DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification

## Abstract

Abstract Recent advances in deep neural networks (DNNs) have led to remarkable success across a wide range of tasks. However, their susceptibility to adversarial perturbations remains a critical vulnerability. Existing diffusion-based adversarial purification methods often require intensive iterative denoising, severely limiting their practical deployment. In this paper, we propose Diffusion Bridge Distillation for Purification (DBLP), a novel and efficient diffusion-based framework for adversarial purification. Central to our approach is a new objective, noise bridge distillation, which constructs a principled alignment between the adversarial noise distribution and the clean data distribution within a latent consistency model (LCM). To further enhance semantic fidelity, we introduce adaptive semantic enhancement, which fuses multi-scale pyramid edge maps as conditioning input to guide the purification process. Extensive experiments across multiple datasets demonstrate that DBLP achieves state-of-the-art (SOTA) robust accuracy, superior image quality, and around 0.2s inference time, marking a significant step toward real-time adversarial purification.

## 1 Introduction

Deep neural networks (DNNs) have achieved remarkable success across a wide range of tasks in recent years. However, their widespread deployment has raised increasing concerns about their security and robustness He et al. (2016); Liu et al. (2021). It is now well-established that DNNs are highly vulnerable to adversarial attacks Szegedy et al. (2014a), wherein imperceptible, carefully crafted perturbations are added to clean inputs to generate adversarial examples that can mislead the model into producing incorrect outputs Huang & Shen (2025).

To address this issue, adversarial training (AT) Madry et al. (2019) has been proposed, which retrains classifiers using adversarial examples. However, AT suffers from high computational cost and poor generalization to unseen threats, limiting its applicability in real-world adversarial defense scenarios.

In contrast, adversarial purification (AP) has emerged as a compelling alternative due to its stronger generalization capabilities, and its plug-and-play nature, requiring no classifier retraining. AP methods utilize generative models as a preprocessing step to transform adversarial examples into purified ones, which are then fed into the classifier. The recent advances in diffusion models Ho et al. (2020) have further propelled the development of AP. These models learn to transform simple distributions into complex data distributions through a forward noising and reverse denoising process. Crucially, this iterative denoising mechanism aligns well with the goal of removing adversarial perturbations, making diffusion models a natural fit for AP tasks Nie et al. (2022).

However, existing diffusion-based purification approaches suffer from a critical limitation: they require multiple iterative denoising steps, resulting in prohibitively slow inference, which severely restricts their use in latency-sensitive applications such as autonomous driving Chi et al. (2024) and industrial manufacturing Wang et al. (2025). Moreover, most of these methods rely on a key assumption that the distributions of clean and adversarial samples converge after a certain number of forward diffusion steps. This allows the use of pretrained diffusion models, originally designed for generative tasks, to purify adversarial samples. However, this assumption only holds when the diffusion time horizon is sufficiently large. Empirical evidence from DiffPure Nie et al. (2022) suggests that excessive diffusion steps can lead to significant loss of semantic content, rendering accurate reconstruction of clean images infeasible.

In this paper, we propose Diffusion Bridge Distillation for Purification (DBLP), a novel framework designed to simultaneously address the two key limitations of existing diffusion-based adversarial purification methods: low inference efficiency and detail degradation. At its core, DBLP introduces a noise-bridged alignment strategy within the Latent Consistency Model Luo et al. (2023a), effectively bridging adversarial noise and clean targets during the consistency distillation process to better align with the purification objective. By leveraging noise bridge distillation, DBLP enables direct recovery of clean samples from diffused adversarial inputs using an ODE solver. To further mitigate detail loss caused by fewer denoising steps, we introduce adaptive semantic enhancement, a lightweight yet effective conditioning mechanism that utilizes multi-scale pyramid edge maps to capture fine-grained structural features. These semantic priors are injected into inference to enhance content preservation. DBLP achieves SOTA robust accuracy across multiple benchmark datasets while substantially reducing inference latency, requiring only 0.2 seconds per sample, thus making real-time adversarial purification feasible without compromising visual quality.

In summary, our contributions can be summarized as follows:

- •
We propose DBLP, a novel diffusion-based adversarial purification framework that significantly accelerates inference while improving purification performance and visual quality.
- •
We introduce a noise bridge distillation objective tailored for adversarial purification within the latent consistency model, effectively setting a bridge between adversarial noise and clean samples. Additionally, we design an adaptive semantic enhancement module that improves the model’s ability to retain fine-grained image details during purification.
- •
Comprehensive experiments across multiple benchmark datasets demonstrate that our method achieves SOTA performance in terms of robust accuracy, inference efficiency, and image quality, moving the field closer to practical real-time adversarial purification systems.

## 2 Related Work

### 2.1 Adversarial Training

Adversarial training is a prominent defense strategy against adversarial attacks Goodfellow et al. (2015), which enhances model robustness by retraining the model on perturbed adversarial examples Lau et al. (2023). A substantial body of research has demonstrated its efficacy in adversarial defense. Notable methods include min-max optimization framework Madry et al. (2018), TRADES which balances robustness and accuracy via a regularized loss Zhang et al. (2019), and techniques like local linearization Qin et al. (2019) and mutual information optimization Zhou et al. (2022). Despite its strong robustness, adversarial training suffers from several notable drawbacks. It often generalizes poorly to unseen attacks Laidlaw et al. (2021), and it incurs significant computational overhead due to the necessity of retraining the entire model. Moreover, it typically leads to a degradation in clean accuracy Wong et al. (2020).

### 2.2 Adversarial Purification

Adversarial purification represents an alternative and effective defense strategy against adversarial attacks that circumvents the need for retraining the model. The core idea is to employ generative models to pre-process adversarially perturbed images, yielding purified versions that are subsequently fed into the classifier. Early efforts in this domain leveraged GANs Samangouei et al. (2018) or score-based matching techniques Yoon et al. (2021); Song et al. (2021) to successfully restore adversarial images. DiffPure Nie et al. (2022) advanced this with diffusion models, inspiring follow-ups like adversarially guided denoising Wang et al. (2022); Wu et al. (2022), improved evaluation frameworks Lee & Kim (2023), gradient-based purification Zhang et al. (2023a), dual-phase guidance Song et al. (2024), and adversarial diffusion bridges Li et al. (2025). Despite their promising results, these methods exhibit certain limitations. Many approaches rely on auxiliary classifiers, which often compromise generalization performance. Others involve iterative inference procedures that are computationally intensive and time-consuming, thereby limiting their practicality in real-time or resource-constrained scenarios.

### 2.3 Diffusion Models

Diffusion models Ho et al. (2020), originally introduced to enhance image generation capabilities, have since demonstrated remarkable success across various domains, including video synthesis Ho et al. (2022) and 3D content generation Luo & Hu (2021). As a class of score-based generative models, diffusion models operate by progressively corrupting images with Gaussian noise in the forward process, and subsequently generating samples by denoising in the reverse process Huang & Tang (2025). Given a pre-defined forward trajectory $\{\mathbf{x}_{t}\}_{t\in[0,T]}$, indexed by a continuous time variable $t$, the forward process can be effectively modeled using a widely adopted stochastic differential equation (SDE) Karras et al. (2022):

$$ $\mathrm{d}\mathbf{x}_{t}=\bm{\mu}(\mathbf{x}_{t},t)\mathrm{d}t+\sigma(t)\mathrm{d}\mathbf{w}_{t},$ (1) $$

where $\bm{\mu}(\mathbf{x}_{t},t)$ and $\sigma(t)$ denote the drift and diffusion coefficients, respectively, while $\{\mathbf{w}_{t}\}_{t\in[0,T]}$ represents a standard $d$-dimensional Brownian motion. Let $p_{t}(\mathbf{x})$ denote the marginal distribution of $\mathbf{x}_{t}$ at time $t$, and $p_{\mathrm{data}}(\mathbf{x})$ represent the distribution of the original data, then $p_{0}(\mathbf{x})=p_{\mathrm{data}}(\mathbf{x})$.

Remarkably, Song et al. (2021) established the existence of an ordinary differential equation (ODE), referred to as the Probability Flow (PF) ODE, whose solution trajectories share the same marginal probability densities $p_{t}(\mathbf{x})$ as those of the forward SDE:

$$ $\mathrm{d}\mathbf{x}_{t}=\left[\bm{\mu}\left(\mathbf{x}_{t},t\right)-\frac{1}{2}\sigma(t)^{2}\nabla\log p_{t}(\mathbf{x}_{t})\right]\mathrm{d}t.$ (2) $$

For sampling, a score model $s_{\bm{\phi}}(\mathbf{x},t)\approx\nabla\log p_{t}(\mathbf{x})$ is first trained via score matching to approximate the gradient of the log-density at each time step. This learned score function is then substituted into Equation equation [2](https://arxiv.org/html/2508.00552v2#S2.E2) to obtain an empirical estimate of the PF ODE:

$$ $\frac{\mathrm{d}\mathbf{x}_{t}}{\mathrm{d}t}=\bm{\mu}\left(\mathbf{x}_{t},t\right)-\frac{1}{2}\sigma(t)^{2}s_{\bm{\phi}}(\mathbf{x}_{t},t).$ (3) $$

## 3 Preliminaries

### 3.1 Problem Formulation

Adversarial attacks were first introduced by Szegedy et al. (2014b), who revealed the inherent vulnerability of neural networks to carefully crafted perturbations. An adversarial example $\mathbf{x}_{\mathrm{adv}}$ is visually and numerically close to a clean input $\mathbf{x}$, yet it is deliberately designed to mislead a classifier $\mathrm{C}$ into assigning it to an incorrect label, rather than the true class $y_{\mathrm{true}}$, formally expressed as:

$$ $\arg\max_{y}\mathrm{C}(y|\mathbf{x}_{\mathrm{adv}})\neq y_{\mathrm{true}},$ (4) $$

with the constraint of $\|\mathbf{x}_{\mathrm{adv}}-\mathbf{x}\|\leq\epsilon$, where $\epsilon$ is the perturbation threshold.

The concept of adversarial purification is to transform the adversarial input $\mathbf{x}_{\mathrm{adv}}$ into a purified sample $\mathbf{x}_{\mathrm{pur}}$ before passing it to the classifier $\mathrm{C}$, such that $\mathbf{x}_{\mathrm{pur}}$ closely approximates the clean sample $\mathbf{x}$ and yields the correct classification outcome. This process can be formulated as:

$$ $\max_{\mathrm{P}}\mathrm{C}(y_{\mathrm{true}}|\mathrm{P}(\mathbf{x}_{\mathrm{adv}})),$ (5) $$

where $\mathrm{P}:\mathbb{R}^{d}\to\mathbb{R}^{d}$ is the purification function.

### 3.2 Consistency Models

Figure: Figure 1: The overview structure of our DBLP. An adversary perturbs a clean image $\mathbf{x}$ with noise $\bm{\epsilon}_{a}$ into an adversarial example $\mathbf{x}^{a}$, we first encode it into the latent space using the encoder $\mathcal{E}$ to obtain the latent representation $\mathbf{z}$, followed by noise injection as defined in Equation equation [11](https://arxiv.org/html/2508.00552v2#S4.E11). During training, we adopt a modified LCM-LoRA framework to perform noise bridge consistency distillation on the diffusion model, and employ a leapfrog ODE solver to accelerate sampling. During inference, we introduce adaptive semantic enhancement, using the weighted fusion of pyramid edge maps as a semantic-preserving condition to guide the purification process. The final purified image $\mathbf{x}_{\mathrm{pur}}$ is then recovered via the decoder $\mathcal{D}$.
Refer to caption: x1.png

The long inference time of diffusion models is a well-known limitation, prompting the introduction of the Consistency Model Song et al. (2023), which enables the sampling process to be reduced to just a few steps, or even a single step. It proposes learning a direct mapping from any point $\mathbf{x}_{t}$ along the PF ODE trajectory $\{\mathbf{x}_{t}\}_{t\in[0,T]}$ back to its starting point, referred to as the consistency function, denoted as $\bm{f}:(\mathbf{x}_{t},t)\mapsto\mathbf{x}_{\epsilon}$, where $\mathbf{x}_{\epsilon}$ represents the starting state at a predefined small positive value $\epsilon$. The self-consistency property of this function can be formalized as:

$$ $\bm{f}(\mathbf{x}_{t},t)=\bm{f}(\mathbf{x}_{t^{\prime}},t^{\prime})\quad\forall t,t^{\prime}\in[0,T].$ (6) $$

The goal of the consistency model $\bm{f_{\theta}}$ is to estimate the underlying consistency function $\bm{f}$ by enforcing the self-consistency property. The model $\bm{f_{\theta}}$ can be parameterized as:

$$ $\bm{f_{\theta}}(\mathbf{x},t)=c_{\mathrm{skip}}(t)\mathbf{x}+c_{\mathrm{out}}(t)F_{\bm{\theta}}(\mathbf{x},t),$ (7) $$

where $c_{\mathrm{skip}}(t)$ and $c_{\mathrm{out}}(t)$ are differentiable functions. To satisfy the boundary condition $\bm{f}(\mathbf{x}_{\epsilon},\epsilon)=\mathbf{x}_{\epsilon}$, we have $c_{\mathrm{skip}}(\epsilon)=1$ and $c_{\mathrm{out}}(\epsilon)=0$.

Building on this, the Latent Consistency Model Luo et al. (2023a) extends the consistency model to the latent space using an auto-encoder Rombach et al. (2022). In this setting, the consistency function conditioned on $\mathbf{c}$ is defined as $\bm{f_{\theta}}:(\mathbf{z}_{t},\mathbf{c},t)\mapsto\mathbf{z}_{\epsilon}$. To fully leverage the capabilities of a pretrained text-to-image model, LCM parameterizes the consistency model as:

$$ $\bm{f_{\theta}}(\mathbf{z},\mathbf{c},t)=c_{\mathrm{skip}}(t)\mathbf{z}+c_{\mathrm{out}}(t)\left(\frac{\mathbf{z}-\sigma_{t}\hat{\bm{\epsilon}}_{\theta}(\mathbf{z},\mathbf{c},t)}{\alpha_{t}}\right),$ (8) $$

LCM-LoRA Luo et al. (2023b) proposes distilling LCM using LoRA, significantly reducing the number of trainable parameters and thereby greatly decreasing training time and computational cost.

## 4 Methodology

### 4.1 Overall Framework

In this work, we aim to accelerate the purification backbone using a consistency distillation-inspired approach. Noting that the starting and ending points of the ODE trajectory respectively contain and exclude adversarial perturbations, we propose Noise Bridge Distillation in Section [4.2](https://arxiv.org/html/2508.00552v2#S4.SS2) to explicitly align the purification objective.

To achieve acceleration, we leverage the Latent Consistency Model with LoRA-based distillation and introduce a leapfrog ODE solver for efficient sampling. During inference, as detailed in Section [4.3](https://arxiv.org/html/2508.00552v2#S4.SS3), we propose Adaptive Semantic Enhancement, which fuses pyramid edge maps into a semantic-preserving condition to guide the diffusion model toward effective purification.

### 4.2 Noise Bridge Distillation

Figure: Algorithm 1 Noise Bridge Distillation

Following LCM Luo et al. (2023a), let $\mathcal{E}$ and $\mathcal{D}$ denote the encoder and decoder that map images to and from the latent space, respectively. Given an image $\mathbf{x}$, its latent representation is $\mathbf{z}=\mathcal{E}(\mathbf{x})$. Unlike DDPM, DBLP includes adversarial perturbations $\bm{\epsilon}_{a}$ at the start of the noising process, such that $\mathbf{z}_{0}^{a}=\mathbf{z}_{0}+\bm{\epsilon}_{a}$. The forward process is then $\mathbf{x}_{t}^{a}=\sqrt{\bar{\alpha}_{t}}\mathbf{x}_{0}^{a}+\sqrt{1-\bar{\alpha}_{t}}\bm{\epsilon}$, where $\bm{\epsilon}\sim\mathcal{N}(\mathbf{0},\mathbf{I})$.

Our objective is to learn a trajectory that maps the diffused adversarial distribution ($\mathbf{z}_{T}^{a}$) back to the clean data distribution ($\mathbf{z}_{0}$). Notably, the starting point of this trajectory contains adversarial noise, whereas the endpoint does not. Therefore, we aim to find a consistency model $\bm{f_{\theta}}$ that satisfies: $\bm{f_{\theta}}(\mathbf{z}_{t}^{a},\varnothing,t)=\bm{f_{\theta}}(\mathbf{z}_{t},\varnothing,t)=\mathbf{z}_{\epsilon}$, where $\mathbf{z}_{\epsilon}\approx\mathbf{z}_{0}$ denotes the limiting state of $\mathbf{z}_{t}$ as $t\to 0$. However, this contradicts Equation equation [7](https://arxiv.org/html/2508.00552v2#S3.E7), as the trajectories initiated from $\mathbf{z}_{t}$ and $\mathbf{z}_{t}^{a}$ are misaligned, causing $\bm{f_{\theta}}(\mathbf{z}_{t}^{a},\varnothing,t)-\bm{f_{\theta}}(\mathbf{z}_{t},\varnothing,t)\to\bm{\epsilon}_{a}$. To explicitly reconcile this discrepancy, we introduce a coefficient $k_{t}$ and define an adjusted latent variable $\tilde{\mathbf{x}}_{t}$ to align the trajectories accordingly:

$$ $\tilde{\mathbf{z}}_{t}=\mathbf{z}_{t}^{a}-k_{t}\bm{\epsilon}_{a},$ (9) $$

with $k_{0}=1$ and $k_{T}=0$. Our goal is to ensure that the sampling distribution during the denoising process is independent of the adversarial perturbation $\bm{\epsilon}_{a}$. Although $\bm{\epsilon}_{a}$ can be computed during training as $\bm{\epsilon}_{a}=\arg\max_{\epsilon}\mathcal{L}(\mathrm{C}(\mathcal{D}(\mathbf{z}+\bm{\epsilon})),y_{\mathrm{true}})$, its exact value is unknown at inference time. Leveraging Bayes’ theorem and the properties of Gaussian distributions, we achieve this by selecting the value of coefficient $k_{t}$ such that the term involving $\bm{\epsilon}_{a}$ is eliminated. After a series of derivations, we obtain an explicit closed-form expression for $k_{t}$:

$$ $k_{t}=\sqrt{\bar{\alpha}_{t}}-\frac{\bar{\alpha}_{T}(1-\bar{\alpha}_{t})}{\sqrt{\bar{\alpha}_{t}}(1-\bar{\alpha}_{T})},0\leq t\leq T,$ (10) $$

which satisfies $k_{0}=1$ and $k_{T}=0$. Thus the $\tilde{\mathbf{z}}_{t}$ is constructed as:

$$ $\tilde{\mathbf{z}}_{t}=\sqrt{\bar{\alpha}_{t}}\mathbf{z}_{0}+\sqrt{1-\bar{\alpha}_{t}}\bm{\epsilon}+\frac{\bar{\alpha}_{T}(1-\bar{\alpha}_{t})}{\sqrt{\bar{\alpha}_{t}}(1-\bar{\alpha}_{T})}\bm{\epsilon}_{a},$ (11) $$

In this way, the sampling process doesn’t require $\bm{\epsilon}_{a}$. The full proof is provided in Appendix [A.2](https://arxiv.org/html/2508.00552v2#A1.SS2).

**Table 1: Clean Accuracy and Robust Accuracy ($\%$) results on CIFAR-10. Avg. denotes the average robust accuracy across three types of attack threats, vanilla refers to models without any adversarial defense mechanism. The best results are bolded, and the second best results are underlined.**
| Architecture | Type | Method | Clean<br>Acc. | Robuse Acc. |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| $\ell_{\infty}$ | $\ell_{1}$ | $\ell_{2}$ | Avg. |  |  |  |  |
| WRN-70-16 | $-$ | Vanilla | 96.36 | 0.00 | 0.00 | 0.00 | 0.00 |
| WRN-70-16 | AT | Gowal et al. (2021a) | 91.10 | 65.92 | 8.26 | 27.56 | 33.91 |
| WRN-70-16 | Rebuffi et al. (2021) | 88.54 | 64.26 | 12.06 | 32.29 | 36.20 |  |
| WRN-70-16 | Aug. w/ Diff Gowal et al. (2021b) | 88.74 | 66.18 | 9.76 | 28.73 | 34.89 |  |
| WRN-70-16 | Aug. w/ Diff Wang et al. (2023) | 93.25 | 70.72 | 8.48 | 28.98 | 36.06 |  |
| MLP+WRN-28-10 | AP | Shi et al. (2021) | 91.89 | 4.56 | 8.68 | 7.25 | 6.83 |
| UNet+WRN-70-16 | Yoon et al. (2021) | 87.93 | 37.65 | 36.87 | 57.81 | 44.11 |  |
| UNet+WRN-70-16 | GDMP Wang et al. (2022) | 93.16 | 22.07 | 28.71 | 35.74 | 28.84 |  |
| UNet+WRN-70-16 | ScoreOpt Zhang et al. (2023a) | 91.41 | 13.28 | 10.94 | 28.91 | 17.71 |  |
| UNet+WRN-70-16 | Purify++ Zhang et al. (2023b) | 92.18 | 43.75 | 39.84 | 55.47 | 46.35 |  |
| UNet+WRN-70-16 | DiffPure Nie et al. (2022) | 92.50 | 42.20 | 44.30 | 60.80 | 49.10 |  |
| UNet+WRN-70-16 | ADBM Li et al. (2025) | 91.90 | 47.70 | 49.60 | 63.30 | 53.50 |  |
| UNet+WRN-70-16 | DBLP (Ours) | 94.8 | 58.4 | 64.4 | 59.4 | 60.73 |  |

Accordingly, based on the loss function introduced in LCM Luo et al. (2023a), our consistency distillation loss can be formulated as:

$$ $\mathcal{L}_{CD}\left(\bm{\theta},\bm{\theta}^{-}\right)=\mathbb{E}_{\mathbf{z},n}\left[d\left(\bm{f_{\theta}}\left(\tilde{\mathbf{z}}_{t_{n+k}},\varnothing,t_{n+k}\right),\bm{f_{\theta^{-}}}\left(\hat{\mathbf{z}}_{t_{n}}^{\Psi},\varnothing,t_{n}\right)\right)\right],$ (12) $$

where $d(\cdot,\cdot)$ denotes a distance metric, and $\Psi(\cdot,\cdot,\cdot,\cdot)$ represents the DDIM Song et al. (2022) PF ODE solver $\Psi_{\mathrm{DDIM}}$. The term $\hat{\mathbf{z}}_{t_{n}}^{\Psi}$ refers to the solution estimated by the solver when integrating from $t_{n+k}$ to $t_{n}$:

$$ $\hat{\mathbf{z}}_{t_{n}}^{\Psi}\leftarrow\mathbf{z}_{t_{n+k}}+\Psi(\mathbf{z}_{t_{n+k}},t_{n+k},t_{n},\varnothing).$ (13) $$

Following Kim et al. (2024), we also incorporate a reconstruction-like loss that leverages clean images to better align the distillation training process with the purification objective:

$$ $\mathcal{L}_{\mathrm{rec}}\left(\bm{\theta}\right)=d\left(\bm{f_{\theta}}\left(\tilde{\mathbf{z}}_{t},\varnothing,t\right),\mathbf{z}\right)$ (14) $$

The training algorithm is detailed in Alg. [1](https://arxiv.org/html/2508.00552v2#alg1).

#### Leapfrog Solver

To enhance the dynamical interpretability of the sampling process, we refine the DDIM-based PF ODE solver using a leapfrog-inspired mechanism. Specifically, we decompose the prediction into a position-like estimate of the clean image and a velocity-like estimate of the noise, which are then updated jointly through a first-order leapfrog integration step Verlet (1967):

$$ $\mathbf{z}_{t-1}=\mathbf{z}_{0}+h\cdot\mathbf{v}_{1/2},$ (15) $$

where $\mathbf{z}_{t}=\sqrt{\bar{\alpha}_{t-1}}\cdot\hat{\mathbf{z}}_{0}$ and $\mathbf{v}_{0}=\sqrt{1-\bar{\alpha}_{t-1}}\cdot\hat{\bm{\epsilon}}$, while $\mathbf{v}_{1/2}=2\mathbf{v}_{0}$ serves as the midpoint velocity estimate.

### 4.3 Adaptive Semantic Enhanced Purification

**Table 2: Clean Accuracy and Robust Accuracy ($\%$) results on ImageNet. The default setting for attack is $\epsilon=4/255$. The best results are bolded, and the second best results are underlined.**
| Method | Type | Attack | Standard Acc. | Robust Acc. | Architecture |
| --- | --- | --- | --- | --- | --- |
| w/o Defense | $-$ | PGD-100 | 80.55 | 0.01 | Res-50 |
| Schott et al. (2019) | AT | PGD-40 | 72.70 | 47.00 | Res-152 |
| Wang et al. (2020) | PGD-100 | 53.83 | 28.04 | Res-50 |  |
| ConvStem Singh et al. (2023) | AutoAttack | 77.00 | 57.70 | ConvNeXt-L |  |
| MeanSparse Amini et al. (2024) | AutoAttack | 77.96 | 59.64 | ConvNeXt-L |  |
| DiffPure Nie et al. (2022) | AP | PGD-100 | 68.22 | 42.88 | Res-50 |
| DiffPure Nie et al. (2022) | AutoAttack | 71.16 | 44.39 | WRN-50-2 |  |
| Bai et al. (2024) | PGD-200 ($\epsilon=8/255$) | 70.41 | 41.70 | Res-50 |  |
| Lee & Kim (2023) | PGD+EOT | 70.74 | 42.15 | Res-50 |  |
| Lin et al. (2025) | PGD+EOT | 68.75 | 45.90 | Res-50 |  |
| Zollicoffer et al. (2025) | PGD-200 ($\epsilon=8/255$) | 73.98 | 56.54 | Res-50 |  |
| MimicDiffusion Song et al. (2024) | AutoAttack | 66.92 | 61.53 | Res-50 |  |
| ScoreOpt Zhang et al. (2023a) | Transfer-PGD | 71.68 | 62.10 | WRN-50-2 |  |
| Pei et al. (2025) | PGD-200 ($\epsilon=8/255$) | 77.15 | 65.04 | Res-50 |  |
| OSCP Lei et al. (2025) | PGD-100 | 77.63 | 73.89 | Res-50 |  |
| DBLP (Ours) | PGD-100 | 78.2 | 75.6 | Res-50 |  |
| DBLP (Ours) | AutoAttack | 78.0 | 74.8 | Res-50 |  |
| DBLP (Ours) | PGD-200 ($\epsilon=8/255$) | 77.4 | 74.2 | Res-50 |  |

Although diffusion models are effective at learning the denoising process from noise to images, relying solely on this process often leads to the loss of fine-grained details Berrada et al. (2025). While OSCP Lei et al. (2025) attempts to mitigate this by incorporating edge maps to enhance structural information, it uses fixed-threshold Canny edge detection Canny (1986), which lacks adaptability to varying attack intensities. Moreover, adversarial perturbations introduce noise that can interfere with accurate edge extraction. To address these issues, we propose Adaptive Semantic Enhancement, a non-trainable, computationally efficient module to aggregate multi-scale edge information, enhancing structural integrity and detail preservation.

Given an adversarial image $\mathbf{x}_{0}^{a}\in\mathbb{R}^{H\times W\times 3}$, we construct an $L$-level Gaussian blur pyramid and apply adaptive thresholding at each level $l$ to compute the corresponding edge map:

$$ $\mathbf{E}_{l}=\mathrm{Canny}(\mathrm{GaussianBlur}(\mathbf{x}_{0}^{a},\sigma_{l})),$ (16) $$

where the thresholds are calculated using Otsu Otsu (1979) algorithm.

We employ a gradient-guided mechanism to fuse edge maps across different scales. We first upsample all edge maps to a unified resolution $\mathbf{E}_{l}$, then use gradient consistency to compute the weights for each scale:

$$ $\mathbf{A}_{l}=\frac{\exp\left(-\|\nabla\mathbf{x}_{0}^{a}-\nabla\tilde{\mathbf{E}}_{l}\|_{2}/T^{*}\right)}{\sum_{k=1}^{L}\exp\left(-\|\nabla\mathbf{x}_{0}^{a}-\nabla\tilde{\mathbf{E}}_{k}\|_{2}/T^{*}\right)}$ (17) $$

where $T^{*}$ is the temperature parameter. Finally the fused edge map is:

$$ $\mathbf{E}_{\mathrm{fused}}=\sum_{l=1}^{L}\mathbf{A}_{l}\odot\tilde{\mathbf{E}}_{l}$ (18) $$

We then use $\mathbf{E}_{\mathrm{fused}}$ as a condition in the LCM, resulting in a semantically enhanced purified image.

## 5 Experiments

### 5.1 Experimental Settings

**Table 3: Robust Accuracy ($\%$) results on CelebA under PGD-10. The best results are bolded, and the second-best results are underlined.**
| Method | AF | FN | MFN |
| --- | --- | --- | --- |
| w/o Defense | 0.0 | 0.3 | 0.0 |
| GaussianBlur ($\sigma=7.0$) | 2.8 | 51.4 | 2.8 |
| SHIELD Das et al. (2018) | 17.3 | 84.1 | 27.6 |
| OSCP Lei et al. (2025) | 86.8 | 97.8 | 84.9 |
| DBLP (Ours) | 82.4 | 98.8 | 91.0 |

#### Datasets

We conduct extensive experiments to validate the effectiveness and efficiency of our proposed method across several widely-used datasets, including CIFAR-10 Krizhevsky et al. (2009), ImageNet Deng et al. (2009), and CelebA Liu et al. (2015). CIFAR-10 consists of 60,000 color images of size 32×32 across 10 object classes, representing general-purpose natural scenes. ImageNet is a large-scale visual database with over 14 million human-annotated images spanning more than 20,000 categories. CelebA contains over 200,000 celebrity face images, each annotated with 40 facial attributes and five landmark points.

**Table 4: Robust Accuracy ($\%$) on DBLP under Diff-PGD-10 attack $\epsilon=8/255$ on ImageNet.**
| Method | ResNet-50 | ResNet-152 | WideResNet-50-2 | ConvNeXt-B | ViT-B-16 | Swin-B |
| --- | --- | --- | --- | --- | --- | --- |
| DiffPure Nie et al. (2022) | 53.8 | 49.4 | 52.2 | 42.9 | 16.6 | 45.1 |
| OSCP Lei et al. (2025) | 59.0 | 56.5 | 57.9 | 49.1 | 34.1 | 53.9 |
| DBLP (Ours) | 63.0 | 59.4 | 60.7 | 52.4 | 38.2 | 58.3 |

Figure: Figure 2: Visualization of (a) clean images, (b) adversarial images and (c-f) purified images under different method.
Refer to caption: x2.png

#### Training Settings

For our pretrained diffusion backbone, we use Stable Diffusion v1.5 Rombach et al. (2022). The distillation process is trained for 20,000 iterations with a batch size of 4, a learning rate of 8e-6, and a 500-step warm-up schedule. For our leapfrog solver $\Psi_{\mathrm{leap}}$, we set $k=20$ in Equation equation [13](https://arxiv.org/html/2508.00552v2#S4.E13) and $h=0.8$ in Equation equation [15](https://arxiv.org/html/2508.00552v2#S4.E15). During training, adversarial noise is generated using PGD-100 with $\epsilon=4/255$, targeting a ResNet-50 He et al. (2016) classifier.

#### Evaluation Metrics

We evaluate our approach using multiple metrics: clean accuracy (performance on clean data), robust accuracy (performance under adversarial attack), inference time, and image quality metrics including LPIPS Zhang et al. (2018), PSNR, and SSIM Horé & Ziou (2010).

### 5.2 Results

#### CIFAR-10

We first conduct experiments on the CIFAR-10 dataset, evaluating our method under adversarial threats constrained by $\ell_{\infty}$, $\ell_{1}$, and $\ell_{2}$ norms. Since DBLP is trained under $\ell_{\infty}$ attacks, this scenario is considered a seen threat, while the $\ell_{1}$ and $\ell_{2}$ settings are treated as unseen threats. The results are presented in Table [1](https://arxiv.org/html/2508.00552v2#S4.T1). Although DBLP belongs to the category of adversarial purification methods, its access to the victim classifier makes it comparable to SOTA adversarial training and purification methods. Adversarial training performs well on seen threats but generalizes poorly to unseen ones, and DiffPure variants offer limited gains. In contrast, DBLP achieves substantially higher robust accuracy on both seen and unseen threats, while preserving strong clean accuracy. It outperforms prior methods by 7.23%, highlighting its robustness, generalization, and efficiency.

#### ImageNet

We further conducted comprehensive experiments on the ImageNet dataset, with results summarized in Table [2](https://arxiv.org/html/2508.00552v2#S4.T2). Compared to CIFAR-10, adversarial purification methods on this larger-scale dataset can achieve standard accuracy comparable to or even surpassing that of adversarial training, while offering substantially higher robust accuracy. Notably, our method, DBLP, consistently achieves strong performance across various adversarial attacks. Under PGD-100, AutoAttack, and PGD-200 (with $\epsilon=8/255$), DBLP outperforms previous SOTA approaches by 1.14%, 0.64%, and 0.04% on average, respectively, in terms of both standard and robust accuracy. These results demonstrate the scalability, robustness, and general applicability of DBLP across datasets of different complexity and size.

#### Celeb-A

**Table 5: Inference time of purification models to purify one image. The best results are bolded.**
| Method | runtime (s) |
| --- | --- |
| GDMP Wang et al. (2022) | $\sim 43$ |
| DiffPure Nie et al. (2022) | $\sim 53$ |
| OSCP Lei et al. (2025) | $\sim 0.8$ |
| DBLP (Ours) | $\sim\textbf{0.2}$ |

We further validated the effectiveness of our method on a subset of the CelebA-HQ dataset by evaluating it against three representative victim models: ArcFace (AF) Deng et al. (2019), FaceNet (FN) Schroff et al. (2015), and MobileFaceNet (MFN) Chen et al. (2018). Leveraging model weights pretrained on ImageNet, we applied our purification framework to adversarial face images. As shown in Table [3](https://arxiv.org/html/2508.00552v2#S5.T3), DBLP significantly enhances purification performance on facial data, demonstrating its robust generalization across image resolutions and domains.

### 5.3 Image Quality

**Table 7: A quality comparison between the clean image $\mathbf{x}$ and the purified image $\mathbf{x}{\mathrm{pur}}$. The $\mathbf{x}_{\mathrm{adv}}$ row reports the metrics between the purified and adversarial images. The best results are bolded.**
| Method | LPIPS$\downarrow$ | PSNR$\uparrow$ | SSIM$\uparrow$ |
| --- | --- | --- | --- |
| $\mathbf{x}_{\mathrm{adv}}$ | 0.0975 | 26.17 | 0.7764 |
| DiffPure Nie et al. (2022) | 0.2616 | 24.11 | 0.7155 |
| OSCP Lei et al. (2025) | 0.2370 | 24.13 | 0.7343 |
| DBLP (Ours) | 0.1012 | 26.03 | 0.7655 |

Beyond correct classification, adversarial purification also seeks to maintain visual fidelity relative to the clean input. As shown in Table [7](https://arxiv.org/html/2508.00552v2#S5.T7), DBLP achieves strong image quality across all three metrics, with purified outputs $\mathbf{x}_{\mathrm{pur}}$ closely matching both adversarial $\mathbf{x}_{\mathrm{adv}}$ and clean images $\mathbf{x}$. This highlights DBLP’s superior visual quality. Qualitative results in Figure [2](https://arxiv.org/html/2508.00552v2#S5.F2) further confirm its ability to preserve fine-grained details.

Figure: Figure 3: Parameter analysis of inference steps.
Refer to caption: x3.png

### 5.4 Ablation Study

We conduct ablation studies to assess the adaptive semantic enhancement module in DBLP, with results in Table [6](https://arxiv.org/html/2508.00552v2#S5.T6). Omitting edge maps leads to a small drop in robust accuracy but a significant decline in image quality. Using pyramid edge maps further improves both metrics, showing that multi-scale edge representations better capture structural details and enhance visual fidelity. We further conduct a parameter analysis on the number of inference steps, as shown in Figure [3](https://arxiv.org/html/2508.00552v2#S5.F3). As the number of steps increases, robust accuracy shows a slight improvement, while sampling time grows significantly. For more ablation results, please refer to Appendix [A.3](https://arxiv.org/html/2508.00552v2#A1.SS3).

### 5.5 Transferability

We further evaluated DBLP under the Diff-PGD attack Xue et al. (2023). The LCM was trained using PGD-generated adversarial noise on ResNet-50 and tested for transfer robustness across diverse architectures, including ResNet-50/152, WideResNet-50-2 Zagoruyko & Komodakis (2016), ConvNeXt-B Liu et al. (2022), ViT-B-16 Kolesnikov et al. (2021), and Swin-B Liu et al. (2021). As shown in Table [4](https://arxiv.org/html/2508.00552v2#S5.T4), DBLP consistently outperforms prior SOTA methods under Diff-PGD-10, demonstrating strong cross-architecture robustness.

### 5.6 Inference Time

A key limitation of diffusion-based adversarial purification is the long inference time, which impedes real-time deployment. As shown in Table [6](https://arxiv.org/html/2508.00552v2#S5.T6), DBLP achieves SOTA inference speed and significantly outperforms other methods. On ImageNet, it completes purification in just 0.2 seconds, greatly accelerating diffusion-based defenses and enabling practical real-time use.

## 6 Conclusion

In this work, we propose DBLP, an efficient diffusion-based adversarial purification framework. By introducing noise bridge distillation into the LCM, DBLP establishes a direct bridge between the adversarial and clean data distributions, significantly improving both robust accuracy and inference efficiency. Additionally, the adaptive semantic enhancement module fuses pyramid edge maps as conditional for LCM, leading to superior visual quality in purified images. Together, these advancements bring the scientific community closer to practical, real-time purification systems.

## References

- Amini et al. (2024)
Sajjad Amini, Mohammadreza Teymoorianfard, Shiqing Ma, and Amir Houmansadr.
Meansparse: Post-training robustness enhancement through
mean-centered feature sparsification, 2024.
URL [https://arxiv.org/abs/2406.05927](https://arxiv.org/abs/2406.05927).
- Bai et al. (2024)
Mingyuan Bai, Wei Huang, Tenghui Li, Andong Wang, Junbin Gao, Cesar F Caiafa,
and Qibin Zhao.
Diffusion models demand contrastive guidance for adversarial
purification to advance.
In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian
Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (eds.),
*Proceedings of the 41st International Conference on Machine Learning*,
volume 235 of *Proceedings of Machine Learning Research*, pp. 2375–2391. PMLR, 21–27 Jul 2024.
URL [https://proceedings.mlr.press/v235/bai24b.html](https://proceedings.mlr.press/v235/bai24b.html).
- Berrada et al. (2025)
Tariq Berrada, Pietro Astolfi, Melissa Hall, Marton Havasi, Yohann Benchetrit,
Adriana Romero-Soriano, Karteek Alahari, Michal Drozdzal, and Jakob Verbeek.
Boosting latent diffusion with perceptual objectives.
In *International Conference on Learning Representations*, 2025.
- Canny (1986)
John Canny.
A computational approach to edge detection.
*IEEE Transactions on Pattern Analysis and Machine
Intelligence*, PAMI-8(6):679–698, 1986.
doi: 10.1109/TPAMI.1986.4767851.
- Chen et al. (2018)
Sheng Chen, Yang Liu, Xiang Gao, and Zhen Han.
Mobilefacenets: Efficient cnns for accurate real-time face
verification on mobile devices.
pp.  428–438, 2018.
- Chi et al. (2024)
Lijun Chi, Mounira Msahli, Qingjie Zhang, Han Qiu, Tianwei Zhang, Gerard Memmi,
and Meikang Qiu.
Adversarial attacks on autonomous driving systems in the physical
world: a survey.
*IEEE Transactions on Intelligent Vehicles*, pp.  1–22, 2024.
doi: 10.1109/TIV.2024.3484152.
- Das et al. (2018)
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Siwei Li,
Li Chen, Michael E. Kounavis, and Duen Horng Chau.
Shield: Fast, practical defense and vaccination for deep learning
using jpeg compression.
In *Proceedings of the 24th ACM SIGKDD International Conference
on Knowledge Discovery & Data Mining*, KDD ’18, pp.  196–204, New York,
NY, USA, 2018. Association for Computing Machinery.
ISBN 9781450355520.
doi: 10.1145/3219819.3219910.
URL [https://doi.org/10.1145/3219819.3219910](https://doi.org/10.1145/3219819.3219910).
- Deng et al. (2009)
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.
Imagenet: A large-scale hierarchical image database.
In *2009 IEEE Conference on Computer Vision and Pattern
Recognition*, pp.  248–255, 2009.
doi: 10.1109/CVPR.2009.5206848.
- Deng et al. (2019)
Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou.
Arcface: Additive angular margin loss for deep face recognition.
In *Proceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR)*, June 2019.
- Dhariwal & Nichol (2021)
Prafulla Dhariwal and Alex Nichol.
Diffusion models beat gans on image synthesis.
In *Proceedings of the 35th International Conference on Neural
Information Processing Systems*, NIPS ’21, Red Hook, NY, USA, 2021. Curran
Associates Inc.
ISBN 9781713845393.
- Goodfellow et al. (2015)
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy.
Explaining and harnessing adversarial examples.
In *International Conference on Learning Representations*, 2015.
URL [http://arxiv.org/abs/1412.6572](http://arxiv.org/abs/1412.6572).
- Gowal et al. (2021a)
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli.
Uncovering the limits of adversarial training against norm-bounded
adversarial examples, 2021a.
URL [https://arxiv.org/abs/2010.03593](https://arxiv.org/abs/2010.03593).
- Gowal et al. (2021b)
Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan
Calian, and Timothy Mann.
Improving robustness using generated data.
In *Proceedings of the 35th International Conference on Neural
Information Processing Systems*, NIPS ’21, Red Hook, NY, USA,
2021b. Curran Associates Inc.
ISBN 9781713845393.
- He et al. (2016)
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In *2016 IEEE Conference on Computer Vision and Pattern
Recognition (CVPR)*, pp.  770–778, 2016.
doi: 10.1109/CVPR.2016.90.
- Ho et al. (2020)
Jonathan Ho, Ajay Jain, and Pieter Abbeel.
Denoising diffusion probabilistic models.
In *Proceedings of the 34th International Conference on Neural
Information Processing Systems*, NIPS ’20, Red Hook, NY, USA, 2020. Curran
Associates Inc.
ISBN 9781713829546.
- Ho et al. (2022)
Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi,
and David J Fleet.
Video diffusion models.
In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh
(eds.), *Advances in Neural Information Processing Systems*, volume 35,
pp.  8633–8646. Curran Associates, Inc., 2022.
URL
[https://proceedings.neurips.cc/paper_files/paper/2022/file/39235c56aef13fb05a6adc95eb9d8d66-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2022/file/39235c56aef13fb05a6adc95eb9d8d66-Paper-Conference.pdf).
- Horé & Ziou (2010)
Alain Horé and Djemel Ziou.
Image quality metrics: Psnr vs. ssim.
In *2010 20th International Conference on Pattern Recognition*,
pp.  2366–2369, 2010.
doi: 10.1109/ICPR.2010.579.
- Huang & Shen (2025)
Chihan Huang and Xiaobo Shen.
Huang: A robust diffusion model-based targeted adversarial attack
against deep hashing retrieval.
*Proceedings of the AAAI Conference on Artificial Intelligence*,
39(4):3626–3634, Apr. 2025.
doi: 10.1609/aaai.v39i4.32377.
URL [https://ojs.aaai.org/index.php/AAAI/article/view/32377](https://ojs.aaai.org/index.php/AAAI/article/view/32377).
- Huang & Tang (2025)
Chihan Huang and Hao Tang.
Scoreadv: Score-based targeted generation of natural adversarial
examples via diffusion models, 2025.
URL [https://arxiv.org/abs/2507.06078](https://arxiv.org/abs/2507.06078).
- Karras et al. (2022)
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine.
Elucidating the design space of diffusion-based generative models.
In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh
(eds.), *Advances in Neural Information Processing Systems*, volume 35,
pp.  26565–26577. Curran Associates, Inc., 2022.
URL
[https://proceedings.neurips.cc/paper_files/paper/2022/file/a98846e9d9cc01cfb87eb694d946ce6b-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2022/file/a98846e9d9cc01cfb87eb694d946ce6b-Paper-Conference.pdf).
- Kim et al. (2024)
Dongjun Kim, Chieh-Hsin Lai, Wei-Hsiang Liao, Naoki Murata, Yuhta Takida,
Toshimitsu Uesaka, Yutong He, Yuki Mitsufuji, and Stefano Ermon.
Consistency trajectory models: Learning probability flow ode
trajectory of diffusion.
In *International Conference on Learning Representations*, 2024.
- Kolesnikov et al. (2021)
Alexander Kolesnikov, Alexey Dosovitskiy, Dirk Weissenborn, Georg Heigold,
Jakob Uszkoreit, Lucas Beyer, Matthias Minderer, Mostafa Dehghani, Neil
Houlsby, Sylvain Gelly, Thomas Unterthiner, and Xiaohua Zhai.
An image is worth 16x16 words: Transformers for image recognition at
scale.
In *International Conference on Learning Representations*, 2021.
- Krizhevsky et al. (2009)
Alex Krizhevsky et al.
Learning multiple layers of features from tiny images.
In *California Institute of Technology*, 2009.
- Laidlaw et al. (2021)
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi.
Perceptual adversarial robustness: Defense against unseen threat
models.
In *International Conference on Learning Representations*, 2021.
- Lau et al. (2023)
Chun Pong Lau, Jiang Liu, Hossein Souri, Wei-An Lin, Soheil Feizi, and Rama
Chellappa.
Interpolated joint space adversarial training for robust and
generalizable defenses.
*IEEE Transactions on Pattern Analysis and Machine
Intelligence*, 45(11):13054–13067, 2023.
doi: 10.1109/TPAMI.2023.3286772.
- Lee & Kim (2023)
Minjong Lee and Dongwoo Kim.
Robust evaluation of diffusion-based adversarial purification.
In *Proceedings of the IEEE/CVF International Conference on
Computer Vision (ICCV)*, pp.  134–144, October 2023.
- Lei et al. (2025)
Chun Tong Lei, Hon Ming Yam, Zhongliang Guo, Yifei Qian, and Chun Pong Lau.
Instant adversarial purification with adversarial consistency
distillation.
In *Proceedings of the Computer Vision and Pattern Recognition
Conference (CVPR)*, pp.  24331–24340, June 2025.
- Li et al. (2025)
Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yining Liu, Yingzhe He, Jie
Shi, and Xiaolin Hu.
Adbm: Adversarial diffusion bridge model for reliable adversarial
purification.
In *International Conference on Learning Representations*, 2025.
- Lin et al. (2025)
Guang Lin, Zerui Tao, Jianhai Zhang, Toshihisa Tanaka, and Qibin Zhao.
Adversarial guided diffusion models for adversarial purification,
2025.
URL [https://arxiv.org/abs/2403.16067](https://arxiv.org/abs/2403.16067).
- Liu et al. (2021)
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and
Baining Guo.
Swin transformer: Hierarchical vision transformer using shifted
windows.
In *Proceedings of the IEEE/CVF International Conference on
Computer Vision (ICCV)*, pp.  10012–10022, October 2021.
- Liu et al. (2022)
Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell,
and Saining Xie.
A convnet for the 2020s.
In *2022 IEEE/CVF Conference on Computer Vision and Pattern
Recognition (CVPR)*, pp.  11966–11976, 2022.
doi: 10.1109/CVPR52688.2022.01167.
- Liu et al. (2015)
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.
Deep learning face attributes in the wild.
In *Proceedings of International Conference on Computer Vision
(ICCV)*, December 2015.
- Luo & Hu (2021)
Shitong Luo and Wei Hu.
Diffusion probabilistic models for 3d point cloud generation.
In *Proceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR)*, pp.  2837–2845, June 2021.
- Luo et al. (2023a)
Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao.
Latent consistency models: Synthesizing high-resolution images with
few-step inference, 2023a.
- Luo et al. (2023b)
Simian Luo, Yiqin Tan, Suraj Patil, Daniel Gu, Patrick von Platen, Apolinário
Passos, Longbo Huang, Jian Li, and Hang Zhao.
Lcm-lora: A universal stable-diffusion acceleration module,
2023b.
URL [https://arxiv.org/abs/2311.05556](https://arxiv.org/abs/2311.05556).
- Madry et al. (2018)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and
Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
In *International Conference on Learning Representations*, 2018.
- Madry et al. (2019)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and
Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
In *International Conference on Learning Representations*, 2019.
- Nie et al. (2022)
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree
Anandkumar.
Diffusion models for adversarial purification.
In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari,
Gang Niu, and Sivan Sabato (eds.), *Proceedings of the 39th
International Conference on Machine Learning*, volume 162 of
*Proceedings of Machine Learning Research*, pp.  16805–16827. PMLR,
17–23 Jul 2022.
URL [https://proceedings.mlr.press/v162/nie22a.html](https://proceedings.mlr.press/v162/nie22a.html).
- Otsu (1979)
Nobuyuki Otsu.
A threshold selection method from gray-level histograms.
*IEEE Transactions on Systems, Man, and Cybernetics*, 9(1):62–66, 1979.
doi: 10.1109/TSMC.1979.4310076.
- Pei et al. (2025)
Gaozheng Pei, Ke Ma, Yingfei Sun, Qianqian Xu, and Qingming Huang.
Diffusion-based adversarial purification from the perspective of the
frequency domain, 2025.
URL [https://arxiv.org/abs/2505.01267](https://arxiv.org/abs/2505.01267).
- Qin et al. (2019)
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy (Dj)
Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli.
*Adversarial robustness through local linearization*.
Curran Associates Inc., Red Hook, NY, USA, 2019.
- Rebuffi et al. (2021)
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Calian, Florian Stimberg, Olivia
Wiles, and Timothy Mann.
Data augmentation can improve robustness.
In *Proceedings of the 35th International Conference on Neural
Information Processing Systems*, NIPS ’21, Red Hook, NY, USA, 2021. Curran
Associates Inc.
ISBN 9781713845393.
- Rombach et al. (2022)
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn
Ommer.
High-resolution image synthesis with latent diffusion models.
In *Proceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR)*, pp.  10684–10695, June 2022.
- Samangouei et al. (2018)
Pouya Samangouei, Maya Kabkab, and Rama Chellappa.
Defense-gan: Protecting classifiers against adversarial attacks using
generative models.
In *International Conference on Learning Representations*, 2018.
- Schott et al. (2019)
Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel.
Towards the first adversarially robust neural network model on mnist.
In *International Conference on Learning Representations*, 2019.
- Schroff et al. (2015)
Florian Schroff, Dmitry Kalenichenko, and James Philbin.
Facenet: A unified embedding for face recognition and clustering.
In *2015 IEEE Conference on Computer Vision and Pattern
Recognition (CVPR)*, pp.  815–823, 2015.
doi: 10.1109/CVPR.2015.7298682.
- Shi et al. (2021)
Changhao Shi, Chester Holtz, and Gal Mishne.
Online adversarial purification based on self-supervision.
In *International Conference on Learning Representations*, 2021.
- Singh et al. (2023)
Naman D Singh et al.
Revisiting adversarial training for imagenet: architectures, training
and generalization across threat models.
In *Proceedings of the 37th International Conference on Neural
Information Processing Systems*, NIPS ’23, Red Hook, NY, USA, 2023. Curran
Associates Inc.
- Song et al. (2022)
Jiaming Song, Chenlin Meng, and Stefano Ermon.
Denoising diffusion implicit models.
In *International Conference on Learning Representations*, 2022.
- Song et al. (2024)
Kaiyu Song, Hanjiang Lai, Yan Pan, and Jian Yin.
Mimicdiffusion: Purifying adversarial perturbation via mimicking
clean diffusion model.
In *Proceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR)*, pp.  24665–24674, June 2024.
- Song et al. (2021)
Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano
Ermon, and Ben Poole.
Score-based generative modeling through stochastic differential
equations.
In *International Conference on Learning Representations*, 2021.
- Song et al. (2023)
Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever.
Consistency models.
In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt,
Sivan Sabato, and Jonathan Scarlett (eds.), *Proceedings of the 40th
International Conference on Machine Learning*, volume 202 of
*Proceedings of Machine Learning Research*, pp.  32211–32252. PMLR,
23–29 Jul 2023.
URL [https://proceedings.mlr.press/v202/song23a.html](https://proceedings.mlr.press/v202/song23a.html).
- Szegedy et al. (2014a)
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan,
Ian Goodfellow, and Rob Fergus.
Intriguing properties of neural networks.
In *International Conference on Learning Representations*,
2014a.
URL [http://arxiv.org/abs/1312.6199](http://arxiv.org/abs/1312.6199).
- Szegedy et al. (2014b)
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan,
Ian Goodfellow, and Rob Fergus.
Intriguing properties of neural networks.
In *International Conference on Learning Representations*,
2014b.
- Verlet (1967)
Loup Verlet.
Computer ”experiments” on classical fluids. i. thermodynamical
properties of lennard-jones molecules.
*Phys. Rev.*, 159:98–103, Jul 1967.
doi: 10.1103/PhysRev.159.98.
URL [https://link.aps.org/doi/10.1103/PhysRev.159.98](https://link.aps.org/doi/10.1103/PhysRev.159.98).
- Wang et al. (2020)
Haohan Wang, Xindi Wu, Zeyi Huang, and Eric P. Xing.
High-frequency component helps explain the generalization of
convolutional neural networks.
In *Proceedings of the IEEE/CVF Conference on Computer Vision
and Pattern Recognition (CVPR)*, June 2020.
- Wang et al. (2022)
Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu.
Guided diffusion model for adversarial purification, 2022.
URL [https://arxiv.org/abs/2205.14969](https://arxiv.org/abs/2205.14969).
- Wang et al. (2025)
Xin Wang, Hongkai Jiang, Mingzhe Mu, and Yutong Dong.
A trackable multi-domain collaborative generative adversarial network
for rotating machinery fault diagnosis.
*Mechanical Systems and Signal Processing*, 224:111950, 2025.
ISSN 0888-3270.
doi: https://doi.org/10.1016/j.ymssp.2024.111950.
URL
[https://www.sciencedirect.com/science/article/pii/S0888327024008483](https://www.sciencedirect.com/science/article/pii/S0888327024008483).
- Wang et al. (2023)
Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan.
Better diffusion models further improve adversarial training.
In *Proceedings of the 40th International Conference on Machine
Learning*, ICML’23. JMLR.org, 2023.
- Wong et al. (2020)
Eric Wong, Leslie Rice, and J. Zico Kolter.
Fast is better than free: Revisiting adversarial training.
In *International Conference on Learning Representations*, 2020.
- Wu et al. (2022)
Quanlin Wu, Hang Ye, and Yuntian Gu.
Guided diffusion model for adversarial purification from random
noise, 2022.
URL [https://arxiv.org/abs/2206.10875](https://arxiv.org/abs/2206.10875).
- Xue et al. (2023)
Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen.
Diffusion-based adversarial sample generation for improved
stealthiness and controllability.
In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and
S. Levine (eds.), *Advances in Neural Information Processing Systems*,
volume 36, pp.  2894–2921. Curran Associates, Inc., 2023.
URL
[https://proceedings.neurips.cc/paper_files/paper/2023/file/088463cd3126aef2002ffc69da42ec59-Paper-Conference.pdf](https://proceedings.neurips.cc/paper_files/paper/2023/file/088463cd3126aef2002ffc69da42ec59-Paper-Conference.pdf).
- Yoon et al. (2021)
Jongmin Yoon, Sung Ju Hwang, and Juho Lee.
Adversarial purification with score-based generative models.
In Marina Meila and Tong Zhang (eds.), *Proceedings of the 38th
International Conference on Machine Learning*, volume 139 of
*Proceedings of Machine Learning Research*, pp.  12062–12072. PMLR,
18–24 Jul 2021.
URL [https://proceedings.mlr.press/v139/yoon21a.html](https://proceedings.mlr.press/v139/yoon21a.html).
- Zagoruyko & Komodakis (2016)
Sergey Zagoruyko and Nikos Komodakis.
Wide residual networks.
In Edwin R. Hancock Richard C. Wilson and William A. P. Smith (eds.),
*Proceedings of the British Machine Vision Conference (BMVC)*, pp. 87.1–87.12. BMVA Press, September 2016.
ISBN 1-901725-59-6.
doi: 10.5244/C.30.87.
URL [https://dx.doi.org/10.5244/C.30.87](https://dx.doi.org/10.5244/C.30.87).
- Zhang et al. (2023a)
Boya Zhang et al.
Enhancing adversarial robustness via score-based optimization.
In *Proceedings of the 37th International Conference on Neural
Information Processing Systems*, NIPS ’23, Red Hook, NY, USA,
2023a. Curran Associates Inc.
- Zhang et al. (2023b)
Boya Zhang et al.
Purify++: Improving diffusion-purification with advanced diffusion
models and control of randomness, 2023b.
URL [https://arxiv.org/abs/2310.18762](https://arxiv.org/abs/2310.18762).
- Zhang et al. (2019)
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and
Michael Jordan.
Theoretically principled trade-off between robustness and accuracy.
In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.),
*Proceedings of the 36th International Conference on Machine Learning*,
volume 97 of *Proceedings of Machine Learning Research*, pp. 7472–7482. PMLR, 09–15 Jun 2019.
URL [https://proceedings.mlr.press/v97/zhang19p.html](https://proceedings.mlr.press/v97/zhang19p.html).
- Zhang et al. (2018)
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang.
The unreasonable effectiveness of deep features as a perceptual
metric.
In *Proceedings of the IEEE Conference on Computer Vision and
Pattern Recognition (CVPR)*, June 2018.
- Zhou et al. (2022)
Dawei Zhou, Nannan Wang, Xinbo Gao, Bo Han, Xiaoyu Wang, Yibing Zhan, and
Tongliang Liu.
Improving adversarial robustness via mutual information estimation.
In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari,
Gang Niu, and Sivan Sabato (eds.), *Proceedings of the 39th
International Conference on Machine Learning*, volume 162 of
*Proceedings of Machine Learning Research*, pp.  27338–27352. PMLR,
17–23 Jul 2022.
URL [https://proceedings.mlr.press/v162/zhou22j.html](https://proceedings.mlr.press/v162/zhou22j.html).
- Zollicoffer et al. (2025)
Geigh Zollicoffer, Minh N. Vu, Ben Nebgen, Juan Castorena, Boian Alexandrov,
and Manish Bhattarai.
Lorid: Low-rank iterative diffusion for adversarial purification.
*Proceedings of the AAAI Conference on Artificial Intelligence*,
39(21):23081–23089, Apr. 2025.
doi: 10.1609/aaai.v39i21.34472.
URL [https://ojs.aaai.org/index.php/AAAI/article/view/34472](https://ojs.aaai.org/index.php/AAAI/article/view/34472).

## Appendix A Derivations and Proofs

### A.1 Proof of Limit Formula

Here, we aim to show that as $t\rightarrow 0$, the difference between the consistency model outputs converges to the adversarial perturbation, i.e., $\bm{f_{\theta}}(\mathbf{z}_{t}^{a},\varnothing,t)-\bm{f_{\theta}}(\mathbf{z}_{t},\varnothing,t)\to\bm{\epsilon}_{a}$.

$$ $\displaystyle\lim_{t\to 0}\bm{f_{\theta}}(\mathbf{z}_{t}^{a},\varnothing,t)-\bm{f_{\theta}}(\mathbf{z}_{t},\varnothing,t)$ (19) $\displaystyle=$ $\displaystyle\lim_{t\to 0}c_{\mathrm{skip}}(t)\mathbf{z}_{t}^{a}+c_{\mathrm{out}}(t)\left(\frac{\mathbf{z}_{t}^{a}-\sigma_{t}\hat{\epsilon}_{\theta}\left(\mathbf{z}_{t}^{a},c,t\right)}{\alpha_{t}}\right)$ $\displaystyle\quad-c_{\mathrm{skip}}(t)\mathbf{z}_{t}-c_{\mathrm{out}}(t)\left(\frac{\mathbf{z}_{t}-\sigma_{t}\hat{\epsilon}_{\theta}\left(\mathbf{z}_{t},c,t\right)}{\alpha_{t}}\right)$ $\displaystyle=$ $\displaystyle\lim_{t\to 0}c_{\mathrm{skip}}(t)\left(\mathbf{z}_{t}^{a}-\mathbf{z}_{t}\right)$ $\displaystyle\quad+c_{\mathrm{out}}(t)\left(\frac{(\mathbf{z}_{t}^{a}-\mathbf{z}_{t})-\sigma_{t}(\hat{\epsilon}_{\theta}\left(\mathbf{z}_{t}^{a},c,t\right)-\hat{\epsilon}_{\theta}\left(\mathbf{z}_{t},c,t\right))}{\alpha_{t}}\right)$ $\displaystyle=$ $\displaystyle\lim_{t\to 0}c_{\mathrm{skip}}(t)\sqrt{\bar{\alpha}_{t}}\bm{\epsilon}_{a}+c_{\mathrm{out}}(t)\left(\frac{\sqrt{\bar{\alpha}_{t}}\bm{\epsilon}_{a}-\sigma_{t}(\hat{\epsilon}_{\theta}^{a}-\hat{\epsilon}_{\theta})}{\alpha_{t}}\right)$ $\displaystyle=$ $\displaystyle\lim_{t\to 0}c_{\mathrm{skip}}(t)\sqrt{\bar{\alpha}_{t}}\bm{\epsilon}_{a}$ $\displaystyle=$ $\displaystyle\bm{\epsilon}_{a}$ $$

### A.2 Derivation of Equation equation 10

In Equation equation [9](https://arxiv.org/html/2508.00552v2#S4.E9), our objective is to select kt such that the adversarial perturbation $\bm{\epsilon}_{a}$ is effectively removed, given that
only the adversarial latent $\mathbf{z}^{a}$ is available at inference. Following Dhariwal & Nichol (2021), we leverage Bayes’ theorem and the properties of Gaussian distributions to rewrite
the sampling formulation as:

$$ $\displaystyle q\left(\tilde{\mathbf{z}}_{t-1}|\tilde{\mathbf{z}}_{t},\mathbf{z}_{0}\right)$ $\displaystyle=\frac{q\left(\mathbf{z}_{0},\tilde{\mathbf{z}}_{t-1},\tilde{\mathbf{z}}_{t}\right)}{q\left(\mathbf{z}_{0},\tilde{\mathbf{z}}_{t}\right)}$ (20) $\displaystyle=q\left(\tilde{\mathbf{z}}_{t}|\tilde{\mathbf{z}}_{t-1},\mathbf{z}_{0}\right)\frac{q\left(\tilde{\mathbf{z}}_{t-1}|\mathbf{z}_{0}\right)}{q\left(\tilde{\mathbf{z}}_{t}|\mathbf{z}_{0}\right)}$ $\displaystyle\propto\exp\left(-\frac{1}{2}\left(\mathrm{A}\left(\tilde{\mathbf{z}}_{t-1}\right)^{2}+\mathrm{B}\tilde{\mathbf{z}}_{t-1}+\mathrm{C}\right)\right)$ $$

where,

$$ $\displaystyle\mathrm{A}=\frac{1-\bar{\alpha}_{t}}{(1-\alpha_{t})(1-\bar{\alpha}_{t-1})}$ (21) $\displaystyle\mathrm{B}=-2\sqrt{\alpha_{t}}\cdot\frac{\tilde{\mathbf{z}}_{t}-(\sqrt{\alpha_{t}}k_{t-1}-k_{t})\bm{\epsilon}_{a}}{1-\alpha_{t}}$ $\displaystyle\qquad-2\frac{\sqrt{\bar{\alpha}_{t-1}}\mathbf{z}_{0}+(\sqrt{\bar{\alpha}_{t-1}}-k_{t-1})\bm{\epsilon}_{a}}{1-\bar{\alpha}_{t-1}}$ $$

To achieve our goal, we should remove terms related to $\bm{\epsilon}_{a}$ in Equation equation [20](https://arxiv.org/html/2508.00552v2#A1.E20), which leads to:

$$ $\frac{\sqrt{\alpha_{t}}(\sqrt{\alpha_{t}}k_{t-1}-k_{t})\bm{\epsilon}_{a}}{1-\alpha_{t}}=\frac{(\sqrt{\bar{\alpha}_{t-1}}-k_{t-1})\bm{\epsilon}_{a}}{1-\bar{\alpha}_{t-1}}$ (22) $$

Then we have:

$$ $\displaystyle k_{t}$ $\displaystyle=\frac{\bar{\alpha}_{t}-1}{\sqrt{\alpha_{t}}(\bar{\alpha}_{t-1}-1)}k_{t-1}+\frac{\sqrt{\bar{\alpha}_{t-1}}(1-\alpha_{t})}{\sqrt{\alpha_{t}}(\bar{\alpha}_{t-1}-1)}$ (23) $\displaystyle=\frac{\sqrt{\alpha}_{t}(\bar{\alpha}_{t}-1)}{\bar{\alpha}_{t}-\alpha_{t}}k_{t-1}+\frac{\sqrt{\bar{\alpha}_{t-1}}(1-\alpha_{t})}{\bar{\alpha}_{t}-\alpha_{t}}$ $$

By dividing both sides by $\sqrt{\bar{\alpha}_{t}}$, we obtain the recursive
formula:

$$ $\frac{k_{t}}{\sqrt{\bar{\alpha}_{t}}}=\frac{\bar{\alpha}_{t}-1}{\bar{\alpha}_{t}-\alpha_{t}}\frac{k_{t-1}}{\sqrt{\bar{\alpha}_{t-1}}}+\frac{1-\alpha_{t}}{\bar{\alpha}_{t}-\alpha_{t}}$ (24) $$

Thus, we can easily obtain the closed-form expression:

$$ $\frac{k_{t}}{\sqrt{\bar{\alpha}_{t}}}=\frac{\bar{\alpha}_{1}(1-\bar{\alpha}_{t})}{\bar{\alpha}_{t}(1-\bar{\alpha}_{1})}\left(\frac{k_{1}}{\sqrt{\bar{\alpha}_{1}}}-1\right)+1$ (25) $$

With $k_{T}=0$, replace $t=T$ in the equation, we have:

$$ $\frac{k_{1}}{\sqrt{\bar{\alpha}_{1}}}=1-\frac{\bar{\alpha}_{T}(1-\bar{\alpha}_{1})}{\bar{\alpha}_{1}(1-\bar{\alpha}_{T})}$ (26) $$

Finally we can obtain the closed-form expression of $k_{t}$:

$$ $k_{t}=\sqrt{\bar{\alpha}_{t}}\left(1-\frac{\bar{\alpha}_{T}(1-\bar{\alpha}_{t})}{\bar{\alpha}_{t}(1-\bar{\alpha}_{T})}\right)=\sqrt{\bar{\alpha}_{t}}-\frac{\bar{\alpha}_{T}(1-\bar{\alpha}_{t})}{\sqrt{\bar{\alpha}_{t}}(1-\bar{\alpha}_{T})}$ (27) $$

### A.3 More Ablation Results

We conducted additional ablation studies to rigorously evaluate the effectiveness of each component in DBLP. Specifically, we ablated Noise Bridge Distillation (NBD) and the Leapfrog ODE solver, comparing them respectively with the consistency distillation loss (CD) of the Latent Consistency Model and the conventional DDIM solver. The distillation loss ablation results, summarized in Table [8](https://arxiv.org/html/2508.00552v2#A1.T8), demonstrate that NBD consistently outperforms the traditional CD across all metrics, achieving superior robust accuracy and perceptual image quality. This indicates that, by introducing a noise bridge, NBD more effectively aligns the adversarial noise distribution with the clean data distribution, thereby substantially enhancing both model robustness and the quality of purified images.

**Table 8: Ablation study on different distillation loss.**
| Distillation Loss | Robust Accuracy | LPIPS | SSIM |
| --- | --- | --- | --- |
| w/o | 65.1 | 0.1857 | 0.7260 |
| CD | 73.5 | 0.1337 | 0.7492 |
| NBD | 75.6 | 0.1012 | 0.7655 |

In the ODE solver ablation, the Leapfrog solver exhibits remarkable performance and efficiency, surpassing the DDIM solver. These results confirm that the Leapfrog solver’s distinctive update mechanism enables higher computational efficiency without compromising purification quality.

**Table 9: Ablation study on different ODE solvers.**
| ODE Solver | Robust Accuracy | LPIPS | Time |
| --- | --- | --- | --- |
| DDIM | 75.40 | 0.1029 | 0.2670 |
| Leapfrog | 75.60 | 0.1012 | 0.2315 |

## Peer Reviews

confidence: 3
contribution: 1
initial_rating: 2
presentation: 3
questions: Please refer to the weaknesses.
soundness: 2
strengths: 1. The paper tackles an important challenge in DBP methods. By aiming for a one-step (or very few-step) diffusion purification, NoiseBridge targets the key limitation of speed to make DBP methods practical for real-world use.
2.  The experimental evaluation shows that NoiseBridge achieves strong adversarial robustness on multiple datasets.
summary: This paper proposes NoiseBridge, a DBP defense method that uses a consistency regularization to purify AEs in a very low number of diffusion steps. The approach leverages a latent consistency model to bridge adversarial noise and clean data distributions, and introduces an adaptive semantic enhancement module that injects multi-scale edge information to preserve image content during purification.
weaknesses: 1. The technical novelty of NoiseBridge is questionable (also mentioned by Reviewer kUDN in the public comments). The core approach appears to be heavily based on OSCP [1] with only incremental changes. OSCP introduced the idea of single-step adversarial purification using a distilled diffusion model, employing a consistency distillation objective and an edge-based guidance to preserve content. NoiseBridge essentially follows the same template: a diffusion model is fine-tuned with a noise-to-clean consistency objective (analogous to OSCP’s GAND) and uses edge information during inference (similar to OSCP’s CAP) to maintain structure. The only notable difference is that NoiseBridge uses *multi-scale* edge maps instead of a fixed edge detector. While this is a useful improvement, it is relatively minor in terms of conceptual novelty. 
2. Compounding the above issue, the paper’s positioning with respect to OSCP is problematic. Given the high degree of overlap in methodology, one would expect a clear acknowledgment and discussion of how NoiseBridge differs from and builds upon OSCP. However, the attribution in the current draft is not adequately prominent. OSCP is indeed cited, but the authors seem to downplay its influence. For example, by renaming similar techniques (e.g., consistency distillation as "noise bridge distillation", edge-guided purification as "adaptive semantic enhancement") without explicitly crediting that these ideas originate in OS. This insufficient attribution can mislead readers into overestimating the originality of NoiseBridge and raises ethical concerns. Currently it gives the impression that the paper is repackaging someone else’s contributions with only superficial changes.
3. While the paper reports state-of-the-art results, the actual gains over OSCP are quite small. For instance, NoiseBridge improves robust accuracy on ImageNet by roughly 1%-1.5% (e.g., from ~73.9% to ~75.6% under comparable attack settings), and a similar modest gain is seen in clean image preservation metrics.
4. The paper evaluates robustness using standard attacks (PGD, AutoAttack, etc.), but it does not evaluate against stronger attacks. According to [2], PGD+EOT should be evaluated for DBP methods. This is an important issue to investigate for a complete evaluation of an adversarial defense.

[1]  Instant adversarial purification with adversarial consistency distillation. In CVPR 2025.

[1] Robust evaluation of diffusion-based adversarial purification. ICCV 2023.

---

confidence: 3
contribution: 1
initial_rating: 2
presentation: 1
questions: Please refer to  **weaknesses** and address all my concerns by answering the listed weaknesses.
soundness: 2
strengths: 1. The paper focuses on a realistic problem within existing DBP framework, which is the inference time feasibility.

2. Leveraging consistency model is a promising direction for future DBP work.
summary: The paper proposes Diffusion Bridge Distillation for Purification (DBLP), a novel and efficient framework for diffusion-based purification (DBP).
Existing DBP methods often require a large number of NFEs for both adversarial image generation and denoising, which limits their practicality. DBLP aims to address this issue and improve the deployability of DBP methods in real-world scenarios.

1) The proposed framework consists of two key components:

2) Latent Consistency Model (LCM): trained to purify adversarial inputs by learning the underlying adversarial noise distribution.

Semantic Preservation Module: leverages computer vision techniques to retain the semantic content of the original image during the denoising process.

Experimental results demonstrate that DBLP achieves comparable or improved robustness against existing DBP baselines across multiple benchmarks, while maintaining efficiency.
weaknesses: Before addressing my specific questions, I would like the authors to respond to the following major concern:

This work exhibits substantial overlap with the previously published OSCP paper [1]. The authors should carefully clarify the differences in motivation and methodology to distinguish their contributions.

The other weaknesses are the following:

**1. Formatting and citation issues.**

The current version contains multiple formatting inconsistencies, such as incorrect citation usage (e.g., using \citet{} for all references) and duplicated equation references (e.g., line 176). These should be revised to meet standard academic formatting conventions.

**2. Disorganized experimental layout.**

The presentation of experimental results is confusing. The attack settings should be clearly described in Section 5. Table 2 mixes results from ImageNet under various adaptive attacks and classifiers, making it difficult to interpret or compare performance fairly. Each table should isolate comparable settings for clarity. Also, in line 238, the stated objective is consistent with all the DBP methods that leverages diffusion model to map conditional gaussian distribution back to original data distribution. The objective cannot become a contribution as stated in line 073.

**3.Incorrectly highlighted results.**

Table 1 mistakenly bolds the DBLP results for both clean and robust accuracies, even though ADBM achieves higher $\ell_2$ robustness. This raises concerns about proofreading and result verification prior to submission.

**4. Limited methodological novelty.**

The proposed Adaptive Semantic Enhancement (ASE) contributes only marginal robustness gains. ASE essentially applies a layer-wise Canny edge detector with Gaussian blur pyramids — a relatively minor modification compared with prior work [1]. Would you like to explain the design principle of choosing a gaussian blur pyramids?

**5. Incorrect comparison in methodology.**

At line 236, the statement “Unlike DDPM, DBLP includes adversarial perturbations $\epsilon_a$ at the start of the noising process” is misleading. In diffusion-based purification (DBP) frameworks, inputs are either adversarial ($x_{adv}$) or natural ($x_{nat}$) images. This comparison misrepresents the role of $\epsilon_a$ and should be corrected.

**6. Potential plagiarism concern.**

Figure 1 appears highly similar to that of OSCP [1], particularly in the design of the LCM-LoRA module. The overall pipeline closely resembles the OSCP architecture, suggesting that DBLP’s improvements may stem more from leveraging consistency models’ one-step denoising rather than introducing a genuinely novel methodology.


[1] Lei et al, "Instant Adversarial Purification with Adversarial Consistency Distillation", CVPR 2025.

---

confidence: 4
contribution: 2
initial_rating: 2
presentation: 2
questions: **Q1. Relationship to OSCP**

Can you explicitly clarify how "Noise Bridge Distillation" differs conceptually from OSCP's "Gaussian Adversarial Noise Distillation"? Both methods:
- Add adversarial noise to the forward diffusion process  
- Use the same training objective structure
- Employ edge-based conditioning for inference

Is your contribution primarily an alternative mathematical formulation, or is there a fundamental conceptual difference?

---

**Q2. Inference-Time Computation**

How is $\tilde{\mathbf{z}}_t$ in Eq. (11) computed at inference without knowing $\epsilon_a$? Please provide:
- Step-by-step inference algorithm (not just training)
- Explicit method for handling the $\epsilon_a$ term
- Explanation of how Appendix A.2's posterior derivation enables this

---

**Q3. Statistical Significance**

Your improvement over OSCP is 1.71% (73.89% → 75.6%). Please provide:
- How many independent runs were performed?
- Standard deviations across runs?
- Statistical significance test (e.g., paired t-test)?
- Could this be within experimental noise?

---

**Q4. Adaptive Attacks**

Have you evaluated against:
- Adaptive attacks aware of your purification (e.g., attacking the LCM directly)?
- C&W attack?
- Diff-PGD with different loss functions?

Table 4 shows Diff-PGD-10, but what about stronger adaptive threats?

---

**Q5. Reproducibility**

Can you provide:
- GPU model and training time
- Random seeds used
- Complete hyperparameter values (PGD step size, temperature T*)
- Code release commitment upon acceptance?

---

**Q6. Ablation Studies**

Table 8 compares CD vs NBD, but what about:
- Vanilla LCM (no distillation) vs your method?
- Your noise bridge vs just using OSCP's formulation directly?
- Impact of each component in "Adaptive Semantic Enhancement"?
soundness: 2
strengths: **S1. Addresses Important Problem**
- Inference speed is a critical bottleneck for diffusion-based adversarial purification
- Achieving 0.2s represents significant speedup over DiffPure (53s)
- Motivation for real-time defense is well-articulated

**S2. Comprehensive Experiments**
- Multiple datasets (CIFAR-10, ImageNet, CelebA) evaluated
- Various threat models tested ($\ell_\infty$, $\ell_1$, $\ell_2$)
- Cross-architecture transferability shown (Table 4)

**S3. Competitive Empirical Results**  
- 75.6% robust accuracy on ImageNet under PGD-100
- Maintains reasonable clean accuracy (78.2%)
- Strong performance on face recognition tasks
summary: This paper proposes DBLP, a fast adversarial purification method using diffusion models. The authors claim two main contributions: (1) Noise Bridge Consistency Distillation that aligns adversarial and clean distributions in Latent Consistency Models, and (2) Adaptive Semantic Enhancement using multi-scale edge maps for conditioning. However, the paper suffers from critical issues: the core methodology is substantially similar to OSCP (Lei et al., CVPR 2025), the theoretical foundation has fundamental gaps regarding inference-time computation, and essential experimental details are missing. The claimed improvements over OSCP are marginal (1.7%) without statistical significance testing. These issues prevent acceptance at ICLR.
weaknesses: **W1. Substantial Similarity to OSCP (Lei et al., CVPR 2025)**

The core methodology is nearly identical to OSCP's GAND approach:

**Identical Forward Process:**
- OSCP Eq. (11): $\mathbf{z}^*_t = \sqrt{\bar{\alpha}_t}\mathbf{z} + \sqrt{1-\bar{\alpha}_t}(\boldsymbol{\epsilon} + \boldsymbol{\delta}_{\text{adv}})$
- DBLP Eq. (11): $\tilde{\mathbf{z}}_t = \sqrt{\bar{\alpha}_t}\mathbf{z}_0 + \sqrt{1-\bar{\alpha}_t}\boldsymbol{\epsilon} + \frac{\bar{\alpha}_T(1-\bar{\alpha}_t)}{\sqrt{\bar{\alpha}_t(1-\bar{\alpha}_T)}}\boldsymbol{\epsilon}_a$

Both add adversarial noise to the diffusion forward process. DBLP's coefficient $k_t$ derivation (Eq. 10) is merely a mathematical reparameterization with no conceptual difference.

**Nearly Identical Training Objective:**
- OSCP's GAND loss (Eq. 15) and DBLP's LCD loss (Eq. 12) have the same structure
- DBLP's only addition is reconstruction loss from Kim et al. (2024)

**Similar Inference Pipeline:**
- Both use Canny edge detection + ControlNet
- DBLP's "Adaptive Semantic Enhancement" adds standard techniques (Otsu thresholding, image pyramids) to OSCP's CAP

**Inadequate Disclosure:**
- While DBLP cites OSCP (Table 2), it never explicitly states that "Noise Bridge Distillation" is essentially the same idea as OSCP's GAND
- Related Work (Sec. 2.2) mentions OSCP only for speed, not methodology
- This insufficient disclosure raises academic integrity concerns

**Marginal Improvement:**
- Claims 1.71% improvement over OSCP (73.89% → 75.6%)
- No statistical significance testing provided
- Could be experimental variation rather than true improvement

---

**W2. Fundamental Theoretical Gap**

**Critical contradiction regarding Eq. (11):**

Line 248 states: "its exact value [$\epsilon_a$] is unknown at inference time"  
Line 258 claims: "sampling process doesn't require $\epsilon_a$"  
But Eq. (11) explicitly requires $\epsilon_a$: $\tilde{\mathbf{z}}_t = \sqrt{\bar{\alpha}_t}\mathbf{z}_0 + \sqrt{1-\bar{\alpha}_t}\boldsymbol{\epsilon} + \frac{\bar{\alpha}_T(1-\bar{\alpha}_t)}{\sqrt{\bar{\alpha}_t(1-\bar{\alpha}_T)}}\boldsymbol{\epsilon}_a$

**The problem:** Appendix A.2 shows how to eliminate $\epsilon_a$ from the posterior distribution through choice of $k_t$, but does NOT explain how to construct $\tilde{\mathbf{z}}_t$ without knowing $\epsilon_a$ at inference. This is not addressed in Algorithm 1, which only describes training.

---

**W3. Severe Reproducibility Issues**

Missing critical details:
- No GPU specifications
- No total training time  
- No random seeds
- No hyperparameter search description
- No code release commitment
- Missing PGD step size $\alpha$
- Missing temperature $T^\ast$ in Eq. (17)

These omissions violate ICLR reproducibility standards.

---

**W4. Experimental Design Flaws**

**Overfitting to seen attacks:**
- Training: PGD-100, $\epsilon=4/255$, $\ell_infty$, ResNet-50 (Sec. 5.1)
- Main evaluation: PGD-100, $\epsilon=4/255$, $\ell_infty$, ResNet-50 (Tables 1-2)
- This is essentially a "seen attack" scenario

**Missing evaluations:**
- No adaptive attacks aware of the purification method
- Limited AutoAttack results (only 2 settings in Table 2)
- No analysis of failure modes
- No statistical significance testing (no error bars, no multiple runs)

---

**W5. Limited Novel Contribution**

Given similarity to OSCP, the incremental contributions are:
1. Mathematical reparameterization of OSCP's forward process (no conceptual advance)
2. Adding Otsu thresholding + image pyramids to edge detection (standard CV techniques)
3. Leapfrog solver shows minimal improvement (Table 9: 0.2% gain)

These incremental modifications do not constitute sufficient novelty for a major venue.

---

confidence: 5
contribution: 2
initial_rating: 4
presentation: 3
questions: Could you explain the your choices of the classifier and the adversarial attack algorithm used during training?
soundness: 3
strengths: 1. This paper is well-written and well-structured.
2. DBLP achieves significant acceleration in adversarial purification by leveraging its noise bridge distillation technique.
3. The paper demonstrates a comprehensive literature review and employs cutting-edge baselines for comparison.
summary: This paper proposes DBLP, a diffusion-based adversarial purification framework that addresses the limitations of slow inference in existing methods by introducing noise bridge distillation within a latent consistency model, which constructs a principled alignment between adversarial noise and clean data distributions to enable efficient one-step purification, complemented by an adaptive semantic enhancement module that fuses multi-scale pyramid edge maps to preserve fine-grained details and improve visual fidelity. Extensive experiments on multiple datasets demonstrate that DBLP achieves state-of-the-art robust accuracy
weaknesses: 1. The novelty of this work is limited, as the direct modeling of the transition between adversarial noise and the image distribution has been previously explored by ADBM.
2. While this method demonstrates certain advantages, it requires a training process, which is computationally expensive. Furthermore, compared to other training-free alternatives, it exhibits limited generalizability.
3. During training, the method requires a classifier to generate adversarial examples. The noise bridge distillation process relies heavily on the specific classifier and the adversarial attack algorithm used, which can further undermine DBLP's generalization performance.