How Do Diffusion Models Improve Adversarial Robustness?
Recent findings suggest that diffusion models significantly enhance empirical adversarial robustness. While some intuitive explanations have been proposed, the precise mechanisms underlying these improvements remain unclear. In this work, we systematically investigate how and how well diffusion models improve adversarial robustness. First, we observe that diffusion models intriguingly increase, rather than decrease, the $\ell_p$ distance to clean samples--challenging the intuition that purification denoises inputs closer to the original data. Second, we find that the purified images are heavily influenced by the internal randomness of diffusion models, where a compression effect arises within each randomness configuration. Motivated by this observation, we evaluate robustness under fixed randomness and find that the improvement drops to approximately 24% on CIFAR-10--substantially lower than prior reports approaching 70%. Importantly, we show that this remaining robustness gain strongly correlates with the model's ability to compress the input space, revealing the compression rate as a reliable robustness indicator without requiring gradient-based analysis. Our findings provide novel insights into the mechanisms underlying diffusion-based purification, and offer guidance for developing more effective and principled adversarial purification systems.
Code (0)
등록된 구현이 없습니다.
Tasks
Adversarial PurificationAdversarial RobustnessMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
D4: Detection of Adversarial Diffusion Deepfakes Using Disjoint Ensembles
Detecting diffusion-generated deepfake images remains an open problem. Current detection methods fail against an adversary who adds imperceptible adversarial perturbations to the deepfake to evade detection. In this work…
Adversarial RobustnessDeepFake DetectionFace SwappingImproving Adversarial Robustness by Contrastive Guided Diffusion Process
Synthetic data generation has become an emerging tool to help improve the adversarial robustness in classification tasks since robust learning requires a significantly larger amount of training samples compared with stan…
Adversarial RobustnessSynthetic Data GenerationAdversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
Recently, the text-to-image diffusion model has gained considerable attention from the community due to its exceptional image generation capability. A representative model, Stable Diffusion, amassed more than 10 million …
Adversarial AttackImage GenerationSurveyDensePure: Understanding Diffusion Models towards Adversarial Robustness
Diffusion models have been recently employed to improve certified robustness through the process of denoising. However, the theoretical understanding of why diffusion models are able to improve the certified robustness i…
Adversarial RobustnessDenoisingRobust Classification via a Single Diffusion Model
Diffusion models have been applied to improve adversarial robustness of image classifiers by purifying the adversarial noises or generating realistic data for adversarial training. However, diffusion-based purification c…
Adversarial DefenseAdversarial RobustnessClassificationmodel+1