Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Authors: Gaozheng Pei
Ke Ma
Yingfei Sun
Qianqian Xu
Qingming Huang
Venue: ICML 2025 spotlightposter (2025)
Keywords: Adversarial Purification
Primary area: social_aspects->security
TL;DR: Adversarial Purification from Perspective of Frequency Domain

Abstract: The diffusion-based adversarial purification methods attempt to drown adversarial perturbations into a part of isotropic noise through the forward process, and then recover the clean images through the reverse process. Due to the lack of distribution information about adversarial perturbations in the pixel domain, it is often unavoidable to damage normal semantics. We turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spectrum. We find that for both spectra, the damage caused by adversarial perturbations tends to increase monotonically with frequency. This means that we can extract the content and structural information of the original clean sample from the frequency components that are less damaged. Meanwhile, theoretical analysis indicates that existing purification methods indiscriminately damage all frequency components, leading to excessive damage to the image. Therefore, we propose a purification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. Specifically, at each time step during the reverse process, for the amplitude spectrum, we replace the low-frequency components of the estimated image's amplitude spectrum with the corresponding parts of the adversarial image.
For the phase spectrum, we project the phase of the estimated image into a designated range of the adversarial image's phase spectrum, focusing on the low frequencies. Empirical evidence from extensive experiments demonstrates that our method significantly outperforms most current defense methods.

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Gaozheng Pei
Ke Ma
Yingfei Sun
Qianqian Xu²
Qingming Huang 324
Abstract
frequencies. Empirical evidence from extensive experiments demonstrates that our method signifi- cantly outperforms most current defense methods. Code is available at https:: : //ggtuu.b... com/ GaozhengPei/Eregee
The diffusion-based adversarial purification meth- ods attempt to drown adversarial perturbations into a part of isotropic noise through the for- ward process, and then recover the clean images through the reverse process. Due to the lack of distribution information about adversarial pertur- bations in the pixel domain, it is often unavoid- able to damage normal semantics. We turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spec- trum. We find that for both spectra, the damage caused by adversarial perturbations tends to in- crease monotonically with frequency. This means that we can extract the content and structural infor- mation of the original clean sample from the fre- quency components that are less damaged. Mean- while, theoretical analysis indicates that existing purification methods indiscriminately damage all frequency components, leading to excessive dam- age to the image. Therefore, we propose a pu- rification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. Specifically, at each time step during the reverse process, for the amplitude spectrum, we replace the frefrreuency components of the estimated image's amplitude spectrum with the correspond- ing parts of the adversarial image. For the phase spectrum, project the phase of the estimated image into a designated range of the adversar- ial image's ' phase spectrum, focusing on the low
1. Introduction
Adversarial purification (Nie al., 2022; Wang et al., 2022; Lee & Kim, 2023; Bai et al., 2024; Song et al., 2024; Zolli- coffer et al., 2025) is a data preprocessing technique aimed at transforming adversarial images back into their original clean images during the testing phase. Compared to adver- sarial training (Gosch et al., 2023; Wang al., 2024; Singh et al., 2024), it offers advantages such as decoupling training and testing, and strong generalization. The main challenge faced by adversarial purification is how to eliminate adver- sarial perturbations while preserving the original semantic information as much as possible. Therefore, it is essential to explore how adversarial perturbations damage the images.
Current research (Chen al., 2022; Wang al., 2020; Han et al., 2021; Maiya et al., 2021; Han et al., 2021; Maiya et al., 2023) studies the distribution of adversarial perturbations in the frequency domain, but they lack quantitative analysis and typically do not distinguish between amplitude spec- trum and phase spectrum. Due to the different distribution characteristics of amplitude spectrum and phase spectrum, in this paper, we further decompose images into amplitude spectrum and phase spectrum. We statistically analyze the variations in amplitude spectrum and phase spectrum of original clean images and adversarial images across multi- ple models, attack methods, and different perturbation radii (more experimental results and details in the Appendix C). From Figure we find that for both the amplitude spectrum and the phase spectrum, the degradation caused by adversar- ial perturbations exhibits an approximately monotonically increasing trend with frequency.
'School of Electronic, Electrical and Communication En- gineering, UCAS, Beijing. Key Laboratory of Intelligent Information Processing, Institute of Computing Technology, CAS. Beijing. "School of Computer Science and Technol- ogy, UCAS, Beijing. *Key Laboratory of Big Data Min- ing and Knowledge Management, UCAS, Beijing.. Corre- spondence to: Ke Ma waa.ke@ucas..ccc.... Qingming Huang <qmhuang @ @cc.s.ac.cn>>
Existing methods of eeffusiin-based adversarial purifica- tion attempt to drown adversarial perturbations as part of isotropic noise through the forward process, and then re- cover clean images through the reverse process. However, we theoretically prove that this strategy will destroy all fre-
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Amplitude
Phase
Overall, the contribution of this paper is follows:
ogs- 81542255
pgt 2p2-ax--42155
2gF 8125
P91 lat 51255
CIFARIO
1.3
1. We decompose the image into amplitude spectrum and phase spectrum, and explore how adversarial perturba- tion disturbs the original image from the perspective of the frequency domain.
1.0
0.3
ImirgeNet
Pg bel b225
Pgol lnf 8723
1.3
04-
30 AEEA22
2. We theoretically demonstrate that current diffusion- based purification methods excessively destroy the am- plitude spectrum and phase spectrum of input images.
1.0
0.-
Frequency
Frequencc
Our proposed method retains the original structural information and content while eliminating adversarial perturbations by selectively preserving the amplitude spectrum and phase spectrum at each time-step.
Figure 1.
We decompose the image into the amplitude spectrum (left) and the phase spectrum (right), and calculate the differences between the adversarial images and the original images, respec- tively. The damage caused by adversarial perturbations tends to increase monotonically with frequency for both spectra.
4. Extensive experiments show that our method outper- forms other methods by a promising improvement against various adversarial attacks.
quency components in both the amplitude spectrum and phase spectrum and this destruction becomes increasingly severe as the time-step increases. The empirical findings above suggest that if we want to restore adversarial images to their original clean images, we should minimize the dis- ruption the low-frequency amplitude spectrum and phase spectrum to ensure consistency and preserve the inherent characteristics of the original images. Therefore, believe that current diffusion-based adversarial purification methods cause excessive damage to the semantic information of the input images.
2. Related Work
Adversarial purification is a technique designed to eliminate adversarial perturbations from input images before classi- fication, ensuring more robust model performance. These purification approaches can be categorized into two pri- mary paradigms: training- dataset preparation, and diffusion- basonn techniques that of- fer a training-agnostic solution, capable of operating without direct access to original training data.
methods that necessitate
2.1. Training- Adversarial Purification
Motivated by experimental findings and theoretical analysis, we propose novel adversarial purification method that can remove adversarial perturbations from adversarial images while minimizing destruction to the image. Specifically, at each time-step during the reverse process, we decom- pose the predicted estimated clean image into its amplitude spectrum and phase spectrum. For amplitude spectrum, since low-freqyyncy components of the adversarial image are almost unaffected, we replace the low-frequency part of the estimated image's ' amplitude spectrum with the low- frequency part of the adversarial image's 's amplitude spec- trum. For phase spectrum, we project the estimated image's ' low-frequency phase spectrum onto a certain range of the adversarial image's i fow-frequency phase spectrum. This is because the low-frequency phase spectrum is less affected by adversarial perturbations, allowing us extract coarse- grained structural information from the image while grad- ually aligning it with the -requency phase information of natural images. Our proposed method selectively retains low- www-frequency phase and amplitude spectrum information, which not only preserves some structural and content infor- mation of the image but also provides prior information for the restoration of high-freeg frequency details.
(Song et al., 2018) empirically demonstrates that adversarial examples predominantly exist in the low probability areas of the training distribution and aims to redirect them back towards this distribution. (Samangouei et al., 2018) initially models the distribution of clean images and subsequently seeks the nearest clean sample to the adversarial example during inference. (Naseer et al., 2020) generates perturbed images using self-supervised perturbation attack that dis- rupts the deep perceptual features and projects back the perturbed images close to the perceptual space of clean images. (Zhou et al., 2021) introduces a method to learn generalizable invariant features across various attacks using an encoder, engaging in a zero-sum game to reconstruct the original image with a decoder. (Lin et al., 2024) combines adversarial training and purification techniques via employ- ing random transforms disrupt adversarial perturbations and fine-tume thnettness a purifier model using adversarial loss. (Tang & Zhang, 2024) leverages the phenomenon of FGSM ro- bust overfitting to enhance the robustness of deep neural networks against unknown adversarial attacks. Nonetheless, these approaches necessitate training on the training dataset, which dime-intensivy and lacks generalizability.
2

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
2.2. Diffusion-based Adversarial Purification
Definition 3.3. (Difference of phase) Given the phase Φx of the input image Xo and the phase oxx of the noisy image X₁, respectively. We definite the difference between there two phase of the images at arbitrary coordinate (u, v) are as follows:
(Yoon et al., 2021) shows that an energy- model trained with denoising score-matchinn can quickly purify attacked images within a few steps. (Nie et al., 2022) begins by adding a small amount of noise to the images and then re- covers the clean image through reverse generative process (Wang et al., 2022) suggests using the adversarial image as a reference during the reverse process, which helps ensure that the purified image aligns closely with the original clean image. (Leee& & Kim, 2023) proposed new gradient esti- mation method and introduced stepwise noise scheduling strategy to enhance the effectiveness of the current purifica- tion methods. (Song et al., 2024) proposes a method that reduces the negative impact of adversarial perturbations by mimicking the generative process with clean images as in- put. (Bai al.. 2024) designs the forward process with the proper amount of Gaussian noise added and the reverse process with the gradient of contrastive loss as the guidance of diffusion models for adversarial purification. However, our theoretical analysis demonstrates that these methods excessively disrupt the semantic information of the images.
( v) Ox, (u, u) Ox (u, v).
(4)
This value represents the degree of variation in the shape and structure of the image.
Theorem 3.4. (Proof in Appendix D.2) The variance of the first-order approximation of the difference of phase between clean image xo and noisy image x, at arbitrary coorlinates (u, v) at frequency domain is as follows:
Var (ar(A(((u.))
1,
(5)
SNR((a.))
where signal to noise ratio (SNR) at time-step is defined as follows:
(N, = Vā (o v) V1-ai ar(c((, b)
(6)
3. Theoretical Study
Obviously, SN Re Re(u, v) decreases monotonically with t, so the variance of the difference of phase Var (,0 v)) in- creases monotonically with t. This means that t increases, the phase spectrum of the original image is increasingly dis- rupted by noise.
We perform discrete Fourier transform (DCT) on the input image Xo and the noisy image x, obtained using forward process (Ho et al., 2020) at time-step as follows:
xo(u, u) = (x)) = (u, ())e)))) (e, v)= = (xT(x,) bx, (u. v) (e dxx (w.e),
(L)
Remark 3.5. From Theorem 3.2 and Theorem 3.4, we can conclude that all frequency components of the image are disrupted by the forward process, and the degree of disruption increases monotonically with (ar decreases monotonically with t ). From Figure 1, we can find that as t increases, while the adversarial perturbations are drowned out into part of isotropic noise, the normal content and structural information contained in the amplitude and phase spectra of low frequencies will also be disrupted by the forward process, which means that the existing method may result in excessive disruption of the input images.
where u and are coordinates at frequency domain. (xo( u) and (x, vi] denote the amplitude spectrum, dx (u, (u, 6) and (xx v) denote the phase spectrum.
Definition 3.1. (Difference of amplitude) Given the am- plitude (u, v) of the input image X9 and the amplitude [xx (u, w) of the noisy image x,, respectively. We definite the difference between there two amplitude of the images at arbitrary coordinate (u, v) are as follows:
Aui( v) = |x (u,
(u, v) - Xxo 2-]l
(2)
This value represents the degree of variation in the image content.
4. Methodology
Theorem 3.2. (Proof in Appendix D.I) The variance of the difference of amplitude at time-step t between clean image Xa and noisy image Xt at arbitrary coordinates (u, v) at frequency domain is as follows:
To minimize the damage to semantic information while eliminating adversarial perturbations, we propose a novel adversarial purification method named FreqPure from the perspective of the frequency domain. The core of the Fre- qPrre method lies in selectively preserving low-frequency phase and amplitude spectrum information which are less affected by adversarial perturbations. Our approach not only maintains some structural features and content of the original image during the reverse process but also provides valuable prior constraints for the reconstruction of high- frequency information in the image.
Var(AA (u, o))
0a
a1)
(3)
2
16]xo(u, "a
The RHS is monotonically increasing with respect to t, This means that as increases, the amplitude spectrum of the original image at arbitrary coordinate (u, v) is increasingly disrupted by noise.
3

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Amplitude Exchange
Next State Generation
HA
Xado
Ax
Axole
A
OCE
Xo
Xo
SaIe
Pxple
P
Hp
P X014
Low pass filter
Xado
Pxudo
High pass filter
1pp
DCT
Phase Projection
iDCT
Figure Pipeline of our method. care our method is to preserve, at each time-step of reverse process, amplitude and phase spectrum information of the original clean samples extracted from adversarial images as prior. This ensures the retention of the original image's s content and structural information while also providing guidance for the restoration of high feeh-ffrruencyy details.
Given an adversarial example Xodv at time-step t = 0, i.e., Xo Xadv E #xxX We first diffuse it according to the forward process from = 0 to f = t². Then, during the reverse diffusion process at each time-step, we aim to yield clean intermediate states for refinement. Following (Wang et al., 2023), to obtain "clean" samples, estimate Xo from and the predicted noise Za (), We denote the estimated image at time-step as Xp t, which can be formulated as
disturbances. Additionally, natural signals (such as images) generally exhibit low-pass characteristics, meaning that the low-frequency power spectrum components are relatively large. Therefore, we opt to retain this portion of the am- plitude spectrum and replace the low-frequency amplitude spectrum components of the estimated image Xnj= accord- ingly each time-step. We first construct filter H (u, v) for amplitude spectrum as follows:
HA(U, v) = {(d
1, D(u, < DA 0, D(u, > DA
(10)
Xoj+ Vat
(xi Zo t-v
(7)
where D is hyper- pyper-parameter, D(u, v) represents the dis- tance from point (u, v) to the center of the W frequency rectangle the frequency domain, which also the magni- tude of the frequency. The formula is as follows:
where Zp neural network used by DDPM(Ho et al., 2020) to predict the noise for each time-step i, i.e., 6, Zo (x(,,,t), Then, we perform DCT on both the input image Xo and the estimated image Xoje decompose them into the amplitude spectrum and phase spectrum as follows:
D(u, v) [[u H/2)² + (v W/2)313 (11)
(Axo (u, v), Pxo (u, v)) = (x)),
(8)
With the filter HA defined above, frequency components of the estimated image's amplitude spectrum with the low-frequency components of the input sample's amplitude spectrum for each channel (Color im- ages are typically composed of three channels: RGB) as follows:
replace the low-
(Axore (u, v), Pxome (u, v)) (xo()))))
(9)
where Axo (u, v), Axo, ( (u, v) Px x0x( (u, v) and Px.,, (u, v) rep- resent the amplitude spectrum and phase spectrum of input image Xo and estimated image Xgjt, respectively. (u, v) denotes the coordinate at the frequency domain. The am- plitude spectrum reflects the energy distribution of various frequency components in the image. The phase spectrum contains the structural and shape information of the image.
Axo1i = Axole x (1 HA) + Axo x HA. (12)
Axpis represents the updated amplitude spectrum of the estimated image Xglt-
4.1. Amplitude Spectrum Exchange
4.2. Phase Spectrum Projection
Experimental reveals that low-frequency amplitude spec- trum components demonstrate significant robustness to ad- versarial perturbations, being almost unaffected by such
Different from the amplitude spectrum, the phase spectrum is affected by adversarial perturbations all frequency com-

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
ponents. Directly retaining the low-frequency phase spec- trum, which is less disturbed, will preserve the adversarial perturbations while also affecting the restoration of the high- frequency phase spectrum. Therefore, we choose to project the estimated image's low-frequency phase spectrum into a certain range of the input image's ' fow-frequency phase spectrum. First, We construct a filter Hp for phase spec- trum which the same as (10) but with different hyper- parameter Dp. Then, we update the phase spectrum of the sampled result as follows:
Algorithm 1 Sampling Process
Require: Sample Xadv. timestep E*.
1: x, N/ I)
2: for 1 1" ,...,, 1 do
3: Xolt - (x: (x tt/1 ass
yau
4:
(Axoji Pxol) = (xoje)))))
5:
(Axadu Pxadu) )= = DCT(Xxdu)
Amplitude Spectrum Exchange
7:
Axal: Axpl= x (1 HA) + Axo= x HA
8:
1/ Phase Spectrum Projection
9:
P Pxoli
Pp + Pxo x (1 Hp)
Pxole -Ip Pxo x HH)+ + Pxaje (1- - Hp); (13)
10:
// Next State Generation
PL
11:
ROj= = iDCT (Axoie Px..))
12: X,-1 ~ p(xc-1 [xt, x0
where II the projection operation. Pr. is the low-frequency phase spectrum and ó denotes the range within which we allow variations in the low-frequency phase spectrum of the estimated image Xoje-
13: end for
14: Output X0
This strategy can benefit from two aspects: 1) We can ex- tract coarse-grained lowffreyyyncy structural information while allowing it to vary within a certain range, enabling it to gradually align with the low-frequency structural informa- tion of natural images. 2) The coarse-graines low-frequency structural information can provide prior guidance for the recovery of sehhfrreuency information.
5. Experiment
5.1. Experimental Settings
Datasets and network architectures. Three datasets are utilized for evaluation: CIFAR-10 (Krizhevsky & Hinton, 2009), SVHN and ImageNet (Deng et al., 2009). Our re- sults are compared against several prominent defense tech- niques listed in the standardized benchmark RobustBench (Croce et al., 2021) for both CIFAR-10 10 and ImageNet, and we also examine various adversarial purification methods. For CIFAR-10, we employ two widely used classifier ar- chitectures: WideRes.Net-28- 10-10 and WideRessNet -0- 16 (Zagoruyko Komodakis, 2016). In the case of SVHN WideRes acts as the backbone, whereas ResNet- 50 (He et al., 2016) is utilized for ImageNet. Adversarial attack methods.
Overall, we aim to extract and retain information from the original clean image by focusing on frequencies that are less affected by adversarial perturbations, thereby maximizing the preservation of the original image's structure and con- tent, while also providing a correct prior for the restoration of high-freuuency information.
4.3. Next State Generation
With the updated amplitude spectrum Axos and phase spec- trum Px We combine Axor and Pxoge obtain their rep- resentation in the time domain through the inverse discrete Fourier transformation (iDCT) as follows:
evaluate strong adaptive attacks (Athalye et al., 2018; Tramer et al., 2020) against our approach and other adversarial purification methods. The well-known AutoAttack (Croce & Hein, 2020) is im- plemented under Eoo and E threat models. Furthermore, the projected gradient descent (PGD) attack (Madry et al., 2018) is assessed on our method, suggested in (Lee & Kim, 2023). To account for the randomness introduced by the diffusion and denoising processes, Expectation Over Trans- formation (EOT) (Athalye et al., 2018) is adapted for these adaptive attacks. Additionally, we employ the BPDA+EOT (Hill et al., 2021) attack to facilitate a fair comparison with other adversarial purification methods. Lastly, following the recommendations of (Lee & Kim, 2023), a surrogate pro- cess is utilized to derive the gradient of the reverse process for white-box attacks.
0 = iACT(Ax, Pro
(14)
As suggested in (Wang et al., 2023), the next state x,-1 can be sampled from joint distribution, which is formulated as:
Po(x &ojz) W(He(x;
(15)
where ph (X,, x y Va
v aai(1-au a1
1-ai XoIz +
1-a; x, and
of = phase spectrum and amplitude spectrum provided by the input image to guide the sampling process in each time- step f, we ultimately obtain the clean image dig with natural amplitude spectrum and phase spectrum. The complete algorithm process can refer to 4.3.
1- - Br By using the low- frequency priors of the 1-o,
Pre-trained Models. We utilize the unconditional CIFAR- 10 checkpoint of EDM supplied by NVIDIA (Karras et al., 2022) for the CIFAR-10 10 dataset. For the ImageNet experi- ments, we adopt the 256x256 unconditional diffusion check-
5

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Original
Adversarial
DifiPure t 0.1
DiflPure t' 0.2
REAP
Ours
Figure 3. Visualization of origianl clean images, adversarial images and purified images. The images purified by our method similar to the origianl clean images.
point from the guided-diffusion library. The pre-trained clas- sifier for CIFAR- 10 is obtained from RobustBench (Croce et al., 2021), whereas the classifier weights for ImageNet are sourced from the TorchVision library.
Table 1. Standard and robust accuracy of different Adversarial Training (AT) and Adversarial Purification (AP) methods against PGD and Auto &xx (c 8/255) CIFAR-10 half number of iterations for the attack due to the high computa- tional cost. indicates the requirement of extra data. The result with an underline indicates the second highest.
utilizes
Evaluation metrics. To evaluate the effectiveness de- fense methods, we employ two metries: standard accuracy, which is calculated on clean images, and robust accuracy, assessed adversarial examples. Given the significant computational expense associated with evaluating models against adaptive attacks, we randomly sample fixed subset of 512 images from the test set for robust evaluation, con- & Kim, 2023; Song et al., 2024: Lin et al., 2024; Bai al., 2024). In all experiments, report the mean and standard deviation across three runs to evaluate both standard and robust accuracy.
Robust Avc.
Type
Method
Stundard Acc.
AttoAttack
WideResNeet 28-
(Gowal 2021) 2021)
88.54
65.93
63.38
AT
(Gowal al., 2020)
87.51
66.01
62.76
(Pang 2022)
88.62
64.95
61.04
sistent with (Nie al., 2022;
(Yoon al., 2021)
85.
59.51+0.87
(Nic et al., 2022)
90.07=0.97
56.8440 59
63 13.60+0.81
(Loc & Kim, 2023)
90.1620.64
35.8240.59
70.47a1.53
AP
(Bai 2024)
91.41
49.22"
77.08
(Zollicoffer et al., 2025)
84.20
59.14
Implementation details. We adhere to the configurations outlined in (Lee & Kim, 2023). Diffusion-based purification methods are evaluated using the PGD attack with 200 update iterations, while BPDA and AutoAttack are assessed with 100 update iterations, except for ImageNet, which utilizes 20 iterations. The number of EOT is set to 20, and the step size is 0.007. For randomized defenses, such those in (Nie et al., 2022; Lee & Kim, 2023; Song et al., 2024; Bai et al., 2024), we employ the random version of Attack whereas the standard version used for static defenses.
(Lin 2024)
90.62
72.85
Ours
92.19 #0.33
59.3950079
77.35+2.14
10 and WideRessNet-7-116 Robust accuracy is evaluated under three types of attacks: BPDA+EOT, PGD, and AutoAttack. For (Gowal et al., 2021; 2020; Pang et al., 2022), they typically construct adversarial examples based on other attack methods for adversarial training. Focusing the &oo attack, illustrated in Table our method demonstrates significant advantage over other baselines when using WideResNet-28-11 as the backbone. Our method not only improves the standard accuracy metric by 0.78% but also enhances robust accuracy under PGD and AutoAttack attacks by 2.55% and 0.27%, respectively. When WideResNett70-11 used as the backbone, from
5.2. Experimental Results
CIFAR10 We perform extensive experiments on the CIFAR-10 dataset, comparing our method with other approaches using two model architectures: WideResNet-28-
6

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Table 2. Standard and robust accuracy of different Adversarial Training (AT) and Adversarial Purification (AP) methods against PGD and AutoAttack fox (c 8/255) on CIFAR- 10." TTe num- ber of iterations for the attack is half that of the other methods for less computational overhead. indicates the requirement extra data. The result with underline indicates the second highest.
Table 3. Standard and rohust accuracy against PGD and AutoAt- tack fz(c = 0.5) on CIFAR- 10. Adversarial Training (AT) and Adversarial Purification (AP) methods are evaluated. "The number of iterations for the attack is half that of the other methods for less computational overhead. indicates the requirement of extra data, retruiieeee
adopts WideResNNet34-111 10 as the backbone, with the same width but more layers than the default one. The result with an underline indicates the second highest.
Type
Method
Standard Ace.
Robust Acc. AutoAttack
PGD
WodeReeNett70-16
Type
Method
Standard Acc.
Robast Ace.
PGD
AutoAttack
(Rebulli al., 2021)*
92.22
69.97
66.56
(Gowal et al., 2020)
91.10
68.66
66.10
WideResNet 28. 10
(Giowal et at., 2021)
88.75
69.03
65.88
(Rebuffi al., 202
91.79
85 15.05
78.80 80
(Yoon et al., 2021)
86,76#1.15
37.11+1.55
60. 86
AT
(Augustin al., 2020y
93,96
86.14
78.79
(Nie et al., 2022)
90.4340.60 60
51.1340.87
66.0611.17
(Pang al., 2022y
90.93
83.75
77.24
(Lee & Kim, 2023)
90.5346.1
56.88&1.06
70.31:60.2
(Bai et al., 2024)
92.97
48.83*
79.10
(Yoon al., 2021)
66.66.60.1
73.32a0.76
79.5720.38
AP
(Zollicoffer al., 2025)
84.60
66.40
(Nie al., 2023)
91 |1111.00
19.45=1.16
81.7=0.84
(Zolicooffer et al., 2025)
86.90
59.20
(Lee Kim, 2023)
90. 90.16=0.66
83.59+0.88
86.48+0.35
(Lin et al., 2024)
91 .9
76.37
(Bai al., 2024)
91,41
86.
80.92
Ours
92.52+0.53
62.50+2.73
78.19+1.95
AP (Zallicoffeer et al., 2025)
84.40
77.90
(Zollicoffor al., 2025)
84,20
73.60
(Lin et al., 2024)
90.62
80:47
Ours
=0.33
87.89=1.17
89.06:2.43
table 2 can see that though method decreases the standard accuracy metric by 0.45%, our method enhances robust accuracy under PGD and AutoAttack attacks by 5.62% and 1.76%, respectively. We also assess the accuracy of our method and other baselines against the & attack. From Table 3, we observe that, When WideResNet-28. 10 is used as the backbone, Our method improves standard accuracy by 0.78%, and robust accuracy increases by 1.86% and 2.68%, respectively. As shown in Table 4 when WideResNet- is the backbone, our method outperforms other baselines, though decreasing by 0.45% in standard accuracy and by 3.62% and 4.25% in robust accu- racy under PGD and Auto/ttack, respectively. Additionally, we apply the BPDA+BOT attack, which approximates differentiabilityy. As shown in Table 5, Our method leads by 0.82% in Standard Accuracy and 0.64% in Robust Accuracy. To measure the degree of similarity between the purified samples and the original clean samples, We plot the distribution map of the purified images. As shown in Figure 4, our method yields a distribution of purified images that is the most similar to the original images when compared to other methods. In addition qualitative analysis, we also conduct some quantitative analyses. Here, We opt to utilize measures like DINO similarity (Caron et al., 2021; Oquab et al., 2024) and CLIP similarity (Radford et al.. 2021), which calculate the cosine similarity between embeddings extracted from two images. From Table 7, Our method achieves the highest similarity score, indicating that the images purified by our method are the most akin the original clean images. This is attributed to our strategy of appropriately preserving the inherent content and structural information of the images during the purification process. Overall, our method outperforms others, demonstrating its effectiveness in preserving semantic information while eliminating adversarial perturbations.
Table 4. Standard and robust accuracy against PGD and AutoAt- tack fz(e = 0.5) CIFAR-IO. 10. Adversarial Training (AT) and Adversarial Purification (AP) methods are evaluated. ("The num- ber of iterations for the attack is half that of other methods for less computational overhead. methods need extra data.) The result with an underline indicates the second highest.
Robust Ace.
Type
Method
Standard Acc.
PGD
Attack
WideResNet 70. 16
(Rehuffi et al., 2021>?
95.74
89.62
82.32
AT
(Gowal al., 2020)²
94,74
88.18
80.53
(Rebulfi et al., 2021)
92.41
86.24
80.42
(Yoen al., 2021)
86.76a1.15
75.66621.2 .229
80.4330.42
(Nie et al., 2022)
92.155
82.97+1.38
83.06+ 2.27
(Lee & Kim, 2023)
90.53+0.11
83.75+0.99 999
85. 55,59+0.61
AP
(Bai et 2024)
92,97
84.37*
83.01
et al., 2024)
91.99
81.35
Ours
92.52+0.53
87.8911.17
89.84=1.56
ImageNet We evaluate ResNet50 as the backbone of the ImageNet dataset under PGD attacks, consistent with (Nie et al., 2022; Lee & Kim, 2023; Bai et al., 2024). From Table 6, our method outperforms competitors by 0.53% in standard accuracy and 3.52% in robust accuracy, significantly exceeding the baseline. Additionally. the method from (Nie et al., 2022) achieves a standard accuracy of 73 96% and a robust accuracy of 40.63% when 1" = 0.2. For t = 0.3, standard accuracy decreases to 72.85% while robust accuracy increases 48.24%. However, at t" = 0.4, both standard accuracy and robust accuracy decline to 61.71% and 41.67%, respectively. This demonstrates that traditional methods increasingly destroy semantic information as increases, which aligns with our theoretical proof. In addition, we also visualize the purified images. From Figure 3, we observe that compared DiffPure and
7

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Table Standard and rohust accuracy against BPDA+FOT Loo 8/255) on CIFAR-10. The result with an underline indicates the second highest.
Method
Purification
Accuracy
Standard
Robust
WideResNet-28-10
(Song al., 2018)
Gibbs Update
(Yang al., 2019)
Mask+Rocon
94.00
15,00
(Hill et al., 2021)
EBM+LD
84.12
54.90
Orginal
On
(Yoon al., 2021)
DSM+LD
85.6640.551
66.91#1.75
et 2022)
Diffusion
90.0740.97
81,45&1.51
(Bai et al., 2024)
Diffusion
91.37+ 1.21
80.51+0.81
(Wang et al., 2022)
Diffusion
89.96440.44 44
75.59+1.26
(Song al., 2024)
Diffusion
89.88400335
88.4340.83
(Lee & Kim, 2023)
Dilfusion
90. 64
88 08,40000.888
Ours
Diffusion
92.19:0079
89.07=0.79
Table 6. Standard and robust accuracy against PGD le 4/255) on ImageNet. ResNet-50 used as the classifier. The result with an underline indicates the second highest.
REAP
Accuracy
Type
Mothod
Standard Robust
Figure 4. Joint distribution of the original images and purified im- ages. The distributions of the purified images by our method and the original images are the most similar.
ResNet-50
(Salman al., 2020)
63.86
39.11
AT
(Eagstrom ct al., 2019)
62.42
33.20
Wong al. (Wong al., 2020)
53.83
(E" 0.2) (Nic al., 2022)
23.96
40.63
(6' 0.3) (Nie al., 2022)
72.85
48.24
5.3. Ablation Study
(E" 0.4) (Nie al., 2022)
61.71
41.67
(Rai al., 2024)
70.41
41.70
To demonstrate the effectiveness of our method, we conduct comprehensive ablation experiments. We test the standard accuracy and robust accuracy. We divide our method into several parts: the first part is amplitude spectrum exchange (ASE), and the other part is phase spectrum project (PSP), The backbone we chose is WideResNNt-
AP
(Lee & Kim, 2023)
71.42
46.59
(Song al., 2024)
62.25
(Zollicoffer et ol., 2025)
73.98
56.54
Ours
71.88
59.77
and the at- tack method is AutoAttack with for and 8/255. After removing ASE and PSP, the method becomes the same as (Lee & Kim, 2023). However, due to the different number of time-step used in our method, there are some differences in the results compared the original method. All ablation studies are conducted under our predefined noise time-step to verify the effectiveness of each module. From the table 8, we can see that removing either ASE or PSP will affect standard accuracy and robust accuracy, proving that our improvement is effective.
REAP, our method achieves the best restoration effect. This attributed to the prior guidance provided by extracting the wwwffrquency phase spectrum and amplitude spectrum with smaller perturbations during the image restoration process, which allows for effective recovery of high-frequency details. Our method decreases standard accuracy by 2. %, but improves robust accuracy by 3.23%, respectively. With average accuracy improves by 0.55%. In general, these experiments can demonstrate the effectiveness of our approach.
Table 8. Standard accuracy and robust accuracy under different combinations. WideResNer28- 10 servers the backbone.
Table To measure the similarity between the purified image and the clean image, we calculated the DINO similarity and CLIP similarity between them.
ASE
PSP
Standard
Robust
Average
X
91.79
71.68
81.73
DiffPure REAP CGAP Ours
x
89.07
77.35
83.21
DINO
Standard
0.887
0.860
0.879
0.917
X
91.41
76.17
83.79
Robust
0,820
0.805
0.822
0,877
92.19
77.35
84.77
Standard
0.961
0,952
0.962
0.972
CLIP
Robust
0.949
0,946
0.954
0.956
8

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
6. Conclusion
European Conference on Computer Vision, pp. 228-245, 2020.
We analyze how adversarial perturbations disrupt the ampli- tude spectrum and phase spectrum from the perspective of the frequency domain. Additionally, we theoretically prove that current diffusion-basee adversarial purification methods excessively damage images. Based on these, we propose refining the low- wowffrquencyy amplitude spectrum and phase spectrum of the estimated image at each time-step during the reverse process. This approach not only preserves some structural information and image content but also guides the restoration of high-frequency components. However, both our approach and previous work still face challenges in accurately and quickly calculating gradients. This poses dif- ficulties in evaluating the effectiveness of defense methods.
Bai, M., Huang, W., Li, T., Wang, A., Gao, J., Caiafa, C. F, and Zhao. Q. Diffusion models demand contrastive guid- ance for adversarial purification to advance. In Interna- tional Conference on Machine Learning, pp. 2024.
Caron, M., Touvron, H., Misra, I., Jegou, H., Mairal, J., Bojanowski, P., and Joulin, A. Emerging properties in self-supervised vision transformers. In IEEE/CVF Inter- national Conference on Computer Vision, pp. 9650-9660, 2021.
Chen, Y., Ren, Q., and Yan, J. Rethinking and improving robustness of convolutional neural networks: a shapley value-based approach in frequency domain. Annual Con- ference on Neural Information Processing Systems, pp. 324-337, 2022.
Impact Statement
The work presented in this paper seeks to significantly advance the emerging field of machine learning security, specifically addressing vulnerabilities related to adversarial attacks. Recognizing that adversarial images pose severe threats to the integrity and reliability of machine learning models, we introduce a novel purification method leverag- ing diffusion models from a frequency domain perspective. Our approach uniquely exploits the frequency characteris- ties inherent to adversarial perturbations, enabling efficient and effective mitigation of malicious modifications input images. This purification process enhances the robustness of model predictions, safeguarding them against a broad spec- trum of adversarial strategies and ultimately improving their reliability and trustworthiness in real-world applications.
Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee at- tacks. In International Conference on Machine Learning, 2020.
pp.
Croce, F,, Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: a standardized adversarial robustness benchmark. In Annual Conference on Neural Information Processing Systems, 2021.
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In IEEE/CVF Computer Vision and Pattern Recognition, pp. 248-228822 255, 2009.
Acknowledge
This work was supported in part by the National Sci- ence and Technology Major Project 2022/D01 19204, in part by National Natural Science Foundation of China: 62236008, 62441232, U21B2038, U23B2051, 62122075 and 62376257, in part by Youth Innovation Promotion As- sociation CAS, in part by the Strategic Priority Research Program of the Chinese Academy of Sciences, Grant No. XDB0680201, in part by the Fundamental Research Funds for the Central Universities, in part by Xiaomi Young Tal- ents Program.
Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021.
Engstrom, L.,, Ilyas, A., Salman, H., Santurkar, S., and Tsipras, D. Robustness (python library). 2019. URL http:///htbbb.oomomdddaa////obb/
2019.
Gosch, L., Geisler, S., Sturm, D.., Charpentier, B., Zügner, D., and Günnemann, S. Adversarial training for graph neural networks: Pitfalls, solutions, and new directions. Annual Conference on Neural Information Processing Systems, pp. 58088-58112, 2023.
References
Athalye, A., Carlini, N., and Wagner, D. Obfuscated gra- dients give a false sense of security: Circumventing de- fenses to adversarial examples. In International Confer- ence on Machine Learning, pp. 274 283, 2018
Gowal, S., Qin, C., Uesato, J., Mann, T., and Kohli, P. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593, 2020.
Augustin, M., Meinke, A., and Hein, M. Adversarial robust- ness on in-and out out-iistritttion improves explainability. In

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T. A. Improving robustness using gen- erated data. Annual Conference on Neural Information Processing Systems, pp. 4218 4233,4223330000 2021.
adversarial robustness. arXiv preprint arXi::2111.0086, 2021.
Maiya, S. R., Ehrlich, M., Agarwal, V., Lim, S.-N., Gold- stein, T., and Shrivastava, A. Unifying the hanmonic analysis of adversarial attacks and robustness. In British Machine Vision Conference, pp. 620-621, 2023.
Han, S., Lin, C., Shen, C., and Wang, Q. Rethinking ad- versarial examples exploiting frequency- analysis. In Information and Communications Security, pp. 73-89, 2021.
Naseer, M., Khan, S., Hayat, M., Khan, F. S., and Porikli, F. A self-supervised approach for advensarial robustness. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 262-271, 2020.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 770- 778, 2016.
Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., and Anandkumar, A. Diffusion models for adversarial purifi- cation. In International Conference on Machine Learning, pp. 16805-16827, 2022.
Hill, M., Mitchell, J. C., and Zhu, S.-C. Stochastic security: Adversarial defense using long-run dynamics of energy- based models. International Conference on Learning Representations, 2021.
Oquab, M., Darcet, T., Moutakanni, T., Vo, H. V., Szafraniec, M., Khalidov, V., Fernandez, P., Haziza, D., Massa, F, El-Nouby, A., Assran, M., Ballas, N., Galuba, W., Howes, R., Huang, P.-Y., Li, S.-W., Misra, I., Rab- bat, M., Sharma, V., Synnaeve, G., Xu, H., Jégou, H., Mairal, J., Labatut, P., Joulin, A., and Bojanowski, Di- nov2: Learning robust visual features without supervision. Transactions on Machine Learning Research, 2024.
Ho. J., Jain, A., and Abbeel, P. Denoising diffusion proba- bilistic models. Annual Conference on Neural Informa- tion Processing Systems, pp. 6840-68511 2020.
Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K. Q. Densely connected convolutional networks. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4700-4708, 2017.
Pang, T., Lin, M., Yang, X., Zhu, J., and Yan, S. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning, pp. 17258-172777 2022.
Karras, T., Aittala, M., Aila, T., and Laine, S. Elucidating the design space of diffusion-basee generative models. Annual Conference Neural Information Processing 2022.
Systems, pp.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763, 2021.
Krizhevsky, A. and Hinton, G. Learning multiple layers of features from tiny images. 2009.
Lee, M. and Kim, D. Robust evaluation of diffusion-basee adversarial purification. In /EEE/CVF International Con- ference on Computer Vision, pp. 134-144, 2023.
Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg. F., Wiles, O., and Mann, T. A. Data augmentation can improve robustness. Annual Conference on Neural Information Processing Systems, pp. 29935-29948, 2021.
Lin, G., Li, C., Zhang, J., Tanaka, T., and Zhao, Q. Adver- sarial training purification (ATop): Advancing both robustness and generalization. In International Confer- ence on Learning Representations, 2024.
Richards, M. discrete fourier transform of windowed stationary white noise. Georgia Institute of Technology, Tech. Rep, 2013.
The discrete-time fourier transform and
Liu, Z., Mao, H., Wu, C.-Y.. Feichtenhofer, C., Darrell, T., and Xie, S. A convnet for the 2020s. In IEEE/CVF Computer Vision and Pallern Recognition, pp. 11976- 11986, 2022.
Salman, H., Ilyas, A., Engstrom, L., Kapoor, A., and Madry, A. Do adversarially robust imagenet models transfer better? Annual Conference on Neural Information Pro- cessing Systems, pp. 3533-3545, 2020.
Madry, A., Makelov, A., Schmidt, I.., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018
Samangouei, P., Kabkab, M.. and Chellappa, R. Defense- GAN: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Representations, 2018
Maiya, S. R., Ehrlich, M., Agarwal, V., Lim, S.-N., Gold- stein, T., and Shrivastava, A. frequency perspective of
10

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In Interna- tional Conference on Learning Representations, 2015.
Yoon, J., Hwang, S. and Lee, J. Adversarial purification with score-based generative models. In International Con- ference on Machine Learning, pp. 12062-12072, 2021.
Singh, D., Croce, F., and Hein, M. Revisiting adversarial training for imagenet: Architectures, training and gen- eralization across threat models. Annual Conference on Neural Information Processing Systems, 2024.
Zagoruyko, S. and Komodakis, N. Wide residual networks. In British Machine Vision Conference, 2016.
Zhou, D., Liu, T., Han, B., Wang, N., Peng, C., and Gao, X. Towards defending against adversarial examples via features. In International Conference on Machine Learning, pp. 12835-12845, 2021.
Song. K.. Lai, H., Pan, Y.. and Yin, J. Mimicdiffusion: Purifying ad adversarial perturbation via mimicking clean diffusion model. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 24665-24674, 2024.
Zhuang. J., Dvornek, N., Li, X., Tatikonda, S., Papademetris, X., and Duncan, J. Adaptive checkpoint adjoint method for gradient estimation in neural ode. In International Conference on Machine Learning, pp. 11639-11649, 2020.
Song, Y., Kim, T., Nowozin, S., Ermon, S., and Kushman, N. Pixeldefend: Leveraging generative models to un- derstand and defend against adversarial examples. In International Conference Learning Representations, pp. 24347-24356, 2018.
Zollicoffer, G., Vu, M. N., Nebgen, B., Castorena, J., Alexandrov, B., and Bhattarai, M. Lorid: Low-rank itera- tive diffusion for adversarial purification. In Proceedings of the AAAI Conference on Artificial Intelligence, pp.
Tang, L. and Zhang, L. Robust overfitting does matter: Test- time adversarial purification with fgsm. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.
23081 23089, 2025.
Tramer, F., Carlini, N., Brendel, W., and Madry, A. On adaptive attacks to adversarial example defenses. Annual Conference on Neural Information Processing Systems, pp. 1633- (633-1645,22 2020.
Wang, H., Wu, X., Huang, Z.,, and Xing, E. P. High- frequency component helps explain the generalization of convolutional neural networks. IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pp. 8684-8694. 2020.
Wang, J., Lyu, Z., Lin, D., Dai, B., and Fu, H. Guided dif- fusion model for adversarial purification. arXiv preprint arXiv:2205. 14969, 2022.
Wang, Y., Yu, J., and Zhang, Zero-shot image restoration using denoising diffusion null-space model. In Interna- tional Conference on Learning Representations, 2023.
Wang, Z., X., Zhu, H., and Xie, C. Revisiting adversarial training scale. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24675-24685, 2024.
Wong, E., Rice, L., and Kolter, J. Z. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020.
Yang. Y., Zhang, G., Katabi, D., and Xu, Z. Me-net: To- wards effective adversarial robustness with matrix estima- tion. In International Conference on Machine Learning. pp. 7025-7034, 2019.

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
A. More Experimental Results
A.I. Hyperparameter Sensitivity Analysis
In this section, we conduct hyperparameter sensitivity analysis, and our method includes three hyperparameters: one for controlling the retention of the amplitude spectrum A, and the other two for controlling the retention of the phase spectrum Dp and the projection range d. WideResNe128-10 serves as the classifier and we use PGD the attack method with eo and 8/255. From Figure
that the best performance is achieved when DA and Dr 2, 0.2.
100
95
Robust
88%
86%
Accuracy
Acc
84%
82%
80%
75
0.5
0.4
70
0.2
Da
0.1
Figure Robust Standard Accuracy under different thresholds Da (left) and under diffcrent combinations Dr and (right).
A.2. Adaptive Attack and Surrogate Process
Strong adaptive attacks (Athalye et al., 2018; Tramer et al., 2020) require computing full gradients of diffusion- adversarial purification methods. (Nie et al., 2022) proposes to use the adjoint method to compute full gradients of the reverse generative process. The adjoint method can compute the exact gradient in theory, but in practice, the adjoint relies on the performance of the numerical solver, whose performance becomes problematic in some cases as reported by (Zhuang al., 2020). Furthermore, the experiments conducted by (Lee & Kim, 2023) reveal that this method tends to overestimate the robustness of the defensive measures. As suggested in (Lee & Kim, 2023), they use the approximated gradient obtained from surrogate process. The surrogate process utilizes the fact that given the total amount of noise, we can denoise the same amount of noise with different numbers of denoising steps. Therefore, instead of using the entire denoising steps, we can mimic the original denoising process with fewer function calls, whose gradients can be obtained by prokapropgggting the forward and denosing process directly. To investigate whether our defense method is sensitive to the varying number of denoising steps in the surrogate process, we conducted an experimental analysis.
B. Discrete Fourier Transform
B.1. Preliminary
Given an image HW we perform a two-dimensional discrete Fourier transform (DCT) on it:
#-1 --1
x(u, u) DCT(CC(xxx))))
Σ
y)r
+W))
(16)
==0
where u = 0, 0, H. and v = 0,1,2.... W 1. When the transform x(u, v) is known, x(x, y) can be obtained using the inverse discrete Fourier transform (IDCT):
H-1W W
x(x.v) IDCT HW
Σ Σ X(u,
2xx
(17)
where x = 0,,,,, - and y = 0, 1, W 1 Since the two-dimensional discrete Fourier transform is usually a complex function, it can be represented in polar coordinates:
x(u, r) R(u, v) + ++JT (u, w) = [xu,, v) d((.)))
(18)
12

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
The method for calculating the amplitude is follows:
x(u, w)] = V (u, v) (2(,,
(19)
The method for calculating the phase is as follows:
Iuu, v)
ouu u) = arctan
(20)
R(u, v)
B.2. Property
(Linearity) For any two images x and y. where and are constants, then:
DCT(a x(x, b. y(r, v)) DCT(a x(x,,)) DCT(b- y(r, + -b-
(21)
= x(-x(u,, U) + b y(u,
C. Distribution of Adversarial Perturbations in the Frequency Domain
C.1. Experiment Settings
We decompose the images into amplitude spectrum and phase spectrum using the discrete Fourier transform, exploring how adversarial perturbations affect the amplitude spectrum and phase spectrum. Here, we randomly selected 512 images from the ImageNet dataset. We tested different attack methods, including AutoAttack (Croce & Hein, 2020), Projected Gradient Descent (PGD (Madry et al., 2018)) under loo and & nrom, well as various perturbation radii, using different models including ResNet50 (He et al., 2016), VGG19 (Simonyan & Zisserman, 2015), VIT 6 (Dosovitskiy et al., 2021), DenseNet 7 (Huang et al., 2017) and ConvNeXT 8 (Liu et al., 2022).
Given two images, one normal image x and one adversarial image Xadv, we decompose them into amplitude spectrum and phase spectrum using the discrete Fourier transform as follows:
x(u, (,, v) = DCT(x) = |x(u, v)le"dx(un))
(22)
Nadu (u,v) DCT((xad) Xadv (u, v (0
To investigate the variation of adversarial perturbations with frequency, calculate the differences of the amplitude spectrum and phase spectrum between the normal image and the adversarial image. For the amplitude spectrum, the amplitude spectrum of the image exhibits low-pass characteristics with respect to frequency, specifically:
x( b) oc v),
(23)
Typically, the parameter a is 3. Due the power-law distribution characteristic of the amplitude spectrum, we choose quantify the differences between the amplitude spectra of adversarial images and normal images using rhe absolute value of the percentage difference:
Xadu (u, v) - (x(u, v)]
E(
(24)
x (u, v)
The distribution of the phase spectrum is typically random and closely related the specific content of the image. Its values range from 0 to 2m. Therefore, we choose measure the differences between the phase spectra of adversarial images and nromal images using the absolute value of the differences:
E((ox(u, v) Oxaac (u, t)).
(25)
C.2. More Experiment Results
13

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Amplitude
Phase
2.5
Pg6-Inff4/255
Pgd Sop--inf-42255
Pgd-inn-82255
pgd-iint-8225
aa-linf-/2255
an-linf-8/255
as-linf-8/255
1.0
0.2
0.0
0.0
P96-12-0.5
0.20
Pg6-12-0.5
PQd-1-1
Pgd-2-1
a8-12-0.5
0.10
aa-12-0.5
0.0
0.00
150
Frequency
Frequency
Figure Vision Transformer serves as backbone. decompose image into amplitude spectrum (left) the phase spectrum (right), and calculate the differences between the adversarial images and the normal images, respectively.
Amplitude
Phase
pgd-lint-4/255
2gd-line-4/255
Pgd-linf-2255
Pgd-iin--/255
aH-inf-4/255
0.4
aa-linf-4/255
100
2-
38-lnf-8/255
2a-lint-8/255
0.2
25
50
100
125
150
25
50
100
125
150
0.4
0.20
pgd-2-0.5
PQd-2-1
Pgt-2-11
a2-12-1
0.15
aa-12-1
0.2
0.10
6.1
0.05
25
50
100
125
150
25
30
100
125
150
Frequency
Frequency
Figure DenseNet121 serves backbone. We decompose the image into the amplitude spectrum (left) and the phase spectrum (right). and calculate the differences between the adversarial images and the normal images, respectively.
Amplitude
Phase
rgd-iinf44225
4o9--inf-44255
pgd
Pgd
aa linf-4/255
0.4
aa lini ilnff4/2555
0.2
0
25
50
100
125
150
25
50
100
125
150
Pgd 12 0.5
P2d 0.5
0.3
0.20
aa-12-1
aa-12-1
0.2
38-12-0.5
aaH2-0.5
0.1
0.05
25
100
125
150
0
25
100
125
150
Frequency
Frequency
Figure 8. ConvNeXT serves as hackbone. We decompose the image into the amplitude spectrum (left) and the phase spectrum (right), and calculate the differences between the adversarial images and the normal images, respectively.
14

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
D. Proof
D.I. Proof Theorem 3.2.
Theorem D.1. (Modified Edition) The variance of the difference of amplitude at time-step between clean image Xo and noisy image X₁ at arbitrary coordinates (u, v) at frequency domain is as follows:
1-a; at.
(1-a,)
Var (ar(AA((u,))
(26)
2
16, v) Poi
The RHS is monotonically increasing with respect to t, This means that as increases, the amplitude spectrum of the original image at arbitrary coordinate (u, is increasingly disrupted by noise.
Proof. The forward process of DDPM (Ho et al., 2020) in the time domain is as follows:
Va v1 TCC.
(27)
where t denotes the time-step. Xo denotes the input clean image. ~ NN.. I) denotes the gaussian noise. To analyze the impact of noise on different frequency components, we transform the (27) from time domain into the frequency domain via discrete Fourier transform as follows:
DCT(x.) = DCT( + v1 a+t) =V,DDTT(x)) v1 or DC)(e),
(28)
To simplify the equation. We omit the DCT and use xo(u, u). X (u, and c(u, v) coordinate (u, v) at frequency daomain:
x1 u) va (u, v) -I- a,c(u,))
(29)
To demonstrate the forward process will damage the amplitude spectrum, in the following give the corresponding proof:
((xx(u,)))
v) vI vI- 2))
a.e( (u, 1) 20 (u, v) v }) E(| (u, 2)12 + ++v1 -
(30)
= [E(o, (o,,, )² + (1 - av),e(u, 0) + 2v a1 / He (xo(u, v) * e(u, u)*});
where, Re represents the real part and cu, u)* is the complex conjugate of c(u, v). The power spectral density of the noise flat, and the noise independent at different frequencies. Its mean is O, and the variance a constant (When the distribution follows standard normal distribution, the variance 1.):
E(e(u, r)) 0 E((e(u,)) v)13) o² =1
(31)
Therefore,
(1, E(Te/xo(u 2 + [))((, + -, v)*
au,xo
+) -1 E(((u,
(32)
T. (u, 2 (1 ãz),
x<(u, v) = -Vixxo(u, v) + v1 - axe(u, v))
ReeeVaaaoooo v)) + ReRRRe(V (u, v)) +i (an(Vaxx((u,))) w)) + Jml (V1 (u, v)))
(33)
( (w,))) )
L.((mmVvaxxa (u.v)), "
We can see that the means of the real part and the imaginary part are different, the variances are the same, and they independent of each other (Richards, 2013). Therefore, the amplitude (x,(u,, u)] follows a Rice distribution:
f(xxelu, v)]) xx(u, v)l 0²
exp (_ (u, (u, v)12 + v/2 To [2xe(1, 2)(K
(34)
20
σ²
15

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
With the assumption of SNR, R2 > 1, have:
0² (()x((,,))) v
(o, u)] + 1 az
(35)
2v
4 0 xo(u, (u, u)}'
The variance of the difference of amplitude at time-step between clean image Xo and noisy image x, is as follows:
Var(AA.(u, v)) = Var(Ix (u, o)] - (xo( v))
= Var(Ixi (u, u)l)
[U) v)(2) (1,
2 Tr. (o w){ = (1 -r) - (v +
ae 4 / xo(u, u)
(36)
(1 (T))) )²
2
16 X (u, Pa."
When SN R3 is sufficiently large, it is clearly that Var(A u)) monotonically decreasing with t.
D.2. Proof of Theorem 3.4.
Theorem D.2. According to Theorem 3.2. in (Nie et al., 2022) that L should be sufficiently small. Therefore, assume SNR, > 1. the variance of difference of phase Var (A v)) between input image and noisy image at arbitrary coordinates (u, v) at frequency domain is as follows:
Var (ar(AO((u,v))
(37)
SNR.
where signal to noise ratio (SNR) at time-step is defined as follows:
Va [o v)
SN v) = vi - (u,
(38)
Proof. The forward process of DDPM (Ho al., 2020) in the time domain is as follows:
x Va
are.
(39)
Where denotes the time-step. X, denotes the input clean image. e ~ N(,0 I) denotes the gaussian noise. To analyze the impact of noise on different frequency components, we transform the (27) from time domain into the frequency domain via discrete Fourier transform follows:
DCT(X:) = DCT(V + -I-ac
(40)
= =VT,DCT(x.) + vI 1a1-,,DCTT d,DCT()),
To simplify the equation. We omit the DCT and use xo(u, v). xi v) and eu, v) at coordinate (u, v) at frequency daomain:
x;(u, v) vārxo (u, v) + vI [,((u,)).
(41)
To demonstrate the forward process will damage the phase spectrum, in the following we give the corresponding proof:
X₂ (u, vārxo(u, u) + VI-acclu v)
V xo vile (o (wm)) + vI Ti Feleeu, (0.0))) (a.))
Siettxn (u,0) + (u.,))
(42)
Seetixn (1, (1+ (loe S
(1+
N
S (1))0 (1 + K)eld).
16

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
Here can get the difference between the phase of the original image Xo and the noisy image Xy²
A 0x (u, v) 4xo (u, v)
arg(1 (1 + K,e*0)
argg1 ( + (c()os( + isin())))
-arg(1 (1 + Kg cos (x) + ik, (Kis)(())
(43)
Reat
Imaginary
K,sin(o)
arccann
1 Kr cos
(Ø) 1+ K2 cos(o)
The last line of the formula is obtained through first-order Taylor expansion The phase spectrum of Gaussian noise is uniformly distributed in the range [0,2m]]
{
if &. < 2n otherwise
p(o.)
{0- 0
(44)
Due to the periodicity of phase, the range of de (u, The expectation of the phase difference is as follows:
2x (u, v) is also uniformly distributed in the range [0,2
E(AO) = E( K(sin(
1 + K, cos(Ø)
2m K2sin(0)
(45)
db
2T Jo 1 K₁ cos
0.
The Variance of the phase difference as follows:
Var(A0) F((20))) (E()0))²= =((A0)})
1
2T
K? (
(1 + K, cos (0))² de
2T
2m
2x
J
K₁ sin())
1 K,cos(
K, sin
K2cos(Ø)
2
1 + K, cos( dδ)
2π
+ K₁ cos(o) ④)
1
1
2n
1
dó
2m Jo
1 K, cos(Ø)
(46)
do - 2
2x
1 K2 cos(
x))
+00
2dl.
2xx
2m
1 K, T+t7
1 + 12
1
+00
2dl
2xx
K₁ + (1 K2)t²
1
arctan 11200 2nT)
2x
K?
1.
K?
17

---

Diffusion-based Adversarial Purification from the Perspective of the Frequency Domain
E. Visualization
E.1. ImageNet
We randomly select some images for visualization and chose DiffPure (Nie et al., 2022) and REAP (Lee & Kim, 2023) as the baselines. The attack method we use here PGD. And to make the visualization effect more pronounced, with the perturbation radius set to & = 12/ We plot the original images, the images after adversarial attacks, and the images purified using our method and other methods.
Original
Adversarial
DiftPure t' 0.1
DiffPure t" 0.2
REAP
Ours
Figure 9. Visualization of some randomly selected images from ImageNet dataset.
E.2. CIFAR10
We randomly select 64 images for visualization, choosing PGD as the attack method and setting the attack radius to Lo = 8/255.
18

---

Diffusion-basee Adversarial Purification from the Perspective of the Frequency Domain
Original
Adversarial
DiffPure t = 0.1
DiffPure t' 0.2
REAP
Ours
Figure Visualization some randomly selected images from ImageNet dataset.
Figure Visualization original images randomly selected from CIFAR10 dataset.
19

---

Diffusion-baser Adversarial Purification from the Perspective of the Frequency Domain
Figure 12. Visualization of adversarial images randomly selected from CIFARIO dataset.
Figure 13, Visualization of purified images randomly selected from CIFARI0 dataset.
20


Reviews:
[{"review_id": "0GAyEftsTo", "reviewer": "Reviewer_PfQW", "summary": "The paper proposes a novel adversarial purification method called FreqPure through frequency domain analysis and theoretical proof. The core idea of the method is to provide effective prior guidance for image purification by selectively retaining low-frequency spectral information. Experimental results demonstrate its significant advantages in eliminating adversarial perturbations while preserving semantic information.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your careful review and valuable feedback. We have made every effort to address your concerns. We believe that investigating diffusion model-based adversarial purification from a frequency-domain perspective enables further research.\n## Q1 Results for ASE+PSE without PSP\nThank you for your careful review. We indeed overlook this situation, and we have added the relevant experiments.  The complete ablation experiment table is as follows:\n|ASE    |PSP    |PSE   |Standard| Robust|\n| :---: | :---: | :---:|:---:   |:---:|\n|x      |x      |x     | 87.89  |53.52|\n|✓      |x      |x     |90.82  |87.11|\n|x      |x     |✓      | 94.14 |79.30|\n|x      |✓     | x     | 94.53 |80.47|\n|✓      |x     |✓      |93.36|87.50|\n|✓      |✓    |x       | 94.53 |88.28|\n\nThe last line, ASE+PSE, represents our complete method.\n## Q2 Meaning of t*\nIn our paper, $t^*$ does not refer to the optimal value but rather to a hyperparameter. The adversarial purification based on diffusion models can be roughly divided into two stages. The first stage is the forward process, where noise is added; the role of $t^*$  is to control the intensity of the noise added. The second stage is the denoising process. Here, we select three different values for DiffPure on the ImageNet dataset to explore the best performance of the method under different hyperparameters for comparison.\n## Q2 A detailed explanation of evaluation metrics\nThe purpose of adversarial purification is to remove the adversarial perturbations from adversarial samples so that these samples can be classified correctly as much as possible, while minimizing the impact on the classification of normal samples.\nLet normal samples be represented by $x$ and adversarial samples by $x_{\\text{adv}}$. The purification method is denoted as $\\text{AP}$, and the classifier is represented by $f$.   \nFor **Standard Accuracy**, we select a batch of normal samples and calculate whether the predicted labels $f(x)$ and $f(\\text{AP}(x))$ are consistent. The Standard Accuracy is then computed as the number of consistent predictions divided by the total number of normal samples.  \nFor **Robust Accuracy**, we select a batch of adversarial samples and calculate whether the predicted labels $f(x_{\\text{adv}})$ and $f(\\text{AP}(x_{\\text{adv}}))$ are consistent. The Robust Accuracy is computed as the number of consistent predictions divided by the total number of adversarial samples.\nThe number of samples we select is consistent with previous methods, and we conduct multiple rounds of experiments while calculating the errors.\n## Q3 Number of iterations about Baietal.,2024\nThe more iterations there are, the stronger the attack effect becomes, which leads to a decrease in robust accuracy. For the method proposed by Bai et al. (2024), the robust accuracy with half the number of iterations is lower than that of other methods. Therefore, the robust accuracy with the complete number of iterations will be even lower. In Table 1, the robust accuracy decreases from 49.22% to 48.92% under the full number of iterations.\n## Q4 Memory and computational overhead\nCompared to other methods, our approach introduces an additional discrete Fourier transform and inverse discrete Fourier transform only once at each time step, and the time introduced by the Fourier transform is almost negligible. The inference times and memory used for various methods are as follows:\n| Method| Lee&Kim,2023| Baietal.,2024|Nieetal.,2022|Ours|\n| :---: |  :---:      | :---:       |:---:         |:---: |\n| Time(s)  | 19.09±0.04  |6.43±0.13    |4.26±0.14     |4.29±0.09|\n| Memory(GB)|        0.56| 0.70        | 0.56      |   0.56|\n## Suggestions: false reference number\nThank you for noticing this issue. We have made corrections and will check and correct other typos.", "claims_and_evidence": "The article conducts comparative experiments with other methods, providing quantitative experimental data and visualization results.", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria can effectively address the current problem and provide a reasonable basis for measuring related applications.", "theoretical_claims": "The overall proof logic of the paper is rigorous, and the derivation process is reasonable. Specifically, for Theorem 3.2, \"the variance of the difference of amplitude at time-step t between the clean image x0​ and the noisy image xt​\" is provided with a complete derivation process in the appendix. This indicates that the authors have provided a detailed and rigorous explanation of the proof for Theorem 3.2, ensuring its correctness and reliability.", "experimental_designs_or_analyses": "I reviewed the main experimental results, ablation experiments, and supplementary experiments in the appendix. The experimental setup follows the settings of previous work. However, in the ablation experiments, I am puzzled as to why the results of ASE+PSE without PSP are not included.", "relation_to_broader_scientific_literature": "The method proposed in this paper decomposes images into amplitude and phase spectra and explores how to perform image restoration on adversarial images. It represents another approach to improving model robustness besides adversarial training.", "essential_references_not_discussed": "The key contribution of the paper is proposing a purification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. The approach from the frequency domain is a novel perspective, and the authors provide mathematical proofs for its rationality and effectiveness.", "other_strengths_and_weaknesses": "Strengths:\n(1) This paper analyzes the gap between adversarial images and original images from the frequency domain perspective, and provides derivations and proofs of the related formulas.\n(2) In the experiments, the proposed method shows significant improvements over the baselines, demonstrating its effectiveness.\n(3) Extensive visualization results effectively confirm that the purified images are closer to the original images.\nWeaknesses:\nSome details in the experimental setup and ablation studies are not clearly explained.", "other_comments_or_suggestions": "In line 256, you intended to reference ​Algorithm 1 in Section 4.3, but the PDF displays ​4.3. Please verify whether the reference number is correct.", "questions_for_authors": "(1) In the ablation study, the results for ASE+PSE without PSP are not included.\nTo strengthen the validity of the conclusions, the ablation study should include a comparison of ASE+PSE without PSP.\n(2) Regarding the experimental setup, in Algorithm 1, t = t*, …, 1 is mentioned, while in the experiments, values like t* = 0.2, t* = 0.3, and t* = 0.4 are used. This creates confusion for readers about the specific meaning of t*.\nAdditionally, the evaluation metrics, Standard Acc and Robust Acc, are not clearly defined. While it is mentioned that \"standard accuracy is calculated on clean images, and robust accuracy is assessed on adversarial examples,\" a more detailed explanation of how these metrics are computed and their significance would improve clarity.\n(3) In the experimental tables, one baseline method uses only half the number of iterations due to computational overhead. However, the number of iterations is a critical factor for PGD, and reducing it by half may weaken the strength of the PGD attack, leading to an unfair comparison of Robust Acc.\nTo address this, either a reasonable explanation should be provided for the reduced iterations, or experimental data with the same number of iterations should be included to ensure a fair comparison.\n(4) While the method’s effectiveness is demonstrated in terms of Standard and Robust Acc, it is also important to evaluate the efficiency of the proposed method.\nA comparison with other methods in terms of memory and computational overhead would be a valuable addition to the experimental section.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Dt9uSIGH2R", "reviewer": "Reviewer_22XE", "summary": "The paper focuses on adversarial defense methods, particularly addressing challenges in accurately and quickly calculating gradients, which is crucial for evaluating the effectiveness of defense mechanisms. The authors propose a method that significantly outperforms other approaches in terms of both standard and robust accuracy. The paper also explores the sensitivity of their defense method to the number of denoising steps in the surrogate process, providing experimental analysis to support their findings.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable feedback, which will enhance the integrity of our paper. To address your concerns, we have provided additional theoretical proofs and experiments. We sincerely hope our response resolves the concerns raised, and we would greatly appreciate reconsideration of the score.\n## W1&Q1 Computational Efficiency\nAdversarial purification is a test-time defense that involves no training process, only an inference process. For example, for the ImageNet and CIFAR-10 datasets, we directly use the pre-trained weights of the corresponding diffusion models. In terms of inference time, our approach requires just one additional DFT/IDFT pair per time step, with minimal computational impact as the Fourier transform operations contribute negligible overhead. The inference time for various methods are as follows:\n| Method| Lee&Kim,2023| Baietal.,2024|Nieetal.,2022|Ours|\n| :---: |  :---:      | :---:       |:---:         |:---:|\n| Time(s)  | 19.09±0.04  |6.43±0.13    |4.26±0.14     |4.29±0.09|\n## W2 Theoretical Proof\nWe provide a simple proof regarding how adversarial perturbations primarily disrupt the high-frequency components of an image.  \nThe original image is denoted as $x$,  the adversarial perturbation as $\\delta$ and $F$ represents the Fast Fourier Transform.  \nThe power spectrum characteristics of natural images follow the distribution as follows, where $\\alpha>1$:\n$$\n    |F_x(w)|^2\\propto \\frac{1}{w^{\\alpha}}\\\\\n$$\nThe definition of the noise to signal ratio (NSR) is as follows:\n$$\n    NSR(w)=\\frac{|F_{\\delta(w)}|^2}{|F_x(w)|^2}\n$$\nCombining the above two formulas leads to the following relation:\n$$\n    NSR(w)\\propto w^{\\alpha}|F_{\\delta}(w)|^2\n$$\nWe choose $\\alpha=2$ , and we assume that the attack objective is to maximize the NSR:\n$$\n\\max\\sum_{w}NSR(w)=\\max\\sum_{w} w^{2}|F_{\\delta}(w)|^2  \n$$\n The above optimization objective should be satisfied when it is maximized:\n$$\n    |F_{\\delta}(w)|^2\\propto w^2\n$$\nWe find that the power of the perturbation in the frequency domain is proportional to the square of the frequency, meaning that the perturbation tends to disrupt the high-frequency information of the image.\n## Q2  A principled way to select optimal hyperparameters\nWe first observe Figure 1 to determine the approximate range where adversarial perturbations cause minimal damage. Within this range, for smaller datasets, we tend to use grid search to find the optimal hyperparameters. For larger datasets, such as ImageNet, we proportionally expand the optimal hyperparameters found on the smaller datasets to search for the optimal hyperparameters.\nSpecifically, directly multiply by 2 or 3 at the same time and then perform a grid search around it.\n## Q3 Generalization to real-world scenarios\nTo demonstrate the generalizability of our method, we conduct relevant experiments in the context of adversarial patch. The method for constructing adversarial patch is described in [1]. The dataset is ImageNet, and the classifier is ResNet50. Since different attack methods do not affect standard accuracy, we only test robust accuracy. The results are as follows:\n| Method| Lee&Kim,2023| Baietal.,2024|Nieetal.,2022|Ours|\n| :---:          |  :---:      | :---:       |:---:         |:---:|\n| Robust Acc(%)  |74.219 |82.812    |78.906              |83.594|    \n\n[1] Brown T B, Mané D, Roy A, et al. Adversarial patch[J]. arXiv preprint arXiv:1712.09665, 2017.", "claims_and_evidence": "Yes, the claims made in the submission appear to be supported by clear and convincing evidence.", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "The paper extends the scientific literature by combining insights from training-based and diffusion-based purification methods while introducing a frequency domain perspective to enhance robustness against adversarial attacks. This aligns with and advances prior findings in the field.", "essential_references_not_discussed": "The references cited in the paper appear to be adequate for supporting the key contributions and findings.", "other_strengths_and_weaknesses": "## Strenghts\n\n1. This paper addresses a critical challenge in adversarial defense: improving both standard accuracy and robust accuracy against adversarial attacks. The experimental results show substantial improvements, such as a 15.04% increase in standard accuracy and a 41.01% increase in robust accuracy on the SVHN dataset, which is a notable advancement over existing methods.\n2. The paper is well-structured and clearly presents its methodology, experiments, and results. \n3. The paper provides extensive experimental validation across multiple datasets and attack scenarios, demonstrating the robustness and generalizability of the proposed method. \n\n## Weaknesses\n\n1. The paper demonstrates improvements in adversarial robustness, but there is limited discussion on computational efficiency. Since diffusion-based models are already computationally expensive, adding frequency-domain modifications might introduce further overhead.\n2. Some theoretical claims, while backed by empirical observations, could benefit from more formal proofs (e.g., The assumption that low-frequency components are less affected by adversarial perturbations is based on empirical findings, but no rigorous theoretical proof is provided).", "other_comments_or_suggestions": "See weaknesses.", "questions_for_authors": "1. Could the authors elaborate on the computational efficiency of the proposed method, particularly in terms of training and inference time compared to existing methods?\n2. Can the authors provide a principled way to select optimal hyperparameters for different datasets or attack settings?\n3. Does the method generalize well to real-world scenarios, such as adversarial examples crafted under distribution shifts or physical-world attacks (e.g., adversarial patches)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "8zc8i354k9", "reviewer": "Reviewer_EkQr", "summary": "This study discovered that the damage caused by adversarial perturbations tends to increase monotonically with the rise in frequency. Nevertheless, existing purification efforts impact both low-frequency and high-frequency components. Based on this finding, this study retains the low-frequency information of the input image in the frequency domain of x0|t in the reverse phase and restores x_{t-1} using it. Experiments have confirmed that this approach can effectively enhance the performance of current purification.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive feedback, which will enhance the completeness and persuasiveness of our article.\n## Claims And Evidence\nFigure 1 shows the extent of damage caused by adversarial perturbations to the phase spectrum and amplitude spectrum of images at different frequency components. The vertical axis represents the difference between the amplitude spectrum and phase spectrum of original clean samples and adversarial samples. It is not the Var mentioned in Section 3. To illustrate our theory in Section 3 more intuitively, we conduct experiments using Var as the vertical coordinate, and we provide the experimental results from low frequency to high frequency: (https://bashify.io/i/tBXTqh). These results are consistent with our theoretical analysis. Additionally, we find that the phase spectrum is more easily damaged compared to the amplitude spectrum, indicating the importance of preserving the phase spectrum during the purification process. Regarding final purification damage and attack damage of diffusion, we calculate the mean of different frequency variations for some samples. The experimental results are as follows: (https://bashify.io/i/CQpvZD). We observe that the trends of attack damage of diffusion and purification damage are consistent, which also supports our claims.\n## Different experimental conclusions\nWe cite this paper in the second paragraph of the Introduction and briefly claim the differences between these methods and ours. Here, we elaborate on the distinctions between this paper and our method. First, there is a difference in the measurement approach. This paper defines a Perturbation Gradients $\\frac{dy}{d\\delta}$ and observes its variation with frequency using the **DCT** decomposition. Therefore, more accurately, the conclusion of this paper should be that Perturbation Gradients are neither high frequency nor low frequency phenomena, while we directly measure the differences between the amplitude and phase spectrum values of adversarial samples in the frequency domain and those of normal samples. Additionally, the decomposition method we use is the **DFT**, which can directly compute the phase spectrum of images. The importance of the phase spectrum has been validated in many papers, such as  (Chen et al., CVPR2021) and (Zhou et al., ICML2023).\n## Monotonicity of Equation 3\nThe RHS being monotonically decreasing requires both coefficients to be greater than 0. However, under the assumptions we derived, the coefficient of the first term is less than 0. However, this assumption is somewhat strong, so we re-derive part of the conclusions in the proof. Specifically, we re-derive the first moment of the amplitude spectrum:\n$$\n    \\mathbf{x}_t(u,v) = \\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)+\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v)=\n\\underbrace{\\mathfrak{R}\\mathfrak{e}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v))+\\mathfrak{R}\\mathfrak{e}(\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v))}_R+i\\underbrace{(\\mathfrak{I}\\mathfrak{m}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v))+\\mathfrak{I}\\mathfrak{m}(\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v)))}_I\n$$\n$R\\sim\\mathcal{N}(\\mathfrak{R}\\mathfrak{e}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)),\\frac{1-\\overline{\\alpha}_t}{2})$ and $I\\sim\\mathcal{N}(\\mathfrak{I}\\mathfrak{m}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)),\\frac{1-\\overline{\\alpha}_t}{2})$.\nWe can see that the means of the real part and the imaginary part are different, the variances are the same, and they are independent of each other. Therefore, the amplitude $|\\mathbf{x}_t(u,v)|$ follows a **Rice distribution**. \"Therefore, we can utilize some known conclusions.With the assumption of $SNR_t>1$ in the Theorem 3.4. We can obtain the following conclusions：\n$$\n    \\mathbb{E}(|\\mathbf{x}_t(u,v)|)\\approx \\nu+\\frac{\\sigma^2}{2\\nu}=\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)| + \\frac{1-\\overline{\\alpha}_t}{4\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)|}\n$$\nFor $\\mathbb{E}(|\\mathbf{x}_t(u,v)|^2)$ we still use the conclusion derived from Equation 40. We re-derive $Var(\\Delta A_t(u,v))$as follows:\n$$\n    \\begin{aligned}\n        Var(\\Delta A_t(u,v))\n        &\\approx \\overline{\\alpha}_t |\\mathbf{x}_0(u,v)|^2+(1-\\overline{\\alpha}_t) + (\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)| + \\frac{1-\\overline{\\alpha}_t}{4\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)|})^2\\\\\n        &=\\frac{1-\\overline{\\alpha}_t}{2} -\\frac{(1-\\overline{\\alpha}_t)^2}{16|\\mathbf{x}_0(u,v)|^2\\overline{\\alpha}_t}\n    \\end{aligned}\n$$\nIt is clear that the RHS is monotonically increasing with respect to $t$.\n## Discussion\nThe characteristics of adversarial perturbations in the frequency domain are that the values of high-frequency components are greater than those of low-frequency components. Diffusion perturbations are normal Gaussian noise, and their amplitude and phase spectrum distributions in frequency domain conform to a normal distribution.\n## Missing Reference\nWe will add them in our paper.", "claims_and_evidence": "The work provides sufficient theoretical or experimental support for each theory and viewpoint. Among them, I have some doubts about the experiment in Figure 1. How does the vertical axis of this graph reflect this damage? Is it the Var calculated in Section 3? If they use aligned Var for evaluation, can they plot the final purification damage and attack damage of diffusion at the same time? This will prove the author's point more intuitively than theoretical arguments. If it is not an aligned evaluation criterion, can the author make the comparison as described above?", "methods_and_evaluation_criteria": "The evaluation method used in this work is a commonly used evaluation strategy for purification and meets the experimental requirements.", "theoretical_claims": "1. Regarding the author's assertion that adversarial perturbations “increase monotonically” in the frequency domain, it is noted that the article [1] advances a perspective: “We demonstrate that adversarial examples are neither high frequency nor low frequency phenomena.” Does This present a contradiction to this work's view. How does the author reconcile these disparate views and phenomena?\n[1] Maiya S R, Ehrlich M, Agarwal V, et al. A frequency perspective of adversarial robustness[J]. arXiv preprint arXiv:2111.00861, 2021.\n\n2. Var in Equation 3 appears to be monotonically decreasing with respect to t, because it has a linear relationship with sqrt(alpha_t) and alpha_t, and alpha_t monotonically decreases with respect to t. This does not match the author's relationship, so please check and explain.", "experimental_designs_or_analyses": "The experimental analysis of this paper is effective and reasonable", "relation_to_broader_scientific_literature": "The authors' findings on the characteristics of adversarial attacks in the frequency domain may be generalizable and may guide a wide range of purification or AT learning processes.", "essential_references_not_discussed": "There are some missing references on both diffusion-model based adversarial robustness:\n\n[1] Zhang J, Dong P, Chen Y, et al. Random Sampling for Diffusion-based Adversarial Purification[J]. arXiv preprint arXiv:2411.18956, 2024.\n\n[2] Maiya S R, Ehrlich M, Agarwal V, et al. A frequency perspective of adversarial robustness[J]. arXiv preprint arXiv:2111.00861, 2021.\n\n[3] Chen H, Dong Y, Wang Z, et al. Robust classification via a single diffusion model[J]. arXiv preprint arXiv:2305.15241, 2023.\n\n[4] Mei H, Dong M, Xu C. Efficient Image-to-Image Diffusion Classifier for Adversarial Robustness[J]. arXiv preprint arXiv:2408.08502, 2024.\n\nAmong them, paper [1] is also an optimization algorithm for diffusion purification, and paper [2] also discusses the characteristics of adversarial attacks in the frequency domain. Papers [3] and [4] show another possibility of using diffusion models to improve adversarial robustness. Adding these works can more comprehensively demonstrate the research progress in this field.", "other_strengths_and_weaknesses": "The paper's discussion of the ideas, method and its structure are clear.\nThis method has a significant improvement in performance on various data sets.", "other_comments_or_suggestions": "No other comments", "questions_for_authors": "A more detailed discussion of the frequency domain characteristics of adversarial perturbations and a comparison with diffusion perturbations.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AAZ7IpHt8S", "reviewer": "Reviewer_HJhM", "summary": "The paper proposes FreqPure, a frequency-aware adversarial purification method that addresses the limitations of existing diffusion-based approaches by preserving critical semantic information during purification. Through frequency domain analysis, the authors demonstrate that adversarial perturbations disproportionately damage high-frequency components of both amplitude and phase spectra, while low-frequency components remain relatively intact. They theoretically prove that standard diffusion purification indiscriminately disrupts all frequencies, leading to excessive semantic loss. FreqPure mitigates this by (1) replacing low-frequency amplitude components of the estimated clean image with those from the adversarial input to retain content information, and (2) projecting low-frequency phase spectra into a perturbation-resistant range to preserve structural features. Extensive experiments on CIFAR-10, SVHN, and ImageNet show FreqPure outperforms state-of-the-art methods, achieving 31.44% higher robust accuracy against PGD attacks and 13.35% improvement against AutoAttack while maintaining superior visual fidelity, validated through DINO/CLIP similarity metrics. The work establishes frequency-domain manipulation as an effective strategy for balancing adversarial robustness and semantic preservation.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We greatly appreciate your responsible and meticulous review. Your valuable feedback will improve our work greatly.\n## Q1.1: Assumption of Theorem 3.2\nThis assumption is indeed somewhat strong, especially for the amplitude spectrum of low frequencies. Therefore, to eliminate this assumption, we re-derive the first moment of the amplitude spectrum, as detailed below:\n$$\n    \\mathbf{x}_t(u,v) = \\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)+\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v)=\n\\underbrace{\\mathfrak{R}\\mathfrak{e}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v))+\\mathfrak{R}\\mathfrak{e}(\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v))}_R+i\\underbrace{(\\mathfrak{I}\\mathfrak{m}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v))+\\mathfrak{I}\\mathfrak{m}(\\sqrt{1-\\overline{\\alpha}_t}\\mathbf{\\epsilon}(u,v)))}_I\n$$\n$R\\sim\\mathcal{N}(\\mathfrak{R}\\mathfrak{e}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)),\\frac{1-\\overline{\\alpha}_t}{2})$ and $I\\sim\\mathcal{N}(\\mathfrak{I}\\mathfrak{m}(\\sqrt{\\overline{\\alpha}_t}\\mathbf{x}_0(u,v)),\\frac{1-\\overline{\\alpha}_t}{2})$.\nWe can see that the means of the real part and the imaginary part are different, the variances are the same, and they are independent of each other. Therefore, the amplitude $|\\mathbf{x}_t(u,v)|$ follows a **Rice distribution**. \"Therefore, we can utilize some known conclusions.With the assumption of $SNR_t>1$ in the Theorem 3.4. We can obtain the following conclusions：\n$$\n    \\mathbb{E}(|\\mathbf{x}_t(u,v)|)\\approx \\nu+\\frac{\\sigma^2}{2\\nu}=\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)| + \\frac{1-\\overline{\\alpha}_t}{4\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)|}\n$$\nFor $\\mathbb{E}(|\\mathbf{x}_t(u,v)|^2)$ we still use the conclusion derived from Equation 40. We re-derive $Var(\\Delta A_t(u,v))$as follows:\n$$\n    \\begin{aligned}\n        Var(\\Delta A_t(u,v))\n        &\\approx \\overline{\\alpha}_t |\\mathbf{x}_0(u,v)|^2+(1-\\overline{\\alpha}_t) + (\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)| + \\frac{1-\\overline{\\alpha}_t}{4\\sqrt{\\overline{\\alpha}_t}|\\mathbf{x}_0(u,v)|})^2\\\\\n        &=\\frac{1-\\overline{\\alpha}_t}{2} -\\frac{(1-\\overline{\\alpha}_t)^2}{16|\\mathbf{x}_0(u,v)|^2\\overline{\\alpha}_t}\n    \\end{aligned}\n$$\nTherefore, our paper only has one assumption $SNR_t>1$.\n## Q1.2: Assumption of Theorem 3.4\nThe assumption $SNR_t>1$ is not strong. We plot a graph (https://bashify.io/i/Qn7ZX7) showing how $SNR_t$ changes with $t$, and it can be observed that the condition $SNR_t>1$ only occurs when $t=500$. In the experiment, for $l_{\\infty}=\\frac{8}{255}$ we choose \n$t=100$. This means that for attacks with a larger radius, this assumption can still be satisfied.\n## Q2: Frequency-Aware Attack Resilience\nThe attack methods used in our paper are all strong adaptive attacks, meaning that the attacker calculates the complete gradient of the defense system. This white-box attack has incorporated our strategy of retaining low frequencies into the gradient calculation. We test the generalization of our method using the code provided in paper: Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity. The result is as follows (https://bashify.io/i/dj9GYO)\n## Q3: Phase Projection vs. Alternatives\nCompared to the amplitude spectrum, the phase spectrum is more significantly affected by adversarial perturbations. Therefore, performing a projection operation can extract coarse-grained low-frequency phase information, while using a diffusion model can generate phase information that best fits the natural distribution within a specified range. Additionally, ablation experiments also demonstrate that directly replacing the phase spectrum is a suboptimal choice. To balance robustness vs overfitting, we use hyperparameter search to find the optimal parameter.\n## Q4: Hyperparameter Generalization\nThe hyperparameters exhibit a certain degree of generalization across datasets of the same size; for example, the parameters from the CIFAR-10 dataset can be transferred to the SVHN dataset. As for the ImageNet dataset, due to its larger size, the preserved frequencies must also be increased. We nearly double the values for $D_A$ and $D_P$, but we keep$\\delta$ unchanged because the range of phase spectrum variation is$[0,2\\pi]$, which is independent of the image size. Figure 5 shows the performance of suboptimal choices on the CIFAR-10 dataset; even with suboptimal results, our method still surpasses the state-of-the-art.\n## Q5: Perceptual Quality Metrics\nAdversarial purification is strictly a classification task and does not concern itself with whether it will introduce artifacts. Previous methods only evaluated experimental metrics such as Standard Accuracy and Robust Accuracy. We also calculate FID and LPIPS (https://bashify.io/i/ZYZsP5).\n## Q6: Unspecified Subset Size \nThe size of the subset is fixed and remains consistent with previous methods. Considering that the subset may vary, we select multiple subsets for the experiments and report the experimental errors.", "claims_and_evidence": "The claims in the submission are largely supported by evidence, though some aspects warrant further scrutiny. The theoretical analysis (Theorems 3.2 and 3.4) rigorously demonstrates that diffusion-based purification disrupts all frequency components monotonically, aligning with their critique of existing methods. Empirical validation across datasets (CIFAR-10/ImageNet) and attacks (PGD, AutoAttack) shows FreqPure’s superiority in robust accuracy (e.g., +31.44% over baselines), supported by ablation studies confirming the contributions of amplitude replacement and phase projection. However, the phase spectrum projection’s effectiveness is less conclusively proven: while low-frequency phase alignment is motivated intuitively, the paper lacks a direct causal link between phase manipulation and structural preservation. Additionally, sensitivity analysis for hyperparameters (e.g., $D_A$, $D_P$) is limited to fixed values, leaving robustness to parameter choices unclear. While visualizations and DINO/CLIP metrics suggest semantic preservation, quantitative measures of perceptual quality (e.g., LPIPS, FID) are absent. Overall, the core claims hold, but finer-grained evidence for phase-related mechanisms and parameter robustness would strengthen the argument.", "methods_and_evaluation_criteria": "The proposed methods and evaluation criteria are well-aligned with the problem of adversarial purification. The focus on frequency-domain manipulation (amplitude replacement and phase projection) directly addresses the core challenge of preserving low-frequency semantic content while removing high-frequency adversarial perturbations, which aligns with the paper’s theoretical insights about perturbation distribution. Benchmark datasets (CIFAR-10, ImageNet) and attacks (PGD, AutoAttack) are standard in adversarial robustness research, ensuring comparability. Metrics like robust accuracy and DINO/CLIP similarity appropriately measure defense effectiveness and semantic preservation. However, two limitations exist: (1) The evaluation lacks perceptual quality metrics (e.g., LPIPS, FID) to quantify visual fidelity beyond feature-space similarity; (2) While adaptive attacks (BPDA+EOT) are included, the paper does not fully address potential vulnerabilities to stronger frequency-aware attacks explicitly targeting the proposed components. Overall, the methodology and evaluation framework are sensible but could be strengthened with additional metrics and attack scenarios.", "theoretical_claims": "The paper’s Theorem 3.2 (amplitude spectrum disruption) and Theorem 3.4 (phase spectrum disruption) were reviewed for correctness. Theorem 3.2 derives a lower bound for the variance of amplitude differences, $Var(\\delta A_t)$, using inequalities (e.g., $E(∣x_t|\\leq\\sqrt{\\bar{a}_t}|x_0|+\\sqrt{2/\\pi}$) and monotonicity arguments. While the steps are mathematically sound under the assumption that $|x_0(u,v)|\\leq\\sqrt{(1+4\\bar{a}_t)/(8\\pi\\bar{a}_t)}-\\sqrt{1/(8\\pi\\bar{a}_t)$, this constraint is neither empirically validated nor guaranteed to hold for real images, potentially limiting the theorem’s practical relevance. Theorem 3.4 approximates phase variance via small-angle linearization ($arctan(z)\\approx z$) and integrates over uniformly distributed noise phase, yielding $Var(\\delta \\theta_t)\\approx 1/\\sqrt{1-1/SNR_t^2}-1$. While valid for high SNR ($SNR_t>1$), this approximation breaks down for larger perturbations (low SNR), which are common in adversarial settings. Key issues: (1) The bounded-amplitude assumption in Theorem 3.2 lacks empirical verification; (2) Theorem 3.4’s SNR-dependent validity is not experimentally tested for adversarial noise regimes. While the proofs are technically correct under their assumptions, their practical applicability to adversarial examples (which may violate these assumptions) remains partially unproven.", "experimental_designs_or_analyses": "The experimental design is largely sound but has notable limitations:\n- Attack Coverage: While evaluated against adaptive attacks (BPDA+EOT, PGD, AutoAttack), the paper does not test frequency-specific attacks that could exploit FreqPure’s reliance on low-frequency components, leaving a critical robustness gap.\n- Perceptual Metrics: DINO/CLIP similarity validates semantic preservation but omits human-aligned metrics (e.g., LPIPS, FID) to assess visual quality, which is crucial for purification tasks.\n- Ablation Study: The phase projection (PSP) is compared to phase exchange (PSE), but the rationale for choosing projection over other phase alignment strategies (e.g., regularization) is underexplored.\n- Hyperparameter Sensitivity: Analysis is limited to fixed $D_A=3,D_P=2,\\delta=0.2$ without testing robustness to parameter shifts across datasets or threat models.\n- Theoretical-Experimental Link: While theorems claim monotonic frequency disruption, experiments in Fig. 1 only show trends for adversarial (not purified) images, weakening the connection to FreqPure’s mechanism.\n- Sample Size: ImageNet evaluations use an unspecified subset size (common in robustness benchmarks), but reproducibility depends on clarifying this.\n\nOverall, the experiments support the core claims but leave open questions about generalization to frequency-aware attacks and perceptual quality.", "relation_to_broader_scientific_literature": "The paper’s contributions advance adversarial purification literature by bridging frequency-domain insights with diffusion-based defense mechanisms, building on three key prior findings:\n- Frequency Vulnerability of Adversarial Examples: Extending work by Chen et al. (2022) and Maiya et al. (2021), which showed adversarial perturbations disproportionately affect high-frequency components, the authors formalize this observation through quantitative amplitude/phase analysis and link it to diffusion purification’s limitations.\n- Diffusion-Based Purification: Improving upon Nie et al. (2022) and Wang et al. (2022), who used diffusion models without frequency awareness, FreqPure introduces explicit frequency constraints to mitigate semantic damage, aligning with broader efforts to incorporate domain-specific priors (e.g., image structure in SSP by Naseer et al., 2020).\n- Phase Spectrum Importance: While prior work (e.g., Oppenheim & Lim, 1981) established phase’s role in structural integrity, the paper innovatively applies this to adversarial defense by projecting low-frequency phase, akin to Zhou et al. (2021)’s invariant feature learning but in the frequency domain.\nBy unifying these threads, the work demonstrates how frequency-domain signal processing principles can address a core challenge in adversarial robustness—preserving semantics during purification—offering a new paradigm for defense mechanisms beyond pixel-space heuristics.", "essential_references_not_discussed": "None.", "other_strengths_and_weaknesses": "The paper’s originality lies in its novel integration of frequency-domain analysis with diffusion-based purification, a significant departure from pixel-space methods. The theoretical grounding (linking diffusion noise to frequency disruption) and practical innovation (amplitude replacement/phase projection) address a critical gap in adversarial defense: semantic preservation. Results demonstrate substantial empirical significance, with robust accuracy gains (+31% over SOTA) and high DINO/CLIP similarity, validating both defense strength and content retention. The clarity of the frequency-domain framework and ablation studies strengthens reproducibility.", "other_comments_or_suggestions": "None.", "questions_for_authors": "1. Assumption Validation for Theorems: \n- Theorem 3.2 assumes $|x_0(u,v)|\\leq\\sqrt{(1+4\\bar{a}_t)/(8\\pi\\bar{a}_t)}-\\sqrt{1/(8\\pi\\bar{a}_t)$. Do empirical measurements of $|x_0(u,v)|$ in natural images (e.g., CIFAR-10/ImageNet) confirm this bound holds? If not, does the theorem’s conclusion still hold under practical conditions?\n- Theorem 3.4 assumes $SNR_t>1$. How does this hold for adversarial examples, where perturbations are designed to maximize damage with minimal $\\ell_p$-norm? If adversarial noise violates this, does the phase variance approximation remain valid?\n\n2. Frequency-Aware Attack Resilience: The evaluation excludes attacks explicitly targeting frequency components. Would FreqPure remain robust if adversaries perturb low-frequency amplitude/phase intentionally?\n\n3. Phase Projection vs. Alternatives: The phase projection (Eq. 13) restricts low-frequency phase to $P_L+\\delta$. Why is projection preferable to direct replacement (as done for amplitude), and how does $\\delta$ balance robustness vs. overfitting to adversarial phase?\n\n4. Hyperparameter Generalization:\nThe hyperparameters $D_A$, $D_P, \\delta$ are fixed across datasets . Are these settings universally optimal, or do they require per-dataset tuning? How does performance degrade with suboptimal choices?\n\n5. Perceptual Quality Metrics: The paper uses DINO/CLIP similarity but omits perceptual metrics like LPIPS or FID. Do FreqPure’s purified images preserve human-aligned visual quality, or do they introduce artifacts (e.g., blurring) despite high feature similarity?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PqvYSWSa06", "reviewer": "Reviewer_e7tr", "summary": "This paper  explores a novel method for adversarial purification by analyzing the impact of adversarial perturbations on images in the frequency domain. The authors propose a method that selectively preserves low-frequency components of images during the purification process to minimize damage to semantic information while effectively removing adversarial perturbations.  Theoretical analysis and experimental validation on CIFAR-10, SVHN, and ImageNet demonstrate the effectiveness of this method.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for recognizing our paper. To the best of our knowledge, our paper is the first to improve the purification effect of diffusion models from the perspective of the frequency domain. Compared to pixel space, the frequency domain makes it easier to decouple the perturbed components from the unperturbed components. This significantly enhances the purification effect\n## Format of references \nThank you for noticing this issue. We will change the format uniformly as per your request to facilitate reading.\n## Experimental results on CLIP\nWe conduct a simple experiment on CLIP. We randomly select two classes from the ImageNet dataset, totaling 100 images, and use ['a photo of a xxx'] as the text to implement a simple zero-shot classification task with CLIP. The results are as follows:\n| Method| Lee&Kim,2023| Baietal.,2024|Nieetal.,2022|Ours|\n| :---:          |  :---:      | :---:       |:---:     |:---:|\n| Standard Acc(%)|   66          |    90         |    74      |  93   |  \n| Robust Acc(%)  |   65          |    86        |    70      |  91  |  \n\nOur method still performs the best, which demonstrates the generalizability of our approach.", "claims_and_evidence": "I think that the claims of this paper are well-supported both theoretically and experimentally.\nIn particular, the paper provides comprehensive theoretical proofs and visual explanations in the appendix.", "methods_and_evaluation_criteria": "This method is highly meaningful, as adversarial attacks pose a serious threat to visual neural networks. In particular, many recent vision-language models also exhibit significant vulnerability to adversarial examples, and directly training them for robustness is computationally expensive. Therefore, developing effective adversarial purification methods is also of great importance.", "theoretical_claims": "The authors argue that from a frequency perspective, an image can be decomposed into its amplitude spectrum and phase spectrum. For both types of spectra, the damage caused by adversarial perturbations increases monotonically with frequency. This suggests that we can extract the content and structural information of the original clean sample from the frequency components that are less affected by perturbations.\nI conduct a preliminary review of the paper’s proofs and did not find any obvious errors.", "experimental_designs_or_analyses": "The experiments, including those in the main text and the appendix, provide an in-depth analysis across multiple datasets. I believe these experiments sufficiently demonstrate the effectiveness of the proposed method.", "relation_to_broader_scientific_literature": "The related work section clearly establishes the position of this study within the field and provides readers with insights into recent advancements in the area.\nHowever, I notice that some references are not cited correctly. For example, when a reference itself serves as the subject of a sentence, it should be written as “Song et al. (2018) empirically demonstrates” rather than “(Song et al., 2018) empirically demonstrates.”", "essential_references_not_discussed": "I believe the main relevant works are all discussed in the paper.", "other_strengths_and_weaknesses": "Strengths:\n1. The experimental results show a significant improvements.\n2. The writing of this paper is very clear.\n\nWeaknesses:\n\nThe citations need to follow a more standardized format.", "other_comments_or_suggestions": "If preliminary experimental results on CLIP were included, it could enhance the broader applicability of this paper.", "questions_for_authors": "I have a positive overall opinion of this paper, with no obvious issues.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: Based on the observations that the diffusion-based adversarial purification methods attempt to drown adversarial perturbations into a part of isotropic noise through the forward process, and then recover the clean images through the reverse process, and that due to the lack of distribution information about adversarial perturbations in the pixel domain, it is often unavoidable to damage normal semantics, the authors in this paper turn to the frequency domain perspective, decomposing the image into amplitude spectrum and phase spectrum, and find that for both spectra, the damage caused by adversarial perturbations tends to increase monotonically with frequency, meaning that it is possible to extract the content and structural information of the original clean sample from the frequency components that are less damaged. Besides, the theoretical analysis indicates that existing purification methods indiscriminately damage all frequency components, leading to excessive damage to the image. 
Based on the above concerns, the authors propose a purification method that can eliminate adversarial perturbations while maximizing the preservation of the content and structure of the original image. 

During the review and rebuttal processes, all the four reviewers consistently give positive comments on this work, and the raised questions have been properly addressed.
Therefore, this paper is suggested to be accepted in ICML'25.
Decision: Accept (spotlight poster)