Test-Time Adversarial Defense with Opposite Adversarial Path and high Attack time cost

## Abstract

Abstract Deep learning models are known to be vulnerable to adversarial attacks by injecting sophisticated designed perturbations to input data. Training-time defenses still exhibit a significant performance gap between natural accuracy and robust accuracy. In this paper, we investigate a new test-time adversarial defense method via diffusion-based recovery along opposite adversarial paths (OAPs). We present a purifier that can be plugged into a pre-trained model to resist adversarial attacks. Different from prior arts, the key idea is excessive denoising or purification by integrating the opposite adversarial direction with reverse diffusion to push the input image further toward the opposite adversarial direction. For the first time, we also exemplify the pitfall of conducting AutoAttack (Rand) for diffusion-based defense methods. Through the lens of time complexity, we examine the trade-off between the effectiveness of adaptive attack and its computation complexity against our defense. Experimental evaluation along with time cost analysis verifies the effectiveness of the proposed method.

## 1 Introduction

### 1.1 Background

It has been well known that deep learning models are vulnerable to adversarial attacks by injecting (imperceptible) adversarial perturbations into the data that will be input to a neural network (NN) model to change its normal predictions Athalye et al. (); Carlini et al. (); Croce et al. (); Frosio & Kautz (); Goodfellow et al. (); Gowal et al. (); Madry et al. (); Venkatesh et al. ().
Please also see Chen & Liu () for a recent review on the adversarial robustness of deep learning models.

It can be found from the literature that adversarial attacks defeat their defense counterparts easily and rapidly, and there is still a gap between natural accuracy and robust accuracy.

The study of adversarial defense in resisting adversarial attacks can be divided into two categories: (1) Adversarial training/Training-time defense Gowal et al. (); Hsiung et al. (); Huang et al. (); Suzuki et al. (); Wang et al. (; ); Wu et al. (); Zhang et al. (); and (2) Input pre-processing/Test-time defense Alfarra et al. (); Chen et al. (); Hill et al. (); Ho & Vasconcelos (); Nie et al. (); Wang et al. (); Wu et al. (); Yoon et al. ().
Adversarial training utilizes adversarial examples derived from the training data to enhance the robustness of the classifier.
Despite the effort in training-time defense, we do see ( [RobustBench](https://robustbench.github.io/) Croce et al. ()) there is still a remarkable gap between natural accuracy and robust accuracy.

Different from the training-time defense paradigm, in this paper, we propose a new test-time adversarial defensive method by pre-processing data in a way different from the prior works.
It is a kind of purifier and serves as a plug-and-play module that can be used to improve the robustness of a defense method once our module is incorporated as a pre-processor.
Specifically, the formulation of processing the input data is derived as: $\min_{\phi,\,\theta}\mathbb{E}\left[\max_{x^{\prime}\in B(x)}{\mathcal{L}}((f_
{\phi}\circ g_{\theta})(x^{\prime}),y)\right]$,
where $x^{\prime}$ denotes the adversarial example corresponding to clean image $x$ with label $y$, $B(\cdot)$ is the threat model, $f_{\phi}$ is the image classifier parameterized by $\phi$, and $g_{\theta}$ is a pre-processor.

A key to test-time defense is the design of pre-processor or denoiser (e.g., $g_{\theta}$), which aims at denoising an adversarial example to remove the added perturbations.
Intuitively, the goal is to have the denoised image as close to the original one
so as to achieve perceptual similarity.

### 1.2 Related Works

We introduce representative test-time adversarial defense methods Alfarra et al. (); Ho & Vasconcelos (); Hill et al. (); Yoon et al. (); Nie et al. (); Wang et al. (); Wu et al. () that share the same theme as our method.
Please also see Sec. 6 in the Supplementary for details of Hill et al. (); Yoon et al. (); Wang et al. (); Wu et al. ().

In Alfarra et al. (), a defense method is proposed by connecting an anti-adversary layer with a pre-trained classifier $f_{\phi}$. Given an input image $x$, it will be first sent to the anti-adversary layer for generating anti-adversarial perturbation $\gamma$ by solving an optimization problem.
As the name implies, in most cases, the direction $\gamma$ will be opposite to the direction of adversarial perturbation. The resultant purified image $x+\gamma$ is then used for classification.

DISCO Ho & Vasconcelos () is proposed as a purification method to remove adversarial perturbations by localized manifold projections. The author implemented it with an encoder and a local implicit module, which is leveraged by the architecture called LIIF Chen et al. (); Chen & Zhang (), where the former produces per-pixel features and the latter uses the features in the neighborhood of query pixel for predicting the clean RGB value.

In DiffPure Nie et al. (), given an input (clean or adversarially noisy), the goal is to obtain a relatively cleaner version through a series of forward and reverse diffusion processes. Moreover, a theoretical guarantee is derived that, under an amount of Gaussian noise added in the forward process, the adversarial perturbation may be removed effectively.
This is independent of the types of adversarial perturbations, making DiffPure defend against unseen attacks.

Recently, the robustness of diffusion-based purifiers is considered overestimated. Lee & Kim () provides recommendations for robust evaluation, called surrogate process, and shows that the defense methods may be defeated under the surrogate process. Kang et al. () proposes DiffAttack, a new attack technique against diffusion-based adversarial purification defenses, that can overcome the challenges of attacking diffusion models, including vanishing/exploding gradients, high memory costs, and large randomness. The use of a segment-wise algorithm allows attacking with much longer diffusion lengths than previous methods.

Although the aforementioned purification-based adversarial defense methods show promising performance in resisting adversarial attacks, Croce et al. () argues that their evaluations are ineffective in two aspects: (i) Incorrect use of attacks or (ii) Attacks used for evaluation are not strong enough.
However, the authors also mentioned
test-time defense complicates robustness evaluation because of its complexity and computational cost, which impose even more computations for the attackers.

### 1.3 Motivation

Let us take image classification as an example, where clean/natural accuracy is the classification accuracy for benign images and robust accuracy is measured for adversarial samples.
However, we argue that “perceptually similar” does not mean adversarial robustness as it is not guaranteed to entirely remove the adversarial perturbations such that the residual perturbations still have an impact on changing the prediction of a learning model.
On the contrary, we propose to purify the input data along the direction of opposite adversarial paths (OAPs) excessively, as illustrated in Fig. 1.

**Figure 1: Concept diagram of new reference point generation via $K$ consecutive purifications along opposite adversarial paths (OAPs).**
| -$K$ Steps | Clean Accuracy (%) | Robust Accuracy (%) |
| --- | --- | --- |
| 0 | 95.16 | 0.18 |
| -1 | 89.94 | 6.18 |
| -3 | 98.56 | 83.64 |
| -5 | 99.63 | 96.78 |
| -10 | 99.96 | 99.86 |
| -20 | 100.00 | 100.00 |

Conceptually, if we add the adversarial perturbation along the opposite direction of Projected Gradient Descent (PGD) Madry et al. (), denoted as “$-adv$,” to a given data, robust accuracy can be improved.
To gain an insight that excessive denoising (more than one step along the opposite gradient) is advantageous in resisting attacks,
a simple experiment was conducted by moving each data point $x$ to the new position $x^{K}$ through $K$ iterations of opposite adversarial perturbation, according to the ground truth label and classifier.
Given each kind of $x^{K}$, the accuracy change is illustrated in Table 1.
For the decrease in clean accuracy at $K=1$, we conjecture that the process “$-adv$” is still unstable. Hence, some data points near the decision boundary may be perturbed to incorrect class.
Moreover, motivated by Croce et al. (), our defense method also aims to complicate the computation of adaptive adversarial attacks.

### 1.4 Contributions

Different from prior works, the concept of OAP can be incorporated into any training scheme of purifiers, and the OAP-based purifier can also become a part of modules in other defense processes. For instance, OAP-based purifiers can provide additional directions within reverse diffusion, whereas diffusion models alone Song et al. () (baseline model in DiffPure) only provide direction to generate images. Unlike the traditional purification methods, we do not use classifier-generated labels (e.g. Anti-Adv Alfarra et al. ()) in our baseline purifier during testing.
On the contrary, combining the proposed baseline purifier with the reverse diffusion process provides reference directions pointing to a safer area during the purification process.

Contributions of this work are summarized as follows:

- 1.
We are first to present the idea of excessive denoising along the opposite adversarial path (OAP) as the baseline purifier for adversarial robustness. (Sec. 3.1)
- 2.
We integrate the OAP baseline purifier and conditional reverse diffusion as a sophisticated adversarial defense that can be interpreted as moving purified data toward the combination of directions from the score-based diffusion model and baseline purifier (Sec. 3.2).
- 3.
To complicate the entire defense mechanism by complicating the computation overhead of adaptive attacks accordingly, we study a double diffusion path cleaning-based purifier (Sec. 3.3). This creates a trade-off between the attack effectiveness and attack computation.
- 4.
For the first time, we exemplify the pitfall of conducting AutoAttack (Rand) for diffusion-based adversarial defense methods (Sec. 3.4).

## 2 Preliminary

### 2.1 Basic Notation

In the paper, $x$ denotes an input image, $\hat{x}$ denotes a recovered image or overly denoised/purified image, $x_{adv}$ denotes an adversarial image, $y$ is a ground-truth label of $x$, $\hat{y}$ is a prediction, $g_{\theta}$ is a purifier, and $f_{\phi}$ is a pre-trained classifier.

For the diffusion model, the forward process is denoted by $q(\cdot|\cdot)$ and the backward/reverse process is denoted by $p_{\theta}(\cdot|\cdot)$ with parameter $\theta$.
For $t\in[0,T]$, $x_{t}$ represents an image at time step $t$ during the forward / reverse diffusion process. Usually, $x_{0}$ is a clean image and $x_{T}\sim{\mathcal{N}}(0,I)$.

For the adversarial attack, it modifies the input image $x$ by adding to it adversarial perturbation $\delta$ by calculating the gradient of loss according to information leakage of pre-trained NN $f_{\phi}$ without changing $\phi$, causing $f_{\phi}$ to classify incorrectly.
According to the leakage level, there are roughly two types of attacks. Please see Sec. 7 in the Supplementary for details.

### 2.2 Diffusion Models

Since the diffusion model Sohl-Dickstein et al. (); Ho et al. (); Song & Ermon (); Song et al. () is a baseline model in diffusion-based purifiers, to make this paper self-contained, please refer to Sec. 8 of Supplementary for a brief introduction to the diffusion model.

## 3 Proposed Method

We describe the proposed test-time adversarial defense method with its flowchart illustrated in Fig. 2.

Figure: Figure 2: Flowchart of our method. The purifier (gray block) can be one of (a)-(c), where (a) is the proposed baseline purifier, (b) shows the combination of baseline purifier and reverse diffusion, and (c) expands (b) with two diffusion paths. In (c), $x_{1}^{tar},\ldots,x_{C}^{tar}$ are obtained via (2) from fixed $C$ images with one image per class (in CIFAR-10). The image in front of Color OT with green/blue arrow is called the source/target image. $x^{p_{2}}$ is defined in (10).
Refer to caption: extracted/5945279/figs/flow_chart_new_3.png

### 3.1 Baseline Purifier: Opposite Adversarial Path (OAP)

Given a classifier model $f_{\phi}$ parameterized by $\phi$, a loss function ${\mathcal{L}}(x,y,\phi)$, and a pair of data $(x,y)$, the adversarial attack can be computed as

$$ $\displaystyle x_{adv}=\Pi_{x+{\mathcal{S}}}(x+\alpha\operatorname{sign}(\nabla _{x}{\mathcal{L}}(x,y,\phi))),$ (1) $$

where ${\mathcal{S}}$ is the set that allows the perceptual similarity between natural and adversarial images.
This iterative process aims to find the adversarial image $x_{adv}$ that maximizes the loss function.

On the other hand, the opposite direction of each iteration points to minimize the loss. Assume now we get an ordinary noisy input $x_{adv}=x+\delta$ with $\left\|\delta\right\|_{p}\leq\epsilon_{p}$ via image processing, a denoiser can push the denoised input close to $x$ within a non-perceptual distortion.
Nevertheless, if the noisy input $x_{adv}$ is a sophisticated design via adversarial attack, it is too early to claim, depending on the perceptual similarity between $x$ and $x_{adv}$, that the denoised image can be free from being affected by adversarial perturbations.
We argue that if we properly push the denoised image further away from the decision boundary, the downstream classifier can still successfully classify the input since the direction we push points to a lower loss area on the input-loss surface, as illustrated in Fig. 1.
Also note that the plug-and-play module lies under the setting that the baseline purifier is only trained on a given attack (e.g., PGD-$\ell_{\infty}$-7), which is independent of the attacks (e.g., PGD-$\ell_{\infty}$-40, AutoAttack, and BPDA+EOT) used in testing.
In addition, the diffusion model is pre-trained (Sec. 3.2) and does not involve adversarial examples during its training.

#### 3.1.1 New Reference Point Generation

Previous test-time defense methods with a plug-and-play fashion take $x_{adv}$ as an input and generate the predicted “clean” image $\hat{x}$. In our scenario, we want to move a few steps further.
Starting from the clean image $x$, ground-truth label $y$, parameter $\phi$ and loss function ${\mathcal{L}}$ of classifier $f$,
we can generate a new reference point $x^{K}$ for training by the following formula:

$$ $\displaystyle x^{k}=\Pi_{x^{k-1}+{\mathcal{S}}}(x^{k-1}-\alpha\operatorname{ sign}(\nabla_{x^{k-1}}{\mathcal{L}}(x^{k-1},y,\phi))),$ (2) $$

for $1\leq k\leq K$, where $x^{0}=x$. If we iterate (2), we can get a series of data, $x^{1},x^{2},\ldots,x^{K}$, as illustrated in Fig. 1.

#### 3.1.2 Baseline Purifier Training

In traditional denoising, the goal is to train a purifier that produces a denoised output $\hat{x}$ from the adversarial input $x_{adv}$, denoted as $x_{adv}\mapsto\hat{x}$, such that $\hat{x}$ and $x$ can be as similar as possible in terms of, say, $\ell_{p}$-norm.
We, instead, train the purifier to produce $\widehat{x^{K}}$ from $x_{adv}$ that further points toward the opposite adversarial attack direction.
We call the resultant $\widehat{x^{K}}$ an excessively-denoised image and the model $g_{\theta}$ that moves data along the opposite adversarial path (OAP) the “baseline purifier.”

In practice, we train a baseline purifier
using data pairs $\{(x_{adv},x^{K})\}$ with a certain number of opposite steps $K\in\mathbb{N}$, where $x^{K}$ is generated by (2).
The training procedure of $g_{\theta}$ is to minimize:

$$ $\displaystyle\theta^{\ast}=\displaystyle\operatorname*{argmin}_{\theta}\left\| g_{\theta}(x_{adv})-x^{K}\right\|_{1},$ (3) $$

where $g_{\theta}$ can be any existing defense methods (e.g., DISCO Ho & Vasconcelos ()).
The results of training on different opposite steps
are shown in Table 2 respect to PGD-$\ell_{\infty}$ Madry et al. (), AutoAttack (AA) Croce & Hein (), and BPDA Athalye et al. ().
We can observe that the idea of the new reference point indeed improves DISCO.
Specifically, when $K=1$, the robust accuracy can be improved greatly, but it decreases as $K$ goes larger.
The results are somewhat inconsistent with those in Table 1.
The reason we conjecture is that the experiment presented in Table 1 is under the condition of using the ground-truth label to move data step-by-step, whereas that in Table 2 is not.
Hence, as $K$ increases excessively, the distance that pushes the data increases excessively, which is similar to the effect of large step size in gradient descent.
Therefore, based on the empirical observations, we will empirically set $K=1$ for learning the opposite direction of an adversarial attack during training.

On the other hand, we will later demonstrate that OAP is a powerful module readily to be incorporated with existing adversarial defenses (e.g., DISCO) in improving both the clean and robust accuracy.

**Table 2: Evaluation of DISCO trained with the relation between new reference point and adversarial perturbations by PGD attack generated in ResNet-18. Entire CIFAR-10 testing dataset was used. (Left) Attack: Non-adaptive PGD-$\ell_{\infty}$. Test model: ResNet-18. (Middle) Attack: Non-adaptive AutoAttack (AA). Test model: WRN-28-10 Zagoruyko & Komodakis (). (Right) Attack: BPDA. Test model: VGG16 Simonyan & Zisserman ().**
| -K steps | Non-adapt PGD-$\ell_{\infty}$ / ResNet-18 |  |
| --- | --- | --- |
| Clean Acc (%) | Robust Acc (%) |  |
| 0 | 89.57 | 73.13 |
| -1 | 90.71 | 86.10 |
| -3 | 89.53 | 82.02 |
| -7 | 89.33 | 56.21 |

### 3.2 Diffusion-based Purifier with OAP Prior

In Sec. 3.1, we have witnessed the merit of baseline purifier based on OAP in improving robustness against adversarial attacks.
This data moving trick also motivates us to study how to incorporate OAP prior and diffusion models as a stronger adversarial defense.

We first propose to integrate the idea of opposite adversarial paths with the reverse diffusion process (e.g., guided diffusion Dhariwal & Nichol (), ILVR Choi et al. (), and DDA Gao et al. ()) to achieve a similar goal of pushing the input image further toward the opposite adversarial direction.
More importantly, for each step in the reverse diffusion process, the purifier is used to provide a direction that points to $x^{K}$.

To this end, according to (16) of guided diffusion described in Sec. 8 in Supplementary,
by taking logarithm and gradient with respect to $x_{t-1}$ Dhariwal & Nichol (), we can derive

$$ $\displaystyle\nabla_{x_{t-1}}\log p_{\theta}(x_{t-1}|x_{t},y)=\nabla_{x_{t-1}} \log p_{\varphi}(x_{t-1}|x_{t})+\nabla_{x_{t-1}}\log p_{\phi}(y|x_{t-1}),$ (4) $$

where $t$ denotes the diffusion time step.
Based on Langevin dynamics, we get a sampling chain on $x_{t-1}$ as:

$$ $\displaystyle x_{t-1}\leftarrow x_{t}+\nabla_{x_{t-1}}\log p_{\varphi}(x_{t-1} |x_{t}),$ (5) $$

where we get the first direction (specified by $p_{\varphi}$) of moving to $x_{t-1}$.
However, if we want to generate $x_{t-1}$ by moving along the direction given $x_{t}$ and $y$, we have to introduce the second direction (specified by $p_{\phi}$) to move to $x_{t-1}$ given condition $y$ based on (4). Hence, we add $\nabla_{x_{t-1}}\log p_{\phi}(y|x_{t-1})$ in the sampling chain (5) as:

$$ $\displaystyle x_{t-1}\leftarrow x_{t}+\nabla_{x_{t-1}}\log p_{\varphi}(x_{t-1} |x_{t})+\nabla_{x_{t-1}}\log p_{\phi}(y|x_{t-1}),$ (6) $$

where the last two terms are the same as the RHS of (4).
Note that the second term can be approximated by a model $\mathbf{\epsilon_{\varphi}}(\cdot)$ that predicts the noise added to the input.
According to (11) in Dhariwal & Nichol (), it can be used to derive a score function as:

$$ $\displaystyle\nabla_{x_{t-1}}\log p_{\varphi}(x_{t-1}|x_{t})=-\frac{\mathbf{ \epsilon_{\varphi}}(x_{t-1})}{\sqrt{1-\bar{\alpha}_{t}}},$ (7) $$

where $\bar{\alpha}_{t}=\prod_{s=1}^{t}(1-\beta_{s})$.

Different from previous works, if $y$ in the third term of (6) is replaced with the new reference point $x^{K}$, as described in (2) of Sec. 3.1, then the term becomes $\nabla_{x_{t-1}}\log p_{\phi}(x^{K}|x_{t-1})$ and represents how to move along the direction to $x^{K}$ given $x_{t-1}$. This can be set by

$$ $\displaystyle\widehat{x^{K}}\leftarrow g_{\theta}(x_{t-1});\;\;\;\nabla_{x_{t- 1}}\log p_{\phi}(x^{K}|x_{t-1})\approx\eta(\widehat{x^{K}}-x_{t-1}),$ (8) $$

where $\eta$ is the step size and $g_{\theta}(\cdot)$ is the purifier (see Sec. 3.1) that can approximate the mapping of $x_{adv}\to x^{K}$.
Hence, the purification process can be interpreted as moving toward the combination of directions from the score-based diffusion model Nie et al. (); Song & Ermon (); Song et al. () and baseline purifier $g_{\theta}(\cdot)$.

#### 3.2.1 Connecting the OAP Prior with Diffusion

We are aware that the base purifier has to operate in the domain the same as that in the diffusion reverse process, i.e., they deal with different inputs with noises at different scales.
However, according to (3), the baseline purifier only takes inputs that are adversarially perturbed.
Hence, during the training of baseline purifier, we randomly add different scales of noise to the input data so that the base purifier can accommodate the different noise scales in the reverse diffusion process, denoted as:

$$ $\displaystyle\theta^{\ast}_{n}=\displaystyle\operatorname*{argmin}_{\theta} \mathbb{E}_{p_{data}(x_{adv})}\mathbb{E}_{p_{\sigma_{t}}(\tilde{x}|x_{adv})} \left\|g_{\theta}(\tilde{x})-x^{K}\right\|_{1},$ (9) $$

where $t$ is uniformly chosen from $0\ldots t^{\ast}$, $\sigma_{t}$ is the corresponding noise scale at diffusion time step $t$, and $\tilde{x}$ is the perturbed data according to the diffusion process. We replace the baseline purifier $g_{\theta}$ in (8) in Sec. 3.2 with this purifier $g_{\theta_{n}}$.

### 3.3 Diffusion Path Cleaning-based Purifier

In this section, we describe how to further utilize other gradients from different constraints to modify/move our samples toward specific directions.
Moreover, the goal is to complicate the entire framework of purifier+classifier so as to complicate the computation of adaptive attacks accordingly while maintaining comparable clean and robust accuracy.
We first conduct a test to verify whether such a framework could be affected by such an attack.

Figure: Figure 3: (Ideal model) Red arrows depict directions to minimize $\ell_{2}$ distance between the intermediate images of two reverse diffusion paths, $p_{1}$ and $p_{2}$. $\mathcal{L}$ is the loss function. Dataset: CIFAR-10.
Refer to caption: extracted/5945279/figs/clean_path_test.png

In this test, we verify the framework composed of two diffusion paths, denoted as $p_{1}$ and $p_{2}$, and a pre-trained classifier $f_{\phi}$ (e.g., pre-trained WRN-28-10), as shown in Fig. 4.
The adaptive adversarial image $x_{adv}$ is generated via BPDA+EOT Athalye et al. () as an input to path $p_{1}$ while the clean image $x$ is assumed to be available (ideal case) in path $p_{2}$.
In this case, we minimize the $\ell_{2}$ distance between the intermediate image in the reverse process $p_{1}$ and that in $p_{2}$, which gives a direction to make $p_{1}$ close to $p_{2}$. Finally, the output $\widehat{x^{p_{1}}}$ is feed into the classifier $f_{\phi}$ for prediction.
We obtain the natural accuracy of $93.5\%$ and robust accuracy of $93.0\%$ from the test.
This provides us a hint that the diffusion path $p_{1}$ should be maintained relatively clean (e.g., both the input and reverse diffusion process in path $p_{1}$ are as clean as those in path $p_{2}$) so that the output of $p_{1}$, which is the recovered image $\widehat{x^{p_{1}}}$, is purified enough.

Therefore, the motivation here is to expand the idea of the opposite adversarial direction in modifying (i) the input for arriving at a safer area and (ii) the entire path for purification.
Nevertheless, the clean image $x$ corresponding to $x_{adv}$ required for the second path $p_{2}$ is absent during testing. In addition, it is known that adversarial perturbation is added to an image and causes imperceptible changes.
In view of this, we resort to generating purified images as input to $p_{2}$ using the new reference point strategy, as described in (2) of Sec. 3.1.

Conceptually, the idea of generating the input to path $p_{2}$ that guides path $p_{1}$ is to transfer pixel values from the source image (adversarial image) to the other target image (clean/purified image), which can be treated as finding the optimal transport plan that moves every 3D point (RGB value) in a source point cloud to a target point cloud with the minimum cost (e.g., in terms of $\ell_{2}$ distance between two point clouds).
Fortunately, we can use non-attack images, which are the training data, combined with (2) to produce excessively denoised target images for diluting the attack perturbation.

Based on the above test and observations, we now describe the proposed method for cleaning the diffusion path with adversarial images as input.
The flowchart is illustrated in Fig. 2(c).
First, suppose we have $x_{adv}$ as the source image, it will be processed by color transfer with optimal transport Feydy et al. (), which is denoted as “Color OT” in Fig. 2(c), using the images coming from the training dataset.
To this end, we pick $C$ images with one image per class, where $C$ stands for the number of classes.
By using (2) to generate new reference points from these picked images, we have the target images $x_{1}^{tar},\ldots,x_{C}^{tar}$ for “Color OT” to change/purify the adversarial pixels in $x_{adv}$.
The $C$ target images will not be picked again throughout the testing so that there is no randomness.

Second, after finding the $x_{j}^{tar}$ that has the lowest Sinkhorn divergences $S_{\varepsilon}$ ((3) in Feydy et al. ()) with $x_{adv}$, we then use color transfer $f_{CT}$ to modify $x_{adv}$ with reference to $x_{j}^{tar}$. The output is denoted as $x^{p_{2}}$.
The purification procedure is specified as:

$$ $j=\displaystyle\operatorname*{argmin}_{i\in\{1,\ldots,C\}}S_{\varepsilon}(x_{ adv},x_{i}^{tar});\;\;\;x^{p_{2}}=f_{CT}(x_{adv},x_{j}^{tar}).$ (10) $$

As our starting point, $x^{p_{2}}$ goes into the diffusion process, as shown in Fig. 2(c).
This ensures all pixel values in $x^{p_{2}}$ are not from $x_{adv}$.
To make it clear, examples of the intermediate images generated from the diffusion process in Fig. 2(c) are illustrated in Fig. 5 of Sec. 9 in the Supplementary.

Third, we put $x_{adv}$ and $x^{p_{2}}$ into the diffusion model and set $t^{*}$, which is the optimal time step Nie et al. () to remove the adversarial noise.
We maintain two paths: the path with superscript $p_{1}$ for denoising the color values and the path with superscript $p_{2}$ for recovering the image.
Unlike the test in Fig. 4, during the reverse diffusion process, we do not use $p_{2}$ to pull $p_{1}$, since $x^{p_{2}}$ is generated by $f_{CT}$. Instead, we use “baseline purifier+reverse diffusion” described in Sec. 3.2 on one path, $p_{1}$.
Therefore, after the reverse diffusion process, the image $\widehat{x^{p_{2}}}$ will refer to the denoised image $\widehat{x^{p_{1}}}$ as the target for $f_{CT}$ to restore the colors, which is denoted as $\widehat{x_{clean}}$.
This is because $\widehat{x^{p_{2}}}$ is still a color-transferred image after the diffusion model, but the output from $p_{2}$ in the aforementioned test (Fig. 4) starts from the ideal clean image $x$ without needing color restoration. The whole process will be iterated again with starting point $\widehat{x_{clean}}$ and $t^{*}$ being halved at each iteration.

### 3.4 Granularity of Gradient Approximation in Realizing Powerful Adaptive AutoAttack

We present to implement a more powerful adaptive AutoAttack via granularity of gradient approximation in order not to overestimate robustness.
Actually, our implementation requires the output in each step from torchsde in the diffusion reverse process, which starts from $x_{t^{*}}$ and calls torchsde to produce the output $x_{t^{*}-1}$ of next time step till we get the final image $\hat{x}$.
Hence, if one understands the mechanism of using adjoint method as BPDA correctly, gradient computation in the reverse diffusion process will demand the same amount of calls of adjoint method as in that of torchsde.
We have to particularly point out that this is different from DiffPure Nie et al. (), where the authors only used one torchsde call for the final image and one call of adjoint method for computing the gradient.
We believe the granularity (one call vs. multiple calls of adjoint method) of gradient approximation causes the performance difference, and the use of multiple calls indeed provides AutoAttack with sufficient information to generate a more powerful adversarial perturbation.

To verify our finding, we have observations across different datasets, as shown in Table 3. First, we selected a subset from CIFAR-10 testing dataset consisting of $64$ images, then generated the corresponding adversarial examples from adaptive AutoAttack (Rand) with $20$ EOT via two different implementations, including (1) AutoAttack (Rand-DiffPure): Original code from DiffPure Nie et al. () using one torchsde function call and (2) AutoAttack (Rand-Ours): Our own implementation that pulls the output $x_{t}$ at each time step from torchsde solver, which means $100$ torchsde function calls. See Fig. 4 for comparison of different implementations of reverse diffusion process.

We can see from Table 3 that in comparison with AutoAttack (Rand-DiffPure), the defense capability of DiffPure is remarkably reduced (the accuracy in boldface) when the adversarial examples generated from AutoAttack (Rand-Ours) are present, obviously indicating robustness overestimation.
Actually, it is evidence of revealing that our implementation can let attackers create stronger adversarial examples and can be used as a proxy to attack diffusion-based purifiers. Also, this finding sheds light on whether using adjoint method hides the information used for creating stronger adversarial examples in an adaptive AutoAttack setting.

Finally, since DiffPure Nie et al. () has not been evaluated in Croce et al. (), it is believed that this simple trick of implementation that creates stronger AutoAttack (Rand) can be an easy way of attacking test-time adversarial defense purifiers and a promising supplement to Croce et al. ().
In the following experimental evaluations, this kind of adjoint strategy will be used in implementing stronger adaptive attacks.

**Table 3: Robust accuracy for adversarial examples (Adv) generated from different implementations of diffusion purification under adaptive AutoAttack (Rand) with $20$ EOT. Our implementation uses output in every time step from torchsde, whereas DiffPure Nie et al. () uses torchsde without accessing the intermediate outputs, which is encapsulated in torchsde function call. Left: CIFAR-10/WRN-28-10; Middle: CIFAR-100/WRN-28-10; Right: ImageNet/ResNet-18.**
| AutoAttack | (Rand-DiffPure) | (Rand-Ours) |
| --- | --- | --- |
| DiffPure | 76.56% | 64.06% |

### 3.5 Attack Cost and Time Complexity

We study how to resist adaptive attacks by analyzing and increasing the time cost of breaking the proposed defense models.
The results are shown in Table 5.
Due to space constraints, please see the time complexity analysis in Sec. 10 in the Supplementary for details.

## 4 Experiments

We examine the performance of proposed test-time adversarial defense methods, described in Sec. 3.2 and Sec. 3.3, against state-of-the-art adversarial attacks, and performance comparison with SOTA purification-based defenses.

### 4.1 Datasets and Experimental Settings

Three datasets, CIFAR-10 Krizhevsky et al. (), CIFAR-100 Krizhevsky et al. (), and ImageNet Deng et al. (), were adopted, where the results for CIFAR-100 and ImageNet are shown in Table 3 and Sec. 11 of Supplementary.
All experiments were conducted on a server with Intel Xeon(R) Platinum 8280 CPU and NVIDIA V100.

For a fair comparison, we followed RobustBench Croce et al. () and existing literature to conduct experiments on two popular NN models, including ResNet-18 He et al. () and WRN-28-10 Zagoruyko & Komodakis ().
The step size, $\eta$, in (8) of Sec. 3.2 was set as $2.5\times 10^{-3}$ and we followed Nie et al. () to set $t^{*}$ used in Sec. 3.2 and Sec. 3.3 as $0.1$. Since $t^{*}=0.1$, the number of steps required in the reverse process is $100$, where the step size $dt$ for torchsde solver is set to 1e-3.
We set $\varepsilon=0.05$ in (10), which is the default setting in the official package ([GeomLoss](https://www.kernel-operations.io/geomloss/index.html)) Feydy et al. (). For all attacks, we used $\ell_{\infty}$ and set perturbation
$\left\|\delta\right\|_{\infty}\leq 8/255$.

For training, the only model that needs to be trained is the baseline purifier $g_{\theta_{n}}$ with $K=1$, which we chose DISCO Ho & Vasconcelos () as the baseline to be combined with our new reference point generation in (2) with $K=1$ throughout the experiments.
In computing the attack gradient per step ($K$), we used PGD-$\ell_{\infty}$ with 7 iterations.
For testing the diffusion-based purifiers, we followed the testing paradigm described in [DiffPure](https://github.com/NVlabs/DiffPure) Nie et al. (), including the uses of $24$ random subsets (each contains $64$ images) for AutoAttack and $15$ random subsets (each contains $200$ images) for BPDA+EOT from CIFAR-10 testing dataset.

### 4.2 Adversarial Robustness Evaluations

Two types of adversarial attacks, including non-adaptive attack (PGD-$\ell_{\infty}$ Madry et al. (), AutoAttack (Standard) Croce & Hein ()) and adaptive attack (BPDA+EOT Athalye et al. (), PGD+EOT Lee & Kim () and DiffAttack Kang et al. ()), were adopted. For AutoAttack, we utilized the package [AutoAttack](https://github.com/fra31/auto-attack) Croce & Hein () with $\ell_{\infty}$, in which it has two settings: (1) “Standard,” which includes APGD-CE, APGD-DLR, FAB, and Square Attack and (2) “Rand,” which includes APGD-CE and APGD-DLR with Expectation Over Time (EOT) Athalye et al. () in case of models with stochastic components. To the most extreme case in which the attacker knows every detail about our framework of “purifier+classifier,” we utilized BPDA (adjoint method Li et al. () for the diffusion model) to bypass purifiers and EOT to combat the randomness in purifiers.
As mentioned in Sec. 3.4, our adjoint strategy will be used to implement stronger adaptive attacks in order to avoid robustness overestimation.

The robustness performance was measured regarding clean/natural accuracy (Clean Acc) for benign samples and robust accuracy (Robust Acc) for adversarial samples.
Several test-time adversarial defense methods, including Anti-Adv Alfarra et al. (), DISCO Ho & Vasconcelos (), DiffPure Nie et al. (), SOAP Shi et al. (), Hill et al. Hill et al. (), and ADP Yoon et al. (), were adopted for comparison.
Tables 4 and 5 show the robustness evaluation results and indicate that our methods either outperform or are comparable with the prior works.

The experiment in Table 4 is under the setting of non-adaptive attacks (PGD-$\ell_{\infty}$ with 40 iterations and AutoAttack (Standard)), in which the attacker only knows the information of the downstream classifier. According to Alfarra et al. (), we specifically point out that the authors used the robustly trained classifier, Adversarial Weight Perturbation (AWP) Wu et al. (), as the testing classifier.
So, except Alfarra et al. (), we used a normally trained classifier throughout the experiments.

Table 5 shows the results obtained under adaptive attacks, including stronger ones like PGD+EOT Lee & Kim () and DiffAttack Kang et al. ().
For the two kinds of AutoAttack (Rand) described in Sec. 3.4, please refer to Table 3.
Since most diffusion-based purifiers exhibit randomness,
we utilized the “EOT” setting for randomness, and “BPDA” for bypassing the reverse process of diffusion-based methods, which use the adjoint method to calculate the gradient of such process.
We also provide the time needed to attack an image (attack time cost) against a defense method.
Besides, according to the dual-paths design of Sec. 3.3, all adaptive attacks have to attack both paths. As a result, our defense experiences TWICE stronger attacks than other single-path methods since gradients are obtained from two paths. In other words, attacks are computed twice.

**Table 4: Non-adaptive robustness comparison between our method and state-of-the-art methods. Classifier: WRN-28-10. Asterisk (*) indicates that the results were excerpted from the papers. Boldface indicates the best performance for each attack. Note that, by incorporating our Opposite Adversarial Path (OAP) prior, the clean and robust accuracy of DISCO can be greatly increased.**
| Defense Methods | Clean Accuracy (%) | Robust Accuracy (%) | Attacks |
| --- | --- | --- | --- |
| No defense | 94.78 | 0 | PGD-$\ell_{\infty}$ |
| \hdashlineAWP Wu et al. ()* | 88.25 | 60.05 | AutoAttack (Standard) |
| Anti-Adv Alfarra et al. ()* + AWP Wu et al. () | 88.25 | 79.21 | AutoAttack (Standard) |
| \hdashlineDISCO Ho & Vasconcelos ()* | 89.26 | 82.99 | PGD-$\ell_{\infty}$ |
| DISCO Ho & Vasconcelos () + our OAP ($K=1$) | 92.5±2.06 | 88.29±3.3 | PGD-$\ell_{\infty}$ |
| DiffPure Nie et al. () | 88.06±2.65 | 87.21±2.28 | PGD-$\ell_{\infty}$ |
| DiffPure Nie et al. () | 88.15±2.86 | 87.71±2.12 | AutoAttack (Standard) |
| SOAP Shi et al. ()* | 96.93 | 63.10 | PGD-$\ell_{\infty}$ |
| Hill et al. Hill et al. ()* | 84.12 | 78.91 | PGD-$\ell_{\infty}$ |
| ADP ($\sigma=0.1$) Yoon et al. ()* | 93.09 | 85.45 | PGD-$\ell_{\infty}$ |
| Ours (Sec. 3.2) | 90.77±2.25 | 88.48±2.04 | PGD-$\ell_{\infty}$ |
| Ours (Sec. 3.2) | 90.46±2.36 | 89.06±2.62 | AutoAttack (Standard) |

**Table 5: Aadaptive robustness comparison between our method and state-of-the-art methods with attack time cost per image. Classifier: WRN-28-10. Asterisk (*) indicates that the results were excerpted from the papers. Boldface indicates the best performance for each attack. The attacks include BPDA+EOT, PGD+EOT Lee & Kim (), and DiffAttack Kang et al. ().**
| Defense Methods | Clean Accuracy (%) | Robust Accuracy (%) | Attack time cost (sec.) | Attacks |
| --- | --- | --- | --- | --- |
| No defense | 94.78 | 0 | N/A | BPDA+EOT |
| DiffPure | 92.38±1.86 | 80.92±3.53 | 592.92 | BPDA+EOT |
| Hill et al.* | 84.12 | 54.90 | N/A | BPDA+EOT |
| ADP ($\sigma=0.1$)* | 86.14 | 70.01 | N/A | BPDA+EOT |
| Ours (Sec. 3.3) | 92.08±1.99 | 81.25±3.62 | 6880.97 | BPDA+EOT |
| \hdashlineDiffPure | 96.88 | 46.88 | 3632.94 | PGD+EOT |
| Ours (Sec. 3.3) | 100 | 53.12 | 22721.90 | PGD+EOT |
| \hdashlineDiffPure | 89.02 | 46.88 | N/A | DiffAttack |
| Ours (Sec. 3.3) | 95.31 | 93.75 | 20397.27 | DiffAttack |

More specific, we can see from Table 5 that, in addition to accuracy, the time costs the attackers need to generate attack examples for our defense method are greatly higher than those for other defense methods.
If the attackers would like to shorten computations of generating adversarial examples, the number of iterations of conducting attacks or the number of EOT need to be reduced, thereby weakening the attack performance.
Take BPDA+EOT as an example: the total time to finish a batch testing on DiffPure costs less than 1 day but it costs 2 days to test on our proposed method under the same setting with 8 V100 GPUs.
Moreover, the number of paths in our method (Sec. 3.3) can be flexibly increased to be larger than two to greatly increase the time cost for attackers to generate adaptive attack examples.
An accompanying merit is that the robust accuracy of our method in resisting DiffAttack is rather high because DiffAttack focuses on attacking the only one path by computing the gradient on it without meeting our dual path strategy.

Finally, our method outperforms the prior works with a gap in Table 5 remarkably larger than that in in Table 4.
One main reason is due to the data size and the given random seeds between adaptive and non-adaptive attacks are quite different.

## 5 Conclusions & Limitations

We have presented a new test-time adversarial defense method.
The key is to excessively denoise the incoming input image along the opposite adversarial path (OAP) so as to move far away from the decision boundary.
This OAP prior can be readily plugged into the existing defense mechanisms for robustness improvement.
Our defense method also forces attackers to spend a great deal of time creating adaptive adversarial examples.
Meanwhile, we exemplify, for the first time, the pitfall of conducting AutoAttack (Rand) for diffusion-based adversarial defense methods. However, we are aware there are several attacks targeting diffusion-based adversarial defenses, and the performance of our proposed method may be overestimated since the gradient computation is approximated.

## Appendix

## 6 Related Works: Supplement

In Hill et al. (), the author proposed incorporating an energy-based model (EBM) with Markov Chain Monte Carlo (MCMC) sampling for adversarial purification.
This method constitutes a memoryless sampling trajectory that removes adversarial signals, while this sampling behavior preserves image classes over long-run trajectories.

In Adaptive Denoising Purification
(ADP) Yoon et al. (), the authors used the Noise Conditional Score Network (NCSN) with Denoising Score Matching (DSM) as the purifier, but with a deterministic short-run update rule for purification. This fixes the need for performing long-run sampling in order to remove adversarial noise in Hill et al. ().

Guided Diffusion Model for Purification (GDMP) Wang et al. (), Wu et al. () is proposed to embed purification into the reverse diffusion process of a DDPM Ho et al. (). GDMP submerges adversarial perturbations with gradually added Gaussian noises during the diffusion process and removes both noises through a guided denoising process. By doing so, GDMP can significantly reduce the perturbations raised by adversarial attacks and improve the robustness of classification.

## 7 Adversarial Attacks

Two types of adversarial attacks are briefly introduced here.

White-box attack. The attacker knows all information about $f_{\phi}$, including the model architecture, parameters $\phi$, training schedule, and so on.
One of the most indicative white-box attacks is projected gradient descent (PGD) Madry et al. (), a gradient-based attack. It produces adversarial perturbation by projecting NN’s gradients on the clipping bound in an iterative manner.
If the gradient is correctly calculated, the loss would certainly be maximized, and the NN, especially for non-robust NN, will be likely to return misclassified outputs.

Black-box attack. The attacker does not know all the information mentioned above in $f_{\phi}$. Common black box attack methods are roughly divided into two types: Query-base attack and Transfer-based attack.

No matter white- or black-box attack is concerned, in order to make adversarial perturbation less detectable, we will set a range of attack intensity, that is, adversarial perturbation is only allowed to perturb within a given norm value.
Usually $\ell_{p}$-norm, denoted as $\left\|\cdot\right\|_{p}$ ($p=1,2,\infty$), is used:

$$ $\displaystyle\left\|\delta\right\|_{p}:=\left\{\begin{array}[]{ll}\left(\sum_{ i}\delta_{i}^{p}\right)^{1/p}&p=1\mbox{ or }2,\\ \max_{i}\left|\delta_{i}\right|&p=\infty.\end{array}\right.$ (13) $$

In terms of intensity, we are accustomed to using $\epsilon_{p}$ to represent it. For example, it often uses $\epsilon_{\infty}=8/255$ to indicate that the intensity range of currently used $\delta$ is $\left\|\delta\right\|_{\infty}\leq 8/255$.

## 8 Diffusion Models: Supplement

Diffusion models were inspired by the diffusion phenomena under nonequilibrium thermodynamics in the physical world to design a framework that generates data by learning the reverse process of the data being destroyed by Gaussian noise gradually.

In the literature, the diffusion model Sohl-Dickstein et al. () is a type of generative model (e.g., GAN and VAE).
Conceptually, this generative process behaves like denoising.
Given a data point $x_{0}\sim q$, where $q$ denotes the (unknown) true data distribution, and a variance schedule $\{\beta_{t}\}_{t=1}^{T}$, the forward diffusion process follows $q(x_{1:T}|x_{0})=\prod_{t=1}^{T}q(x_{t}|x_{t-1})$,
where $q(x_{t}|x_{t-1})={\mathcal{N}}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}I)$, and the reverse diffusion process follows:

$$ $\displaystyle p_{\theta}(x_{0:T})=p(x_{T})\prod_{t=1}^{T}p_{\theta}(x_{t-1}|x_ {t}),$ (14) $$

where $p_{\theta}(x_{t-1}|x_{t})\sim{\mathcal{N}}(x_{t-1};\mu_{\theta}(x_{t},t),
\Sigma_{\theta}(x_{t},t))$,
$x_{T}\sim{\mathcal{N}}(0,I)$, and $\mu_{\theta}(x_{t},t)$ and $\Sigma_{\theta}(x_{t},t)$ denote the mean and covariance from the diffusion model parameterized by $\theta$ at time step $t$, respectively.

After that, there are several types of recently developed diffusion models, including score-based diffusion Song & Ermon (); Song et al. (), guided-diffusion Dhariwal & Nichol (), ILVR Choi et al. (), denoising diffusion probabilistic model (DDPM) Ho et al. (), and DDA Gao et al. ().

Specifically, in guided diffusion Dhariwal & Nichol (), given a label $y$ as the condition and (14), the conditional reverse process is specified as:

$$ $\displaystyle p_{\theta}(x_{0},\ldots,x_{T-1}|x_{T},y)=\prod_{t=1}^{T}p_{ \theta}(x_{t-1}|x_{t},y).$ (15) $$

To solve
(15), $\theta$ is decomposed into two terms as $\theta=\varphi\cup\phi$ to form separate models:

$$ $\displaystyle p_{\theta}(x_{t-1}|x_{t},y)=Zp_{\varphi}(x_{t-1}|x_{t})p_{\phi}( y|x_{t-1}),$ (16) $$

where $Z$ is a normalization constant.
Guided-diffusion improves the model architecture by adding attention head and adaptive group normalization, that is, adding time step and class embedding to each residual block. At the same time, with reference to GAN-based conditional image synthesis, class information is added during sampling and another classifier is used to improve the diffusion generator. To be precise, the pre-trained diffusion model can be adjusted using the gradient of classifier to direct the diffusion sampling process to any label.

Score-based diffusion Song & Ermon (); Song et al. () generates samples by estimating the gradients of unknown data distribution with score matching, followed by Langevin dynamics, moving data points to areas with higher density of data distribution.
In practice, the score network $s_{\theta}$ is trained to predict the true data distribution $q$ as:

$$ $\displaystyle s_{\theta}(x_{t},t)\approx\nabla_{x_{t}}\log q(x_{t})=-\frac{ \mathbf{\epsilon_{\theta}}(x_{t},t)}{\sqrt{1-\bar{\alpha}_{t}}},$ (17) $$

where $\bar{\alpha}_{t}=\prod_{s=1}^{t}(1-\beta_{s})$.

On the other hand, the conditional generation of the diffusion model has also received considerable attention.
In ILVR Choi et al. (), the author proposed a learning-free conditioning generation, which is challenging in denoising diffusion probabilistic model (DDPM) Ho et al. () due to the stochasticity of the generative process. It leveraged a linear low-pass filtering operation $\phi_{N}$ as a condition to guide the generative process in DDPM for generating high-quality images based on a given reference image $c$ at time $t$, termed $c_{t}$, which can be obtained by the forward diffusion process $q$. The update rules are derived as follows:

$$ $\displaystyle x^{\prime}_{t}\sim p_{\theta}(x^{\prime}_{t}|x_{t+1})$ $\displaystyle c_{t}\sim q(c_{t}|c)$ $\displaystyle x_{t}\leftarrow\phi_{N}(c_{t})-x^{\prime}_{t}-\phi_{N}(\hat{x}^{ \prime}_{t}),$ (18) $$

where the factor of downsampling and upsampling is denoted as $N$.

DDA Gao et al. () also came up with a similar approach to resolve the domain adaptation problem in the test-time scenario. The authors adapt the linear low-pass filtering operation $\phi_{N}$ in ILVR Choi et al. () as conditions, and their method also forces the sample $x_{t}$ to move in the direction that decreases the distance between the low-pass filtered reference image $\phi_{N}(x_{0})$ and low-pass filtered estimated reference image $\phi_{N}(\hat{x}_{0})$. The update rule is specified as follows:

$$ $\displaystyle\hat{x}_{0}\leftarrow\sqrt{\frac{1}{\bar{\alpha}_{t}}\,}\,x_{t}- \sqrt{\frac{1}{\bar{\alpha}_{t}}-1\,}\,\mathbf{\epsilon_{\theta}}(x_{t},t)$ (19) $\displaystyle x_{t}\leftarrow\hat{x}_{t}-\textit{w}\nabla_{x_{t}}\left\|\phi_{ N}(x_{0})-\phi_{N}(\hat{x}_{0})\right\|_{2},$ (20) $$

where $N$ is the factor of downsampling and upsampling, and w is the step size.

## 9 Intermediate Images Generated from Fig. 2 (c)

In Fig. 5, we show the images generated from each step in Fig. 2(c) for visual inspection.

Figure: Figure 5: Intermediate Images generated from Fig. 2(c). From Top to Bottom: The images denote clean image $x$, $x^{p_{2}}$, $x^{p_{1}}_{t^{*}}$, $\widehat{x^{p_{1}}}$, $x^{p_{2}}_{t^{*}}$, $\widehat{x^{p_{2}}}$, and purified image $\widehat{x_{clean}}$, respectively.
Refer to caption: extracted/5945279/figs/x.png

## 10 Attack Cost in Time Complexity: Detailed Analysis

In this section, we discuss the cost the attackers need to pay to defeat our proposed test-time adversarial defense method. In particular, we focus on analyzing the time complexity of defeating the diffusion-based purifiers presented in Sec. 3.2 and Sec. 3.3.

In DISCO Ho & Vasconcelos (), let $N_{d}$ and $N_{c}$ be defined as the number of parameters in DISCO and its downstream classifier, respectively.
In training time, the authors estimated that the time complexity of defense/purification is ${\mathcal{O}}(N_{d})$ and that of adaptive attack (i.e., designing an adversarial example by knowing the whole model) is ${\mathcal{O}}(KN_{d}+N_{c})$, where $K$ is the number of steps.
Hence, the ratio of attack-to-defense cost in training time is ${\mathcal{O}}(K+N_{c}/N_{d})$ and the authors asserted that the time complexity of defense is much less than that of attack since $N_{d}<N_{c}$.
In testing time, the time complexity of defense becomes ${\mathcal{O}}(KN_{d})$ (see green bars in Fig 10 of Ho & Vasconcelos ()) while the other remains the same.
Hence, the ratio of attack-to-defense cost in testing time is ${\mathcal{O}}(1+N_{c}/(KN_{d}))$, revealing that even $N_{c}$ is larger than $N_{d}$, the time complexity for both the attacker and defender can tie if $K$ is large enough.

In DiffPure Nie et al. (), the authors argued that an adaptive attack on diffusion model by traditional back-propagation would cause high memory cost.
To overcome this issue, they instead applied adjoint method Li et al. () to efficiently estimate the gradient used for designing adaptive adversarial perturbation under constant memory cost.
From Table 1 in Li et al. (), it is asserted that, under the tolerance $\epsilon=1/T$, the per-step time complexity scales as $\log_{2}T$, where $T$ is the number of steps required during the reversed process. So, the time complexity of adjoint method through the reverse diffusion process is ${\mathcal{O}}(T\log_{2}T)$.

We, however, raise the concern that the presented time cost is likely to ignore one important factor: the number of parameters in a diffusion model, denoted as $N_{dm}$.
Hence, in conservatively speaking, the time complexity of adjoint method through the reverse process should be corrected as ${\mathcal{O}}(N_{dm}T\log_{2}T)$.

Based on the above concerns, our estimations of the time complexity of adversarial attack and proposed defense methods in testing time are described as follows.
For the defense method described in Sec. 3.2,
since the baseline purifier $g_{\theta}$ is reused in every step of the diffusion process, $T$ is equal to $K$ (hereafter, we will use them interchangeably).
So, the time complexity costs of adaptive attack and our defense are derived as ${\mathcal{O}}(N_{dm}T\log_{2}T+TN_{d}+N_{c})$ and $O(N_{dm}T+N_{d}T+N_{c})$, respectively.
In practice, $N_{dm}$ is usually much larger than $N_{d}$ and $N_{c}$, so we have ${\mathcal{O}}(N_{dm}T\log_{2}T+TN_{d}+N_{c})\approx{\mathcal{O}}(N_{dm}T\log_{
2}T)$ and ${\mathcal{O}}(N_{dm}T+N_{d}T+N_{c})\approx{\mathcal{O}}(N_{dm}T)$, and the ratio of attack-to-defense cost is ${\mathcal{O}}(\log_{2}T)$. Moreover, if the attacker adopts the Expectation Over Time (EOT) operation with a number of iterations, $T_{EOT}$, the time cost of creating such an attack has to be additionally multiplied by $T_{EOT}$.
For example, if $T=100$ and $T_{EOT}=20$, the ratio theoretically approximates $133$; i.e., the time cost of adaptive attack is around $133$ times as big as that of defense.

For the defense method described in Sec. 3.3, since two diffusion paths should be maintained during purification, the time complexity is simply doubled than the one in a single path (Sec. 3.2).
It is concluded that although the inference time of our proposed test-time defense methods is increased, the increased cost also complicates the adaptive attacks as well.

Table 6 shows the time cost comparison between the reverse diffusion process (purification) and adaptive attack (BPDA+$20$ EOT), implemented using the adjoint strategy in Sec. 3.4, under DiffPure and our defense methods. Here, we do not consider the adaptive AutoAttack since the mechanism is much more complex beyond the above analysis.

**Table 6: Computational time cost comparison in five runs. This evaluation utilizes four testing images with batch size two, running on one NVIDIA V100. The ratio is calculated as the average time required for BPDA+20 EOT divided by that for reverse diffusion.**
| Methods | Purification Time (sec.) | Attack Time (sec.) | Ratio |
| --- | --- | --- | --- |
| DiffPure Nie et al. () | 35.20±0.67 | 2508.56±116.06 | 71.27 |
| Sec. 3.2 | 34.59±0.95 | 2504.14±112.61 | 72.39 |
| Sec. 3.3 | 72.84±34.41 | 7517.03±1970.35 | 103.20 |

## 11 More Experimental Results

In this section, we examine the robustness of our method using CIFAR-100 Krizhevsky et al. () and ImageNet Deng et al. ().
Due to limited computation resources and budgets, some attacks on these datasets are still running. We hope that in the near future, the results can be ready since they are extremely eager for computation resources.

### 11.1 Results on CIFAR-100

We provide the robustness evaluation against adversarial attacks on CIFAR-100, as shown in Table 7 (cf. Tables 4 and 5 for CIFAR-10).
Similarly, the experiments in the first block of Table 7 are under the setting of non-adaptive attack, in which the attacker only knows the information of the downstream classifier.
We also excerpt the results of Rebuffi et al. (); Wang et al. (); Cui et al. () from [RobustBench](https://robustbench.github.io/) Croce et al. () for more comparisons.
The second block of Table 7 shows the results obtained under the setting of adaptive attacks.
Note that the results for DiffPure Nie et al. () are from Zhang et al. ().
We can find that our methods are either better than the prior works under BPDA+EOT or comparable with DiffPure under AutoAttack and PGD-$\ell_{\infty}$.

**Table 7: Robustness evaluation and comparison between our method and state-of-the-art methods. Classifier: WRN-28-10. Testing dataset: CIFAR-100. Asterisk (*) indicates that the results were excerpted from the papers. Boldface indicates the best performance for each attack.**
| Defense Methods | Clean Acc (%) | Robust Acc (%) | Attacks |
| --- | --- | --- | --- |
| No defense | 81.66 | 0 | PGD-$\ell_{\infty}$ |
| Rebuffi et al.Rebuffi et al. () | 62.41 | 32.06 | AutoAttack (Standard) |
| Wang et al.Wang et al. () | 72.58 | 38.83 | AutoAttack (Standard) |
| Cui et al.Cui et al. () | 73.85 | 39.18 | AutoAttack (Standard) |
| DiffPure Nie et al. () | 61.96±2.26 | 59.27±2.95 | PGD-$\ell_{\infty}$ |
| DiffPure Nie et al. () | 61.98±2.47 | 61.19±2.87 | AutoAttack (Standard) |
| Ours (Sec. 3.2) | 61.71±2.49 | 60.21±1.82 | PGD-$\ell_{\infty}$ |
| Ours (Sec. 3.2) | 62.02±2.24 | 60.08±2.44 | AutoAttack (Standard) |
| No defense | 81.66 | 0 | BPDA+EOT |
| DiffPure Nie et al. (); Zhang et al. () | 69.92 | 48.83 | BPDA+EOT |
| Hill et al. Hill et al. ()* | 51.66 | 26.10 | BPDA+EOT |
| ADP ($\sigma=0.1$) Yoon et al. ()* | 60.66 | 39.72 | BPDA+EOT |
| Ours (Sec. 3.3) | 70.38±4.05 | 51.25±3.82 | BPDA+EOT |

### 11.2 Results on ImageNet

We provide the robustness evaluation against non-adaptive PGD-$\ell_{\infty}$ on ImageNet, as shown in Table 8. This experiment was conducted on a more advanced transformer-based classifier Liu et al. () with $\left\|\delta\right\|_{\infty}\leq 8/255$ and ResNet-50 with $\left\|\delta\right\|_{\infty}\leq 4/255$.
Our method proposed in Sec. 3.3 is slightly better than DiffPure, while Our method proposed in Sec. 3.2 is comparable with DISCO, which, however, needs additional data for training EDSR for purification.

**Table 8: Robustness comparison between our method and DISCO/DiffPure. Testing dataset: ImageNet. Asterisk (*) indicates that the results were excerpted from the paper. Boldface indicates the best performance for each attack.**
| Defense Methods | Clean Acc (%) | Robust Acc (%) | Classifier | Attack |
| --- | --- | --- | --- | --- |
| DISCO Ho & Vasconcelos ()* | 72.64 | 66.32 | ResNet-50 | PGD-$\ell_{\infty}$ ($4/255$) |
| Ours (Sec. 3.2) | 69.32±12.18 | 68.12±12.13 | ResNet-50 | PGD-$\ell_{\infty}$ ($4/255$) |
| Ours (Sec. 3.3) | 67.55±11.73 | 66.54±12.15 | ResNet-50 | PGD-$\ell_{\infty}$ ($4/255$) |
| DiffPure Nie et al. () | 75.13±11.67 | 73.11±11.76 | SwinV2 Liu et al. () | PGD-$\ell_{\infty}$ ($8/255$) |
| Ours (Sec. 3.2) | 75.37±12.01 | 71.73±12.63 | SwinV2 Liu et al. () | PGD-$\ell_{\infty}$ ($8/255$) |
| Ours (Sec. 3.3) | 75.38±12.78 | 73.20±11.27 | SwinV2 Liu et al. () | PGD-$\ell_{\infty}$ ($8/255$) |

## Peer Reviews

confidence: 3
contribution: 2
initial_rating: 5
presentation: 2
questions: 1. What is the aim of Color OT?
2. Why does the robustness decrease with the increase of K in Table 2?  
3. How does the number of diffusion paths influence the purification time?
soundness: 3
strengths: 1. The proposed plug-and-play purifier can be integrated into pre-trained models, improving their robustness against adversarial attacks. 
2. The method increases the time required for attackers to generate adaptive adversarial examples. 
3. The paper also critiques the use of AutoAttack (Rand) for evaluating diffusion-based defenses and highlights the trade-off between attack effectiveness and computational complexity in adversarial robustness evaluations.
summary: This paper introduces a test-time adversarial defense method that utilizes diffusion-based purification along Opposite Adversarial Paths to excessively denoise adversarial inputs, pushing them away from decision boundaries. The proposed plug-and-play purifier can be integrated into pre-trained models, improving their robustness against adversarial attacks.
weaknesses: 1.  The author's explanation of his method is not clear enough. There is no overall algorithm description (e.g. for section 3.3), making the reader difficult to follow. 
2.  The explanation in Table 2 is not persuasive. Why with the increase of K, the robustness decreases?   It seems that this is contrary to the assumption in Figure 1.  Could you provide a more detailed explanation of this apparent contradiction and discuss potential reasons for the decrease in robustness as K increases? 
3.  The algorithm is too complex to be applicable. For example, it uses several diffusion paths. From Table 6, it seems that the purification time will be doubled.  Could you discuss the trade-offs between complexity and performance? Are there ways to simplify the algorithm while maintaining its effectiveness? Additionally, it would be helpful to provide a more detailed analysis of the computational costs and how they scale with the number of diffusion paths.
4. The improvements are little compared with DiffPure regards the transferability. Moreover, this paper did not compare with the latest work, such as
[1] Robust Evaluation of Diffusion-Based Adversarial Purification,ICCV2023
[2] Adversarial Purification with the Manifold Hypothesis,AAAI2024
5.  References should be enclosed in parentheses. For example, it should be In DiffPure (Nie et al. 2022) rather than In DiffPure Nie et al. (2022).
6. Some typos. For example, in Figure 2, it should be Sec 3.xx.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: - Does the proposed method show superior performance against attacks, such as PGD-ODI and ACG,  that converge to different adversarial examples from PGD?
- What do the differences in types and colors of lines mean in the figures?
soundness: 2
strengths: - The idea of reducing the effects of adversarial perturbations by perturbing the input in a way that minimizes training loss makes sense. This process pushes the adversarial input to non-adversarial area. This idea cannot be applied directly because because the ground truth label is not available during inference. The proposed method is able to emulate this process through an inverse diffusion process and achieve efficient denoising.
- The effectiveness of the proposed method is empirically demonstrated by the experimental results. It also shows superior results compared to existing methods against the strong attacks such as EOT and BPDA , which are designed to defeat randomized defenses.
summary: This paper proposes a preprocessing-based test time defense against adversarial attacks. The proposed method relies on the minimization of training loss and adversarial purification using the diffusion model. The adversarial inputs are pushed towards the opposite adversarial direction via the reverse diffusion process. The proposed purifier can be plugged into a pre-train model, which means the proposed method is easily combined with different types of defenses, such as adversarial training.
weaknesses: - To demonstrate that the proposed method is effective against various attacks, it would be better to experiment with methods that converge to adversarial examples that differ from PGD and APGD, such as ACG and PGD-ODI. This is because PGD-based attacks highly depend on the initial point of the attack.
The effectiveness of random initialization, such as Output Diversified Sampling (ODS) in adversarial attacks, implies the high dependency of PGD-based attacks on initial points. It is natural to assume the same dependency in the minimization of training loss with respect to input because PGD-based attacks maximize the same loss to generate adversarial examples.
However, the attacks used for training and evaluation of the proposed method are all derivatives of PGD. Thus, the adversarial examples subject to purification are likely to be similar to each other.
- It would be helpful if you could explain the difference between the solid and dashed lines in the arrows in the figures.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 2
questions: 1. The statement in Section 3.1.2 is contradictory to the statement in Section 1.3, and the corresponding explanation is not convincing enough. In Section 1.3, the clean accuracy decreases at K=1, and the authors argue that “the process ‘-adv’ is still unstable, hence, some data points near the decision boundary may be perturbed to incorrect class”, but in Section 3.1.2, the model has better performance at K=1.  Although the authors conjecture that this inconsistency is because the ground-truth labels are not used in Table 2, the training data $x^K$ is actually generated step-by-step using the ground-truth label y as well, and why this is not unstable. The authors can clarify the specific differences in methodology or experimental setup between these two terms or provide a more detailed analysis of the stability of the '-adv' process across different values of K

2. Some details of the experiment are unclear. In Tables 1-5, it is not clear whether the adversarial attack is against the target model only or against the target model and purifier as a whole. It seems that the described adaptive attack is against the target model only by using BPDA, EOT, etc., rather than a full white-box attack (e.g., C&W) against the target model and the purifier as a whole. The authors can explicitly state for each experiment whether the adversarial attacks are targeting only the model or both the model and purifier.
soundness: 2
strengths: 1. This paper introduces a new method to alleviate the influence of adversarial noise, which proposes to leverage the opposite adversarial path and reverse diffusion.

2. The experiments are performed on three popular datasets, which provides extensive evaluation results.

3. Multiple related works are considered for comparison to present the gains brought by the proposed method.
summary: This paper introduces a test-time adversarial defense method, which exploits the diffusion-based recovery through opposite adversarial paths (OAPs) to enhance robustness against adversarial attacks. This work proposes denoising along the opposite adversarial gradient and incorporating it with reverse diffusion. Experiments on three datasets are conducted to validate the effectiveness of the proposed method.
weaknesses: 1. The statement in Section 3.1.2 is contradictory to the statement in Section 1.3, and the corresponding explanation is not convincing enough.

2. In this work, the proposed method only consider the manner of non-targeted adversarial attacks. For the targeted attacks, the adversarial gradient is varied with the specified target class, and the proposed method with a single opposite adversarial path seems not to be able to handle this case.

3. The adversarial attacks used to evaluate the defenses mainly belong to gradient-based non-targeted methods, the optimization-based adversarial attacks (e.g., C&W, DDN), targeted attacks and black-box attacks can be considered to more comprehensively evaluate the effectiveness of the proposed method.

4. Some details of the experiment are unclear.

5. Some typos, for example, "To this end, according to (14) of guided diffusion described in Sec. 8 in Supplementary" (Line 264) → "To this end, according to Eq.(14) of guided diffusion described in Sec. 8 in Supplementary"

Meta-review: This work proposed a test-time adversarial defense method via diffusion-based recovery along opposite adversarial paths. 

It received 3 detailed reviews. The ideas and the effectiveness in the reported experiments are recognized by most reviewers. Meanwhile, there are also several important concerns, and I think the most important two are:
1. Threat model: The method is only evaluated on white-box gradient-based non-targeted attacks. 
2. Complexity: The complexity is hight. 

The authors made efforts to provide rebuttals, and all reviewers gave further feedback or updated their reviews. Combing reviewers' feedback and my judgement, the final comments about above two points are:
1. It is very strange that the test-time adversarial defense is evaluated under the white-box setting, which means that both attacker and defender can access the model during the whole process, like an online gaming. I cannot imagine when it could happen in real scenarios. The practical setting should be test-time adversarial defense against black-box attacks, and both attacker and defender don't know each other's existence and strategy. Based on the impractical setting, the evaluations of this work are unconvincing.
2. The authors argued in the rebuttal that the additional complexity for defense is not important. It makes no sense. A good defense should neither increase too much cost nor harm the model's performance on benign query. 

Based on above two points, I think the practical effectiveness of the proposed method is limited. Thus, the recommendation is reject.

Decision: Reject