Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification

David D. Nguyen, The-Anh Ta, Yansong Gao, Alsharif Abuadbba

TL;DR

NADD advances diffusion-based adversarial purification by intentionally amplifying forward diffusion noise and guiding purification with a ring-based proximity constraint, balancing robustness and utility. The method introduces ring proximity correction, a tailored correction schedule, and stochastic sampling, all backed by theoretical guarantees that purified samples remain within a ring around the original input. Empirically, NADD achieves a new robustness record on ImageNet (AutoAttack at $\ell_{\infty}=4/255$) and runs orders of magnitude faster than prior diffusion purifiers, enabling practical deployment. These results demonstrate that controlled noise amplification, when coupled with ring-aware guidance and stochasticity, yields scalable, gradient-nonobfuscated defenses against strong white-box attacks.

Abstract

The strategy of combining diffusion-based generative models with classifiers continues to demonstrate state-of-the-art performance on adversarial robustness benchmarks. Known as adversarial purification, this exploits a diffusion model's capability of identifying high density regions in data distributions to purify adversarial perturbations from inputs. However, existing diffusion-based purification defenses are impractically slow and limited in robustness due to the low levels of noise used in the diffusion process. This low noise design aims to preserve the semantic features of the original input, thereby minimizing utility loss for benign inputs. Our findings indicate that systematic amplification of noise throughout the diffusion process improves the robustness of adversarial purification. However, this approach presents a key challenge, as noise levels cannot be arbitrarily increased without risking distortion of the input. To address this key problem, we introduce high levels of noise during the forward process and propose the ring proximity correction to gradually eliminate adversarial perturbations whilst closely preserving the original data sample. As a second contribution, we propose a new stochastic sampling method which introduces additional noise during the reverse diffusion process to dilute adversarial perturbations. Without relying on gradient obfuscation, these contributions result in a new robustness accuracy record of 44.23% on ImageNet using AutoAttack ($\ell_{\infty}=4/255$), an improvement of +2.07% over the previous best work. Furthermore, our method reduces inference time to 1.08 seconds per sample on ImageNet, a $47\times$ improvement over the existing state-of-the-art approach, making it far more practical for real-world defensive scenarios.

NADD: Amplifying Noise for Effective Diffusion-based Adversarial Purification

TL;DR

NADD advances diffusion-based adversarial purification by intentionally amplifying forward diffusion noise and guiding purification with a ring-based proximity constraint, balancing robustness and utility. The method introduces ring proximity correction, a tailored correction schedule, and stochastic sampling, all backed by theoretical guarantees that purified samples remain within a ring around the original input. Empirically, NADD achieves a new robustness record on ImageNet (AutoAttack at ) and runs orders of magnitude faster than prior diffusion purifiers, enabling practical deployment. These results demonstrate that controlled noise amplification, when coupled with ring-aware guidance and stochasticity, yields scalable, gradient-nonobfuscated defenses against strong white-box attacks.

Abstract

The strategy of combining diffusion-based generative models with classifiers continues to demonstrate state-of-the-art performance on adversarial robustness benchmarks. Known as adversarial purification, this exploits a diffusion model's capability of identifying high density regions in data distributions to purify adversarial perturbations from inputs. However, existing diffusion-based purification defenses are impractically slow and limited in robustness due to the low levels of noise used in the diffusion process. This low noise design aims to preserve the semantic features of the original input, thereby minimizing utility loss for benign inputs. Our findings indicate that systematic amplification of noise throughout the diffusion process improves the robustness of adversarial purification. However, this approach presents a key challenge, as noise levels cannot be arbitrarily increased without risking distortion of the input. To address this key problem, we introduce high levels of noise during the forward process and propose the ring proximity correction to gradually eliminate adversarial perturbations whilst closely preserving the original data sample. As a second contribution, we propose a new stochastic sampling method which introduces additional noise during the reverse diffusion process to dilute adversarial perturbations. Without relying on gradient obfuscation, these contributions result in a new robustness accuracy record of 44.23% on ImageNet using AutoAttack (), an improvement of +2.07% over the previous best work. Furthermore, our method reduces inference time to 1.08 seconds per sample on ImageNet, a improvement over the existing state-of-the-art approach, making it far more practical for real-world defensive scenarios.
Paper Structure (21 sections, 1 theorem, 76 equations, 5 figures, 5 tables)

This paper contains 21 sections, 1 theorem, 76 equations, 5 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Preliminaries
  4. Noise Amplified Diffusion Defence
  5. Requirements for Purification with More Noise
  6. Theoretical Diffusion Framework
  7. Ring Proximity Correction
  8. Stochastic Sampling
  9. Theoretical Proofs
  10. Experiments
  11. Setup
  12. Comparison to State-of-The-Art
  13. Ablation Study
  14. Discussion
  15. Conclusion
  16. ...and 6 more sections

Key Result

Theorem 1

Given a pretrained diffusion model with denoiser $D_{\theta}$, number of steps $T$ and diffusion coefficient function $\sigma(t)$. Assume that $(i)$$\sigma(t) = t$ and $t_{i+1} - t_i \leq \Delta \frac{T}{N}$, for some constant $\Delta$; $(ii)$ the diffusion model is well-trained so that the denoiser

Figures (5)

  • Figure 1: Diffusion trajectories for a bimodal data distribution according to a VPSDE. \ref{['fig1a:success']} The red line depicts the forward path, where noise is added to a sample evolving according to the forward diffusion process. The pink line shows the reverse path, ideally returning the noisy sample to its initial mode, centered at 1. \ref{['fig1b:error']} An example of purification error, where a noisy sample from the mode centered at 1 follows a reverse path (orange) that incorrectly returns it to another mode, centered at -1.
  • Figure 2: Output space of the original image depicting the true class (blue) and adversarial class (red) regions. Adversarial examples $(\mathbf{x}_a)$ will sit near decision boundaries. \ref{['fig2a:class']} Class conditioned purification relies upon the guidance of a classifier. A compromised classifier will push purified adversarial examples $(\hat{\mathbf{x}}_a)$ and benign examples $(\mathbf{\hat{x}})$ away from the decision boundary. \ref{['fig2b:prox']} Proximity conditioned purification bounds the purified samples within a local region (dark red) defined by $\kappa_{max}$. A significant portion of this local region will include the adversarial class. \ref{['fig2c:ours']} Ring proximity condition will concentrate purified samples within a ring-like region (dark red) defined by $\kappa_{min}$ and $\kappa_{max}$. This reduces the probability of producing a sample from the adversarial class.
  • Figure 3: Comparison of purification frameworks for adversarial defense: NADD (left) and DiffPure (right). Both frameworks aim to restore adversarial inputs to their original, non-adversarial form before classification. In NADD, a high diffusion time during the forward process effectively removes adversarial perturbations. The ring proximity corrections ensures that purified data is close to the original and stochastic sampling introduces noise throughout the reverse process. In contrast, DiffPure produces poor reconstructions semantically distant from the original input at high noise levels.
  • Figure 4: ImageNet reconstructions by three models at various noise levels defined by $\sigma_{t^\prime}$. The VPSDE model, as used by Nie et al. nie2022diffusion and Lee et al. lee2023robust, shows difficulty in preserving fine details, such as the bamboo stick, starting from $\sigma_{t^\prime} \geq 4$ and fails to maintain the recognizable structure of the panda at $\sigma_{t^\prime} = 16$. The EDM2 model karras2022elucidating encounters similar challenges even at lower noise levels, displaying degradation in image quality. In contrast, our proposed NADD framework significantly enhances the EDM2 model's ability to reconstruct images, demonstrating consistent high-quality outputs even at high noise levels up to $\sigma_{t^\prime} = 16$.
  • Figure 5: The influence of proposed techniques on standard and robust accuracies against PGD+EOT $\ell_\infty$ ($\varepsilon$=8/255), and $\ell_2$ ($\varepsilon$=0.5), using CIFAR-10 and WideResNet-28-10. Each subplot illustrates the relative change in accuracy (y-axis) based on various factors with 95% confidence interval. The initial x-axis value serves as the reference point for comparison. \ref{['fig3a:ablation']} Higher levels of forward noise, as indicated by $t^\prime$, improves robust accuracy against $\ell_\infty$ and $\ell_2$ attacks, while standard accuracy remains mostly unchanged. \ref{['fig3b:ablation']} Stopping correction within the range $t^\otimes \in [0.4,0.6]$ significantly enhances robust accuracy against both $\ell_\infty$ and $\ell_2$ norms. \ref{['fig3c:ablation']} Increasing reverse noise improves robustness against $\ell_\infty$ attacks however can reduce robustness against $\ell_2$ attacks if too high. \ref{['fig3d:ablation']} This sub-figure shows the robustness of a NADD model evaluated using a radius of $\kappa_{max}-\kappa_{min} = 0.25$. Increasing the ring radius improves robust accuracy however begins to decrease after $\kappa_{max}=1.0$.

Theorems & Definitions (1)

  • Theorem 1: Returning estimate for denoising with correction