Sample-Specific Noise Injection For Diffusion-Based Adversarial Purification

2025/06/06 by Yuhao Sun, Jiacheng Zhang, Sun, Yuhao +7 · 1 citation
Computer Science · #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis #Machine Learning (cs.LG) #Stochastic Gradient Optimization Techniques

paper · pdf · doi:10.48550/arxiv.2506.06027

openalex publication_date 2025/06/06 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Diffusion-based purification (DBP) methods aim to remove adversarial noise from the input sample by first injecting Gaussian noise through a forward diffusion process, and then recovering the clean example through a reverse generative process. In the above process, how much Gaussian noise is injected to the input sample is key to the success of DBP methods, which is controlled by a constant noise level t^* for all samples in existing methods. In this paper, we discover that an optimal t^* for each sample indeed could be different. Intuitively, the cleaner a sample is, the less the noise it should be injected, and vice versa. Motivated by this finding, we propose a new framework, called Sample-specific Score-aware Noise Injection (SSNI). Specifically, SSNI uses a pre-trained score network to estimate how much a data point deviates from the clean data distribution (i.e., score norms). Then, based on the magnitude of score norms, SSNI applies a reweighting function to adaptively adjust t^* for each sample, achieving sample-specific noise injections. Empirically, incorporating our framework with existing DBP methods results in a notable improvement in both accuracy and robustness on CIFAR-10 and ImageNet-1K, highlighting the necessity to allocate distinct noise levels to different samples in DBP methods. Our code is available at: https://github.com/tmlr-group/SSNI.

Citations

• One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy
• Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training
• Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability
• Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Score
• Diffusion Models for Imperceptible and Transferable Adversarial Attack
• Robust Evaluation of Diffusion-Based Adversarial Purification
• Guided Diffusion Model for Adversarial Purification
• Diffusion Models for Adversarial Purification
• Probabilistic Margins for Instance Reweighting in Adversarial Training
• Adversarial purification with Score-based generative models
• Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart
• Diffusion Models Beat GANs on Image Synthesis
• Neural SDEs as Infinite-Dimensional GANs
• Score-Based Generative Modeling through Stochastic Differential Equations
• Maximum Mean Discrepancy Test is Aware of Adversarial Attacks
• Denoising Diffusion Implicit Models
• A General Framework For Detecting Anomalous Inputs to DNN Classifiers
• Denoising Diffusion Probabilistic Models
• A Self-supervised Approach for Adversarial Robustness
• Stochastic Security: Adversarial Defense Using Long-Run Dynamics of Energy-Based Models
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Adaptive Attacks to Adversarial Example Defenses
• Scalable Gradients for Stochastic Differential Equations
• Generative Modeling by Estimating Gradients of the Data Distribution
• Efficient Decision-based Black-box Adversarial Attacks on Face Recognition
• Adversarial attacks on medical machine learning
• Theoretically Principled Trade-off between Robustness and Accuracy
• A Simple Unified Framework for Detecting Out-of-Distribution Samples and Adversarial Attacks
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Synthesizing Robust Adversarial Examples
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Swin Transformer: Hierarchical Vision Transformer using Shifted Windows
• Swin Transformer: Hierarchical Vision Transformer using Shifted Windows

Cited by

• MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification
• Neural Network Reprogrammability: A Unified Theme on Model Reprogramming, Prompt Tuning, and Prompt Instruction

Related

• Divide and Conquer: Heterogeneous Noise Integration for Diffusion-based Adversarial Purification
• Random Sampling for Diffusion-based Adversarial Purification
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
• MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial Purification
• DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification