DiffBreak: Is Diffusion-Based Purification Robust?
Andre Kassis, Urs Hengartner, Yaoliang Yu
TL;DR
This work challenges the core claim that diffusion-based purification (DBP) is robust to adversarial examples by showing that gradient-based adaptive attacks can steer the diffusion score model during purification, producing adversarial outputs rather than clean ones. It introduces DiffBreak and DiffGrad to enable reliable, gradient-informed attacks through DBP, and proposes a majority-vote (MV) robustness estimator to counteract stochasticity, along with a low-frequency (LF) attack that exploits global perturbations. The theoretical result that adaptive attacks can manipulate the purification process undermines prior robustness claims and highlights flaws in one-shot evaluation protocols. The findings demonstrate that current DBP defenses are not viable as standalone solutions and motivate developing purification schemes with private or adversary-inaccessible stochastic dynamics, with DiffBreak providing a standardized toolkit for rigorous future evaluations.
Abstract
Diffusion-based purification (DBP) has become a cornerstone defense against adversarial examples (AEs), regarded as robust due to its use of diffusion models (DMs) that project AEs onto the natural data manifold. We refute this core claim, theoretically proving that gradient-based attacks effectively target the DM rather than the classifier, causing DBP's outputs to align with adversarial distributions. This prompts a reassessment of DBP's robustness, accrediting it two critical factors: inaccurate gradients and improper evaluation protocols that test only a single random purification of the AE. We show that when accounting for stochasticity and resubmission risk, DBP collapses. To support this, we introduce DiffBreak, the first reliable toolkit for differentiation through DBP, eliminating gradient mismatches that previously further inflated robustness estimates. We also analyze the current defense scheme used for DBP where classification relies on a single purification, pinpointing its inherent invalidity. We provide a statistically grounded majority-vote (MV) alternative that aggregates predictions across multiple purified copies, showing partial but meaningful robustness gain. We then propose a novel adaptation of an optimization method against deepfake watermarking, crafting systemic perturbations that defeat DBP even under MV, challenging DBP's viability.