Adversarial Guided Diffusion Models for Adversarial Purification

## Abstract

Abstract Diffusion models (DMs) based adversarial purification (AP) has shown to be the most powerful alternative to adversarial training (AT).
However, these methods neglect the fact that pre-trained diffusion models themselves are not robust to adversarial attacks as well.
Additionally, the diffusion process can easily destroy semantic information and generate a high quality image but totally different from the original input image after the reverse process, leading to degraded standard accuracy. To overcome these issues, a natural idea is to harness adversarial training strategy to retrain or fine-tune the pre-trained diffusion model, which is computationally prohibitive.
We propose a novel robust reverse process with adversarial guidance, which is independent of given pre-trained DMs and avoids retraining or fine-tuning the DMs.
This robust guidance can not only ensure to generate purified examples retaining more semantic content but also mitigate the accuracy-robustness trade-off of DMs for the first time, which also provides DM-based AP an efficient adaptive ability to new attacks.
Extensive experiments are conducted on CIFAR-10, CIFAR-100 and ImageNet
to demonstrate that our method achieves the state-of-the-art results and exhibits generalization against different attacks.

## 1 Introduction

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial examples (Szegedy et al., ),
leading to disastrous implications. Since then, numerous methods have been proposed to defend against adversarial examples.
Notably, adversarial training (AT, Goodfellow et al., ; Madry et al., ) enhances classifiers by training with adversarial examples, achieving the state-of-the-art robustness against known attacks.
However, when faced with unseen attacks, AT is almost incapable of defense (Laidlaw et al., ; Dolatabadi et al., ).
Another class of defense methods, adversarial purification (AP, Yoon et al., ),
relies on pre-trained generative models to eliminate perturbations from potentially attacked images before classification.
AP operates as a pre-processing step against unseen attacks without the need to retrain the classifier.
Recently, by leveraging the great generative capability of diffusion models (DMs, Ho et al., ; Song et al., ), Nie et al. () achieved remarkable performance using AP and was shown to be a promising alternative to AT.

Figure: Figure 1: The scheme of diffusion-based AP. The examples are firstly diffused with Gaussian noises by the forward process and then followed by the reverse process to remove the noise step by step.
Refer to caption: x1.png

However, recent studies (Lee and Kim, ; Kang et al., ; Chen et al., ) find that DM-based AP is not as robust as shown in previous literature (Nie et al., ; Wang et al., ).
Indeed, it might be easily fooled by attacks such as PGD+EOT.
Moreover, by adding Gaussian noise, the perturbation is gradually destroyed, thereby enhancing the robust accuracy, but increasing Gaussian noise can also lead to a loss of semantic information, resulting in degraded accuracy.
As a remedy, Wang et al. (); Zhang et al. () propose the reverse processes with guidance to preserve semantic information.
However, their guidance only considers suppressing example information loss, which lacks robustness against adversarial example information and has a risk of preserving or even enhancing adversarial perturbations. We argue that this is caused by the non-robustness of guidance, which is a crucial issue that needs to be solved.
Therefore, our goal is to develop a diffusion model that can preserve semantic information while being robust to adversarial information.

To obtain a robust generator-based purifier, one possible solution is fine-tuning the generative model using adversarial examples and classification loss by freezing the classifier, which can thus preserve semantic information even under adversarial attacks. In particular, Lin et al. () propose a defense pipeline called adversarial training on purification (AToP), which employs the adversarial loss to fine-tune the whole purifier and achieves great success in fine-tuning a robust AE-based purifier (Wu et al., ) and GAN-based purifier (Ughini et al., ). However, Lin et al. () claim that AToP cannot work on DMs due to the high computational cost of generating adversarial examples for DMs.
Therefore, the robustness of the DM-based purifier model still remains challenging.

In this paper, we propose a novel adversarial guided diffusion model (AGDM) that employs a robust reverse process with adversarial guidance of given pre-trained DMs,
as illustrated in Figure 1.
Notably, this robust guidance is independent of DMs and avoids retraining or fine-tuning the whole DMs.
To achieve this, instead of training DMs, we train a robust guidance with a new adversarial loss and then apply this robust guidance to the reverse process of DMs during purification. Since our method does not need to compute the entire reverse process during training of robust guidance, it avoids the computational issue of AToP.
Given the robust guidance, the modified reverse process of DMs can not only generate better purified examples retaining more semantic content but also mitigate the accuracy-robustness trade-off.
To the best of our knowledge, this is the first approach to consider accuracy-robustness trade-off in pre-trained generator-based AP, which might be a significant contribution to advance the development of this field.

To demonstrate the effectiveness of our method,
we empirically evaluate the performance by comparing with the latest AT and AP methods across various attacks, including AutoAttack (Croce and Hein, ), StAdv (Xiao et al., ), PGD (Madry et al., ) and EOT (Athalye et al., ),
on CIFAR-10, CIFAR-100 and ImageNet datasets under multiple classifier models.
The experimental results demonstrate that our method achieves the state-of-the-art performance on both accuracy and robustness among AP baselines.
Moreover, our method exhibits better robust generalization against unseen attacks.
More importantly, our results on the robust evaluation of diffusion-based purification (Lee and Kim, ) manifest the necessity of robust guidance in diffusion models for adversarial purification.
Our contributions are summarized as follows.

- •
To enhance the robustness of diffusion models, we propose a robust reverse process to preserve semantic information and generate robust purified examples.
- •
An adversarial loss is proposed to train robust guidance, thus subtly bypassing the high computational demand when applying AT to DMs. It also provides a practical solution to mitigate the accuracy-robustness trade-off in DM-based AP.
- •
We conduct extensive experiments to empirically demonstrate that the proposed method significantly improves both the accuracy and robustness of diffusion-based purifier models, especially under the new robust evaluation scheme (Lee and Kim, ).

## 2 Preliminary

This section briefly review the adversarial training, adversarial purification, and diffusion models.

### 2.1 Adversarial Training and Adversarial Purification

Given a classifier $c_{\gamma}$ with input $x$ and output $y$, the adversarial attacks aim to find the adversarial examples $x^{\prime}$ that can fool the classifier model $c_{\gamma}$. The adversarial examples can be obtained by

$$ $x^{\prime}=x+\delta,\quad\delta=\mathop{\arg\max}_{\delta\leq\varepsilon} \mathcal{L}(c_{\gamma}(x+\delta),y),$ $$

where $\delta$ represents a small perturbation and $\varepsilon$ represents the maximum scale. To defend against adversarial attacks, the most popular technique is adversarial training (AT, Goodfellow et al., ; Madry et al., ), which requires the classifier $c_{\gamma}$ to be retrained with adversarial examples by

$$ $\min_{\gamma}\mathbb{E}_{p_{\text{data}}(x,y)}[\mathop{\max}_{\delta\leq \varepsilon}\mathcal{L}(c_{\gamma}(x+\delta),y)].$ $$

Another technique is adversarial purification (AP, Yang et al., ; Shi et al., ), which can purify the adversarial examples before feeding them into the classifier model, i.e.,

$$ $c_{\gamma}(g_{\theta}(x+\delta))=c_{\gamma}(x),$ $$

where the purifier model $g_{\theta}$ in general does not require $g_{\theta}(x+\delta)=x$. As a plug-and-play module, the pre-trained generator-based purifier model can be integrated with any classifiers.

### 2.2 Diffusion Models

Diffusion models (Ho et al., ; Song et al., ) are a class of generative models that can generate high-quality images, which consist of two processes: a forward process transforms an image entirely into noise by gradually adding Gaussian noise, and a reverse process transforms noise into the generated image by gradually denoising.

In the denoising diffusion probabilistic model (DDPM, Ho et al., ), given a real image $x_{0}\sim q(x)$, the forward process involves $T$ steps, resulting in $x_{1},x_{2},...,x_{T}$. Since each step $t$ is only related to the previous step $t-1$, it can also be viewed as a Markov process,

$$ $\displaystyle q(x_{t}\mid x_{t-1})$ $\displaystyle=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}\mathbf{I}),$ $\displaystyle q(x_{1:T}\mid x_{0})$ $\displaystyle=\prod_{t=1}^{T}q(x_{t}\mid x_{t-1}),$ $$

where $\beta_{t}$, as a hyperparameter, is typically set to linearly interpolate from 0.0001 to 0.02 (Nichol et al., ). With $\alpha_{t}:=1-\beta_{t}$ and $\bar{\alpha}_{t}:=\prod_{s=1}^{t}\alpha_{s}$, any step $t$ can be rewritten as one direct sample from

$$ $q(x_{t}\mid x_{0})=\mathcal{N}(x_{t};\sqrt{\bar{\alpha}_{t}}x_{0},(1-\bar{ \alpha}_{t})\mathbf{I}).$ (1) $$

The reverse process aims to restore the original image $x_{0}$ from the Gaussian noise $x_{T}\sim\mathcal{N}(0,\mathbf{I})$ by sampling from $p_{\theta}(x_{t-1}\mid x_{t})$, given by

$$ $\displaystyle p_{\theta}(x_{t-1}\mid x_{t})$ $\displaystyle=\mathcal{N}(x_{t-1};\mu_{\theta}(x_{t},t),\sigma_{t}^{2}\mathbf{ I}),$ $\displaystyle p_{\theta}(x_{0:T})$ $\displaystyle=p(x_{T})\prod_{t=T}^{1}p_{\theta}(x_{t-1}\mid x_{t}),$ $$

where $\sigma_{t}$ denotes a time dependent constant and $\mu_{\theta}(x_{t},t)=\frac{1}{\sqrt{\alpha_{t}}}x_{t}-\frac{1-\alpha_{t}}{
\sqrt{1-\bar{\alpha}_{t}}\sqrt{\alpha_{t}}}\epsilon_{\theta}$ is usually modeled by a U-Net $\epsilon_{\theta}$, which needs to be trained to predict a random noise at each time step by Ho et al. (),

$$ $L(\theta)=\mathbb{E}_{t,x_{0},\epsilon}[\lVert\epsilon-\epsilon_{\theta}(\sqrt {\bar{\alpha}_{t}}x_{0}+\sqrt{1-\bar{\alpha}_{t}}\epsilon,t)\rVert^{2}],$ $$

where $\epsilon\sim\mathcal{N}(0,\mathbf{I})$ denotes a Gaussian noise. Unlike the forward process, which can be directly computed by Equation 1, the reverse process requires $T$ steps to obtain $x_{0}$ from $x_{T}$. Therefore, as compared to other generative models, diffusion models are much slower in image generation.

## 3 Methods

We propose a novel adversarial guided diffusion model (AGDM) for adversarial purification, which purifies adversarial examples by a robust reverse process. We derive our method in Section 3.1. Then, we discuss how to train a robust classifier and mitigate the accuracy-robustness trade-off in Section 3.2. Finally, we introduce the whole process of our diffusion-based purification in Section 3.3.

### 3.1 Adversarial Guided Diffusion Model

Unlike the guided diffusion (Dhariwal and Nichol, ; Wu et al., ; Kim et al., ; Zhang et al., ), we are the first to introduce a robust classifier guidance to the reverse process.
Similar to Dhariwal and Nichol (), we have

$$ $\begin{multlined}p_{\theta,\phi}(x_{t}\mid x_{t+1},y,x^{\prime})\propto p_{ \theta}(x_{t}\mid x_{t+1})p_{\phi}(x^{\prime}\mid x_{t})p_{\phi}(y\mid x_{t}), \end{multlined}p_{\theta,\phi}(x_{t}\mid x_{t+1},y,x^{\prime})\propto p_{ \theta}(x_{t}\mid x_{t+1})p_{\phi}(x^{\prime}\mid x_{t})p_{\phi}(y\mid x_{t}),$ (2) $$

where $x^{\prime}$ is the adversarial example. To obtain this factorization of probabilities,
we assume the label $y$ and adversarial example $x^{\prime}$ are conditionally independent given $x_{t}$.
The conditional distribution $p_{\theta}(x_{t}\mid x_{t+1})$ is characterized by the pre-trained diffusion model, while $p_{\phi}(x^{\prime}\mid x_{t})p_{\phi}(y\mid x_{t})$ can be modeled by a robust classifier. In specific, $p_{\phi}(y\mid x_{t})$ is the prediction of labels. Moreover, to describe relations between adversarial and diffused clean images, we adopt a heuristic probability,

$$ $p_{\phi}(x^{\prime}\mid x_{t})\propto\exp(-\mathcal{D}(f_{\phi}(x^{\prime}),f_ {\phi}(x_{t}))),$ $$

where $\mathcal{D}(\cdot,\cdot)$ is distance measurement and $f_{\phi}$ is the classifier function that outputs the logit of labels.

For the first term in Equation 2, we have

$$ $\displaystyle\log p_{\theta}(x_{t}\mid x_{t+1})$ $\displaystyle=-\frac{1}{2}(x_{t}-\mu)^{\intercal}\Sigma^{-1}(x_{t}-\mu)+C_{1},$ (3) $$

where $\mu$ and $\Sigma$ are obtained by the pre-trained diffusion model and $C_{1}$ is a constant w.r.t. $x_{t}$. We omit the inputs of the function for clarity, consistent with notations with Dhariwal and Nichol ().
The second term in Equation 2 can be approximated as

$$ $\displaystyle\log p_{\phi}(x^{\prime}\mid x_{t})\approx$ $\displaystyle\log p_{\phi}(x^{\prime}\mid x_{t})\mid_{x_{t}=\mu}+(x_{t}-\mu)^{ \intercal}\triangledown_{x_{t}}\log p_{\phi}(x^{\prime}\mid x_{t})\mid_{x_{t}=\mu}$ $\displaystyle=$ $\displaystyle(x_{t}-\mu)^{\intercal}\triangledown_{x_{t}}\mathcal{D}(f_{\phi}( x^{\prime}),f_{\phi}(x_{t}))+C_{2},$ (4) $$

where $C_{2}$ is a constant w.r.t. $x_{t}$.
Finally, for the last term in Equation 2, we have

$$ $\displaystyle\log p_{\phi}(y\mid x_{t})\approx$ $\displaystyle\log p_{\phi}(y\mid x_{t})\mid_{x_{t}=\mu}+(x_{t}-\mu)^{\intercal }\triangledown_{x_{t}}\log p_{\phi}(y\mid x_{t})\mid_{x_{t}=\mu}$ $\displaystyle=$ $\displaystyle(x_{t}-\mu)^{\intercal}g+C_{3},$ (5) $$

where $g=\triangledown_{x_{t}}\log p_{\phi}(y\mid x_{t})$ and $C_{3}$ is a constant w.r.t. $x_{t}$.
By plugging Equations 3, 4 and 5 into Equation 2, we obtain the adjusted score function with robust guidance,

$$ $\log p_{\theta,\phi}(x_{t}\mid x_{t+1},y,x^{\prime})=\log p(z)+C_{4},$ $$

where $C_{4}$ is a constant and $z$ follows

$$ $z\sim\mathcal{N}(z;\mu+\Sigma g-\Sigma\triangledown_{x_{t}}\mathcal{D}(f_{\phi }(x^{\prime}),f_{\phi}(x_{t})),\Sigma).$ $$

The full derivation is shown in Section A.1.
The above derivation of guided sampling is valid for DDPM.
However, the robust reverse process can be extended to continuous-time diffusion models.
Specifically, the denoising model $\epsilon_{\theta}$ can be used to derive a score function (Song et al., ; Dhariwal and Nichol, ). Consider a diffusion process with drift coefficient $f(x,t)$ and diffusion coefficient $G(t)$, the robust reverse process becomes (details in Section A.2)

$$ $\mathop{}\!\mathrm{d}x_{t}=\left[f(x,t)-G^{2}(t)(s_{\theta}+a_{\phi}+b_{\phi}) (x,t)\right]\mathop{}\!\mathrm{d}t+G(t)\mathop{}\!\mathrm{d}\bar{w},$ $$

where $s_{\theta}(x,t)$ is the pre-trained score network, $a_{\phi}(x,t)=\nabla_{x_{t}}\log p_{\phi}(y\mid x_{t})$ and $b_{\phi}(x,t)=\nabla_{x_{t}}\log p_{\phi}(x^{\prime}\mid x_{t})$.
The proposed reverse process with robust guidance is presented in Algorithm 1. Note that a key challenge is to obtain the robust guidance for diffusion models. As we explained before, generating adversarial examples for the diffusion model as in Lin et al. () is infeasible. In the next subsection, we address this issue by a modification of the adversarial loss in Lin et al. ().

### 3.2 Robust Guidance Training

According to the above contents and adversarial training (Zhang et al., ), we train another robust classifier with classification loss on clean examples $x$ and discrepancy loss on adversarial examples $x^{\prime}$ and clean examples $x$,

$$ $\min_{\phi}\mathbb{E}_{p_{\text{data}}(x,y)}[\underbrace{\mathcal{L}(f_{\phi}( x),y)}_{\text{for accuracy}}+\lambda\underbrace{\mathop{\max}_{\delta\leq \varepsilon}\mathcal{D}(f_{\phi}(x),f_{\phi}(x^{\prime}))}_{\text{for robustness}}],$ (6) $$

where $x^{\prime}=x+\delta$, and $\lambda$ is a weighting scale to balance the accuracy-robustness trade-off.

Figure: Figure 2: Overview of the diffusion process and reverse process. The movement of the red star represents the entire purification process. Different colored dots represent the data distributions of various categories. In the presence of attacks, without guidance or with incorrect guidance, the red star may move to the wrong category in the reverse process, thereby reducing robust accuracy.
Refer to caption: x2.png

Unlike the previous work (Lin et al., ), they calculate the classification loss with adversarial examples $\mathcal{L}(f_{\phi}(x^{\prime}),y)$ for fine-tuning to improve robust accuracy.
Instead, we introduce discrepancy loss $\mathcal{D}(f_{\phi}(x),f_{\phi}(x^{\prime}))$ to improve robustness while using only clean examples to calculate the classification loss $\mathcal{L}(f_{\phi}(x),y)$ to improve standard accuracy, details in Appendix B. To our best knowledge, this is the first to discuss the accuracy-robustness trade-off challenge in pre-trained generator-based purification.

### 3.3 Robust Reverse Process

The vanilla reverse process is vulnerable to adversarial attacks (Lee and Kim, ). During attacks, the vanilla classifier (Zhang et al., ) may provide incorrect gradients, leading to incorrect guidance. Likewise, the reverse process without guidance can also lead to the sampling of noisy images towards incorrect labels, as shown in Figure 2. Considering this issue, we introduce additional adversarial information to sampling image from the robust reverse process.

Given an adversarial example $x^{\prime}$, we first diffuse $x^{\prime}$ with $t^{*}$ steps by

$$ $x_{t^{*}}=\sqrt{\bar{\alpha}_{t^{*}}}x^{\prime}+\sqrt{1-\bar{\alpha}_{t^{*}}} \epsilon,\quad\epsilon\sim\mathcal{N}(0,\mathbf{I}).$ (7) $$

Then, in the robust reverse process, we can obtain the purified example $x_{0}$ by sampling $x_{t-1}$ from $\mathcal{N}(\mu+s\Sigma\nabla_{x_{t}}\log p_{\phi}(y,x^{\prime}\mid x_{t}),\Sigma)$ with $t^{*}$ steps.
Note that we add scale $s$ to adjust the guidance, which can be regarded as a temperature (Kingma and Dhariwal, ) in the distribution, i.e., $p_{\phi}(x^{\prime}\mid x_{t})^{s}p_{\phi}(y\mid x_{t})^{s}$.

## 4 Related Work

Adversarial training (AT) is initially proposed by Goodfellow et al. () to defend against adversarial attacks.
While adversarial training has been demonstrated as an effective defend against attacks, it remains susceptible to unseen attacks (Stutz et al., ; Poursaeed et al., ; Laidlaw et al., ; Tack et al., ). Additionally, retraining the classifier model with only adversarial examples could severely impair the standard accuracy of the model (Kurakin et al., ; Madry et al., ).
To address this issue, Zhang et al. (); Pang et al. () propose the loss functions that can effectively mitigate the trade-off between robustness and clean accuracy.

Adversarial purification (AP) purifies adversarial examples before classification, which has emerged as a promising defense method (Shi et al., ; Srinivasan et al., ). Compared with the AT method, AP utilizes a pre-trained generator that can defend against unseen attacks without retraining the classifier model (Song et al., ; Samangouei et al., ; Schott et al., ).
For instance, Ughini et al. () utilize a GAN-based generator and Nie et al. () utilize a diffusion-based generator for adversarial purification. However,
pre-trained generator-based AP methods cannot be adapted to known or new attacks, as the generator is trained without adversarial examples (Lee and Kim, ). To address this issue, Lin et al. () propose adversarial training on purification (AToP), which fine-tunes the generator, enabling it to effectively defend against new attacks. However, the computational cost of AToP is highly related to the complexity of the generator model, rendering it impractical for application to diffusion models.

Diffusion model (DM) is a powerful generative model, achieving high-quality image generation (Ho et al., ; Song et al., ).
Motivated by the great success of DMs,
Yoon et al. (); Nie et al. (); Xiao et al. (); Carlini et al. () utilize a pre-trained DM for adversarial purification and provided theoretical analysis, which acts as a solid foundation for diffusion-based purification.
To better preserve semantic information, Wu et al. (); Wang et al. () propose guided diffusion model for adversarial purification.
Following a similar intention, Zhang et al. () proposes a classifier-guided diffusion model to ensure the restoration of images with the target label.

However, all of the diffusion-based purification models do not consider the robustness of DMs, as shown in Lee and Kim () and our experiments. In the presence of attacks, the model can produce incorrect guidance, leading to a decrease in accuracy. Unlike previous works, we improve the inherent robustness of DMs by proposing a novel robust reverse process with adversarial guidance.

## 5 Experiments

In this section, we conduct extensive experiments on CIFAR-10, CIFAR-100 and ImageNet across various classifier models on attack benchmarks.
Compared with the state-of-the-art methods, our method achieves optimal performance and exhibits generalization ability against unseen attacks.
Furthermore, we undertake a more comprehensive evaluation scheme (Lee and Kim, ). Our method achieves the optimal average robust accuracy against PGD+EOT and AutoAttack.

### 5.1 Experimental Setup

Datasets and classifiers: We conduct extensive experiments on CIFAR-10, CIFAR-100 (Krizhevsky et al., ) and ImageNet (Deng et al., ) to empirically validate the effectiveness of the proposed methods against adversarial attacks. For the classifier models, we utilize the pre-trained ResNet (He et al., ) and WideResNet (Zagoruyko and Komodakis, ).

Adversarial attacks: We evaluate our method against AutoAttack (Croce and Hein, ) as one benchmark, which is a powerful attack that combines both white-box and black-box attacks. To consider unseen attacks without $l_{p}$-norm, we utilize spatially transformed adversarial examples (StAdv, Xiao et al., ) for evaluation. Additionally, following the guidance of Lee and Kim (), we utilize projected gradient descent (PGD, Madry et al., ) with expectation over time (EOT, Athalye et al., ) for a more comprehensive evaluation of the diffusion-based purification.

Evaluation metrics: We evaluate the performance of defense methods using two metrics: standard accuracy and robust accuracy, obtained by testing on clean examples and adversarial examples, respectively. Due to the high computational cost of testing models with multiple attacks, following guidance by Nie et al. (), we randomly select 512 images from the test set for robust evaluation.

Training details: According to Zhang et al. (); Dhariwal and Nichol () and experiments, we set the scale $s=1.0$, and the weighting scale $\lambda=6.0$. Unless otherwise specified, all experiments presented in the paper are conducted under these hyperparameters and done using the NVIDIA RTX A5000 with 24GB GPU memory and CUDA v11.7 in PyTorch v1.13.1 (Paszke et al., ).

### 5.2 Comparison with the State-of-the-art Methods

We evaluate our method on defending against AutoAttack $l_{\infty}$ and $l_{2}$ threat models (Croce and Hein, ), and compare with the state-of-the-art methods as listed in RobustBench (Croce et al., ). In all experiments presented in this section, we set the diffusion timestep $t^{*}=70$.

**Table 1: Standard and robust accuracy against AutoAttack $l_{\infty}$ threat ($\epsilon=8/255$) on CIFAR-10. (${}^{\text{\textdagger}}$the methods use additional synthetic images.)**
| Defense method | Extra | Standard | Robust |
| --- | --- | --- | --- |
| data | Acc. | Acc. |  |
| Zhang et al. () | ✓ | 85.36 | 59.96 |
| Gowal et al. () | ✓ | 89.48 | 62.70 |
| Bai et al. () | $\checkmark^{\text{\textdagger}}$ | 95.23 | 68.06 |
| Gowal et al. () | $\times^{\text{\textdagger}}$ | 88.74 | 66.11 |
| Wang et al. () | $\times^{\text{\textdagger}}$ | 93.25 | 70.69 |
| Peng et al. () | $\times^{\text{\textdagger}}$ | 93.27 | 71.07 |
| Nie et al. () | $\times$ | 89.02 | 70.64 |
| Wang et al. () | $\times$ | 84.85 | 71.18 |
| Zhang et al. () | $\times$ | 90.04 | 73.05 |
| Ours | $\times$ | 90.82 | 78.12 |

**Table 5: Standard accuracy and robust accuracy against AutoAttack $l_{\infty}$ ($\epsilon=8/255$), $l_{2}$ ($\epsilon=1$) and StAdv non-$l_{p}$ ($\epsilon=0.05$) threat models on CIFAR-10 with ResNet-50 model. We keep the same settings with Nie et al. (), where the diffusion timestep $t^{*}=125$.**
| Defense method | Standard Acc. | AA $l_{\infty}$ | AA $l_{2}$ | StAdv |
| --- | --- | --- | --- | --- |
| Standard Training | 94.8 | 0.0 | 0.0 | 0.0 |
| Adv. Training with $l_{\infty}$ (Laidlaw et al., ) | 86.8 | 49.0 | 19.2 | 4.8 |
| Adv. Training with $l_{2}$ (Laidlaw et al., ) | 85.0 | 39.5 | 47.8 | 7.8 |
| Adv. Training with StAdv (Laidlaw et al., ) | 86.2 | 0.1 | 0.2 | 53.9 |
| Adv. Training with all (Laidlaw et al., ) | 84.0 | 25.7 | 30.5 | 40.0 |
| PAT-self (Laidlaw et al., ) | 82.4 | 30.2 | 34.9 | 46.4 |
| Adv. CRAIG (Dolatabadi et al., ) | 83.2 | 40.0 | 33.9 | 49.6 |
| DiffPure (Nie et al., ) | 88.2 | 70.0 | 70.9 | 55.0 |
| AGDM (Ours) | 89.3 | 78.1 | 79.6 | 59.4 |

Result analysis on CIFAR-10: Table 1 shows the performance of the defense methods against AutoAttack $l_{\infty}$ ($\epsilon=8/255$) threat model on CIFAR-10 with WideResNet-28-10. Our method outperforms all other methods without extra data (the dataset introduced by Carmon et al. ()) and additional synthetic data in terms of both standard accuracy and robust accuracy. Specifically, as compared to the second-best method, our method improves the robust accuracy by 5.07% and the standard accuracy by 0.78%.
Table 2 shows the performance of the defense methods against AutoAttack $l_{2}$ ($\epsilon=0.5$) threat model on CIFAR-10 with WideResNet-28-10. Our method outperforms all methods in terms of robust accuracy. Specifically, as compared to the second-best method, our method improves the robust accuracy by 0.36%. These results demonstrate that our method achieves the state-of-the-art performance in RobustBench (Croce et al., ).

Result analysis on CIFAR-100: Table 3 shows the performance of the defense methods against AutoAttack $l_{\infty}$ ($\epsilon=8/255$) threat model on CIFAR-100 with WideResNet-28-10. Our method outperforms all other methods without synthetic data in terms of both standard accuracy and robust accuracy. Specifically, as compared to the second-best method, our method improves the robust accuracy by 3.42%. The observations are basically consistent with CIFAR-10, further demonstrating the effectiveness of our method for adversarial purification.

Result analysis on guidance: Table 4 shows the robust accuracy of the three guidance patterns of diffusion model, i.e., the method without guidance (Nie et al., ), the method with guidance (Zhang et al., ), and the method with robust guidance (ours). Our method achieves optimal robustness under all situations.
Specifically, our method improves the robust accuracy by 5.07% against AutoAttack $l_{\infty}$, and by 3.71% against AutoAttack $l_{2}$ on CIFAR-10, respectively. Furthermore, it shows an improvement of 3.9% on CIFAR-100. The results demonstrate that our method can significantly improve the robustness of the pre-trained diffusion-based purifier model.

Result analysis on unseen attacks: As previously mentioned, unlike AT, AP can defend against unseen attacks, which is an important metric for evaluating AP. To demonstrate the generalization ability of AGDM, we conduct experiments under several different attacks with varying constraints (AutoAttack $l_{\infty}$, $l_{2}$ and StAdv non-$l_{p}$ threat models) on CIFAR-10 with ResNet-50.
Table 5 shows that AT methods are limited in defending against unseen attacks and can only defend against known attacks (as indicated by the accuracy with an underscore) that they are trained with. In contrast, diffusion-based AP (DiffPure, Nie et al., ) demonstrates generalization capabilities to defend against all attacks. Our method further outperforms DiffPure in all situations. Specifically, it improves the robust accuracy by 8.1%, 8.7%, and 4.4% on AutoAttack $l_{\infty}$, $l_{2}$ and StAdv non-$l_{p}$, respectively.
The results demonstrate that our method exhibits better generalization ability against unseen attacks.

### 5.3 Robust Evaluation of Diffusion-based Purification

AutoAttack is regarded as one of the strongest adversarial attacks and is acknowledged as a benchmark for evaluating various defense methods, as demonstrated in Section 5.2. However, Lee and Kim () find that AutoAttack may not effectively evaluate the robustness of diffusion-based AP. Following the suggestions made by Croce et al. (), Lee and Kim () provide a new pipeline (PGD+EOT) particularly for measuring the robustness of diffusion-based purification methods against adversarial attacks. To undertake a more comprehensive evaluation, we evaluate our method defenes against $l_{\infty}$ and $l_{2}$ threat models following the guideline of Lee and Kim () in this subsection.

**Table 6: Standard and robust accuracy against PGD+EOT (left: $l_{\infty}$, $\epsilon=8/255$; right: $l_{2}$, $\epsilon=0.5$) on CIFAR-10. We keep the same settings with Lee and Kim (), the diffusion timestep $t^{*}=100$. (^1the method without guidance, ^2the method with guidance, ^3the method with robust guidance.)**
| Type | Defense method | Standard | Robust |
| --- | --- | --- | --- |
| Acc. | Acc. |  |  |
| WideRestNet-28-10 |  |  |  |
| AT | Pang et al. () | 88.62 | 64.95 |
| Gowal et al. () | 88.54 | 65.93 |  |
| Gowal et al. () | 87.51 | 66.01 |  |
| AP | Wang et al. () ^2 | 93.50 | 24.06 |
| Yoon et al. () | 85.66 | 33.48 |  |
| Nie et al. () ^1 | 90.07 | 46.84 |  |
| Lee and Kim () | 90.16 | 55.82 |  |
| Ours ^3 | 90.42 | 64.06 |  |
| WideRestNet-70-16 |  |  |  |
| AT | Gowal et al. () | 91.10 | 68.66 |
| Gowal et al. () | 88.75 | 69.03 |  |
| Rebuffi et al. () | 92.22 | 69.97 |  |
| AP | Yoon et al. () | 86.76 | 37.11 |
| Nie et al. () | 90.43 | 51.13 |  |
| Lee and Kim () | 90.53 | 56.88 |  |
| Ours | 90.43 | 66.41 |  |

Result analysis on PGD+EOT: Table 6 shows the performance of the defense methods against PGD+EOT $l_{\infty}$ ($\epsilon=8/255$) and $l_{2}$ ($\epsilon=0.5$) threat models on CIFAR-10 with WideResNet-28-10 and WideResNet-70-16. Our method outperforms all AP methods in terms of robust accuracy. Specifically, as compared to the second-best method, our method improves the robust accuracy by 8.24%, 9.53% against $l_{\infty}$ and by 1.96%, 2.19% against $l_{2}$, respectively. Table 7 shows the results on ImageNet and the observations are basically consistent with Table 6. These results demonstrate that our method achieves the state-of-the-art robustness in adversarial purification.

Figure: Figure 3: Comparison of robust accuracy against PGD+EOT and AutoAttack with (a) $l_{\infty}$ ($\epsilon=8/255$) threat model and (b) $l_{2}$ ($\epsilon=0.5$) threat model on CIFAR-10 with WideResNet-28-10. The line in the middle of the box represents the average robust accuracy of two attacks. (c) Accurcy-robustness trade-off against AutoAttack $l_{2}$ ($\epsilon=0.5$) threat model on CIFAR-10 with WideResNet-28-10.
Refer to caption: x3.png

Figure: Table 7: Standard accuracy and robust accuracy against PGD+EOT $l_{\infty}$ ($\epsilon=4/255$) on ImageNet with ResNet-50. The diffusion timestep $t^{*}=75$.

Result analysis on guidance: Furthermore, Table 6 also presents the results of three guidance patterns of diffusion model, i.e., the method without guidance (Nie et al., ), the method with guidance (Wang et al., ), and the method with robust guidance (ours). Due to the presence of guidance, the reverse process can generate better images without changing their semantic content, thereby improving classification accuracy. When without attacks, the method with guidance is highly effective, which has a 3.43% increase in standard accuracy. However, they neglect the impact of attacks on guidance, leading to a 22.78% decrease in robust accuracy when facing attacks with full gradient. In contrast, our robust guided reverse process can achieve 17.22% increase in robust accuracy, which is significant.

Comparison between PGD+EOT and AutoAttack: Figure 3a and 3b show the comparison between PGD+EOT and AutoAttack on $l_{\infty}$ and $l_{2}$ threat models. Under different attacks, AT methods (Gowal et al., , ; Pang et al., ) and AP methods (Yoon et al., ; Nie et al., ; Lee and Kim, ) exhibit significant differences in robust accuracy. AT performs better under PGD+EOT, while AP shows superior performance under AutoAttack. Typically, robustness evaluation is based on the worst-case results of the robust accuracy. Under this criterion, our method still outperforms all AT and AP methods. Furthermore, as compared to the second-best method on both attacks, our method improves the average robust accuracy by 6.39% against $l_{\infty}$ and 1.16% against $l_{2}$, respectively.

Accuracy-robustness trade-off: Figure 3c shows the performance against AutoAttack $l_{2}$ ($\epsilon=0.5$) threat models on CIFAR-10 with different weighting scales $\lambda$. We observe that as the weighting scale $\lambda$ increasing, the robust accuracy increases while the standard accuracy decreases, which verifies our Equation 6 on the trade-off between robustness and accuracy.

## 6 Conclusion

In this paper, we propose an adversarial guided diffusion model (AGDM) for adversarial purification, which can enhance the robustness of diffusion models by a robust reverse process.
Our innovative adversarial loss mechanism efficiently bypasses heavy computation of the entire reverse process in DMs during training and provides a practical solution to mitigate the accuracy-robustness trade-off.
We conduct extensive experiments to empirically demonstrate that AGDM can significantly improve the robustness and generalization ability of diffusion-based purification.

Limitations:
One of the limitations is that similar to previous works (Nie et al., ; Wang et al., ; Lee and Kim, ; Zhang et al., ), our proposed AGDM is also a time-consuming reverse process.
In the experiments, evaluating the diffusion-based purifier against a single type of attack on 512 images requires $\sim$13.8 hours on 4-A5000 node.
We leave the study of utilizing our robust guidance in more efficient and fast sampling strategies for future research.

## Appendix A Proofs of Adversarial Guided Diffusion Model (AGDM)

### A.1 Robust Reverse Process for DDPM

In the reverse process with adversarial guidance, similar to Dhariwal and Nichol (), we start by defining a conditional Markovian noising process $\hat{q}$ similar to $q$, and assume that $\hat{q}(y,x^{\prime}|x_{0})$ is an available label distribution and adversarial example (AE) for each image.

$$ $\displaystyle\hat{q}(x_{0})$ $\displaystyle:=q(x_{0})$ (8) $\displaystyle\hat{q}(y,x^{\prime}|x_{0})$ $\displaystyle:=\text{Label and AE per image}$ $\displaystyle\hat{q}(x_{t+1}|x_{t},y,x^{\prime})$ $\displaystyle:=q(x_{t+1}|x_{t})$ $\displaystyle\hat{q}(x_{1:T}|x_{0},y,x^{\prime})$ $\displaystyle:=\prod_{t=1}^{T}\hat{q}(x_{t}|x_{t-1},y,x^{\prime}).$ $$

When $\hat{q}$ is not conditioned on {$y,x^{\prime}$}, $\hat{q}$ behaves exactly like $q$,

$$ $\displaystyle\hat{q}(x_{t+1}|x_{t})$ $\displaystyle=\int_{y,x^{\prime}}\hat{q}(x_{t+1},y,x^{\prime}|x_{t})\,dydx^{\prime}$ (9) $\displaystyle=\int_{y,x^{\prime}}\hat{q}(x_{t+1}|x_{t},y,x^{\prime})\hat{q}(y, x^{\prime}|x_{t})\,dydx^{\prime}$ $\displaystyle=\int_{y,x^{\prime}}q(x_{t+1}|x_{t})\hat{q}(y,x^{\prime}|x_{t})\, dydx^{\prime}$ $\displaystyle=q(x_{t+1}|x_{t})\int_{y,x^{\prime}}\hat{q}(y,x^{\prime}|x_{t})\, dydx^{\prime}$ $\displaystyle=q(x_{t+1}|x_{t})$ $\displaystyle=\hat{q}(x_{t+1}|x_{t},y,x^{\prime}).$ $$

Following similar logic, we have: $\hat{q}(x_{1:T}|x_{0})=q(x_{1:T}|x_{0})$ and $\hat{q}(x_{t})=q(x_{t})$. From the above derivation, it is evident that the conditioned forward process is identical to unconditioned forward process. According to Bayes rule, the reverse process $\hat{q}$ satisfies $\hat{q}(x_{t}|x_{t+1})=q(x_{t}|x_{t+1})$.

$$ $\displaystyle\hat{q}(y,x^{\prime}|x_{t},x_{t+1})$ $\displaystyle=\frac{\hat{q}(x_{t+1}|x_{t},y,x^{\prime})\hat{q}(y,x^{\prime}|x_ {t})}{\hat{q}(x_{t+1}|x_{t})}$ (10) $\displaystyle=\hat{q}(y,x^{\prime}|x_{t}).$ $$

For conditional reverse process $\hat{q}(x_{t}|x_{t+1},y,x^{\prime})$,

$$ $\displaystyle\hat{q}(x_{t}|x_{t+1},y,x^{\prime})$ $\displaystyle=\frac{\hat{q}(x_{t},x_{t+1},y,x^{\prime})}{\hat{q}(x_{t+1},y,x^{ \prime})}$ (11) $\displaystyle=\frac{\hat{q}(x_{t},x_{t+1},y,x^{\prime})}{\hat{q}(y,x^{\prime}| x_{t+1})\hat{q}(x_{t+1})}$ $\displaystyle=\frac{\hat{q}(x_{t}|x_{t+1})\hat{q}(y,x^{\prime}|x_{t},x_{t+1}) \hat{q}(x_{t+1})}{\hat{q}(y,x^{\prime}|x_{t+1})\hat{q}(x_{t+1})}$ $\displaystyle=\frac{\hat{q}(x_{t}|x_{t+1})\hat{q}(y,x^{\prime}|x_{t},x_{t+1})} {\hat{q}(y,x^{\prime}|x_{t+1})}$ $\displaystyle=\frac{\hat{q}(x_{t}|x_{t+1})\hat{q}(y,x^{\prime}|x_{t})}{\hat{q} (y,x^{\prime}|x_{t+1})}$ $\displaystyle=\frac{q(x_{t}|x_{t+1})\hat{q}(y,x^{\prime}|x_{t})}{\hat{q}(y,x^{ \prime}|x_{t+1})}.$ $$

Here $\hat{q}(y,x^{\prime}|x_{t+1})$ does not depend on $x_{t}$.
Then, by assuming the label $y$ and adversarial example $x^{\prime}$ are conditionally independent given $x_{t}$,
we can rewrite the above equation as
$\hat{q}(x_{t}|x_{t+1},y,x^{\prime})=Z\cdot q(x_{t}|x_{t+1})\hat{q}(x^{\prime}|
x_{t})\hat{q}(y|x_{t})$ where $Z$ is a constant.

### A.2 Robust Reverse Process for Continuous-time Diffusion Models

In the main text, we only showcased the preliminaries and the corresponding robust reverse process related to DDPM, but our method can also be extended to continuous-time diffusion models (Song et al., ).
The continuous-time DMs build on the idea of DDPM, employ stochastic differential equations (SDE) to describe the diffusion process as follows,

$$ $dx=f(x,t)dt+G(t)dw,$ (12) $$

where $w$ represents a standard Brownian motion, $f(x,t)$ represents the drift of $x_{t}$ and $G(t)$ represents the diffusion coefficient.

By starting from sample of Eq. 12 and revesing the process, Song et al. () run backward in time and given by the reverse-time SDE,

$$ $dx=[f(x,t)-G(t)^{2}\nabla_{x}\log p_{t}(x)]dt+G(t)d\bar{w},$ (13) $$

where $\bar{w}$ represents a standard reverse-time Brownian motion and $dt$ represents the infinitesimal time step. Similar to DDPM, the continuous-time diffusion model also requires training a network to estimate the time-dependent function $\nabla_{x}\log p_{t}(x)$. One common approach is to use a score-based model $s_{\theta}(x,t)$ (Song et al., ; Kingma et al., ). Subsequently, the reverse-time SDE can be solved by minimizing the score matching loss (Song and Ermon, ),

$$ $\mathcal{L}_{\theta}=\int_{0}^{T}\lambda(t)\mathbb{E}[\|s_{\theta}(x_{t},t)- \nabla_{x_{t}}\log p_{0t}(x_{t}|x_{0})\|^{2}]dt,$ (14) $$

where $\lambda(t)$ is a weighting function, and $p_{0t}$ is the transition probability from $x_{0}$ to $x_{t}$, where $x_{0}\sim p_{0}(x)$ and $x_{t}\sim p_{0t}(x_{t}|x_{0})$.

In the robust reverse process of continuous-time DMs, similar to Song et al. (), we suppose the initial state distribution is $p_{0}(x(0)\mid y,x^{\prime})$ based on Eq. 13. Subsequently, using Anderson () for the reverse process, we have

$$ $dx=\left\{f(x,t)-\nabla\cdot\left[G(t)G(t)^{T}\right]-G(t)G(t)^{T}\nabla_{x} \log p_{t}(x|y,x^{\prime})\right\}dt+G(t)d\bar{w}.$ (15) $$

Given a diffusion process $x_{t}$ with SDE and score-based model $s_{\theta*}(x,t)$, we firest observe that

$$ $\nabla_{x}\log p_{t}(x_{t}|y,x^{\prime})=\nabla_{x}\log\int p_{t}(x_{t}|y_{t}, y,x^{\prime})p(y_{t}|y,x^{\prime})dy_{t},$ (16) $$

where $y_{t}$ is defined via $x_{t}$ and the forward process $p(y_{t}\mid x_{t})$. Following the two assumptions by Song et al. (): $p(y_{t}\mid y,x^{\prime})$ is tractable; $p_{t}(x_{t}|y_{t},y,x^{\prime})\approx p_{t}(x_{t}|y_{t})$, we have

$$ $\displaystyle\nabla_{x}\log p_{t}(x_{t}|y,x^{\prime})$ $\displaystyle\approx\nabla_{x}\log\int p_{t}(x_{t}|y_{t})p(y_{t}|y,x^{\prime}) \,dydx^{\prime}$ (17) $\displaystyle\approx\nabla_{x}\log p_{t}(x_{t}|\hat{y}_{t})$ $\displaystyle=\nabla_{x}\log p_{t}(x_{t})+\nabla_{x}\log p_{t}(\hat{y}_{t}|x_{ t})$ $\displaystyle\approx s_{\theta*}(x_{t},t)+\nabla_{x}\log p_{t}(\hat{y}_{t}|x_{ t}),$ $$

where $\hat{y}_{t}$ is a sample from $p(y_{t}|y,x^{\prime})$. Then, by assuming the label $y$ and adversarial example $x^{\prime}$ are conditionally independent given $x_{t}$, we can update Eq. 13 with above formula, and obtain a new denoising model $\bar{\epsilon}$ with the guidance of label $y$ and adversarial example $x^{\prime}$,

$$ $\mathop{}\!\mathrm{d}x_{t}=\left[f(x,t)-G^{2}(t)(\nabla_{x}\log p_{t}(x)+ \nabla_{x}\log p_{t}(y|x)+\nabla_{x}\log p_{t}(x^{\prime}|x))(x,t)\right] \mathop{}\!\mathrm{d}t+G(t)\mathop{}\!\mathrm{d}\bar{w}.$ (18) $$

### A.3 The Algorithm of Robust Reverse Process

Figure: Algorithm 1 Adversarial guided diffusion model, given a diffusion model $(\mu_{\theta}(x_{t},t),\sigma_{t})$ and scale $s$.

## Appendix B Comparison with AGDM and AToP

To Enhance the existing pre-trained generator-based purification architecture to further improve robust accuracy against attacks. Lin et al. () propose adversarial training on purification (AToP). Based on pre-trained model, they redesign the loss function to fine-tune the purifier model using adversarial loss.

Pre-training stage:

$$ $\text{}L_{\theta_{g}}=L_{g}(x,\theta_{g}).$ (19) $$

Fine-tuning stage:

$$ $L_{\theta_{g}}=L_{g}(x^{\prime},\theta_{g})+s\cdot L_{cls}(x^{\prime},y,\theta _{g},\theta_{f})=L_{g}(x^{\prime},\theta_{g})+s\cdot\max_{\delta}CE\left\{y,f( g(x^{\prime},\theta_{g}))\right\},$ (20) $$

where $L_{g}$ represents the original generative loss function of the generator model, which trained on clean examples and generates images similar to clean examples. During fine-tuning, AToP input the adversarial examples $x^{\prime}$ to optimize generator with generative loss, and further optimize the generator model with the adversarial loss $L_{cls}$, which is the cross-entropy loss between the output of $x^{\prime}$ and the ground truth $y$. However, training the generator with adversarial examples can lead to a decline in the performance on clean examples, thereby reducing standard accuracy. To address this issue, we modify back the input as $x$ in two terms of $L_{\theta_{g}}$ and introduce a new constraint $L_{dis}$ to enhance robust accuracy. To facilitate clearer comparison, we have used the same notation as AToP to represent our loss function, which differs from actual loss function.

$$ $\displaystyle L_{\theta_{g}}$ $\displaystyle=L_{g}(x,\theta_{g})+s_{1}\cdot L_{cls}(x,y,\theta_{g},\theta_{f} )+s_{2}\cdot L_{dis}(x,x^{\prime},\theta_{g},\theta_{f})$ (21) $\displaystyle=L_{g}(x,\theta_{g})+s_{1}\cdot CE\left\{y,f(g(x,\theta_{g})) \right\}+s_{2}\cdot KL\left\{f(g(x,\theta_{g})),f(g(x^{\prime},\theta_{g})) \right\}.$ $$

Distinct from Eq. 20, in Eq. 21 we revert the input of the first two terms back to the clean examples $x$. By increasing the weight of $s_{1}$, we can improve the standard accuracy on clean examples. Additionally, we introduce a new constraint term $L_{dis}$, which is the KL divergence between the feature map from the clean example $x$ and the adversarial example $x^{\prime}$. By increasing the weight of $s_{2}$, we can improve the robust accuracy on adversarial examples. This effectively mitigates the accuracy-robustness trade-off issue.

## Appendix C Visualization

Figure: Figure 4: Clean examples (Top), adversarial examples (Middle) and purified examples (Bottom) of CIFAR-10.
Refer to caption: x4.png

Figure: Figure 5: Clean examples (Top), adversarial examples (Middle) and purified examples (Bottom) of ImageNet.
Refer to caption: x5.png

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 3
presentation: 3
questions: Most questions that I hope the authors can address are given in the weaknesses, and here are some additional questions:

1. Just for curiosity, given that DM-based AP methods and AT methods are completely different, what's the motivation for comparing DM-based AP methods with AT methods here? I can see most experiments follow what was done in DiffPure (except the PGD+EOT experiments), but DiffPure compared to AT methods because it is the first DM-based AP method and thus it cannot find another DM-based AP method to compare with. However, after a few years, now there are many DM-based AP methods in this field and I think comparing to DM-based AP methods is enough to demonstrate the effectiveness of AGDM. I hope authors could share their ideas about this question during the rebuttal.

2. A follow-up question is: if it is necessary to compare with AT methods, what do you think is the most fair way to do so? According to [1], AT methods perform worse on AutoAttack while DM-based AP methods perform worse on PGD+EOT. So a natural question is: how can we compare DM-based AP methods with AT methods in a fair setting?

[1] Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification. In ICCV 2023.

I am willing to increase my rating if the authors can address my concerns during the rebuttal. Also, if I misunderstood any part of the paper, feel free to correct me.
soundness: 2
strengths: 1. The motivation of the paper is very clear, which effectively delivers the main insight of this paper.

2. The proposed method is intuitive and easy to understand.

3. The guided sampling can be extended to continuous-time DMs,  which means AGDM can be generalized to different DMs.
summary: Existing DM-based AP methods have no explicit guidance or improper guidance (e.g., existing guidances may also preserve adversarial perturbations in purified examples). To solve this issue, this paper proposes AGDM, which adversarially trains an auxiliary neural network to provide more robust guidance in the reverse process of DMs. Experiments show that AGDM can improve robustness by a notable margin.
weaknesses: 1. The proposed method may have very low efficiency. DM-based AP method is very slow during the inference stage (as it is a completely 'inference-time defense'). Based on this, this paper proposes to train an auxiliary neural network using AT, which will further increase the computational complexity of both the training (as AT is very slow by its nature) and the inference (as adversarial guidance is introduced to the reverse process of DMs). 

2. A followed-up weakness is: this paper did not report the training time for the auxiliary neural network and the inference time for the entire defense. Therefore, it is unclear whether the improvement obtained by AGDM is worthwhile in terms of the sacrifice in efficiency. I hope the authors could clarify this during the rebuttal.

3. The experiment settings are very unclear. Firstly, what are the seed numbers for those 512 images during the evaluation, are they consistent with DiffPure (as this paper said following DiffPure in line 327)? Secondly, what are the iteration numbers for PGD+EOT and AutoAttack, are they the same across all the baseline methods? Thirdly, it is unclear whether the adversarial examples for evaluations are generated under a white-box setting (i.e., attack AGDM + classifier as a whole) or a grey-box setting (i.e., only attack the classifier, or only attack the vanilla DMs). A fair evaluation process is very important in this field, so I would strongly encourage the authors to include detailed experiment settings during the rebuttal.

4. This paper lacks of ablation studies on the auxiliary neural network. What's the architecture of the auxiliary neural network? How the performance would be affected if other architectures are used?

---

confidence: 4
contribution: 1
initial_rating: 3
presentation: 2
questions: Please see the weaknesses above.
soundness: 3
strengths: 1. The proposed method seems to be reasonable. Combining the robust classifier with diffusion models has the potential to improve the robustness.

2. The experiments are relatively comprehensive, with several datasets and several attack methods included.
summary: This work proposes an adversarial purification method for defending against adversarial examples. The proposed model uses a robust classifier to guide the reverse process of DMs during purification, helping to preserve semantic information and improve robustness against adversarial perturbations. Experiments conducted on several datasets demonstrated the effectiveness.
weaknesses: 1. The tricky illustrations. The diffusion step t is set to be 70 in the experiments, while in Fig 1, the step is set to 400. I recommend using the actual step for illustration to help readers comprehensively understand this work. Furthermore, How to create Figure 2 is not clear and there is no experimental support for Figure 2.
2. There is no theoretical analysis to show the reason why this process is better than other classifier-guided diffusion purification methods.
3. Lack of innovation and contribution. The core contribution of this work is to replace the standard classifier with a robust classifier in the framework of guided diffusion models [1], which do not bring a new perspective on diffusion-based purification. Therefore, the innovation is questionable.
4. The results  are not convincing. According to [2], the robustness of diffusion-based purification is significantly over-estimated and the robustness should be reported under adaptive attacks. I recommend all results in this work be reported following the settings in [2].
5. The chaotic formulations. Please follow the symbolics in DDPM or Score-SDE. For example, $\mathbf{x}$ instead of $x$ should be used to represent an image.

[1] Guided diffusion model for adversarial purification

[2] Robust Classification via a Single Diffusion Model

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 3
questions: - In Lines 209-210, why can we assume that $y$ and $x'$ are conditionally independent given $x_t$?
soundness: 2
strengths: - The limitations of existing related methods are thoroughly discussed, and the proposed AGDM is well-motivated.
- The superiority of AGDM to existing diffusion-based AP methods indicates the significance of guidance for the diffusion model in AP.
summary: This paper introduces an improved diffusion-based adversarial purification (AP) method termed adversarial guided diffusion model (AGDM). To address the limitation of existing diffusion-based AP methods that the lack of proper guidance can lead to shifting towards incorrect classes, AGDM utilizes a robust auxiliary neural network obtained by TRADES to guide the diffusion model in AP. Experimental results suggest that AGDM can improve the robust accuracy compared with the diffusion-based AP baselines.
weaknesses: - The notations and interpretations in Section 3.2 can be confusing. Specifically, the interpretation of $p_{\phi}(x' \mid x_t)$ (Lines 212-213) only concerns the semantic information of $x'$, but the notation itself seems to indicate that the specific pixel values of $x'$ are also concerned. If only the semantic information is considered, it should be something like $p_{\phi}(s(x') \mid x_t)$.
- In Lines 277-278, it is stated that the auxiliary network is not required to be a robust classifier but to have adversarially robust representations. From my perspective, the difference between the two requirements is that the latter does not consider the classification ability of the network (e.g., it can be a self-supervised model), but it seems that a non-classification model may not suffice for the guidance of AGDM.
- The architecture of the auxiliary network (or whether it is the same as the classifier) is not stated in the experimental settings.
- The number of PGD and EOT steps is not stated. Insufficient PGD and EOT iterations can lead to the overestimation of the robustness of AP methods.
- Judging from Figure 3(a), the robust accuracy of the AGDM is not significantly higher than that of AT methods under $\ell_{\infty}$ attacks. It might be the case that using state-of-the-art AT models as the auxiliary network may further improve the performance of AGDM, but no evidence is provided.
- The practicality of the proposed AGDM may be questionable. High computation costs are required for both training (AT of the auxiliary network) and inference (iterative denoising process for purification). It is argued that the adversarial fine-tuning of DMs in AToP is computationally expensive (Lines 079-080), but the proposed method also suffers from the same issue. There is also a lack of evidence for the transferability of a pre-trained AGDM to models of other architectures or for different tasks, which may indicate the practical value of the AP method.

---

confidence: 5
contribution: 2
initial_rating: 5
presentation: 3
questions: 1. How does different AT influence the performance of AGDM? The motivation for this question is from the Weaknesses. 1. AT will inevitably introduce additional problems. For example, if we use PGD to generate training samples for the auxiliary classifier via AT, the classifier's performance will be worse when facing C\&W attack. Is there a way to make the auxiliary classifier better defend against unseen attacks?

2. How does the influence of $s$. For example, could we use the different weights for the MSE and the logit $p_{\phi}(x_{t})$, or could we increase $s$? The motivation for this question is that the training-free conditional generation method relies on the setting of the $s$. Thus, we have to discuss its influence.

To sum up, my main concerns are listed in Sec. Weaknesses and Sec. Questions. The overall contribution of this paper seems limited, and the experimental is not enough. Considering introducing the AT to enhance the AP is an interesting topic, I rate it as "marginally below the acceptance threshold".
soundness: 2
strengths: 1. The overall method is technically sound. AGDM proposes to train an auxiliary classifier via adversarial training, which is sound. Adversarial training could help the classifier recognize the adversarial sample, which could naturally generate the most robust latent features to defend against the adversarial perturbation. Leveraging this, the overall conditional generation process will be more robust against the adversarial perturbation and alleviate the trade-off.

2. Introducing adversarial training to enhance AP is interesting. 

3. The experiments show that AGDM achieves the SOTA performance.
summary: This paper proposed a diffusion model-based adversarial purification (AP) method called adversarial guided diffusion models (AGDM). AP methods face a trade-off between robust and standard accuracy since we have to drop some label semantics to preserve from recovering the adversarial perturbation during the reverse process. 

To overcome this, training-free conditional-based diffusion has been introduced into AP, where we can measure the distance between the intermediate results and the known adversarial samples to keep the label semantic. However, the trade-off still exists since the distance metric will recover the adversarial perturbation again. 

AGDM solves this challenge by introducing an auxiliary neural network pre-trained via an adversarial training paradigm. This auxiliary neural network could be regarded as a feature extractor that maps the images into the latent space. AGDM further argues that the adversarial training paradigm will help auxiliary neural networks extract the latent that does not suffer from the influence of adversarial perturbation. In this condition, we could use the clean latent feature as the condition to guide the generation process, thus alleviating the trade-off. Meanwhile, auxiliary neural networks could offer logit to enrich the condition, further enhancing the AP.
weaknesses: 1. The contributions of this paper are limited. One of the main contributions of this paper is how to calculate the adversarial guidance, which is well explored under the training-free conditional diffusion such as FreeDom. In the view of the FreeDom, it is just a multi-conditional guidance, which could be easy to calculate. 

Specifically, the adversarial guidance in Sec. Methods contains two parts: 1) The MSE in the latent space between the intermediate results $x_{t}$ and the adversarial samples$x^{adv}$. 2) A logit of $p_{\phi}(x_{t})$, where $p_{\phi}$ is the classifier from auxiliary neural networks. This could be conducted in the FreeDom as $\nabla_{x_{t}}\log p ({c^{1},c^{2}}|x_{t})$. 
Then,
$\nabla_{x_{t}}\log p ({c^{1},c^{2}}|x_{t}) = \nabla_{x_{t}}\log p ({c^{1}}|x_{t})  + \nabla_{x_{t}}\log p ({c^{2}}|x_{t}) $, where
$ \nabla_{x_{t}}\log p ({c^{1}}|x_{t}) =p_{\phi}(x_{t}) $ and $\nabla_{x_{t}}\log p ({c^{2}}|x_{t}) = D(c_{\phi}(x_{t}) - c_{\phi}(x^{adv}))$. $c_{\phi}$ is the feature extracted from the auxiliary neural networks given the parameter $\phi$. In this condition, we could achieve the conditional generation based on $\nabla_{x_{t}}\log p ({c^{1},c^{2}}|x_{t})$ i,e, the adversarial guidance. This process is even simpler than Sec. Methods, which weakens one of the main contributions of this paper.

The other main contribution of this paper is introducing an auxiliary classifier via adversarial training. However, it directly leverages the TRADES method without any new insight. This raises a new question: Does AGDM really alleviate the trade-off for AP? The advantage of the AP compared to the adversarial training is to defend against unseen attacks. After introducing adversarial training (AT), how to ensure that AGDM can defend against unseen attacks? The weakness of AT is that it is difficult to defend against unseen attacks since there are no training samples from unseen attacks in AT. In this condition, AGDM generates a new trade-off between AP and AT again.

To sum up, the contribution of this paper seems to verify that an auxiliary classifier via AT could enhance the AP in some conditions, which seems limited.

2. The experiments are not enough to prove the superiority of the AGDM. (1). It lacks the BPDA [2] attacks. BPDA is one of the important attacks to test the performance of AP, which should be discussed. (2) The performance of AGDM is fair. ZeroPur [3] reports the robust accuracy of AutoAttack on CIFAR-10 ($\epsilon=8/255$) is 82.76%, better than the 78.12% reported in AGDM. Meanwhile, the AP for ZeroPur even drops the diffusion models. AGDM introduces the unconditional diffusion models and an auxiliary classifier, which should be better than the ZeroPur, since there is richer previous knowledge for AGDM.

[1] FreeDoM: Training-Free Energy-Guided Conditional Diffusion Model. Yu, Jiwen and Wang, Yinhuai and Zhao, Chen and Ghanem, Bernard and Zhang, Jian. ICCV. 

[2] Diffusion Models for Adversarial Purification. Nie, Weili and Guo, Brandon and Huang, Yujia and Xiao, Chaowei and Vahdat, Arash and Anandkumar, Anima. ICML 

[3] ZeroPur: Succinct Training-Free Adversarial Purification. Xiuli Bi and Zonglin Yang and Bo Liu and Xiaodong Cun and Chi-Man Pun and Pietro Lio and Bin Xiao. ArXiv.