as image generation [68, 63, 67, 74, 81], text-to-speech synthesis [36], 3D shape generation [97, 46, 93], machine learning security [55], as well as human motion generation [79, 94, 66”
Jailbreak and Guard Aligned Language Models With Only Few In-Context Demonstrations (2023, neutral): “, 2017] and preprocessing [Nie et al., 2022] defenses in the vision domain, Jain et al.”
Diffusion Models: A Comprehensive Survey of Methods and Applications (2022, background): “Time Series Modeling Time Series Imputation [200],[2],[158] Time Series Forecasting [167],[2] Adversarial Purification Adversarial Purification [150],[239],[17],[210],[218],[197]”
eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoisers (2022, background): “They have driven successful applications such as text-to-image generation [57, 59, 63], natural language generation [41], time series prediction [76], audio synthesis [39], 3D shape generation [49, 87, 91], molecular conformation generation [84], protein structure generation [83], machine learning s”
Diffusion models as plug-and-play priors (2022, methodology): “The last step performs denoising as in [29] to remove artifacts that appear when optimizing with the classifier constraint.”
Dynamic-Backbone Protein-Ligand Structure Prediction with Multiscale Generative Diffusion Models (2022, background): “…y (0) approximately vanishes thus are set to zeros to initialize the reverse-time SDE, and (b) the C α -atom coordinate marginal q T ∗ x C α ( t ) | x (0) is sufﬁciently close to which approximated by the backbone template q T ∗ x C α ( t ) | ˜ x , guided by the theoretical result proposed in [34].”
Security and Privacy Challenges of Large Language Models: A Survey (2024, positive): “To defend the multi-modal prompts against jailbreaking attacks, Qi et al. recently proposed DiffPure [152], a diffusion model-based countermeasure against the visual jailbreaking examples.”
Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models (2023, neutral): “From our experimentation, it appears that preprocessing (e.g., Denoising the input image (Nie et al., 2022)) and postprocessing defenses may offer a more straightforward implementation and greater efficacy against our specific attack.”
Imagic: Text-Based Real Image Editing with Diffusion Models (2022, background): “…traction, as they advanced the state-of-the-art in image generation [16, 31, 61, 65], and have been deployed in various downstream applications such as image restoration [30, 52], adversarial pu-riﬁcation [11, 40], image compression [63], image classiﬁ-cation [69], and others [13,18,32,44,55,67].”