Enhancing Adversarial Robustness via Score-Based Optimization
Authors: Boya Zhang
Weijian Luo
Zhihua Zhang
Venue: NeurIPS 2023 poster (2023)
Keywords: Adversarial Defense
Adversarial Attack
Score-based Models
Diffusion Models

Abstract: Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce a novel adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data  in the direction guided by score-based priors. We conduct comprehensive experiments on multiple datasets, including CIFAR10, CIFAR100 and ImageNet. Our experimental results demonstrate that our approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.

Enhancing Adversarial Robustness via Score-Based Optimization
Boya Zhang
Weijian Luo
Zhihua Zhang 1
Abstract
Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce novel adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. We conduct comprehensive experiments multiple datasets, including 10, CIFAR 100 and ImageNet. Our experimental results demonstrate that approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.
Introduction
In recent years, there have been breakthrough performance improvements with deep neural net- works (DNNs), particularly in the realms of image classification, object detection, and semantic
segmentation, as evidenced by the works of [3 59
I3 51. However, DNNs have been shown to be easily deceived to produce incorrect predictions by simply adding human-imperceppiblee
53
19
perturbations to inputs. These perturbations are called adversarial attacks [14 36 38 7 resulting in
safety concerns. Therefore, studies of mitigating the impact of adversarial attacks on DNNs, which is referred to as adversarial defenses, are significant for AI safety.
Various strategies have been proposed in order to enhance the robustness of DNN classifiers against adversarial attacks. One of the most effective forms of adversarial defense is adversarial training [36 71 32 71 [44]. which involves training a classifier with both clean data and adversarial samples. However, adversarial training has its limitations as it necessitates prior knowledge of the specific attack method employed to generate adversarial examples, thus rendering it inadequate in handling previously unseen types adversarial attacks or corruptions.
is another form of promising defense that leverages standalone purification model eliminate adversarial signals before conduct- ing downstream classification tasks. The primary benefit of adversarial purification is that it obviates the need retrain the classifier, enabling adaptive defense against adversarial attacks at time. A Additionally, it showcases significant generalization ability in purifying wide range of adversarial attacks, without affecting pre-existing natural classifiers. The integration of adversarial purification models into AI systems necessitates minor adjustments, making it a viable approach to enhancing the robustness of DNN-based classifiers.
On the contrary, adversarial purification 488 68 52
28, 69
Acaddmyy for Advanced Interdisciplinary Studies; Peking University: zhangboya@pku. edu, en: I School of Mathematical Sciences; Peking University: luoweij ianestu pku. edu, en; School of Mathematical Sciences; Peking University; zhzhang@math, pku..uu edu. en;
37th Conference on Neural Information Processing Systems (NcurIPS 2023).

---

Optimization Loop
L- E-lllaanf
Scerr Netw
S+
(,
Figure 1: Illustration of our proposed adversarial defense framework.
Diffusion models 22 54 58]. also known as score-based generative models, have demonstrated state-of-the-art performance various applications, including image and audio generation (9 (0), molecule design [23] and text-to-image generation (3) Apart from their impressive generation ability, diffusion models have also exhibited the potential to improve the robustmess of neural networks against adversarial attacks. Specifically, they can function as adaptive test-time purification
models [40 16 63 66).
inffusion-based purification methods have shown great success in improving adversarial robustness, but still have their own limitations. For instance, they require careful selection of the appropriate hyper-pe para-meesssesss such as forward diffusion timestep [40] and guidance scale [63]. which can be challenging to tune practice. In addition, diffusion-based purification relies on the simulation of the underlying stochastic differential equation (SDE) solver. The reverse purification process requires iteratively denoising samples step by step, leading to heavy computational costs
In the hope of circumventing the aforementioned issues, we introduce a novel adversarial defense scheme that call ScoreOpt. Our key intuition to derive the posterior distribution of clean samples given a specific adversarial example. Then adversarial samples can be optimized towards the points that maximize the posterior distribution with gradient-based algorithms test time. The prior knowledge is provided by pre-trained diffusion models. Our defense is independent of base classifiers and applicable across different types of adversarial attacks, making it flexible enough across various domains of applications. The illustration of our method is presented in Figure
Our main contributions be summarized in three aspects as follows:
We propose a novel adversarial defense scheme that optimizes adversarial samples to reach the points with the local maximum likelihood of the posterior distribution that is defined by pre-trained
score-based priors.
We explore effective loss functions for the optimization process, introduce novel score regularizer and propose corresponding practical algorithms.
We conduct extensive experiments demonstrate that our method not only achieves start-of-the-art performance on various benchmarks but also improves the inference speed.
2
Preliminary
2.1 Score-based Diffusion Models
learn how transform complex data distributions relatively simple ones such as the Gaussian distribution, and vice versa. Diffusion models consist of two processes, forward process that adds Gaussian noise input x from Xo XT, and reverse generative process that gradually removes random noise from sample until it is fully denoised. For the continuous-tinn time diffusion models (see Song et [58) for more details and further discussions). we can use two SDEs to describe the above data-transformatio processes, respectively. The forward- time SDE is given by:
Score-based diffusion models 22 188
dx: f(x,, t)dt + g(f)dw;, t [0,T];
where f: DDD R and g + R are drift and diffusion coefficients respectively, w denotes the standard Wiener process. While new samples are generated by solving the reverse-time SDE:
dx, t(x,,t) Vt( log p: (x:)]dt g(t)dw,, [T,0];

---

where w defines the reverse-time Wiener process. The score function term Vx, log Pe (xt) is usually parameterized by time ceme-dependent neural network so (xx; t) and trained by score- soore-matching related
techniques 25 58
61
56
41
Diffusion Models Prior Recent studies have investigated the incorporation of additional constraint to condition diffusion models for high-dimensional data sampling. DDPM-PnP [17] pro- posed transforming diffusion models into plug-and-play priors, allowing for parameterized samples, and utilizing diffusion models as critics to optimize over image space. Building on the formulation in Graikos al. DreamFusion + further introduced more stable training process. The main idea is to leverage a pre-trained 2D image diffusion model as a prior for optimizing a parameterized 3D representation model. The resulting approach called score distillation sampling (SDS), which bypasses the computationally expensive backpropagation through the diffusion model itself by simply excluding the score-network Jacobian term from the diffusion model training loss. SDS uses the approximate gradient to train a parametric NeRF generator efficiently. Other works K5 37 62
followed similar approaches to extend SDS to the latent space of latent diffusion models 46
2.2 Diffusion-based Adversarial Purification
Diffusion models have also gained significant attention in the field of adversarial purification recently. They have been employed not only for empirical defenses against adversarial attacks [69] 40 63 66),
but also for enhancing certified robustness [3] 677. The unified procedure for applying diffusion models adversarial purification involves two processes. The forward process adds random Gaussian noise to the adversarial example within small diffusion timestep t", while the reverse process recov- ers clean images from the diffused samples by solving the reverse-time stochastic differential equation. Implementing the aforementioned forward-an and-denoise procedure, imperceptible adversarial signals can be effectively eliminated. Under certain conditions, the purified sample restores the original clean sample with high probability in theory 44 677.
However, diffusion- purification methods suffer from two main drawbacks. Firstly, their robustness performance heavily relies on the choice of the forward diffusion timestep, denoted t". Selecting an appropriate t" is crucial because excessive noise can lead to the removal of semantic information from the original example, while insufficient noise may fail to eliminate the adversarial perturbation effectively. Secondly, the reverse process of these methods involves sequentially applying the denoising operation from timestep to the previous timestep 1, which requires multiple deep network evaluations. contrast to previous diffusion- based purification methods, our optimization framework departs from the sequential step-by-step denoising procedure.
3 Methodology
In this section, we present our proposed adversarial defense scheme in detail. Our method is motivated by solving an optimization problem of adversarial samples to remove the applied attacks. Therefore, we start by formally formulating the optimization objective, followed by exploring effective loss functions and introducing two practical algorithms.
3.1 Problem Formulation
Our main idea formulate the adversarial defense as an optimization problem given the perturbed sample and the pre-trained prior, in which the solution to the optimization problem is the recovered original sample that we want. We regard the adversarial example x,, as a disturbed measurement of the original clean example
and we assume that the clean example is generated by prior probability distribution x ~ p(x). The posterior distribution of the original sample given the adversarial example is p(x(x,)) x p(x) p(xx) |x). The maximum posteriori estimator that maximizes the above conditional distribution given by:
* arg min p(x Xx)-
In this work, use the data distribution under pretrained diffusion models the prior px)...
3

---

3.2 Loss Functions for Optimization Process
Following Graikos al. [77. we introduce variational posterior ((x) to approximate the true posterior distribution p(x in the original optimization objective. The variational upper bound on the negative log-likelihood log p(Xx) is:
log p(x)) (x(x) 1- (xa[x)] ] + KL (g(x))lpo (x))
As shown in Song et al. [57 and Vahdat et al. [60], we can further obtain an upper bound on the
second Kullback-Letie Leibler (KL) divergence term between the target variational posterior distribution
((x) and the prior distribution defined by the pre-trained diffusion models Po(x):
KL [lpo (x)) < Be-e0..)-= (w((t) || (xx;t) Vx, log (xx
(3)
where w(t) /2t)3/2 2 is time-dependent weighting coefficient, x; x + dre denotes the forward diffusion process, dg is the pre-designed noise schedule, and &a represents the pre-trained diffusion models.
The simplest approximation to posterior using a point estimate, i.e., the introduced variational posterior g(x) satisfies the Dirac delta distribution g(x) 6(x x,). Thus, the above upper bound can be rewritten as:
E, B.- w(t) || (x,;t) Xx, log (x, (x,))
(4)
We simply use notation x instead of x,. throughout for convenience. The weighted denoising score matching objective in is also equivalent to the diffusion model training loss 44].
According to Tweedie's formula: /l= + Σ V log p(z), where denotes covariance matrix, we can obtain x X; + ofVx. log (xx).. Defining Do (xx:t) == x, + of (x,; t), the KI. term of our opimization objective converts to:
11- (t) [Do (x +.c
(5)
where (() = wt) Note that Dg can be used to estimate the denoised image directly, which is called one-shot denoiser 33 5)
In our work, we adopt the approach of setting ((t) for convenience and performance as in previous studies 17). Since we have no information about the conditional distribution pxx, we need a heuristic formulation for the first reconstruction term in (2) The simplest method is to initialize x by the advensarial sample x,, and use the loss in (5) to optimize over directly, eliminating the constraint term. The rationale behind this simplification that leading x. towards the mode of the (x) with the same ground truth class label makes it easier for the natural classifier to produce correct prediction. In this way, the loss function of our optimization process reduces to:
(x x, 0) E..-ur..). [IlDo (x + () x12]
Randomized smoothing techniques typically assume that the adversarial perturbation follows Gaussian distribution. Suppose the Gaussian assumption holds, we can instantiate the reconstruction term with the mean squared error (MSE) between and x., The optimization objective converts to the following MSE loss:
[IIDo (x + toge - x11 2 A x
LMSE (x, X., 0) EE
(7)
where À is weighting hyper parammte to balance the two loss terms.
3.2.1 Score Regularization Loss
However, both Diff and MSE optimizations have their own drawbacks. Regarding the Diff loss, the optimization process solely focuses on the score prior Po, and the update direction guided by pre-trained diffusion models leads the samples towards the modes of the prior, gradually losing the semantic information of the original samples. As illustrated Figure 2a with a sufficient number of optimization steps, both standard and robust accuracies decline significantly. On the other hand,

---

Sunbeer Clppiin Fober
(a) Robustness performance Diff' (b) Comparison between MSE and
(c) Comparison between MSE and
optimization using different number SR with different optimization itera- of optimization steps.
SR with different regularizer hyper- parameters.
tions.
Figure 2: Robustness performance comparison for Diff, MSE, and SR optimizations.
the MSE loss maintains high standard accuracy at the cost of large drop in robust accuracy. as depicted in Figure 2b) Furthermore, Figure demoonssratssss that the performance of MSE is highly
dependent the weighting hyper-parameter, which controls the intensity of the constraint term.
To address the above-mentiones issues, we propose to introduce hyperparameter-ffee score regular- ization (SR) loss:
LSR( (x, Xa. 0) = -...000.))).....w1100)
(8)
DDoo (x + +o1;tt x12 +Do (x + aii1t) Do (x. 0)22:
We use the introduced constraint to minimize the pixel-level distance between the denoised versions of the current sample and initial adversarial sample X The additional regularization term can be expanded as:
DD (x + o):1; Do (x. oxe2; 0) ||x- x, + of (sa (x:²() so (Xa,t 1))1
The SR loss encourages consistency with the original sample in terms of not only the pixel values but also the score function estimations at the given noise level o,. Since the two parts of SR loss correspond to the same noise magnitude t of score networks, there is need to introduce additional hyperparameter À as
Figure and increases, both the standard and robust accuracy converge stable values, with the latter remaining close to the optimal. In contrast to the MSE loss, the SR loss shows insensitivity to the weighting hyperparameter and significantly outperforms MSE, particularly for larger values of
and 2c demonstrate the effectiveness of the SR loss. As the number of optimization steps
3.3 Practical Algorithms
Algorithm 1: (ScoreOpt-O) Optimizing adversarial sample towards robustness with score-based
prior.
Input: Adversarial image Xa, pre-trained score-based diffusion model sp, noise level range [tmin, mmax), optimization iteration steps M, learning rate 1).
Xg = X,;
for i E 0. ...,. M do
Sample ~ U(Iminn lmaz), 61, 62 ~ N(0;T);
X4, x; 0:61:
Xa.1 + 0ze2;
Calculate the gradient grad of Diff loss (6) or SR loss 8 with respect to x;;
grad Vx, [IDo (x),;t) 1111 + Do (x),;;t) Do (x)1
X,+1 X; 17 grad;
end
return Purified image XM-
Noise Schedule The perturbation introduced by adversarial attacks often subtle and challenging for human perception. As result, our optimization loop does not necessarily incorporate the complete

---

noise levels employed by the original diffusion models, which generate images from pure random noise. fact, high noise levels will disrupt local structures and remove semantic information from the input image, leading to decrease in accuracy. Many previous studies have focused on lower noise levels to conduct image editing tasks. Therefore, we center our pre-designed noise schedule o around lower noise levels to preserve the details of the original image much as possible. Previous diffusion-based purification methods iteratively denoise the noisy image step by step (from X; to x,-1), following predetermined noise schedule. In contrast, our optimization process does not rely on a sequential denoising schedule. Instead, at each iteration, we have the flexibility to randomly select noise level. This approach allows to concurrently explore different noise levels during the optimization process.
Update Rule Given a noise level or we can utilize the aforementioned loss functions to compute the update direction x. Noting that the objectives correspond to one single random chosen noise magnitude, we propose an alternative update rule to further improve inference speed and robustness performance. We can use the loss gradient to optimize over x, directly and then obtain the denoised image x using one-shot denoising. The loss gradients with respect to x and are equivalent in our forward process formulation. Experiments in Section 4 demonstrate that our approach significantly improves one-shot denoising with only few optimization iterations. These two distinct update rules correspond to Algorithm I and Algorithm respectively. Both algorithms are straightforward, effective, and easy implement.
Algorithm 2: (ScoreOpt-N) Optimizing noisy adversarial samples and one-shot demoising. Input: Adversarial image Xa. pre-trained score-based diffusion model 8g. noise level range I max), optimization iteration steps M and N, learning rate 77.
X9 = Xx;
for i E O...,
do
1/ denotes the i-th iteration of the outer loop.
Sample ~ U(tmin maa)), E1 (0;1);
No.t = 0cc1
for j O....N1111
#j denotes the j-th iteration of the inner loop.
Sample 62 ~ (O;I);
Xa.: Xx 0.e2:
Calculate the gradient grad of Diff' loss (6) or SR loss 8 with respect to Xz.r
grad = Vxz,
x; [Do (x,,;;t) t) x, 112 + |D (x),tit - Do (xa, t) t)
X = X₁ - grad;
end
// One-shot denoising. X++1 = xN,, + of (xN,ii t);
end
return Purified image xas-
Experiments
This section presents the experimental evaluations conducted assess the robustness of our proposed methodology against different adversarial attacks, across range of datasets. Due to space constraints, we defer comprehensive details of the experimental settings, quantitative analysis, and additional results to the Appendix. For all experiments, we report the average results (and corresponding standard deviations) over trials.
4.1 Experimental Settings
Attacks In this work, we evaluate the robustness performance of adversarial defenses mainly on é,- norm bounded threat models. ep denotes the perturbation budget under the normr.. All of the attacks are based on Projected Gradient Descent (PGD) attack [36), commonly used gradient-based white- box attack. which iteratively perturbs input images along the direction of the gradient of the classifier

---

Table 1: Standard and robust accuracy against BPDA+EOT attack under lo 8/255) threat model on CIFAR 10, compared with other preprocessor-bassed adversarial defenses and adversarial training methods against white-box attacks.
Type
Architecture
Method
Standard (%)
Robust (%)
Avg. (%)
Base Classifier
WRN-28-10
95.32
0,0
Madry et al.
87.30
45.80
66.55
ResNet18
Zhang ct al.
71
84,90
45.80
65.35
Adversarial Training
Carmon et al. 6
89.67
63.10
76.39
WRN-28-10
Gowal et al.
15
89.48
64.08
77.28
ResNet18
Yang et al.
94.80
40.80
67.80
ResNet62
Song et al.
95.00
9.00
52.00
Hill et al. (00
84.
54.90
69.51
Yoon et al.
699
86, 14
70.01
78.08
Adversarial Purification
Wang et al.
63
93.50
79.83
86.67
WRN-28-10
Nic et al.
40
89.02
81,40
85.21
Ours(o)
90.78=00.40
0.26
86.82
Ours(n)
93.44:10..40
9.05
92.02
loss function and projects into some /pe-ball: 8 + 11, (6 + a sign (V, Loss(f(x a))) where represents a classifier.
Datasets and Baselines Three datasets are considered in our experiments: CIFARIO, CIFAR100, and ImageNet. Following previous works, the evaluation is conducted the test set of each dataset. We adopt two kinds of adversarial defenses for comparison: adversarial training methods and adversarial
purification methods, especially those also based diffusion models (69 40 63
In accordance
with the settings in Nie et al. [40], we conduct evaluations against strong adaptive attacks using fixed subset of 512 randomly sampled images.
Evaluation Metrics We leverage two evaluation metrics to assess the performance our proposed defense method: standard accuracy and robust accuracy. Standard accuracy measures the performance of adversarial defenses on clean data, while robust accuracy measures the classification performance on adversarial examples generated by various attacks.
Models We consider different architectures a fair comparison with previous works. We utilize the ResNet [19] and WideResNet ( (WRN) 770 backbones as our base classifiers. For CIFAR 10 and CIFAR 100 datasets, we employ WRN-28-I1 10 and WRN-70-1 16, the two most common architectures on adversarial benchmarks. For the ImageNet dataset, select WRN-50-2, ResNet-50, and ResNet- 152, which are extensively used in adversarial defenses. As for the pre-trained diffusion models, we incorporate two popular architectures, the elucidating diffusion model (EDM) [29] and the guided diffusion model [9]. The diffusion models and classifiers are trained independently on the same training dataset in prior studies.
4.2
Main Results
In this section, we validate our defense method against two strong adaptive attacks: BPDA+EOT and adaptive white-box attack, i.e., PGD+EOT. The evaluation results of transfer-based attacks are deferred to Appendix B
4.2.1 BPDA+EOT Attack
The combination of Backward Pass Differentiable Approximation (BPDA) [ with Expectation over Transformation (EOT) [2] is commonly used for evaluating randomized adversarial purification methods. In order to compare with other test-time purification models, follow the same settings in Hill et al. 20 with default hyperparameters for evaluation against BPDA+EOT attack. We conduct experiments under Lec 8/255) threat model CIFAR10 and CIFAR100 datasets. Our method achieves high robust accuracies, outperforming existing diffusion based purification methods by significant margin, while maintaining high standard accuracies.
CIFARIO Table shows the robustness performance against BPDA+EOT attack under the loo (E 8/255) threat models CIFAR10 dataset. Mark in parentheses denotes the practi-
7

---

Table 2: Standard accuracy and robust accuracy (%) against BPDA+EOT attack under 600 (E 8/255) threat model on the CIFAR100 dataset.
Diffusion-based Purification (step)
Ours
Accuracy
Hill et al. 20
Yoon et al. 669
20
80
(0)
Standard 51.66
60.66 39.72
61.52
67.77
69.92
67.58
66.99
69.92
75.98
Robust
26.10
40.03
47.66
48.83
48.05
47.85
66.99
65,43
Table 3: Standard and robust accuracy against PGD+EOT on CIFAR-10. Left: 6x 8/255);
Right: (e 0.5). Compared with adversarial training (AT) and purification (AP) methods.
Type
Method
Standard
Robust
Type
Method
Standard
Robust
WideResNet-28-10
WidcResNet-28-10
Pang et ul. 42
88.62
64.95
Sehwag
50
90.93
83.75
AT
Gowal et al. 15
88
65.10
AT
Rebufli al.
44
91.79
85.05
Gowal ct al. 16
87.51
66.01
Augustin et al.
93.96
86.14
Yoon al.
69
85.66
37.27
Yoon al. 669
85.66
74.26
AP
Nic al. Ours
40
90.07
51,25
AP
Nic ct al.
40
91.41
82.11
9..02.10.30
67.68.10.29
Ours
14.9911..09
86.78_.00 0.33
WideResNet-70-16
Wedt
Gowal et
16
88.75
69.03
Rebufii
92.41
86.24
AT
Wang et
92.97
72.46
AT
Wang 64
96,09
86.72
Yoon et al.
69
86.76
41.02
Yoon al.
75.90
AP
Nie al.
40
90.43
$7.03
AP
Nie 40
92.15
84.80
Ours
05018:00.09
0..48:+0.20
Ours
98.18++011
87.11
1111-0.01 0.01
cal method ScoreOpt-O in Algorithm [ and mark denotes the method ScoreOpt-N in Algorithm Our methods achieve surprisingly good results. Specifically, we obtain 90.59% robust accuracy, with absolute improvements of 9.19% over previous SOTA adversarial purification methods. Our method the first adaptive test-time defense to achieve robust accuracy over 90% against the BPDA+EOT attack. Meanwhile, the standard accuracy result is on par with the best-performing method.
CIFARI00 We also conduct robustness evaluations against strong adaptive attacks under the to (c (c=33 (C=8/2558 8/255) threat model on the CIFAR 100 dataset. The results of ScoreOpt and other adap- tive purification methods are presented in Table 2 To showcase the superiority our method over previous diffusion- baaed purification algorithms, we perform experiments using the approach proposed in Nie et 40 with varying reverse denoising steps. The optimal hyperparameter L", representing the forward timestep, is carefully tuned based on experimental results. As indicated in Table increasing the reverse denoising steps only leads to marginal improvements over the one-shot denoising method. Even when the number of denoising steps increased to 80, which will incur large computational cost, no further improvement in robust accuracy is observed. In contrast, our ScoreOpt method achieves notable improvement of 18. 16% in robust accuracy.
4.2.2 Adaptive White-box Attack
In order to evaluate our method against white-box attacks, it is necessary to compute the exact gradient of the entire defense framework. However, optimization process involves backpropagation through the U-net architecture of diffusion models, making it challenging to directly apply PGD attack. Taking inspiration from Lee and Kim (34), we approximate the full gradient using the one-shot denoising process in our experiments. The performance against PGD+EOT is shown in Table Most results for baselines taken from Lee and Kim [34]. Notably, our method significantly outperforms other diffusion- based purification methods. Specifically, compared to Nie et al. [40), our method improves robust accuracy by 16.43% under lxv and by 4.67% under &g on WideResNet-28- 10, and by 14.45% under foc and by 2.31 % under & on WideResNNt-P7 70-16, respectively. Compared with previous SOTA adversarial training methods, ScoreOpt achieves better robust accuracies on both WideResNet-28-11 and WideResNet-70-116 under l2. Furthermore, under foo threat model, ScoreOpt outperforms AT baselines on WideResNett28-111 and achieves comparable robust accuracy on 760 with the top-rank model.

---

Table 4: Standard and robust accuracy against unseen threat models with WRN-70-10 16 CIFARIO. Threat that AT is trained with is marked with an underline, and others are considered unseen.
Robust (%)
Defense
Standard (%)
E2 StAdv
Base WRN-70-16
95.31
Wang et 64
(Trined Exc) (Trained with Ex)
92.97
72.46
71.68
3.13
Wang al. 64
96.09
56.64
86.72
5.27
Ours
95.18
71.48
87.11
93.36
Table 5: Robustness against common corruptions on CIFARIO-C.
Defense
gaussian
shot
impulse
elastic transform
pixelute
ipeg compression
frost
fog
brightness
WRN-70-16
25.71
32.19
27.89
73.17
44.93
67.32
77.82
66.49
71.37
91.33
Wang al.
(
79.85
81,22
62.02
86. 14
88.89
89.93
84.75
83,94
37.87
88.04
Wang et al.
64 (62)
81.91
83.17
63.74
89.96
92.0
93.61
89.26
88.17
48.55
92.88
Ours
89.94
87.96
82.68
83.64
86.36
89.26
83.5
85.73
80.2
91.21
Approximate Gradient. To show the effectiveness of our approximate gradients for sufficient ro- bustness evaluation, we evaluate ScoreOpt (with only one single optimization step) on fixed 512 CIFAR- 10 subset. We use exact gradients and approximate gradients obtained by backpropagating through the one-shot denoising surrogate process, respectively. The attack success rates of PGD+EOT are 3.999 (w/ exact gradients) vs 34.11% 1% (w/ approximate gradients) under lz, and 50.976563% vs 50.976562% under feo. Therefore, this kind of approximate gradients obtained by the one-shot de- noising surrogate process can be considered as effective as computing the exact gradient to sufficiently evaluate the robustness of ScoreOpt.
4.3 Generalization to Different Types of Attacks
Defense against Unseen Threats A significant advantage of adversarial purification is that it can defend against unseen threats in a plug-an Blug-and-pe and-play fashion, while most adversarial training methods exhibit robustness only against the specific threat trained with. Following Nie et al. [40], we conduct evaluations with three threat models: foc. Eg, and the spatially transformed adversarial examples (StAdv). illustrats the poor generalization of AT methods to unseen attacks and the significant generalization ability of our proposed method. The performance of AT baselines drops significantly when confronted with unseen attacks while ScoreOpt demonstrates robustness across all three threat models.
Score-based Black-box Attack We further assess the effectiveness of our method against the score-based black-box attack, SPSA. This evaluation is conducted on CIFAR 10 with the WRN-28-10 classifier, adopting the same experimental setup described in Yoon et al. [69] using 1,280 queries. Notably, our ScoreOpt method achieves robust accuracy of 91.797%, in contrast the reported 80.8% robust accuracy in Yoon et al. [69] This demonstrates significant performance improvement of 10% over the previous method.
Common Corruption To further highlight the generalization ability of ScoreOpt against various types of perturbations, test the robustness of ScoreOpt and AT baselines on CIFAR10-C, dataset comprising 75 frequently encountered visual distortions. The evaluation results are summarized in where ScoreOpt consistently outperforms the AT baselines across most corruptions.
Table 5
4.4
Further Analysis
4.4.1
Combining with adversarial training methods
ScoreOpt can also be seamlessly combined with existing stronger classifiers in plug-and-play manner to further improve robustness performance. To see this, we conduct an additional experiment by combining ScoreOpt with adversarially trained classifiers (64). We evaluate against the PGD+EOT attack and observe improvements under both 7ox (from 71.48% to 72.57%) and l2 (from 87.1 1% to 89.06%), respectively.

---

Table 6: The inference time cost of ScoreOpt with different optimization steps, compared with previous diffusion-basee purification methods with different denoising steps.
Denoising Steps
10
20
50
100
Time Cost (s)
0.0524
0.1930
0.3271
0.6298
1.7125
3.3351
Optimization Steps
10
20
50
Time Cost (6)
0.1172
0,3632
0.6271
1.1747
3.2978
5.8181
Figure 3: Accuracy with respect to optimization steps.
4.4.2 Optimization Steps
Since our defense an iterative optimization process, we conduct ablation experiments on our ScoreOpt algorithm with different optimization steps under foo (e 8/2255) threat model against BPDA+EOT on CIFAR10. Figure D shows that standard accuracy and robust accuracy con- tinuously increase the number of optimization steps increases. As the number of iterations increases further, the accuracies gradually stabilize. This phenomenon shows the effectiveness of our optimization process.
4.4.3 Inference Speed
We compare the inference speed of ScoreOpt with diffusion purification methods that sequential multiple-step denoising process. We compute the inference time cost per image. As shown in Table 6 time cost about twice under the same steps. However, ScoreOpt needs only few steps (about 5) to obtain significantly better results than the multi-step denoising method, which requires nearly 100 denoising steps. Therefore, compared diffusion-based AP baselines, our method further improves the inference speed substantially in practice.
5 Concluding Remarks
In this work, have proposed novel adversarial defense framework ScoreOpt, which optimizes over the input image space to recover original images. We have introduced three optimization objectives using pre-trained score-based priors, followed by practical algorithms. We have shown that ScoreOpt can quickly purify attacked images within few optimization steps. Experimentally. have shown that approach yields significant improvements robustness performance and inference speed. We would believe our work further demonstrates the powerful capabilities of pre-trained generative models for downstream tasks.
prior works in terms of both
Acknowledgments and Disclosure of o Funding
This work has been supported by the National Key Research and Development Project of China (No. 0222FA11040002 and the National Natural Science Foundation of China (No. 12271011).
References
[1] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274-283. PMLR, 2018.
[2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In International conference machine learning, pages 284-293, PMLR, 2018.
[3] Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness on in- and out-distribution improves explainability. In European Conference Computer Vision, 2020.
10

---

[4] Tsachi Blau, Roy Ganz. Babjat Kawar, Alex Bronstein, and Michael Elad. Threat model- agnostic adversarial defense using diffusion models. arXiv preprint (xXi:22277088089 2022.
[5] Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and Zico Kolter. (certified!!) adversarial robustness for free! In The Eleventh International Conference on Learning Representations, 2023.
[6] Yair Carmon, Aditi Raghunathan. Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves ad adversarial robustness. In Advances in Neural Information Processing Systems, volume 32, 2019.
[7] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pages 7206-2216 PMLR, 2020.
[8] Debayan Deb, Xiaoming Liu, and Anil K Jain. Faceguard: A self- self-supervieed defense against adversarial face images. arXiv preprint arXiv:201 1.122//1111// 142/8, 2020.
[9] Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In Advances in Neural Information Processing Systems, 2021.
[10] Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Di- rect input space margin maximization through adversarial training. In International Conference on Learning Representations, 2020.
[11] Yilun Du and Igor Mordatch. Implicit generation and modeling with energy based models. In Neural Information Prucessing Systems, 2019.
[12] Partha Ghosh, Arpan Losalka, and Michael Black. Resisting adversarial attacks using gaussian mixture variational autoencoders. In Proceedings of the AAAI conference on artificial intelligence, volume 33, pages 541 541-548, 2019.
[13] Ross B. Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hierarchies for accurate object detection and semantic segmentation. 2014 IEEE Conference on Computer Vision and Pattern Recognition, pages 580-587, 2013.
[14] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
[15] Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norn-bounded adversarial examples. arXiv preprint arXiv:2010.03599, 2020.
[16] Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems, 34, 2021.
[17] Alexandros Graikos, Nikolay Malkin, Nebojsa Jojic, and Dimitris Samaras. Diffusion models as plug-and-play priors. In Advances in Neural Information Processing Systems, 2022.
[18] Will Grathwohl, Kuan-Chieh Wang. Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. In International Conference on Learning Representations, 2020.
Jacobsen, David Duvenaud, Mohammad
[19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, 2016.
[20] Mitch Hill, Jonathan Craig Mitchell, and Song-Chun Zhu. Stochastic security: Adversarial defense using long-run dynamics of energy-based models. In International Conference on Learning Representations, 2021.
[21] Chih-Hui Ho and Nuno Vasconcelos. DISCO: Adversarial defense with local implicit functions. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors, Advances in Neural Information Processing Systems, 2022.

---

[22] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-6855 2020.
[23] Emiel Hoogeboom, Victor Garcia Satorras, Clément Vignac, and Max Welling. Equivariant diffusion for molecule generation in 3d. In International Conference on Machine Learning, pages 8867-8887. PMLR, 2022.
[24] Uiwon Hwang, Jaewoo Park, Hyemi Jang. Sungroh Yoon, and Nam Ik Cho. Puvae: A variational autoencoder to purify adversarial examples. IEEE Access, 7:126582-1266 126593,, 2019.
[25] Aapo Hyvärinen. Estimation of non- non-normalized statistical models by score matching. J. Mach. Learn. Rex., 6:695-709, 2005.
[26] Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages
2019.
[27] Dvij Kalaria, Aritra Hazra, and Partha Pratim Chakrabarti. Towards adversarial purification using denoising autoencoders. arXiv preprint arXiv:2208. 13838, 2022.
[28] Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Stable neural ode with lyapunov-stable cquilibrium points for defending against adversarial attacks. Advances in Neural Information Processing Systems, 34: 34:14495-14937, 2021.
[29] Tero Karras, Miik Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In Advances in Neural Information Processing Systems, 2022.
[30] Zhifeng Kong, Wei Ping. Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: A versatile diffusion model for audio synthesis. In International Conference on Learning Representations, 2021.
[31] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 60:84 - 90, 2012.
[32] Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2017.
[33] Kyungmin Lee. Provable defense by denoised smoothing with learned score function. In ICLR Workshop on Security and Safety in Machine Learning Systems, 2021.
[34] Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion biffusion-based adversarial purification. arXiv preprint arXiv:2303.0005// 2023.
[35] Chen-Hsuan Lin, Jun Gao, Luming Tang, Towaki Takikawa, Xiaohui Zeng, Xun Huang, Karsten Kreis, Sanja Fidler, Ming- Yu Liu, and Tsung- Yi Lin. Magic3d: High-resolution text-to-3d content creation. arXiv preprint arXiv:2211. 2022.
[36] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
[37] Gal Metzer, Elad Richardson, Or Patashnik, Raja Giryes, and Daniel Cohen-Or. Latent-nerf for shape-guided generation of 3d shapes and textures. arXiv preprint arXiv:2211.076000 2022.
[38] Anh Nguyen, Jason Yosinski. and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEÉ conference on computer vision and pattern recognition, pages 427-436, 2015.
[39] Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Megrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image genera- tion and editing with -extdd diffusion models. In International Conference on Machine Learning, pages 16784-16804, PMLR, 2022.
12

---

[40] Weili Nie. Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anand- kumar. Diffusion models for adversarial purification. In Proceedings of the 39th International Conference Machine Learning, pages 16805-16827, 2022.
[41] Tianyu Pang, Kun Xu, Chongxuan Li, Yang Song, Stefano Ermon, and Jun Zhu. Efficient learn ing of generative models via finite-difference score matching. Advances in Neural Information Processing Systems, 13:19175-19188 2020.
[42] Tianyu Pang, Min Lin, Xiao Yang, Junyi Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference Machine Learning, 2022.
[43] Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. In The Eleventh International Conference on Learning Representations, 2023.
[44] Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01 01946, 2021.
[45] Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning, 2020.
[46] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10684-10695, 2022.
[47] J. Rony, L. G. Hafemann, L. S. Oliveira, I. Ben Ayed, R. Sabourin, and E. Granger. Decoupling direction and norm for efficient gradient- based adversarial attacks and defenses. 2019 IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pages 4317 4325. IEEE Computer Society, 2019.
[48] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Representations, 2018.
[49] Schott, J Rauber, M Bethge, and W Brendel. Towards the first adversarially robust neural network model on mnist. In Seventh International Conference on Learning Representations (ICLR 2019), pages 1-16, 2019.
[50] Vikash Schwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In International Conference on Learning Representations, 2021.
[51] Evan Shelhamer, Jonathan Long, and Trevor Darrell. Fully convolutional networks for semantic segmentation. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 3431-3440, 2014.
[52] Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-supervised learning. In International Conference on Learning Representations, 2021.
[53] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409, 1556, 2014.
[54] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2021.
[55] Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In International Conference on Learning Representations, 2018.
[56) Yang Song, Sahaj Garg, Jiaxin Shi, and Stefano Ermon. Sliced score matching: A scalable approach to density and score estimation. Conference on Uncertainty in Artificial Intelligence, 2019.
13

---

[57] Yang Song. Conor Durkan, lain Murray, and Stefano Ermon. Maximum likelihood training of score-based diffusion models. Advances in Neural Information Processing Systems, 34, 2021.
[58] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
[59] Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1-9, 2015.
[60] Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based generative modeling in latent space. In Neural Information Processing Systems, 2021.
[61] Pascal Vincent. A connection between score matching and denoising autoencoders. Neural computation, 23(7):1661-166 2011.
[62] Haochen Wang, Xiaodan Du, Jiahao Li, Raymond Yeh, and Greg Shakhnarovich. Score jacobian chaining: Lifting pretrained 2d diffusion models for 3d generation. arXiv preprint arXiv:2212.0077,.22 2022.
[63] Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. arXiv preprint arXiv:2205. 14969, 2022.
[64] Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In International Conference Machine Learning (ICML), 2023.
[65] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In Advances in Neural Information Processing Systems, volume 33, pages 2958-2969, 2020.
[66] Quanlin Wu, Hang Ye, and Yuntian Gu. Guided diffusion model for adversarial purification from random noise. arXiv preprint arXiv:2206.00875, 2022.
[67] Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.000 1..0022.. 2022.
[68] Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. In International Conference Machine Learning, 2019.
[69] Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference on Machine Learning, pages 12062-12072. PMLR, 2021.
[70] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016. British Machine Vision Association, 2016.
[71] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482, PMLR, 2019.
14

---

A Related Work
A.1 Adversarial attack
Adversarial attacks are aimed at manipulating deceiving machine learning models by introducing imperceptible perturbations to imput data, which can lead to misclassificatio. These attacks can be categorized into three types: black-box, gray-box, and white-box attacks, with increasing intensity.
In a black-box attack setting, the attacker has no knowledge of the internal structure of both the defender and the classifier. Conversely, white-box attacks have full access to all information about the pre-processee and the target classifier. Defending against white-box attacks the most difficult task.
And gray-hox attacks have partial information about the whole target model. Attackers usually have full access the classifier but lack knowledge about the pre-processor. Adversarial examples generated exclusively based on the classifier and evaluated using the entire model. This type of malicious perturbation inherently limited in its effectiveness compared white-box attacks, is important to note that gray-box attacks can be seen as transfer-based black-box attacks, where the raw classifier serves as the source model, and the entire model (including the pre-processor) represents the target model.
A.2 Adversarial defense
To enhance the resistance of classifiers against adversarial attacks, two primary approaches have been employed. The first approach is adversarial training (AT), which has proven to be highly effective in defending against such attacks [36 32) 7 [ AT involves training classifiers using both clean data with ground-truth labels and adversarially perturbed samples. However, notable limitation of AT is that it can only defend against attacks that the model has been specifically trained on, necessitating retraining the classifier when confronted with new attack types.
Purification, which involves applying a peppppreeeeeee pee-processing procedure to input data before it fed into classifiers, is another approach for enhancing adversarial robustness. Several existing studies have explored the effectiveness of different purification models, such as denoising auto-encoders 24 27). sets of image filters [8], and compression-an--rrcovvee models [26). among others. Among these purification methods, generative models [55] 12 49 have demonstrated significant effectiveness in transforming adversarial data into clean data. The underlying idea of this technique is to learn the underlying distribution of clean data and use to transform adversarial examples.
B Attack Transferred from Base Classifier
We evaluate our defense against adversarial images generated from the PGD attack only on the base classifier. The attack process does not incorporate the pre-processe ree-procsssng model. We conduct experiments against Transfer-PGD attacks for both CIFARIO and ImageNet datasets. The experimental settings adhere previous purification methods. In summary, our proposed method exhibits substantial improvements in both standard and robust accuracy measures.
CIFARIO Table 7 and & show the robustness results against Transfer-PGD attack under the Lo (c= TCC=8/255) 8/255) and lg (C=0)) threat models on CIFAR1O dataset, respectively. We compare our method with two kinds of defenses: adversarial training and adversarial purification methods. The results demonstrate that the robust accuracies of our two methods achieve state-of-the-ard per- formance, with comparable standard accuracies. Specifically, our method outperforms existing adversarial purification methods, including diffusion based multi-step denoising models. Under the loo (e 8/255) threat models, proposed method improves robust accuracy by 2.2%. As for the l2 (E = 0.5) threats, our algorithms still achieve a substantial improvement over existing methods in terms of both standard accuracy 93.1 1% and robust accuracy 92.52%.
IMAGENET Table 9 presents the robustness performance of our method on the Imagenet dataset. We evaluate our method under f 4/255) threat model with different perturbation budgets on three different backbones with different natural classification accuracies. Results show that the effectiveness of our method is not affected by the underlying classifier architecture. Even under larger attack budgets, we find that our method still keeps the ability to purify adversarial perturbations and generally achieves over 60% robust accuracy.
15

---

Table 7: Standard and robust accuracy against Transfer-PGD attack under ( 8/255) threat
model on CIFAR 10, compared with other preprocessor-basee adversarial defenses and adversarial training methods against transfer-based attacks.
Type
Architecture
Method
Standard (%)
Robust (%)
Avg. (%)
Base Classifier
WRN-28-10
95.19
0.00
Madry et al. 36
87.30
70.20
78.75
Adversarial Training
ResNet56
Zhang ct al.
71
84.90
72.20
78.55
ResNer18
Yang et al.
68
94.90
82.50
88.70
ResNe162
Song et al.
55
90.00
70.00
80.00
and Mordatch
48.70
37.50
43.10
Grathwohl et
[8
75.50
23.80
49.65
Advensariul Purification
Hill al.
20
84.12
78.91
81.52
WRN-28-10
Ho and Vasconcelos
89.26
80.80
85.03
Yoon
93.09
85.45
89.27
Wang al. 63
93.50
90.10
91.80
Ours(o)
91.88=00005
90.11=0.05
91.00
Ours(n)
93.11 +
92.30 0.15
92.71
Table 8: Standard and robust accu- racy against Transfer-PGD attack under (c 0.5) threat model on CIFARIO.
Table 9: Standard and robust accuracy against Transfer- PGD &oo threat model ImageNet, under different classifier architectures and attack budgets.
Accuracy (%)
Models
Base Classifier
Standard
95.19
Robust
0.30
Architectrre
Natural Ace
Attack Budget
Standard
Accuracy (%)
Robust
Rony et al.
47
89.05
67.60
ResNet-50
78.52
4/255
72.85
70.51
Ding
66.18
16/255
69.34
62.70
Rice ul.
45
88.67
71.60
4/256
73.83
71.29
ResNet 152
80.66
Wu et al. 65
88.51
73.66
16
72.85
66.60
Gowal
90.90
74.50
4/255
74.61
70.51
WRN-50-2
Ours(o)
91.85 0.02
90.55 0.08
16/255
71.68
62.10
Ourstn)
93.10:10.20
92.52:10.14
Based on the results from Table 7 to we can summarize that ScoreOpt achieves better perfor- mance than previous defenses consistently and purify adversarial examples on transfer-based attacks successfully, across various datasets.
C
Experimental Details
Code is available at wtt.hp/l..tatp.ccctooooooooooooa
C.1
Computing resources
All of our experiments are conducted using GPUs. Specifically, the diffusion models and base classifiers are trained in parallel on eight GPUs. Each test-time robustness evaluation performed on single GPU. The GPUs used in our experiments are NVIDIA TITAN RTX with 24GB of memory.
C.2 Dataset descriptions
We utilize three datasets in our experiments: CIFAR-10, CIFAR-100, and ImageNet. CIFAR- 10 and CIFAR-100 datasets contain 50,000 training images and 10,000 test images, with 10 and 100 classes respectively. All CIFAR images have resolution of 32x32 pixels and three color channels (RGB). On the other hand, ImageNet consists of a validation set with 50,000 examples, featuring 1,000 classes and images with resolution of 256x256 pixels and three color channels.
C.3 Attack details
We conduct evaluations against the BPDA+EOT attack using 50 BPDA iteration steps and 15 EOT attack samples. Regarding the white-box PGD+EOT attack discussed in Section 4.2.2 we employ 20 PGD steps and 20 replicates for EOT attacks, consistent with the setup used in Lee and Kim [34]
16

---

For the Transfer-PGr attack, we adopt 40 PGD update iterations to generate adversarial examples, following previous studies 69 63
The step size a e/4.
C.4 Training details
Diffusion models We utilize pre-trained class-unconditional diffusion models obtained from Karras et al. (29] for CIFAR-10 10 and from Dhariwal and Nichol [ for ImageNet. For the CIFAR-100 dataset, caas-unconditional EDM using the ddpm++ model architecture. The training configuration and network architecture for CIFAR-100 align with the settings used in Karras et al. 29 for CIFAR-10.
train
Classifiers Our classifiers are trained alone on the training set of each dataset. For CIFAR- 10, WRN-28-10 1---288000000 and WRN-70-16 classifiers both achieve 95.19% natural accuracy the whole test set. For CIFAR-100, the WRN-28-10 model achieves 81. 11.5% natural accuracy and WRN-70-16 achieves 81.28% natural accuracy.
C.5 Implementation details of our methods
We evaluate our ScoreOpt method using the Adam optimizer in all experiments. During our experi- ments, we observed that both the Diff loss and the SR loss can yield satisfactory results when the number of optimization steps is relatively small. However, in comparison to SR optimization, Diff optimization offers faster inference speed and requires less memory. Unless otherwise stated, all experiments in the main text are conducted using the WRN-28-108 10-1 classifier architecture. Please refer to Table 10 for the optimization syper-parametor we used obtain the final evaluation results in Section and Appendix B
Table 10: Hyper-parameters choices of our optimization process for experimental results in the main text and appendix.
Attack Type
Perturbation Budget
Method
LR
Step
Noise Level
Dataset: CIFAR10
BPDA+EOT
(E = 8/255)
ScoreOpt-O
0.1
5
[0.40,0.60]
BPDA+EOT
(E 8/255)
ScoreOpt-N
0.1
5
[0.50,0.50]
PGD+EOT
lx (c = 8/255)
ScoreOpt-N
0.1
20
[0.25,0.25]
PGD+EOT
Eg(c 0.5)
ScoreOpt-N
0.1
20
[0.25,0.25]
Transfer-PGD
loo (c = 8/255)
ScoreOpt-O
0.01
20
[0.15,0.35]
Transfer-PGD
lo 8/255)
ScoreOpt-N
0.1
5
[0.25,0.25]
Transfer-PGD
f2(E 0.5)
ScoreOpt-O
0.01
20
[0.15,0.35]
Transfer-PGD
E2(E 0.5)
ScoreOpt-N
0.1
[0.25,0.25] 5
Dataset: CIFAR 100
BPOT+HOT BPDA+BOT
(e = 8/255)
ScoreOpt-O ScoreOpt-N
0.1
3
[0.15,0.35]
Lo 3/255
0.1
3
[0.25,0.25]
D Ablation Studies and Additional Results
D.I Different classifier architectures
To showcase the effectiveness and reliability of incorporating our method into any off-the-shelf classifiers, we conduct additional evaluations using the WideResNett70-I1 classifier architecture. All of these experiments are conducted using the same optimization hyper-parameters as those employed for the WRN-28-10 architecture. [ that our method with WRN-70- 16 consistently achieves high robust accuracy against various attacks on both the CIFAR- 10 and CIFAR- 100 datasets.
17

---

Table 11: Evaluation results obtained by WRN-70-16 classifier architecture.
Acc (%)
Attack Type
Perturbation Budget
Method
Standard
Robust
Dataset: CIFARIO
BOO foo 8/255) foo (e 8/255) l2(E = 0.5)
ScoreOpt-N ScoreOpt-N
93.75
91.60
Transfer-PGD
92.47
92.32
Transfer-PGD
ScoreOpt-N
92.47
92.29
Dataset: CIFARI00
BOO BEDA+
le 8/255) (E 8/255)
ScoreOpt-O ScoreOpt-N
76.56
65.82
69.53
66.99
D.2 Number of EOT attack replicates
We present additional results for ScoreOpt defense by varying the number of EOT attack replicates. All experiments are conducted using the same settings as described Section 4 except the EOT number. Figure illustrates the robustness performance against PGD+EOT attacks with different numbers of EOT replicates, while Figure showcases the results against BPDA+EOT attacks. The evaluations performed using the WRN-28-10 architecture the CIFAR- 10 dataset. Interestingly, our findings indicate that the number of EOT replicates does not significantly impact the standard and robust accuracy of our method.
100
100
Standand Arcunary
Standerd Accurary
Robust
Robust
Accuraty %
60
60
Accuracy
10
15
25
30
15
20
30
Number of EOT replicates
Number COT replicates
(a) (e 8/255)
(b) lz(e 0.5)
Figure 4: Robustness performance against PGD+EOT attack under the loo = 8/255) and Ez(e
0.5) threat models, respectively. We evaluate methods with WRN-28-11 on CIFAR-10.
Standard
60
Accuracy
10
15
20
25
30
Number of EOT replicates
Figure 5: Robustness performance against BPDA+EOT attack under the (o = 88/25)) threat model. We evaluate methods with WRN-28-106 10 CIFAR-10.
18

---

D.3 Hyper-parameter choices of the optimization process
To further assess the effectiveness of our methods, we conduct additional experiments presented in different optimization ssperpparameters compared to the ones used in Table T0 It is worth noting that varying the optimization hyper-panne paperereraettess typically does not have significant impact the final robustness results. This observation suggests that our defense mechanism remains effective and consistent across different choices optimization hyper-parameters, further reinforcing its reliability.
Table [2] In these experiments,
Table 12: Evaluation results with different hyper-parameter parameters. The symbol indicates that the hyperparameter identical to the corresponding experiment in the main text.
Hyper-parameter
Acc (%)
Perturbation Budget
Method
LR Step Noise Level Standard Robust
Attack: BPDA+EOT
Lxc (c 8/255)
ScoreOpt-O ScoreOpt-O
[0.30,0.50]
93.16
79.30
Lxo (c 8/255)
[0.30,0.60)
92.38
81.05
Ex (c = 8/255)
ScoreOpt-N
[0.40,0.40]
94.53
92.19
Leo(E = 8/255)
ScoreOpt-N
[0.60,0.60]
91.60
89.26
Attack: Transfer-PGi
lo (c 8/255)
ScoreOpt-O
0.1
10
91.42
88.56
le 0.5)
ScoreOpt-O
[0.20,0.40]
91.55
90.21
E 0.5)
ScoreOpt-N
10
91.64
91.17
E2(E = 0.5)
ScoreOpt-N
[0.30,0.30]
91.24
90.94
D.4 More results on the whole ImageNet test set
The experimental results presented in Table evaluated on fixed subset of 512 randomly sampled images. To provide more comprehensive assessment, we include additional results on the complete 50,000 test set of ImageNet in Table
Table 13:
Standard and robust accuracy against Transfer-PGD foo threat model on Imagenet, under different classifier architectures and attack budgets.
Accuracy (%)
Architecture
Natural Accuracy
Attack Budget
Standard
Robust
4/255 16/255
70.07
66.02
ResNet-50
76.15
66.93
60.45
4/255
72.38
68.22
WRN-50-2
78.48
16/255
69.27
61.73
E Discussions and Limitations
The experiments conducted demonstrate the significant improvements achieved by our method in terms of both robustness performance and inference speed compared to previous methods. Our approach can be seamlessly integrated into various off-the-shelf classifiers. However, it is important to acknowledge few potential drawbacks of our method.
Firstly, the computational memory cost remains a challenge that needs to be addressed. Although our method requires only a small number of optimization steps, the inclusion of the U-Net Jacobian term the loss function introduces additional computational overhead. This memory constraint limits the evaluation of our method on stronger adversarial benchmarks like RobustBench.
19

---

Secondly, while we have experimentally demonstrated that our rest-time optimization process con- verges certain local optimum within small number of steps, we have not provided theoretical convergence analysis.
Our future work will focus addressing these limitations and further exploring the theoretical aspects of our method. By addressing these issues, we can enhance the practicality and theoretical understanding of our approach, paving the way for more robust and efficient adversarial defense mechanisms.
20


Reviews:
[{"review_id": "TsaG2LLcoO", "reviewer": "Reviewer_epqL", "summary": "The paper proposes a new approach for defending against adversarial attacks using adversarial purification, i.e., removing the adversarial noise from the input image at test time. To that end, the authors leverage diffusion models -- which have been used recently for adversarial purification -- and propose several modifications to previous approaches in order to 1) improve performance and 2) speed up the process.\n\nTwo big problems faced by previous diffusion-based approaches for adversarial purification include the sensitivity to the choice of hyperparameters for the diffusion model, and the long runtime since many denoising steps need to be applied.\n\nTo solve the first problem, the authors propose a new hyper-parameter-free objective function for the adversarial purification using diffusion models. In order to solve the inference speed problem, the authors propose using a one-step denoiser, rather than employing the diffusion model denoise for several steps.\n\nThe authors test their proposed defense in several setups, including standard adversarial attacks and adaptive adversarial attacks. The authors compare their results with previous baselines from the adversarial training literature and the adversarial purification literature. The evaluation shows the effectiveness of the defense, as the proposed method outperforms previous approaches in robust accuracy, while being faster.   ", "questions": "- How's Tweedie's formula used in the paper?\n\n- How much time in total the proposed approach requires?\n\n- Which converges faster: ScoreOpt(n) or ScoreOpt(o)?\n\n- Why does ScoreOpt(n) perform better? The intuition is not very clear.\n\n- The regularization term in the SR loss is not parametrized by a hyper-param. This works well in practice. I am not sure I agree about the reasoning of having similar order of magnitude, since a hyperparameter to control this regularization term can keep the same order of magnitude. Did the authors test adding a hyperparameter to the regularization term, and explore the sensitivity of the method to the choice?\n\n- Does having a different noise level during every iteration help? Have the authors tested having a fixed noise level?\n\n- ", "limitations": "- The authors identified some of the missing terms needed for their approximation, and proposed simple solutions to fix the issue. For example, the authors initialize the optimization variable $\\mathbf{x}$ to the adv image $\\mathbf{x}_a$ since they cannot take expectation over $q(\\mathbf{x}|\\mathbf{x}_a)$ in (1). However, this choice doesn't seem very convincing.\n\n- The method has not been fully tested against adaptive whitebox attacks since the computation cost of differentiation through the U-Net is very expensive. As a result, the authors only differentiate through one step. The results might look a bit different when the attack differentiates through multiple denoising steps.   ", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "Strengths:\n\n- The paper addresses one important problem with previous diffusion-based adv purification approaches: the sensitivity to the choice of hyperparameters. To solve this problem, the authors propose a new objective function for the denoising, where they remove explicit dependence on hyperparameters.\n\n- The paper recognizes that previous approaches for adv purification using diffusion models are slow since the denoising step needs to be applied several times. To solve this issue, the authors propose using a one-shot denoiser.\n\n- The authors notice that some of the components needed for their objective function computation are absent, and propose choices to get circumvent the problem. For example, the authors notice the absence of the distribution of clean images conditioned on adversarial images, and propose an initialization to circumvent this issue.\n\n- The proposed approach is simple and intuitive. \n\n- The proposed approach outperforms previous methods in defending against adversarial attacks on a range of classification tasks. \n\n- The propose approach works well under traditional and adaptive attacks.", "weaknesses": "- The presentation of the ideas needs to be improved. In particular, the methodology section can be confusing, especially when the authors propose new approaches to circumvent some problems. For example, the paragraph about the choice of the noise update rule is very confusing. \n\n- The authors mix notation a lot. For example, the authors use $q(x)$ and $q(x|x_a)$ interchangeably, even though they are not the same. \n\n- Some of the choices made need a slightly better explanation/intuition behind them. For example, the choice of taking gradient in the SR loss w.r.t. $\\mathbf{x}_t$ instead of w.r.t. $\\mathbf{x}$ lacks intuition. \n\n- There seems to be no proofs to the some of the statements of the paper. Are they provided in the appendix, or are they referencing proofs from previous papers?\n\n- The pseudocodes for the two proposed algorithms could be made clearer. First, having a clear explanation what each term represents would be helpful. Furthermore, in alg 1, it would be nice to show the term (5) rather than referencing it. Similarly, in alg 2, show the full term. Also the term $\\mathbf{x}_{j,t}$ doesn't seem to be defined?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your helpful feedback and positive recommendation. Our responses are as follows point by point.\n\n> The presentation of the ideas needs to be improved...\n\n(A1) Thanks for your useful suggestions. We will refine the methodology section in the revised version.\n\n> The authors mix notation a lot...\n\n(A2) Sorry for the confusion and we will carefully differentiate the term $q(x)$ and $q(x|x_a)$ in the final version. As for the revised notations, please refer to the *Derivation Details* part in *General Author Rebuttal*. \n\n> Some of the choices made need a slightly better explanation/intuition behind them. For example, the choice of taking gradient in the SR loss w.r.t. $\\mathbf{x}_t$ instead of w.r.t. $\\mathbf{x}$  lacks intuition. Which converges faster: ScoreOpt(n) or ScoreOpt(o)? Why does ScoreOpt(n) perform better? The intuition is not very clear.\n\n(A3) In our ScoreOpt(O) method, we randomly sample a noise $t$ from the pre-designed noise levels in each iteration, which may introduce unstable gradient directions during optimization. To address this issue, we propose ScoreOpt(N), where we compute the gradients w.r.t. $\\mathbf{x}_t$ and then utilize the one-shot denoiser to obtain $\\mathbf{x}$, aiming to reduce the instability in the optimization process. This alternative of computing gradients with respect to $\\mathbf{x}_t$ is feasible since the gradients are equal for both. \n\nEmpirically, we have observed that ScoreOpt(N) converges faster than ScoreOpt(O) and achieves better performance. This can be attributed to the stable optimization direction and the utilization of a one-shot denoiser. For more details, please refer to Appendix C.3, where we provide information on the optimization steps set for different experiments. We plan to provide a theoretical\nconvergence analysis in the future work.\n\n> There seems to be no proofs to the some of the statements of the paper. Are they provided in the appendix, or are they referencing proofs from previous papers?\n\n(A4) The proof of our statements primarily references previous work. For more details, please refer to *Derivation Details* in *General Author Rebuttal*.\n\n> The pseudocodes for the two proposed algorithms could be made clearer...Also the term $\\mathbf{x}_{j,t}$ doesn't seem to be defined?\n\n(A5) Thanks for your suggestions. We will provide a more detailed version of algorithm pseudocodes in the revised manuscript. The term $\\mathbf{x}_{j,t}$ denotes the $j$-th iteration under the sampled noise level $t$. \n\n> How's Tweedie's formula used in the paper?\n\n(A6) We use Tweedie's formula to derive from Eq.(2) to Eq.(3). Note that $x_t = x + \\sigma_t \\epsilon, \\epsilon\\sim \\mathcal{N}(0,\\mathbf{I})$. According to Tweedie's formula, $\\hat{x}(x_t) \\coloneqq x_t + \\sigma_t^2 \\nabla_{x_t} \\log q(x_t)$\nis the Bayesian optimal estimate of $x$. Then define $D_{\\boldsymbol{\\theta}}\\left(\\mathbf{x}\\_t; t\\right) \\coloneqq \\mathbf{x}\\_t + \\sigma\\_t^2 s\\_{\\boldsymbol{\\theta}}\\left(\\mathbf{x}\\_t; t\\right)$. Plug the two equations into Eq.(2), we can obtain Eq.(3).\n\n> How much time in total the proposed approach requires?\n\n(A7) Please refer to *General Author Rebuttal-Inference Time*. \n\n> The regularization term in the SR loss is not parametrized by a hyper-param...the sensitivity of the method to the choice?\n\n(A8) The insensitivity of the weighting hyperparameter is demonstrated in Figure 2c in Section 3.2.1, which aligns with our analysis. This insensitivity can be attributed to the fact that the two terms of the SR loss correspond to the same noise level $t$.\n\n> Does having a different noise level during every iteration help? Have the authors tested having a fixed noise level?\n\n(A9) We have tested to optimize $x$ with a fixed noise level. In such cases, we should carefully select the optimal hyper-parameter $t^*$ for good performance. Thus it does not align with the motivation of addressing the sensitivity problem associated with hyper-parameters.\n\n> The authors identified some of the missing terms needed for their approximation and proposed simple solutions to fix the issue. For example, the authors initialize the optimization variable $x$ to the adv image $x_a$ since they cannot take expectation over $q(x|x_a)$ in (1). However, this choice doesn't seem very convincing.\n\n(A10) The reason for eliminating the reconstruction term in Eq.(1) and initializing $x$ by $x_a$ is that we have no information about $p(x_a|x)$, not $q(x|x_a)$. (Indeed, $q(x|x_a)$ is tractable, see General Author Rebuttal-Derivation Details.) The rationale behind this simplification is that the adversarial sample usually remains in the vicinity of its corresponding clean sample. Moving towards higher log likelihoods of $x$ will probably lead $x_a$ toward the mode of the $x$ with the same ground-truth class label. As discussed in Section 3.2.1, this simplification has its limitations. Therefore, we propose the SR loss to address this issue.\n\n> The method has not been fully tested against ... multiple denoising steps.\n\n(A11) Our proposed ScoreOpt-N method includes gradient-descent step and one-shot-denoising step. Approximating the full gradient using the one-shot denoising surrogate process corresponds to regarding the gradient-descent step as an identity mapping. This approximation method is also employed in [1] and has been empirically shown to be as effective as computing the exact gradient. Since our method doesn't involve multi-step denoising, approximating through multiple denoising steps does not give a more accurate gradient estimate.  In our experiments, we have observed that the success attack rate decreases when the attack differentiates differentiates through multiple denoising steps.\n\n[1] Chen, Huanran, et al. \"Robust Classification via a Single Diffusion Model.\" arXiv preprint arXiv:2305.15241 (2023)."}, {"review_id": "86Twkas9ZJ", "reviewer": "Reviewer_85mv", "summary": "This paper proposes an adversarial defense scheme named ScoreOpt, which uses purification technology to eliminate adversarial perturbations. Specifically, ScoreOpt formulates the adversarial defense as an optimization problem, which optimizes adversarial examples based on pre-trained score-based priors. And experimental results show that the adversarial robustness of the proposed method outperforms existing adversarial defenses against both transfer-based attacks and adaptive white-box attacks.", "questions": "1. The authors may need to discuss the selection method of the noise level range, that is, how the values of $t_{min}$ and $t_{max}$ are determined, and the impact of the noise level range on the proposed algorithm.\n2. It is recommended to test performance against some other advanced attack methods to enhance the credibility and universality of the method.", "limitations": "The authors point out the limitations of the proposed method in terms of computational memory cost and theoretical convergence analysis.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-written and easy to follow.\n2. The proposed ScoreOpt departs from the sequential step-by-step denoising procedure, which doesn’t involve the process of carefully selecting the forward diffusion timestep.\n3. The proposed hyperparameter-free score regularization loss function takes into account not only the alignment between pixels but also the alignment between score estimations.\n", "weaknesses": "1. In this paper, the pre-designed noise plan is focused on lower noise levels. However, some clear explanations are necessary for this lower noise level. For example, how this lower noise level is defined, whether it is relevant to the dataset and whether too low noise level will affect the effectiveness of the proposed method.\n2. This paper evaluates the robustness performance of adversarial defenses against transfer-based attacks and adaptive white-box attacks. To further illustrate the effectiveness of the proposed method, this paper should also test performance against some other advanced attack methods, such as score-based black-box attacks.\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your helpful feedback and constructive suggestions. We will address your concerns below.\n\n> In this paper, the pre-designed noise plan is focused on lower noise levels. However, some clear explanations are necessary for this lower noise level. For example, how this lower noise level is defined, whether it is relevant to the dataset, and whether too low noise level will affect the effectiveness of the proposed method.\n\n> The authors may need to discuss the selection method of the noise level range, that is, how the values of $t_{min}$ and $t_{max}$ are determined, and the impact of the noise level range on the proposed algorithm.\n\n(A1) Thanks for your kind suggestion. The original diffusion models are mainly used for generating images from pure noise. Higher noise levels allow for more significant modifications to global structural information, while lower noise levels only permit local detail modifications. Many studies have focused on lower noise levels to conduct image editing tasks. Therefore, our pre-designed noise plan primarily focuses on lower noise levels, since adversarial perturbations are human-imperceptible. And too low $t_{max}$ will lead to a significant decline in robust performance since the prior distribution defined by diffusion models is not effectively utilized. \n\nDue to space limitations, we put the analysis and ablation study of hyper-parameters in Appendix C, including the noise level range we choose in our main experiments and the impact of different noise level ranges. The $t_{min}$ and $t_{max}$ we determined are independent of datasets. We will provide more analysis and discussion in the main text in the revision.\n\n> This paper evaluates the robustness performance of adversarial defenses against transfer-based attacks and adaptive white-box attacks. To further illustrate the effectiveness of the proposed method, this paper should also test performance against some other advanced attack methods, such as score-based black-box attacks.\n\n> It is recommended to test performance against some other advanced attack methods to enhance the credibility and universality of the method.\n\n(A2) Thanks for your helpful suggestions. Due to the limited time of the rebuttal period, we evaluate the performance of our method against the score-based black-box attack SPSA, using 1,280 queries on CIFAR-10 with the WRN-28-10 classifier, the same setup as in [3]. In contrast to [3], which reported a robust accuracy of 80.8\\%, our ScoreOpt method achieves 91.797%, outperforming [3] by 11%.\n\nIt is worth highlighting that transfer-based attacks and adaptive white-box attacks are commonly used in the AP literature. We will include the SPSA result in the revision and also consider investigating other types of attacks in future work.\n\n[1] Meng, Chenlin, et al. \"Sdedit: Guided image synthesis and editing with stochastic differential equations.\" arXiv preprint arXiv:2108.01073 (2021).\n\n[2] Song, Kunpeng, et al. \"Diffusion guided domain adaptation of image generators.\" arXiv preprint arXiv:2212.04473 (2022).\n\n[3] Yoon, Jongmin, Sung Ju Hwang, and Juho Lee. \"Adversarial purification with score-based generative models.\" International Conference on Machine Learning. PMLR, 2021.\n"}, {"review_id": "jWXVoFeds9", "reviewer": "Reviewer_US8D", "summary": "This paper introduces an adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. Comprehensive experiments are conducted on multiple datasets, including CIFAR10/100 and ImageNet, demonstrating that ScoreOpt outperforms existing adversarial defenses in terms of both robustness performance and inference speed.", "questions": "- The second term in Equation (1) is the KL divergence between the conditional distribution $q(x|x_a)$ and model distribution $p_{\\theta}(x)$, then how it could be equivalent to the diffusion loss in Equation (2) that formulated between the marginal distribution $q(x)$ and model distribution $p_{\\theta}(x)$?\n\n- Equation (2) is NOT training loss of diffusion models since there is no expectation over $x$. Specifically, denoising score matching (DSM) used for training diffusion models includes expectation over $x$ (i.e., $\\mathbb{E}_{x}$), and this expectation over $x$ is necessary such that the optimal solution of minimizing DSM is equal to the optimal solution of minimizing score matching (SM, or Fisher divergence).\n\n- The weighting coefficient $\\omega(t)$ in Equation (2) should be $g(t)^{2}$ to make it a bound for log-likelihood, thus it is not guaranteed the relationship between  Equation (3) and log-likelihood.\n\n- Equation (4) is only reasonable for $\\ell_{2}$ threat model, but it is not justified why this loss could be effective under, e.g., $\\ell_{\\infty}$ threat model.", "limitations": "Limitations and potential negative societal impact are not discussed in this paper.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "I like the problem formulation in Section 3.1 (although there are some questions that need to be clarified as mentioned in Questions) and a principle perspective from variational inference. Although heuristic, I think the formulation of SR loss is reasonable, especially the send term that minimizing the pixel-level distance between the denoised versions of the current sample $x$ and initial adversarial sample $x_a$. The empirical improvements compared to previous AP baselines are also promising.", "weaknesses": "- I cannot find the values of iteration steps $M$ and $N$ used for Ours(o) and Ours(n) in, e.g., Tables 1, 2 and 4. Do the Ours methods and other AT/AP baselines require comparable inference time to achieve the results reported in Tables 1, 2 and 4? The authors should report inference time for both Ours methods and other AT/AP baselines in these Tables, because in practice, higher inference cost is a much bigger concern than higher training cost.\n\n- Each computation of the SR loss in Equation (5) actually include two forward passes through the scorenet (one for $x_{t}$ and another for $x_{a,t}$). So it is unfair to just compare diffusion steps with previous baselines, the authors should report the actual inference time as mentioned above.\n\n- The proposed ScoreOpt applies EDM, while the considered diffusion-based baselines (both AT and AP) still mainly apply DDPM. Therefore, the authors should add comparisons with more advanced baselines that also apply EDM, such as [1] listed in RobustBench.\n\n[1] Better Diffusion Models Further Improve Adversarial Training", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your helpful feedback and positive recommendation. Our responses are as follows point by point.\n\n> I cannot find the values of iteration steps $M$ and $N$ used for Ours(o) and Ours(n) in, e.g., Tables 1, 2 and 4. Do the Ours methods and other AT/AP baselines require comparable inference time to achieve the results reported in Tables 1, 2 and 4? The authors should report inference time for both Ours methods and other AT/AP baselines in these Tables, because in practice, higher inference cost is a much bigger concern than higher training cost.\n\n> Each computation of the SR loss in Equation (5) actually include two forward passes through the scorenet (one for $x_t$ and another for $x_{a,t}$). So it is unfair to just compare diffusion steps with previous baselines, the authors should report the actual inference time as mentioned above.\n\n(A1) Due to space limitations in the main text, we have included the hyper-parameter choices for the reported results in Appendix C.3, specifically regarding the optimization steps (M*N). It is worth noting that ScoreOpt outperforms diffusion-based purification methods in terms of both robustness performance and inference time.\n\nIn Table 7, we compare the inference speed of ScoreOpt with the diffusion purification baseline [2]. Our approach exhibits approximately twice the time cost  under the same denoising/optimization step. This result aligns with the fact that each computation of the SR loss involves two forward passes through the score network. However, our ScoreOpt-N method achieves the reported results in Tables 1, 2, and 4 with only about 5 iterations, while diffusion-based purification [2] requires nearly 100 denoising steps. Therefore, the final inference time ScoreOpt requires is less, compared to diffusion-based AP baselines.\n\nFor further clarification, we report the final inference time ScoreOpt and DiffPure-EDM cost in *Inference Time* part of the *General Author Rebuttal*.\n\n> The proposed ScoreOpt applies EDM, while the considered diffusion-based baselines (both AT and AP) still mainly apply DDPM. Therefore, the authors should add comparisons with more advanced baselines that also apply EDM, such as [1] listed in RobustBench.\n\n(A2) Thanks for your kind suggestions. In the main text, we apply EDM to generate diffusion-based baseline results in Table 5. Regarding Tables 1, 2, and 4, during the rebuttal period, we have reproduced diffusion-based baselines using EDM (with carefully tuned hyperparameters of diffusion timesteps $t^*$ for different attacks) and provide a brief report on them below.\n\n| Methods | Transfer $\\ell_{\\infty}$ |   Transfer $\\ell_2$ | BPDA+EOT |\n| ------------ | ------------ | ------------ | ------------ | \n| DiffPure(EDM) | 90.08| 91.13 | 83.33 |\n| ScoreOpt | 92.30| 92.52 | 90.02 |\n\nUpon comparing the results, we observe that the improvement achieved by solely replacing DDPM with EDM is incremental, whereas our algorithm demonstrates a significant enhancement. In the revision, we will include detailed baseline results for thorough analysis.\n\n> The second term in Equation (1) is the KL divergence between the conditional distribution $q(x|x_a)$ and model distribution $p_\\theta(x)$, then how it could be equivalent to the diffusion loss in Equation (2) that formulated between the marginal distribution $q(x)$ and model distribution $p_\\theta(x)$?\n\n> Equation (2) is NOT training loss of diffusion models since there is no expectation over $x$. Specifically, denoising score matching (DSM) used for training diffusion models includes expectation over $x$\n (i.e., $\\mathbb{E}_x$), and this expectation over $x$ is necessary such that the optimal solution of minimizing DSM is equal to the optimal solution of minimizing score matching (SM, or Fisher divergence).\n\n(A3) In our problem formulation, we introduce a variational posterior $q(x)$ to approximate the true posterior $p(x|x_a)$ and the $\\mathbb{E}_{q(x)}$ term in the diffusion loss can be eliminated under some assumption. For more details, please refer to *General Author Rebuttal-Derivation Details*.\n\n> The weighting coefficient $w(t)$ in Equation (2) should be $g(t)^2$ to make it a bound for log-likelihood, thus it is not guaranteed the relationship between Equation (3) and log-likelihood.\n\n(A4) For theoretical guarantee, The exact weighting coefficient $w(t)$ should be $g(t)^2/2$. However, previous studies [2,3] have found that training with a simplified objective that ignores the weighting term works better. Therefore, in our work, we adopt the approach of setting $\\tilde{w}(t) = 1$ for convenience and performance.\n\n> Equation (4) is only reasonable for $\\ell_2$ threat model, but it is not justified why this loss could be effective under, e.g., $\\ell_{\\infty}$\n threat model.\n\n(A5) The main role of the regularization term in Eq.(4) is to constraint $x$ within the vincity of $x_a$. The reason of the effectiveness against $\\ell_{\\infty}$ threat model is perhaps that $x$ should also remains close to the adversarial sample $x_a$ under this threat. We will conduct further analysis and provide additional insights on this matter in the future work.\n\n> Limitations and potential negative societal impact are not discussed in this paper.\n\n(A6) We are sorry that due to space constraints, the Discussion and Limitation section is not included in the main text and is placed in the Appendix. We will advance the Discussion and Limitation section to the main text in revision. \n\n[1] Wang, Zekai, et al. \"Better diffusion models further improve adversarial training.\" arXiv preprint arXiv:2302.04638 (2023).\n\n[2] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022. \n\n[3] Graikos, Alexandros, et al. \"Diffusion models as plug-and-play priors.\" Advances in Neural Information Processing Systems 35 (2022): 14715-14728."}, {"review_id": "nK2RPrdjYw", "reviewer": "Reviewer_wKkn", "summary": "This paper proposes a dynamic defense named ScoreOpt, which maximizes the likelihood of input images by minimizing the score-matching loss. To regulate the optimization, the authors propose Score Regularization Loss which bound the distance between the denoised original images and denoised purified images.", "questions": "I would recommend using more advanced evaluation methods for DiffPure and your proposed method, as suggested in [1], [2], and [3]. These methods could provide a more comprehensive evaluation and a fair comparison with state-of-the-art methods.\nI would like to request a detailed derivation of  Equation (1) and an explanation of why it is the variational upper bound of -logp(x).  \n\n[1] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022.\n[2] Chen, Huanran, et al. \"Robust Classification via a Single Diffusion Model.\" arXiv preprint arXiv:2305.15241 (2023).\n[3] Lee, Minjong, and Dongwoo Kim. \"Robust evaluation of diffusion-based adversarial purification.\" arXiv preprint arXiv:2303.09051 (2023).\n", "limitations": "Limitation is not mentioned in the paper.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This paper proposes a novel test time defense, which is much more efficient than previous diffusion-based purification methods.\n2. This paper is well written.\n", "weaknesses": "1. The baseline model, DiffPure with Wide-ResNet-28, achieves 81.40% robustness in your paper. However, according to [1], the original paper where this baseline was proposed, it only achieves 70.64% robustness. This suggests that the robustness of the baselines and proposed method in your paper may be greatly over-estimated.\n2. The proposed method contains an optimization that is typically considered hard to evaluate due to indifferentiability. \n\n[1] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022.\n\n", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your helpful comments and constructive suggestions. Our responses are as follows point by point. \n\n> The baseline model, DiffPure with Wide-ResNet-28, achieves 81.40% robustness in your paper. However, according to [1], the original paper where this baseline was proposed, it only achieves 70.64% robustness. This suggests that the robustness of the baselines and proposed method in your paper may be greatly over-estimated.\n\n(A1) \n**First, we want to clarify that the baseline result 81.40% reported in our work are correct, exactly the same as the original paper [1].** DiffPure achieves 81.40% robustness against the BPDA+EOT attack (Table 5 in the orginal paper [1], Table 4 in our work) and 70.64% against AutoAttack. Regarding BPDA+EOT, our experimental setup is exactly the same as [1], and our code has been included in the supplementary materials. The result of 70.64 is from Table 1 of the original paper in the AutoAttack setting, which is not in the BPDA+EOT setting. The differences between attacks under different settings are further distinguished in Appendix A.1 and the *Evaluation* part in *General Author Rebuttal* to eliminate the misunderstanding. In our work, we do our best to make fair comparisons with unified robustness evaluations.\n\nAs mentioned in [3], PGD+EOT attack is a stronger robustness evaluation than AutoAttack for diffusion-based purification. Therefore, we follow [3] to evaluate robustness performance against PGD+EOT. And we report the results in Table 6 of Section 4.4 in the main text. Against PGD+EOT attack, DiffPure[1] with Wide-ResNet-28-10 achieves 51.25% robustness, a lot lower than the 70.64% value of the AutoAttack setting in [1], this shows that PGD+EOT is more effective than AutoAttack. Our proposed method obtains 65.04%, outperforming DiffPure by 13.79\\% in the same experimental setup.\n\nBased on the above elaborations, we believe that our comparison is fair and the estimations are proper. Hope our response can solve your concerns.\n\n> The proposed method contains an optimization that is typically considered hard to evaluate due to indifferentiability.\n\n(A2) We acknowledge that our proposed baseline also needs approximate gradients to evaluate. Such an issue also arises in other works. For example, [1] proposed adjoint method, while [2] used BPDA as the strong adaptive attack, which approximates the gradient with an identity mapping and [3] used the approximated gradient obtained from a surrogate process.  To address this issue, we use one-shot denoising as the surrogate process following [3]. We will put more discussions on gradient approximation methods in the revision.\n\n> I would recommend using more advanced evaluation methods for DiffPure and your proposed method, as suggested in [1], [2], and [3]. These methods could provide a more comprehensive evaluation and a fair comparison with state-of-the-art methods.\n\n(A3) We indeed test the robustness performance with the evaluation PGD+EOT suggested in [3] for our proposed method and diffusion-based baselines. Our results are reported in Table 6 of Section 4.4 in the main text. We approximate the full gradient using the one-shot denoising surrogate process following [3]. It also corresponds to regarding the rest gradient-descent step as an identity mapping. And this identity mapping approximation method is also used in [2] and is empirically shown as strong as computing the exact gradient. Please see (A1) and (A2) for more details.\n\n> I would like to request a detailed derivation of Equation (1) and an explanation of why it is the variational upper bound of -logp(x).\n\n(A4) We are sorry that there exists a typo in the notation. Equation(1) is the variational upper bound of $-\\log p(x_a)$. The KL divergence between the variational posterior and true posterior is: \n$$\\operatorname{KL}\\left(q(x) \\|\\| p(x|x_a) \\right) = \\mathbb{E}\\_{q(x)} [\\log q(x)] -\\mathbb{E}\\_{q(x)} [\\log p(x)p(x_a|x)] + \\log p(x_a).$$\n\nNote that $ \\operatorname{KL}\\left(q(x) \\|\\| p(x|x_a) \\right) \\geq 0$, we can obtain:\n$$ -\\log p(x_a) \\leq \\mathbb{E}\\_{q(x)}[\\log q(x)]-\\mathbb{E}\\_{q(x)}[\\log p(x)p(x_a|x)]= \\mathbb{E}\\_{q(x)}\\left[-\\log p\\left(x_a|x\\right)\\right]+\\operatorname{KL}\\left(q(x) \\|\\| p \\left(x\\right)\\right). $$\nAnd we use the data distribution under pre-trained diffusion models as the prior distribution, i.e., $p(x)=p_\\theta(x)$.\n\n> Limitation is not mentioned in the paper.\n\n(A5) We are sorry that due to space constraints, the Discussion and Limitation section is not included in the main text and is placed in the Appendix. We will advance the Discussion and Limitation section to the main text in revision. \n\n[1] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022. \n\n[2] Chen, Huanran, et al. \"Robust Classification via a Single Diffusion Model.\" arXiv preprint arXiv:2305.15241 (2023). \n\n[3] Lee, Minjong, and Dongwoo Kim. \"Robust evaluation of diffusion-based adversarial purification.\" arXiv preprint arXiv:2303.09051 (2023)."}]

Author rebuttal:
We sincerely appreciate the thoughtful comments from all the reviewers. In response to some general concerns raised by the reviewers, we provide a unified reply here. And we address specific questions and feedbacks individually.

**Derivation Details.**

Some of the reviewers mentioned that the notation and derivation of our statements may be a little confusing. To address this concern, we provide more detailed derivations of the statements in Section 3.2 to ensure clarity and better understanding.

We introduce a variational posterior $q(\mathbf{x})$ to approximate the true posterior distribution $p(\mathbf{x}| \mathbf{x}\_a)$ in the original optimization objective. The variational upper bound writes:
$$ 
-\log p(\mathbf{x}\_a) \leq  \mathbb{E}\_{q(\mathbf{x})}\left[-\log p\left(\mathbf{x}\_a|\mathbf{x}\right)\right] + \operatorname{KL}\left(q(\mathbf{x}) \|\| p\_{\boldsymbol{\theta}} \left(\mathbf{x}\right)\right). 
$$
As shown in [1,2], we can obtain an upper bound on the second KL divergence term between the variational posterior and the the prior distribution defined by pre-trained score network.
$$
\operatorname{KL}\left(q(\mathbf{x}) \|\| p\_{\boldsymbol{\theta}} \left(\mathbf{x}\right)\right)
\leq \mathbb{E}\_{q(\mathbf{x})}\mathbb{E}\_{t \sim \mathcal{U}(0,1), \epsilon \sim \mathcal{N}(\mathbf{0}, \mathbf{I})}\left[w(t)\left\|\|s\_{\boldsymbol{\theta}}\left(\mathbf{x}\_t; t\right)-\nabla\_{\mathbf{x}\_t} \log q(\mathbf{x}\_t ) \right\|\|\_2^2\right],
$$
where $w(t)=g(t)^2/2$ and $\mathbf{x}\_t = \mathbf{x} + \sigma\_t \epsilon$. 
The simplest approximation to the posterior over $\mathbf{x}$ is point estimate, i.e., the introduced  variational posterior $q(\mathbf{x})$ satisfies the Dirac delta distribution $q(\mathbf{x}) = \delta(\mathbf{x}-\mathbf{x_\mu})$. Thus, the obove upper bound can be rewritten as:
$$
\mathbb{E}\_{t \sim \mathcal{U}(0,1), \epsilon \sim \mathcal{N}(\mathbf{0}, \mathbf{I})}\left[w(t)\left\|\|s\_{\boldsymbol{\theta}}\left(\mathbf{x}\_t; t\right)-\nabla\_{\mathbf{x}\_t} \log q(\mathbf{x}\_t ) \right\|\|\_2^2\right],
$$
where $\mathbf{x}\_t = \mathbf{x\_\mu} + \sigma\_t \epsilon$. We simply use notation $\mathbf{x}$ instead of $\mathbf{x_\mu}$ for convenience in our main paper.
According to Tweedie's formula: $\mu_z=z+\Sigma_z \nabla_z \log p(z)$, we can obtain $\mathbf{x} = \mathbf{x}\_t + \sigma\_t^2 \nabla\_{\mathbf{x}\_t} \log q(\mathbf{x}\_t).$
Defining $D\_{\boldsymbol{\theta}}\left(\mathbf{x}\_t; t\right) \coloneqq \mathbf{x}\_t + \sigma\_t^2 s\_{\boldsymbol{\theta}}\left(\mathbf{x}\_t; t\right)$, the KL term of our opimization objective converts to:
$$
\mathcal{L}(\mathbf{x},\boldsymbol{\theta})=\mathbb{E}\_{t \sim \mathcal{U}(0,1), \epsilon \sim \mathcal{N}(\mathbf{0}, \mathbf{I})}\left[\tilde{w}(t)\left\|\|D\_{\boldsymbol{\theta}}\left(\mathbf{x} + \sigma\_t \epsilon; t\right)-\mathbf{x} \right\|\|\_2^2\right],
$$
where $\tilde{w}(t) = w(t) / \sigma_t^2$.

**Evalutaions.**

There are indeed numerous papers in the adversarial literature, and they are often evaluated using different criteria. In our paper, we have taken great care to ensure a fair comparison. As a result, we compare ScoreOpt with baselines for three types of attacks: transfer-based attacks, strong adaptive attacks BPDA+EOT, and PGD+EOT. The intensity of these attacks increases gradually from weak to strong. It has been demonstrated in [3] that the PGD+EOT attack is stronger than AutoAttack for robust evaluation of diffusion-based methods. Our experimental setups precisely align with those presented in [4], [5], and [3], respectively. Here, we provide a summary of the comparisons between DiffPure and our methods against different attacks.

 | Methods | Transfer | BPDA+EOT | PGD+EOT |
 | ---------- | ---------- | ---------- | ---------- | 
 | DiffPure | 90.08| 81.40 | 51.25 |
 | ScoreOpt | 92.30| 90.02 | 65.04 |

**Inference Time.**

As suggested by the reviewers, we provide the final inference times required by our proposed method and diffusion-based baselines to achieve the results presented in Tables 1, 2, and 4. The evaluation of inference speed was conducted on a single NVIDIA TITAN RTX GPU. We present the corresponding inference time results as follows. The reported values represent the final inference times (in seconds) for one successfully defended image.

 | Methods | Transfer $\ell_{\infty}$ |   Transfer $\ell_2$ | BPDA+EOT |
 | ------------ | ------------ | ------------ | ------------ | 
 | DiffPure(EDM) | 2.656 | 2.735 | 60.942 |
 | ScoreOpt | 1.934 | 1.981 | 24.966 |

[1] Song, Yang, et al. "Maximum likelihood training of score-based diffusion models." Advances in Neural Information Processing Systems 34 (2021): 1415-1428.

[2] Vahdat, Arash, Karsten Kreis, and Jan Kautz. "Score-based generative modeling in latent space." Advances in Neural Information Processing Systems 34 (2021): 11287-11302.

[3] Lee, Minjong, and Dongwoo Kim. "Robust evaluation of diffusion-based adversarial purification."
arXiv preprint arXiv:2303.09051 (2023).

[4] Yoon, Jongmin, Sung Ju Hwang, and Juho Lee. "Adversarial purification with score-based
generative models." International Conference on Machine Learning. PMLR, 2021.

[5] Nie, Weili, et al. "Diffusion Models for Adversarial Purification." International Conference on
Machine Learning. PMLR, 2022.

Meta-review: This paper received mixed reviews. Some reviewers liked the solid motivation and broad evaluation, while others pointed out issues with the presentation of results and depth of the evaluation. The authors engaged extensively during the review period and addressed most reviewer concerns. I have decided to accept the paper, but the authors *must* incorporate all of the reviewer feedback, including (but not limited to):

- As pointed out by reviewer wKkn, the "top-line" result should be the *minimum* accuracy for a given threat model, not the accuracy for a fixed (weak) attack. The authors addressed this point by showing that their method also performs well on white-box adaptive attacks---*this should be the main result*. I would recommend that the authors move the accuracies against (weak) black-box attacks to the appendix (or later in the paper) and replace them with some of the evaluation done during the rebuttal period.

- The authors should include a comprehensive evaluation of EOT and BPDA in this setting, varying hyperparameters of both attacks and also showing the effectiveness of their attack (it was mentioned in a reply to one of the reviewers, but should be discussed in the main paper).

- The notation and pseudocode should be cleaned up and made consistent, and the derivations from the rebuttal should be included in at least an Appendix of the paper. The writing should generally be proofread and improved to address the concerns of the reviewers below.

These are just a few of the main changes that should be made to the paper---the authors should carefully go through the reviews and responses below and ensure that they make all the appropriate changes.
Decision: Accept (poster)