DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification
Authors: Kaibo Wang
Xiaowen Fu
Yuxuan Han
Yang Xiang
Venue: NeurIPS 2024 poster (2024)
Keywords: adaptive adversarial attack
adversarial purification
diffusion
Primary area: safety_in_machine_learning
TL;DR: DiffHammer provides effective and efficient robustness evaluation for diffusion-based purification via selective attack and N-evaluation.

Abstract: Diffusion-based purification has demonstrated impressive robustness as an adversarial defense. However, concerns exist about whether this robustness arises from insufficient evaluation. Our research shows that EOT-based attacks face gradient dilemmas due to global gradient averaging, resulting in ineffective evaluations. Additionally, 1-evaluation underestimates resubmit risks in stochastic defenses. To address these issues, we propose an effective and efficient attack named DiffHammer. This method bypasses the gradient dilemma through selective attacks on vulnerable purifications, incorporating $N$-evaluation into loops and using gradient grafting for comprehensive and efficient evaluations. Our experiments validate that DiffHammer achieves effective results within 10-30 iterations, outperforming other methods. This calls into question the reliability of diffusion-based purification after mitigating the gradient dilemma and scrutinizing its resubmit risk.

DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification
Kaibo Wang', Xiaowen Fu', Yuxuan Han', Yang Xiang DDepartment of Mathematics, The Hong Kong University of Science and Technology HKKUST Shenzhen-Hong Kong Collaborative Innovation Research Institute (kwangbi, xfuak, yhanat)@connect. ust. maxiangQust. .kk
Abstract
Diffusion-bel based purification has demonstrated impressive robustness as an adver- sarial defense. However, concerns exist about whether this robustness arises from insufficient evaluation. Our research shows that EOT-based attacks face gradient dilemmas due to global gradient averaging. resulting ineffective evaluations. Additionally, l-evaluation underestimates resubmit risks in stochastic defenses. To address these issues, we propose an effective and efficient attack named DiffHam- mer. This method bypasses the gradient dilemma through selective attacks on vulnerable purifications, incorporating N-evaluation into loops and using gradient grafting for comprehensive and efficient evaluations. Our experiments validate that DifiHammer achieves effective results within 10-30 iterations, outperforming other methods. This calls into question the reliability of difffusion-berd based purification after mitigating the gradient dilemma and scrutinizing its resubmit risk.
Introduction
The vulnerability of deep neural networks (DNNs) to adversarial samples hinders their application in security-critical domains, where attackers deceive DNNs by introducing carefully crafted noises [25 9]. To mitigate this issue, numerous defense strategies have been proposed to enhance their robustness, among which diffusion- -basedd purification has emerged promising approach [22] 26 3]. Diffusion models [T] 24 are designed to construct stochastic processes from noisy data distributions to cleaner ones. As a result, the presence of small adversarial noise can be drowned out by larger noise, which can then be iteratively denoised using the diffusion model [22 26 purified through a iiffuusion-ivolver optimization (3) The iterative algorithm and stochasticity of diffusion enhance their purification capabilities empirically, yet they also present challenge in evaluating their robustness 13). There are ongoing concerns regarding their effectiveness:
Whether their effectiveness originated from inherent robustness or insufficient evaluation?
The Expectation of Transformation (EOT) 2 method allows attacks adapt across stochastic purifications by averaging the gradients of sampled purifications. It maximizes attack success rate under the assumption that most purifications share common vulnerability, i.e., susceptible same adversarial noise. However, high stochasticity in diffusion- baatud purification challenges this assumption, rendering EOT-based attacks ineffective. Purifications with unshared vulnerability (So. shown in Figure I) will provide inconsistent gradients in the attack, leading to gradient dilemma. Moreover, obtaining gradients for purification time-consuming, and this dilemma further increases computational overhead.
Cooresppndingg author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Loss on S1
(d) E-step: Identification
Fade
grad
Shared
Success
vulnerability
Non-shared vulncrability Sp
(c) Loss on USU
(e) M-step: Aggregation
grad," grad
gradz" gradf grad
Figure 1: Illustration of DiftHammer. From left right: (a) Set of purifications with unshared (Si) shared (S)) vulnerabilities. (b,c) Maximizing the loss function on So U SJ may lead to less effective attacks than on S1. (d,e) Selective attack targets S₁ avoid the gradient dilemma. We identify purifications from S in the E-step and aggregate the gradients of these purifications in the M-step.
To address this, introduce a selective attack method, Dis[Hammer based on expectation maxi- mization (EM) [5]. As shown in Figure[] our algorithm bypasses the gradient dilemma by iteratively identifying vulnerable purifications the E-step and aggregating their gradients in the M-step. This approach focuses on shared vulnerabilities, akin to using hammer on weak spots rather than the entire structure. Additionally, we enhance attack efficiency by reducing the diffusion process's backpropagation complexity from (NN) to (11) through gradient grafting.
Another issue with diffusion- based purification is insufficient evaluation. Attackers aiming for single success, such as logging in, can achieve a higher chance of success by resubmitting an adversarial sample to the stochastic defense (20). This resubmit risk is underestimated in I-evaluation tailored for deterministic defenses, especially given the high stochasticity of the diffusion process. To address this, we upgraded I-evaluation to Neevaluation and seamlessly integrated it into our DifiHammer framework, offering a more comprehensive risk assessment without extra time costs.
We revisit the robustness of diffusion- based purification within the DiffHHmmmr framework. DiffHam- [3 16 by circumventing the gradient dilemma and achieving near-optimal effectiveness within 10-30 iterations. Under N-evaluation protocol and our selective attack, we find that the risk associated with diffusion- purification is significantly underestimated. Mainstream purifications [22] 26 3 fail withstand even 10 resubmit attacks and may degrade the performance of robust models, indicating that their robustness potential remains underutilized. We hope that DiffHammer's insights into evaluating diffusion-based purification robustness will foster more robust defenses. Our main contributions are summarized as follows:
mer surpasses other state-of-the-aa attacks 4 21
We identified the limitation of EOT-based attacks and proposed an efficient and effective evaluation, termed DimmHa to comprehensively diagnose the adversarial risks of diffusion-based purification.
We introduce selective attack that avoids the gradient dilemma by targeting the shared vulnerabilities, with the process expedited by gradient grafting.
We validate the effectiveness of DiffHammer through extensive experiments on mainstream purifications, revealing underestimated risks through standardized N Neevaluation.
2 Preliminary
2.1 Adversarial attacks
Given an image E Rdd and its label y E [K]. classifier / Rd - R with a preprocessor Φ Rd + R will classify it as f(ø(x)) arg max fx [x)), where K is the number of classes. The attacker aims add an imperceptible adversarial noise r on the image to make misclassified, i.e., flo( + r)] # Adversarial noise is typically obtained by maximizing the loss
Thh codes publicly available

---

function L while imposing l p--norm constraint for imperceptibility. For instance, projected gradient descent (PGD) [2] updates || I bounded adversarial samples as:
p((+1) Il |||| Se (r
C (l))))
(I)
where is step size and IT indicates projection operator.
Preprocessors tailored to defend against adversarial noise may lead to vanishing, exploding, or inaccurate gradients. Attackers can resort to approximating the gradient using Backward Pass Differentiable Approximation (BPDA) []] where the preprocessor is typically treated as an identity mapping during the backpropagation:
VzL(fl<z + r())), 12+00 V.Llfloz - - lo(=+r())-
(2)
EOT 12 can be utilized as an additional approach to estimate gradients of stochastic preproces- sors, whose effectiveness derived from the assumption that different preprocessors have shared vulnerabilities, Given N sampled preprocessors o;, the estimated gradient is:
V
N
2.2 Diffusion-based purification
The diffusion model 11 24 14] establishes a link between the clean data distribution po(a)) and the noisy distribution pı (x) through forward (noising) and backward (denoising) processes. The forward process T2 can be expressed as stochastic differential equation (SDE) for from 0 to 24]
dx f(r, t) + g(t)dw,
where xo (z), Wt E Fd is standard Wiener process. f IRd IR + Rd is the drift coefficient and g : IR + R is the diffusion coefficient which is designed so that (x) follows standard
Gaussian distribution (o, Ia). DDPM [ can be viewed as special case of f(x, () -(()x=/22
and (t) == / (t), where (() the noise scheduler, usually set as a linear function w.r.t.
The evolution of reverse-time SDE (t from 1 to 0) then corresponds to the generation of samples:
di [((2 t) g(t)² 2 (Pr + g(t)dw
(5)
where dt is an infinitesimal negative time step and W. is a standard reverse-time Wiener process, and sPP, known as time-dependent score function and is typically estimated by the neural network.
Well-trained diffusion models possess the ability to accurately model the score function and denoise noisy samples, enabling adversarial purification. Considering the small magnitude of adversarial noise, Diffpure [22] therefore floods the adversarial noise while preserving the semantic information by running forward process from to t", and then purifies it through a denoising process. GDMP (26) leverages the distance from the initial samples as guidance to further preserve semantic information. Leveraging the fact that diffusion model approximates the score function of x Po(x) more accurately, likelihood maximization (LM) B optimizes adversarial samples to minimize estimation error, aligning their distribution with Po(2).
3 DiffHammer
To address ineffectiveness in the attack phase and insufficiency in the evaluation phase, we propose DiffHammer to assess the robustness of diffusion-baaie based purification. First, DiftHammer overcomes the gradient dilemma by designing selective attack (Section 3.1 using the EM algorithm. Further- more, we seamlessly integrate N Nevvaluation (Section 3.2) into the algorithm, enabling more accurate resubmit risk diagnosis and facilitating the attack by providing approximate gradients.
3.1 Selective attack
3.1.1 EM algorithm
Notation and objective. For sample Fd with label y [K], aim to design adversarial
noise Ed to mislead classifier with stochastic purification o Rd + gd Let A represent

---

the misclassification event where flø(2 + +r] * y. Our goal is to maximize the probability of misclassification expressed as P(A| r) = Exp(A r). Here Pis is the probability density associated with the stochastic purification Φ, and p denotes the probability density in logits of ʃ given specific 6. We refer to the gradient of loss [(]( w.r.t 2; f6(++r) as the full gradiens Lo) and the approximate gradient (V 0(*+r) respectieev. Without ambiguity, we sometimes abbreviate the loss as Lg and gradients as V..Cg. VoCo.
Assumption. We assume that diffusion-baase purifications have unshared vulnerabilities, dividing ø into two sets. We denote S as the largest set of ó with shared vulnerabilityy i.e., S1 = arg max P(fo flø( # for a same r*]) and S. S1 as the set of e compromised by inconsistent adversarial noise r. We assume that optimization towards & E Su suffers from the gradient dilemma, leading to ineffective attacks. Our task is to identify S and design r for & E Si.
Indicating whether o belongs S1 So by for = for given @. According to the Jensen's 's inequality, we maximize a lower bound of our goal:
or O, we denote q(=) the estimated distribution
Σ (()) In p(A,2 2=0,1
Σ a(=) In p(2 A.r)
max E In
Σ p(A, ()) E 2=0,1
((2)
g(2)
==0,1
(g.rr)
(L(vl))((AArr)
where Q(g, r) represents the evidence lower bound, and KL p(z A.r)) is the KL divergence between q and the posterior distribution of z. Given the coupling of variables r and in the optimization process, we employ the EM algorithm [5] as a solver that alternates between optimizing r (maximizing Q(g,r) r)) in the ststep and estimating 2 (minimizing KL divergence) in the E-step.
M-step. During the M-step, we maximize Q(q. r) w.r.t. r to raise the objective's 's lower bound while keeping q(z) fixed. By omitting terms unrelated to r, i.e. qn(z) and the priors In p(z 0), In p(= = 11), the goal simplifies as
max Q(q,r) + max q(= Im r,
1) + q(= 0) In p(A r, 2 0)
where the second term is further disregarded in the optimization according to our assumption.
In adversarial attacks, the objective E. In p(A r, = 1) is typically replaced by maximizing the loss function L (x + r), achieved through average gradient- tradeent-based methods. Consequently, the M-step update can be integrated into existing attack algorithms like PGD (1] and AA 4 plug-in, with the difference being the reweighting of the gradient from each & by q(> = 1). We further employ stepwise-EM [8] to linearly interpolate the current gradient and the previous gradient with weight 1- for online updating. where / is the number of iterations and a is hyperparameter. This approach intuitively optimizes the adversarial noise towards the shared vulnerability of S1, thus avoiding the gradient dilemma in So-
E-step. During the E-step, update q(= = 1) to p(= = 11 A,r) for given r. thereby eliminating the KL. divergence, which the gap between the objective and its lower bound. Notice that S₁ is defined as the largest set of é susceptible the same adversarial noise r", where usually r* * r. We can estimate p(2 = A, r) by approximating r" with by-products L (x + r) and V.Ca the observation of misclassification event A. Denote the difference between r* and r as Ar, the loss Ls (x + r*) w.r.t. y* can be linearly approximated since Ar is not excessively large, with both r and r* bounded by |1-IIp S E
in
(8) Higher loss increases the likelihood of misclassification, so we map Lo(x + +r*) to p(A r*) using monotonically increasing function a I + [0, 1]. By the definition of S1, r* compromises as many & possible. We find r" through the following optimization:
(r(=+r)) = Lo(2 + Ar TV Lo
r + Ar = r + arg max Ego (Ls +r) + Ar (m4,))
(9)
After determining r", the probability q(= 1) that ø belongs to S₁ can be estimated as (CC
Remark. We use the empirical average w.r.t. N instances o., i = 1, 1,...,NN NN in each iteration to estimate expectations. In the E-step, we optimize r" in a low-cost manner, as no model is involved. We reweight the gradient by oLo, (x + r*)) in the M-step and then use it in an off-the-shelf attack algorithm to update the adversarial noise The primary time cost arises from calculating the gradient V.L.o due to the complexity of the purification process. Section 3.1.2. we will describe how to reduce the O(N) complexity to (1) through gradient grafting.
4

---

Algorithm 1: DiftHammer
Input :Data (x,, y). classifier f with stochastic purification
Purification d
number of resubmit M, off-the-shelf attack algorithm
Classificr
Output:Roo Roobustness Rob in M resubmit attacks
Initialize y(();
for L To d do
Evaluation for iteration and imput for L itteratin;
Sample Φ1, = 1,,-,,,,,,,.....,.,,,, ;N;
gPäd
Hob(t-1) = Eval (r(t-1), M) I! for evaluation;
Record C/)) V(ti for // for attack;
grad
Purification db>
Classifier
E-step: identify the set with shared vulnerability;
gradz
Low
AF(1) arg max E. o(C + AF ( Cst): Co.):
x
qf = = A fo;)) /! probability of affiliation;
10
M-step: estimate full gradients' aggregation;
g(t) = Σ. qi ((() Co:/N /N aggregation & stage;
11
12
Select & according to Equation 11 representative di
Purification d1
9 Backuard (Ō(z + (0111) yy g()) // gradient grafting;
grad 0.2
Classifier
Lows
9 t-- "ggh (1 - ")g" ((()))) // stepwise update;
14
r (0 AttackAlgorithe (r (,-1t1),, ,0);
15
16 end
17 Rob (T) Eval (r()), M) with Φi, 1...",,... N
Figure 2: Illustration of efficient gradient aggregation.
18 return Rob (o ..)
3.1.2 Gradient grafting
To address the efficiency challenges in robustness evaluation for diffusion- purification, we aim to estimate the weighted gradient aggregation E; v)V.L. with minimal computational cost. Our approach aggregates low-cost approximate gradient V oe Lo, in the early stage estimate the weighted full gradient, which can be expressed as
N Σ 9= 1)V = Σ 9:12 1)
NV
Obi V Vor Lo. =
OΦ Σ q:(2
1)V de Co..
(10)
Or
Or
assuming 00r/0x can be approximated by 06/Ox. As illustrated in Figure 2 We first compute the weighted approximate gradient Σ (: o) which is then grafted onto for backpropagation to estimate the gradient expectation, reducing complexity in backpropagation + (x) to O(1). BPDA [ uses / to approximate 0d;/Ox,, offering computational simplicity but potentially compromising performance due to oversimplification. Our gradient grafting enhances estimation with additional backpropagation, achieving better balance between efficiency and effectiveness. Further related design details are discussed below.
E-step in @ stage. Although r" in E-step (Fquation 9 involves the full gradient Va our main interest is o (La + r* r*)). Therefore, we can optimize the stage of Φ rather than x to avoid dependence on the full gradient. We express Ař in the stage of d as AF o(x +r*) o(r +r). The optimization, aimed attacking as many á as possible, becomes max (c((tt))))))+++) Vo Cg). relying only the approximate gradient. We end up deriving o (Lo((I + r*)) from optimized Ar.
Choice of d. We aim select ó with representative vulnerability for backpropagation, whose adversarial noise can also affect other é. For a single-step attack on 6 with adversarial noise (VV&Lo (e.g. sign(V V Lx) in fox case), we choose & among di using the strategy:
arg max de(o,,)1,,.. .N) ColCo, (x + VVVo Coll
(11)
This consistent optimization goal of attacking as many & as possible maintains the shared vulnerability from the & stage to the x stage. The choice of & involves discrete optimization within a finite set, solvable by traversal when N is not very large.
5

---

3.1.3 Discussion
Our selective attack (targeting Si) enhances both the effectiveness and efficiency of the EOT-based attack (targeting So U Si). (1) The EOT-based attack is a specific instance of our algorithm when all @ share a common vulnerability. In this case, with So = 0, g(2 1) 1, our selective attack degenerates into an EOT-based attack without side effects. (2) The identification of S1 involves only approximate gradients, making it nearly cost-free. The grafting trick further increases the efficiency of gradient expectation. (3) The effectiveness of the selective attack arises from avoiding the gradient dilemma, which can cause EOT-basee attacks to fail even in simple binary cases.
Theorem 1 (Failure mode of FOT-based attacks, Proof in Appendix [. Suppose à can be divided into two sets, A and B. The loss functions w.r.t. r in these sets are defined as CA(r) == (P&EA (A r)) and La(r) := o (P (AA r)), which are T and m strongly concave, respectively. If the distance between their optimal points P(B)C /m where m == min ( P(A)mA, P(B)ma), the EOT-based allack is less effective than simple allack targeting either A or B.
and satisfies I|ra - ry ll >
When тл and rg are significantly different, S1 tends to be A or B, whereas the other becomes So and provides neutralized gradients. Empirical results indicate that the gradient dilemma is common in diffusion-based purification, highlighting the necessity of selective attacks.
3.2 In-loop N-evaluation
Traditional 1-evaluation is insuffi- cient for assessing the robustness of diffusion-based purification, particu- larly against resubmit attacks. As a stochastic defense, the model pro- duces inconsistent results for even the same queries, enabling attackers to achieve desired outcomes through re- submissions. In cases where attack costs are manageable and even sin- gle success is advantageous, e.g., lo- gin, defenders should focus the model's robustness over M resubmis- sions. Thus, propose using N- evaluation as a robustness evaluation protocol for two reasons:
100%
0%
100%.
90%
0%%
Attacked
100%
Aftacked
50%
60%
30%
20%
(a) DiffPure 22
(b) GDMP (26
(c) LM 3
Figure 3: Distribution of attack results (E : 8/255) for 1- evaluation (inner ring) and 10-evaluation (outer ring). 32.6%-
46.3% of the samples have unshared vulnerabilities, impos- ing underestimated resubmit risk in I-evaluation.
(1) As detailed in Theorem 2 1-evaluation are significantly biased in estimating M M-resubmit risk. Due to high stochasticity, it common for è to have unshared vulnerabilities, shown in Figure 3 Merely success or failure record I-evaluation fails to capture critical probability information for resubmit risk estimation. For instance, with DiffPure, 46.3% of samples have attack success rate (ASR) P(Si) E (0, 1), leading to a 17.9% overestimation of 10-resubmit robustness I-evaluation (Rob 41.7%, and Rob = 59.6%).
(1)
Theorem (Fsstimation of the resubmit risk, Proof in Appendix B.2). Let the sample's 's robustness in M resubmit attacks AI,... ,AM be denoted as Rob == P(Ai= A = -). There exists a uniformly minimun-variance unbiased estimator (UMVUE) for Rob if and only if the number of evaluation trials N Z M. When N M, the maximum likelihood estimator (MLE) tends to (N) overestimate Rob in expectation, i.e., E E(RobMLE)) 2 Rob.
(2) N N-evaluation can be integrated into the attack's loop without extra burden. Samples d; 1, ....... N serve both as an evaluation for the previous iteration and input for the current, which will not cause information leakage, as each evaluation involves unseen instances.
Our DiffHammer framework integrates selective attacks and N-evaluation, as detailed in Algorithm
I Notably, our N-resubmit robustness extends the traditional 1-submit metric to better assess risks in real-world deployments, orthogonal to our attack algorithm's 's design. Consequently, DiffHammer offers more comprehensive risk assessment and enhances attack effectiveness across various metrics.

---

Table 1: Performance of attacks against diffusion-barte purification on CIFARIO. Metries include /yg./Wor. Rob, (%) and iterations (it.) taken to reach 90% best performance (in parentheses, failure to reach noted as N/A). Attack algorithms include SOTA white-box attacks with EOT: BPDA [
PGD 21. AA 4 DA K. and DiffHammer (DH, ours); and transfer-based attacks (denoted by f):
DMI 29
TMI VMI 27). SVRE 30
Defense Metrics
DiffPure
GDMP
IMM
Avg.Rob (it.)
Ron (it)
Avb.Rob (it.) Wor. (it.))
Avg.Rob (it.))
Wor. Rob (it.))
Clean
90.98
76.56
93.26
83.79
87.77
74.61
foo 4/2255
BPDA
76.27 (N/A)
40.82 (126)
80.61 (N/A)
52.34 (137)
69.57 (N/A)
38.67 (N/A)
DA/AA
71.52 (N/A)
40.04 (118)
73.52 (N/A)
50.78 (44)
46.29 (N/A)
25.78 (N/A)
PGD
69.80 (125)
41.02 (114)
72.32 (N/A)
50.00 (44)
40.55 (N/A)
20.90 (89)
DH
66.62 (26)
35.16 (26)
68.36 (18)
47.27 (13)
29.63 (21)
14.45 (16)
BPDA
70.74 (N/A)
36.72 (N/A)
80.57 (N/A)
51.95 (N/A)
55.27 (N/A)
27.54 (NIA)
DA/AA
57.60 (N/A)
33.79 (N/A)
52.83 (N/A)
37.70 (N/A)
32.56 (N/A)
17.97 (NIA)
80 8/255
PGD
52.73 (N/A)
31.05 (112)
49.41 (N/A)
36.91 (N/A)
17.99 (31)
9.38 (31)
DH
42.54 (20)
22.66 (17)
41.64 (17)
27.54 (13)
16.15 (17)
8.01 (14)
DMI
45.64 (41)
25.20 (35)
43,40 (31)
32.42 (27)
38.81 (N/A)
23.83 (N/A)
TMI
45.04 (39)
25.20 (38)
45,43 (37)
34.77 (30)
41.13 (N/A)
25.59 (N/A)
VMI
50.55 (N/A)
28.71 (44)
50.76 (NZA)
37.11 (44)
21.97 (39)
11.72 (32)
SVRE
59.12 (N/A)
32.81 (N/A)
60.37 (N/A)
42.77 (N/A)
36.11 (N/A)
19.53 (136)
BPDA
79.36 (N/A)
45.31 (110)
86.41 (N/A)
58.40 (N/A)
75.02 (N/A)
46.68 (147)
:05
DA/AA
79.92 (N/A)
46.29 (121)
85.80 (N/A)
59.57 (N/A)
74.96 (N/A)
46.48 (135)
PGD
78.38 (N/A)
44.53 (100)
83.57 (N/A)
56.25 (96)
72.91 (N/A)
43.95 (75)
DH
74.49 (46)
41.41 (44)
78.83 (46)
53.12 (46)
68.54 (38)
41.02 (39)
Experiments
4.1 Experimental Setup
We evaluated the robustness of three diffusion- purification defenses: DifiPure [2]. GDMP (26), and LM 3 For purification, we used a pre-trained score-based based diffusion model [4 in DiffPure and GDMP and an EDM model [14) in LM. To ensure a fair comparison, we employed the WideResNet-70-16 16 32 the classifier across all tests.
Baselines.
We selected three state-of-the-ar attack algorithms equipped with EOT 2 for baseline evaluation: BPDA D. PGD (21] and AA [4]. For DiffPure and GDMP, AA was upgraded to DA [13 by incorporating deeviated-reconstruuce
loss. Our Difthammer adopts AA as the default attack algorithm. We conducted three restarts totaling 150 iterations to thoroughly evaluate the robustness of the model. Additional configurations for defense and attack are detailed in Appendix C. Substitute gradient attacks 22 31 tailored to diffusion-based processes are found to be inferior to PGD with full gradients [6], so we leave comparisons with these methods in the Appendix C.4 Additionally, we evaluate verifiable DiffSmooth classifiers 34), and the results presented in the Appendix
Evaluation metrics. Consistent with prior work, we use subsets of the CIFARIO 15), CI- FARI 100 [1), and ImageNettete [12] (a subset of 10 easily classified classes from Imagenet [6] more suited for robustness evaluation) with sizes of 512, 512, and 256 as datasets, respectively. The evaluation protocol is N-evaluation with N 10, with the average robustness (Avg.Rob,
1 E,, /NS) and worst-case robustness (Wor.Rob,
Σ, (max, A("))/S) as metrics. Here A( indicates whether sample j was attacked at the i-th evaluation, and S is the dataset size. We also reported the iterations taken to reach 90% of the best attack effect among all attacks as metric of efficiency. Experimental results for CIFAR 100 can be found in Appendix C.2 and adversarial samples visualization are shown in Appendix C.9

---

Table 2: Performance of attacks against diffusion- purification on ImageNettete [2].
Defense
Difffure
22
GDMP 226
LM
Metries
Avg.Rob (it.) Wor (it.).
Avg.Rob (it.).
Wor (it.)
Avg.Rob (it.)
Wor.oob (it.))
Clean
97.03
95.31
97.11
94.53
96.41
94.53
4/255
BPDA
58.98 (N/A)
50.78 (N/A)
57.66 (N/A)
51.56 (N/A)
28.28 (28)
22.66 (21)
DA/AA
53.12 (N/A)
46.09 (N/A)
46.64 (N/A)
39.06 (N/A)
51.41 (N/A)
42.19 (N/A)
PGD
54.30 (NIA)
46.88 (N/A)
48.28 (N/A)
38.28 (N/A)
55.31 (N/A)
45.31 (N/A)
DII
38.36 (14)
31.25 (11)
33.98 (11)
28.91 (14)
26.25 (14)
21.88 (11)
192%
1304
100%
02%
30%
100
03%
50%
42%
475
40%
EFDA
PGD
D1
Vixe.
PG0
211
(a) DiftPure
(b) GDMP 26
(c) LM
Figure 4: Avg. and Ror for the first 75 steps of different attacks with foo 8//25..
4.2 Effectiveness and efficiency DiffHammer
We examine the effectiveness and efficiency of various attack methods under different settings, with results for CIFAR and ImageNettete presented in Table [[] respectively. Our findings are as follows. (1) DiffHammer shows superior attack effectiveness across datasets and different norms (Lo,, E2) or attack budgets. This effectiveness arises from selective gradient aggregation, which avoids the gradient dilemma. Its performance improves significantly in high-stochasticity scenarios with pronounced gradient dilemmas, e.g., large-scale datasets like ImageNettete or GDMP with multiple purification rounds. (2) As shown in Figure | (other settings can found in Appendix C.5 HimmHr typically requires only 10-30 iterations to reach near-optimal results, allowing for rapid model robustness assessment. Other methods might occasionally bypass sampling from So for similar effectivenesss, which incurs unnecessary computational costs. (4) Most models show robustness below 50% with 10 resubmits, indicating that a limited number of resubmits can undermine diffusion-based purification, raising concerns about their reliability in practical applications.
4.3 Gradient dilemma and transfer-based attack
We verify the gradient dilemma in diffusion-based purification by examining clustering effects and forgetting phenomena. Our EM algorithm clusters the gradients V,Ca into Sy and S. The distribution of silhouette coefficients (SC) using cosine similarity. indicates that gradients in these sets differ significantly. A direct result of this gradient dilemma is atlack forgetling-wher gradients V VzLa in consecutive iterations are inconsistent, causing the effects previous attacks to forgotten. As the ASR in DiffHammer maintains attack consistency by identifying SJ, thus enhancing efficiency. We provide a toy example explaining the gradient dilemma in Appendix C.6 This dilemma may arise from a non-clustered data distribution (e.g., different breeds of dogs in the dataset), which imposes divergent gravitational pulls for purification and inconsistent perturbations needed to corrupt their features.
displayed in Figure [[a)
iteration shown Figure 5(b)
Transfer-based attacks offer a potential solution by treating adversarial samples like models and aiming to improve generalization on dataset of Φ. As shown in [T] Data augmentation based approaches, DMI 29 and TMI [8], provide improvement in some cases. VMI [27] and SVRE [30] which aim to reduce gradient variance, perform worse. This unexpected outcome attributed to the gradient dilemma: generalizing to ø from S is beneficial, while generalizing to ø in So may be harmful. Thus, DiffHammer acts as data-selectinn approach, contributing to data-centric design in transfer attacks.
8

---

Table Effectiveness (Avg.Rob/ Wor.Ro,, %) of different attacks on robust model with purification
under 2o 8/255 settings, including TRADES [33 and AWP 28
The original adversarial
robustness (Rob) without purification listed in parentheses.
Classifier
AWP 28
(Avg.Rob/ / Wor,ob, Rob:60.0) 4
TRADES 33
(Avg.Rob/ Wor.Rob, Rob:53.1) 4
Purification
DiffPure 22
GDMP [66
LM B
DiffPure 22
GDMP [26]
LM [
BPDA
53.53 / 35.15
58.40 45.70
56.87 / 42.38
50.50/ / 31.82
54.98 / 41.38
53.15 39.26
PGD
53.30/ 36.32
58.57
47.26
69.37
56.84
50.70 35.54
52.73
41.60
64.37 52.54
DAAA
51.75 35.54
58.71 / 47.85
65.27
/ 52.34
49.27 34.37
52.65 42.38
59.78 / 49.02
DH
53.65 / 35.55
58.26 / 45.68
56.48
40.43
49.55
34.37
51.57 /4140
53.10 39.64
272
COMP
DiffPhrne
00
GDMP
DiffPure
3.0
LM
3.5
60-
1.0
ASR
6.75
20
1:5
62h
600
BPDA
DA/AA
PGD
DH
DM1
TMI
VMI
SVRE
Sibouette Conficient
Attacks
(a) Distribution of SC in Su, S₁
(b) Attack successful rate (ASR) in previous (t 1) iteration.
Figure 5: Clustering effects and forgetting phenomen in gradient dilemma (Ex0 : 8/255)..
4.4 Robust classifier
Diffusion-based purification has been explored to enhance the robustness of adversarially trained (AT) models [22]. We revisited this concept using N-evaluation with TRADES 33 and AWP (28 as AT classifiers, as shown in Table 3 Our observations are as follows: (1) Robust models mitigate the
gradient dilemma, resulting in similar performance for most attacks. This occurs because adversarial training implicitly regularizes the approximate gradient VoLo [23]. reducing the full gradient V,Ca of some towards zero. DiftHammer remains effective evaluation tool, iiffusion-based purification occasionally reintroduces the gradient dilemma. (2) In most cases, Iiffusion-based purification weakens the robustness of the AT model. It improves robustness in few instances but increases the risk of resubmit attacks by 11.7%-24 24.8%. Therefore, finding a better combination of diffusion-based purification and robust classifiers remains an open question.
4.5 Ablation study
We conducted ablation experiments on different components in the default settings (grafted gradient 00/OnE(qs V VoLo), a = 0.5, N 10), with results shown in Table The use of a selective approximate gradient E(g, voC leads to sig- nificant performance drop, highlight- ing the importance of the purifica- tion gradient 0ø/Oz attacks. The grafted gradient causes only slight per- formance degradation compared the full gradient E(qs Lo) but avoids a 10x time burden. We quantify the time cost of different approaches the Appendix C.7 smaller hyperparameter a makes the algorithm rely more on the current iteration's 's gradient, and an appropriate a 0.5 achieves a better tradeoff in memorizing and learning. We tested effectiveness at 10-evaluations with N samples of o, finding that proper N 10 efficiently identifies S for
Table 4: Performance difference (Avg.Rob/ / Wor:Rob, %) from default settings with Loo 8/255,
Ablations
DiftPPre 22
GDMP (26
LM 3
Eg V
+27.44 / +12.70
+30.02
+17.33
+41.29 /
Bq V.C
-3.52/-1.1
-3.09 -1.35
a = 0.2
+2.19 +1.37
+0.33/ /0.39
+1.17 40.59
a = 0.8
-0.16/ -0.39
+0.63/+1.
+1.23 1 +1.17
N
+1.44/ +2.34
+1.52/42.77
+7.48 / +4.89
N 20
-1.41/-1.77
-0.47 /0.59
-0.51/0047

---

evaluation. When N = 20, attack effectiveness is slightly boosted with more time overhead. The importance of N N-evaluation for resubmit risk estimation is verified the Appendix C..8
5 Discussion and Insights
Diffusion models remain a promising solution to the adversarial samples due to their fine-grained modeling of data distributions. We advocate for enhancing the robustness of diffusion-based purifi- cation through standardized and powerful evaluation methodologies. Here are some insights into purification-bast based defense and attack:
(1) For deploying stochastic defenses, defenders should consider the potential number of resubmissions MM by attackers and are advised to assess resubmit risk with N N-evaluation where N 2 M. Additionally, robustness overestimation due the gradient dilemma can be avoided by using selective attacks.
(2) On the attack side, adversarial samples are sensitive to defenses with high stochasticity. Thus, modern data-centric designs may help to enhance adversarial transferability.
(3) On the defense side, the goal of stochastic defense is to achieve P(S)) + 1, meaning sample x cannot be attacked for some purifications and cannot be attacked by a same adversarial noise for others. Therefore, purification needs to be coordinated with adversarial training at a more granular level.
Related Work
Evaluation for adversarial purification. test-time adaptive defenses, the iterative process and stochasticity of diffusion-bbat based purification complicate robustness evaluation. Typically, evaluation protocols report only the ASR from a single evaluation. The risk of resubmit attack, referred to the nag factor, considered in [20] but is not fully explored. Regarding evaluation methods, although there are gradient estimators AdjArtack and attacks score-attack based on the characteristics of the diffusion process, both found to be inferior attacks based on the exact gradient [16), such as PGD 21], AA 4 or DiffAttack [33 with reconstruction loss. These methods mitigate stochasticity through the EOT 2 which inevitably inherits its shortcomings.
Trase attacks. Transfer-based attacks aim to generalize attacks from seen defenses to unseen defenses. Data augmentation and improved optimization are the main approaches to enhance transfcrability. Attackers can craft adversarial noise resistant to defenses through input transformations [29] and gradient smoothing (8). In the presence of multiple defenses, momentum (7], variance reducing (27 30) enhance generalizability. Most wranffr-based attacks assume that most defenses share vulnerabilities, enabling generalization in defenses, but this assumption may be invalid in biffusion-based purification.
Conclusion
In this paper, we address the limitations of EOT-based attacks in diffusion-baan -bsse purification, at- tributed to the gradient dilemma, by introducing an effective and efficient method called DiffHammer. First, we propose selective attack strategy that targets vulnerable purifications without encountering the gradient dilemma, enhancing evaluation efficiency through gradient grafting. Second, we incorpo- rate N N-evaluation within the loop to quantify the risk of achieving at least one successful attack in practice. We demonstrate DiffHammer'ss 's superior performance through comprehensive experiments and anticipate it will offer valuable insights for future designs of robust diffusion-baate purification methods.
Acknowledgements
We would like to thank the anonymous reviewers for their valuable suggestions theory and experi- ments. This work is supported by the Project of Hetao Shenzhen-HK HKUT Innovation Cooperation Zone HZQBKCZYB-202000
10

---

References
[1] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learming, pages 274-283, PMLR, 2018.
[2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adver- sarial examples. In International conference machine learning, pages 284-293 PMLR, 2018.
[3] Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu, Robust classification via a single diffusion model. arXiv preprint arXiv:2305. 152441, 2023.
[4] Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning. pages
PMLR, 2020.
[5] Arthur P Dempster, Nan M Laird, and Donald B Rubin. Maximum likelihood from incomplete data via the em algorithm. Journal of the royal statisfical society: series B (methodological), 39(1):1-23 1977.
[6] Jia Deng, Wei Dong. Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. Icce, 2009.
[7] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185-9193, 2018
[8] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by ceasslaioo-invariint attacks. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pages 4312-4321, 2019.
[9] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6572 2014.
[10] Dongyoon Han, Jiwhan Kim, and Junmo Kim. Deep pyramidal residual networks. In Proceed- ings of the IEEE conference on computer vision and paltern recognition, pages 5927-5935, 2017.
[11] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances neural information processing systems, 33:6840-666 00884066551,,, 2020.
[12] Jeremy Howard and Sylvain Gugger. Fastai: layered api for deep learning. Information, 11(2):108, 2020.
[13] Mintong Kang, Dawn Song, and Bo Li. Diffattack: Evasion attacks against diffusion-based adversarial purification. Advances Neural Information Processing Systems, 36, 2024.
[14] Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. Advances in Neural Information Processing Systems, 35:26565-26577, 2022.
[15] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[16] Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion siffusion-based adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 134-144 144, 2023.
[17] Brich Leo Lehmann and Henry Scheffé. Completeness, similar regions, and unbiased estimation- part i. In Selected works of EL Lehmann, pages 233-268. Springer, 201 1.

---

[18] Percy Liang and Dan Klein. Online em for unsupervised models. In Proceedings of human language technologies: The 2009 annual conference of the North American chapter of the association for computational linguistics, pages 61 1-19, 2009.
[19] Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.0300 2022.
[20] Keane Lucas, Matthew Jagielski, Florian Tramer, Lujo Bauer, and Nicholas Carlini. Ran- domness in ml defenses helps persistent attackers and hinders evaluators. arXiv preprint arXiv:2302.133 13464, 2023.
[21] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint orXiv:170600608. 2017.
[22] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.0744:4 2022.
[23] Andrew Ross and Finale Doshi- Velez. Improving the adversarial robustness and interpretability of deep neural networks by regularizing their input gradients. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 32, 2018.
[24] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:201 1. 13456, 2020.
[25] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 131.v 2013.
[26] Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. arXiv preprint arXiv:2205. 14969, 2022.
[27] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924-1933, 1933, 2021.
[28] Dongxian Wu, Shu-Tac Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. Advances in Neural Information Processing Systems, 33:2958-2969 2020.
[29] Cihang Xie, Zhishuai Zhang. Yuyin Zhou, Song Bai, Jianyu Wang. Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pages 2730-2739, 2019.
[30] Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferabilityy In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 14982-14992,
2022.
[31] Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference on Machine Learning, pages 12062-12072. PMLR, 2021.
[32] Sergey Zagoruyko and Nikos Komodakis. 1rXiv:165..07444 2016.
Wide residual networks.
arXiv preprint
[33] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472-7482. PMLR, 2019.
[34] Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, and Bo Li. {DiffSmooth): Certifiably robust learning via diffusion models and local smoothing. In 32nd USENIX Security Symposium (USENIX Security 23), pages 4787-4801 2023.
12

---

A Broader Impact and Limitations
Broader Impact. The vulnerability of deep neural networks adversarial samples limits their broader application. Diffusion-based purification has shown surprssing robustness against EOT- based attacks, making promising defense. In this paper, we identify that EOT-based attacks often overestimate model robustness due to the gradient dilemma. Additionally, traditional 1- evaluations are insufficient for assessing resubmit risk in stochastic defenses. We propose an effective robustness evaluation framework, DiffHammer, which circumvents the gradient dilemma and incorporates N-evaluation. Our selective attack approach applies stochastic defenses beyond diffusion-based purification, enhancing the understanding of stochasticity in robustness and inspiring improved adversarial defenses. Our Neevaluation method uncovers resubmit risks diffusion-based purification, providing comprehensive insights into potential threats from stochastic defenses and informing precautionary measures. Furthermore, we enhance attack efficiency through gradient grafting, enabling rapid iteration of attacks and defenses. We believe that the insights and techniques introduced in our work will guide the development of more robust diffusion-ber based purification methods, ultimately enhancing the security of machine learning systems.
Limitations. In this work, we present a new attack algorithm called DiffHammer that is effective against diffusion-basse purification defenses. While this has potential misuse in safety-critical domains like healthcare or finance, the core insights uncovered could also inform the development of more robust diffusion- -based defenses going forward. Specifically, we introduce a selective attack strategy to overcome the challenge of the gradient dilemma. However, the underlying reasons behind this gradient dilemma are still not fully understood. Our experiments are limited to image classification, and while our approach can extend to other tasks, specific task-related designs need exploration. Overall, this research uncovers vulnerabilities in current diffusion-basee defenses, but the findings could also spur innovations to make these defenses more secure in the future.
B Proofs
B.1 Proof of Thm. 1
Theorem (Thm. 1 in the main text). Suppose d can be divided into two sets, A and B. The loss functions w.r.t. r these sets are defined as La(r) == - r)) and Lb(r) == a (PPEB((A [)), which are m and m strongly concave, respectively. If the distance between their optimal points A and I' satisfies || - r 8 ( (r),,, (r where m = min ( pm P(B)m the EOT-based attack is less effective than a simple attack targeting either or B.
Proof. The obejective for EOT-based attacks is max, P(A)La(F) + (p)) while the obejec- tive for attacks targeting either A or B is max, ((A) or max, ((B) and the optimal points are F and r,, respectively. For any r E Rd, there exist E R s.t. r = TA + 0(r TA). Therefore, the following inequality holds:
+ ( S (MA)C((ra++PBBCCCCA)) +
P(A)MA 2
r P(B)mB
|| |r-rBli (strongly concave)
2
2max/PPAAC..Cr.)PPPPBCC. m((lr 112 + ||r rnll12)
2max(PPA)CC(rs))PPBBCCC0))) m102 + +(1 , rr r (r=rA + A(r rA))
< 22max 2m (2max(PRAACACrs))PPBCCaaaa 100--mm10 m||ra- - - (00² + (1 - 0 2 1
}
< (AAx((())Ca(r)))PPPP)) (condition on ||a r 112)
(12)
13

---

B.2 Proof of Thm. 2
Theorem (Thm. 2 the main text). Let the sample's robustness in resubmit attacks A.,.... An be denoted Rob := P(A1
Am 0). There exists uniformly minimum-variants unbiased estimator (UMVUE) Rob if and only if the number of evaluation trials N 2 M. When
N S M, the maximum likelihood estimator (MLE) tends to overestimate Rob in expectation, i.e.,
R Rob (RobLLE) Rob.
(N)
Proof. First, we provide detailed proof for the uniformly minimum -aarinnce unbiased estimator (UMVUE) case, where we shall use the Lehmann- Schhefééé theorem.
Theorem 3 LLehmann-Schefft theorem (7)). Let XI,... .NN N be random variables from unknown distribution fx;; 8) where 8 E Ω is a parameter in the parameter space. Suppose T(X) is sufficient and complete statistic. If and only condition for m(T) be UMVUE of g(0) is that Eg (T) = g(t).
We denote the results of N resubmissions as AI,... Av. and the probability of successful attack for each resubmission as Then A1. Ay follows Bernoulli distribution, i.e. A,, uid Bin(1. p).
According the definition, Rob (1-p) >d Since the Bernoulli distribution is one of the exponential family of distributions, the sample sum Di=1 A, known be the complete and sufficient statistics. Naturally, we have
(1 A1) ... (1 Am)) = (1 - p)M,
(13)
If N 2 M, the conditional expectation can be written as
E [1 A1)
AM) A + +... .N = n)
= = -...= 0 A + A...AN n) = n /
(14)
which do not depend on p since the sum Ai AN is sufficient, and therefore can be used as an estimator according to Rao-Blackwell Theorem:
(N) Roby = (MTM)/
(15)
Due to the uniqueness of the UMVUE, the estimator is only available when N 2 M.
Next, we show that when N < M, the maximum likelihood estimator (MLE) tends to overestimate
(N)
Rob in expectation, i.e., IE ((RobaLe) > Rob. Following the notation above, the MLE estimator for
is ra/N Due to the transformation invariance of the MLE, the MLE estimator for Rob == (1 p) (1 n/N)a M; here follows binomial distribution Bin p). Therefore. the expectation of the MLE estimator is
N
E( ( = E(1
T
Σ k=
N-
K )M
N
N
(16)
k N
=11
(1-p))~
M (1 p) 2 (1-p))
Therefore, estimating resubmit risk with MLE requires a larger N. When N < M, MLE will underestimate such risk. When N goes larger, the MLE estimator is asymptotically normal. Since
VN(n/N - p) - (0, - p)). the Delta method given function g(p) = M implies
(N) VN(g(n/N)-ske 4 NO p(1 p)g (p)²), Rob is asymptotically normal:
/ Vi(RobILLE Rob) d, No0, M p(1 22)2M11)
(N)
(17)
14

---

C Experiments
C.1 Experimental Configuration
C.1.1 Defense configurations
DiffPure
22
DiffPure adds noise to potentially adversarial samples through the forward
process:
Zt- Vār vI E
(18)
where o4 is predefined scheduler and a₁ II 0s₁, 6 a standard Gaussian noise from W/0, 1).
The reverse process gradually removes the Gaussian noise along with the adversarial noise:
04 co (zt, t) +
It-1
Zt
(19)
a4
where (0(2), () is parameterized neural networks, is standard Gaussian noise in each step and standard deviation o; 1-6r-1
1-aa 11- a1)
In the experiment, t" is set to 0.1 (lxo) and 0.075 (62) in CIFAR [1]. and in ImageNettete [2]. is set to 0.05. We use the surrogate process proposed in [16], i.e., applying different time intervals in attack and defense improve the efficiency. The time interval for the attack is set to 0.01 (CIFAR, Eoo ImageNettete), 0.015 (CIFAR, f2). The time interval for defense is set to 0.002 (ImageNettete), 0.005 (CIFAR).
GDMP (6).. Compared to DiffPure, GDMP adds gradient guidance image similarity D(r,, me) in forward and reverse processes preserve semantic information. The update of 2x-1 can be written as:
1 at co(xx,,) t) - so V., D( 2v) + 0,2
x4
(20)
Vat
1 āi
where is scale of guidance and Iv Vārzo + vI c.c. In addition, GDMP observes that multiple rounds of purification with smaller t" help to improve robustness.
In the experiment, t" is set to 0.036 in CIFAR 15), and 0.03 in ImageNette 12 The rounds of purification are 4 and 2, respectively. The time interval for the attack is set to 0.006 (CIFAR) and 0,003 (ImageNette). The time interval for defense is set to 0.003 (CIFAR), 0.001 (ImageNette).
LM (3. LM is the preprocessor in the robust diffusion classifier (RDC) that maximizes the lower bound of the log-like ligliiildhood through the following optimization process:
min E., ||c co(ie, 12,
s.t. | Tollo Sn n.
(21)
where à; = 5tr St + -- ā and is a predefined threshold.
The above optimization in the experiment was solved by the projected gradient method with step size of 0.1 and iterations. is uniformly sampled from uniform distribution 0.4-0.6. It is worth noting that the RDC consists of the LM and a diffusion classifier (DC). We find that the purifier LM not sufficient to provide reliable robustness. We conjecture that the robustness of RDC mainly stems from the diffusion- based classifier.
C.1.2 Attack configurations
Each attack is performed with three restarts, consisting of 50 iterations per restart, totaling 150 iterations. Samples with an attack success rate below 50% are restarted to save time. We utilize the APGD 4 as the update algorithm for DiffHammer and BPDA [ The step size in PGD [1 set to 0.007, and the momentum coefficient is set to 1. In VMI 27 and SVRE 30 we replace the gradient sampled from the neighborhood for variance estimation with approximate gradients sampled adapting to stochasticity defense. Other attacks employ default parameter settings.
15

---

Table 5: Performance of attacks against diffusion-baseds purification on CIFARI00.
Defense
DiffPure
22
GDMP 226
LM
Metries
Avg.Rob (it.)
Wor (it.).
Avg.Rob (it.),
Wor (it.)
Avg.Rob (it.)
Wor.Rob (it.))
Clean
53.18
26.52
64.20
40.23
68.09
46.29
Lx 4/255
BPDA
32.77 (37)
6.45 (7)
44.80 (N/A)
14.65 (16)
41.45 (12)
19.34 (7)
DA/AA
30.57 (18)
5.47 (5)
41.09 (26)
14.84 (11)
47.58 (N/A)
20.90 (20)
PGD
30.49 (16)
5.66 (5)
40.94 (24)
14.65 (11)
48.57 (N/A)
21.0 (20)
DII
27.83 (10)
4.69 (4)
37.64 (9)
12.50 (4)
41.11 (11)
18.75 (5)
Table 6: Performance of attacks against DiffSmooth
34
CIFARIO.
Defense
82 0.5
1.0
Metries
Avb.Rob (it.)
Wor (it.)
Avg.Rob (it.)
Wor (it.))
Clean
84.63
74.02
70.31
42.19
BPDA
74.40 (N/A)
53.13 (N/A)
49.84 (96)
12.50 (22)
DA
74.22 (N/A)
53.91 (N/A)
50.59 (123)
13.67 (38)
PGD
66.04 (89)
46,29 (82)
47.05 (39)
10.74 (29)
DH
63.18 (42)
42,58 (46)
45.29 (31)
10.16 (21)
C.2
Experimental results CIFARI00
We evaluate the effectiveness of various attacks on diffusion-based purification using CIFAR-100 15] Unlike its predecessor, CIFARIO, which had 10 categories, CIFAR 100 contains 100 categories, providing a greater fine ane-grained classification challenge. For consistency, we employ the EDM unconditional diffusion model [14] as the purifier and pre-trained PyramidNet [10] as the classifier. Given the increased complexity, we set the attack budget to 4/255. As shown in Table [5) DiffHam- mer consistently achieves superior attack results and efficiency across all settings, indicating the persistence of the gradient dilemma in finer-grained purification.
Notably, finer classifications diffusion-based purification even demonstrating less than 50% robustness without adversarial attacks. This may be due current diffusion models' limitations in fine-grained generation, potentially introducing vulnerabilities during reconstruction. Thus, designing diffusion models with enhanced alignment for improved robustness in fine-gra ane-grained classification remains an open challenge.
benefit less from -alusioon-baeed purification, with classifiers with
C.3 Experimental results on DiffSmooth
DiffSmooth 34] enhances certified and empirical robustness through a purified classifier in the inner loop and a sampling-basee based certification process in the outer loop. Since certified robustness provides a theoretical lower bound on model robustness, we focus on attacking the inner-loop purified classifier. moft'mooth's 's purification mechanisms involve single-step purification and majority voting, which can mitigate the risk of resubmission. Unlike DiffPure, DiffSmooth uses single update:
Zt- = Var-zo + VI Cg-C
(22)
(Er-
v1 "r-
Var.
where t' satisfies o²-0² 2 (1 (1)) and o is a predifined noise scale. DiffSmooth applies local smoothing through Gaussian sampling in the neighborhood of purified in. and results are determined by majority voting with scale a':
m
y = arg max
lão + 6,), 8, 0~,,0000))
(23)
16

---

Table 7: Performance of substitute gradient based attacks against diffusion- based purification on CIFAR1O.
Defense Metrics
DiffPure 22
GDMP
22
LM
B
Rvb.
Wor.Rob. +
Wor.Rohl. Avg.Rohl
Rob.R
Wor.Rob
//255
Score 31
77.70
43.36
82.46
56.84
64.04
39.06
Full [3
64.24
37.11
62.46
44.92
46.88
26.95
Adjoint
22
58.61
32.03
57.66
40.43
N/A
N/A
DH
42.54
22.66
41.64
27.54
16.15
8.01
Random smoothing models are primarily used defend against adversarial noise under the & norm. We compared the impact of different attacks Dift'Smooth with settings of & 0.5 and lz 1.0. For the l2 : 0.5 setting, we used a = 0.5, o' = 0.25, applying ResNet-1 smoothing as the classifier. For the 1.0 setting, o 0.25, o' 0.12, with SmoothAdy-trained ResNet-110 as the classifier. A pretrained score-based diffusion model 24 acted as the purifier. As the result shown in Table majority voting found suppress the gradient dilemma, reducing DiffHammer's s impact, though it still achieved better attack results with significant efficiency gains.
10 trained with Gaussian
While majority voting defends against occasional resubmissions, it also poses challenges: (1) It can make the stochastic defense model resemble deterministic one, potentially reducing stochasticity benefits. (2) It imposes significant time burden, intensified by the diffusion process's 's duration. DiffSmooth mitigates this with single-step purification, but this results in more fragile purification.
C.4 Comparison with substitute gradients
Stochastic and iterative algorithms for diffusion based purification yield challenging gradients com- putation, so line of works aimed at approximating gradients in attack algorithms. This includes the Adjoint method [22] and Joint methods (score/ / full) [31].
Adjoint method obtain the gradient V.L- which is solved as:
Var- Va, L throuuhh augmented SDE of Equation 5
= sdeint ( (v)C)
f. w. 0,
(24)
where sdeint an SDE solver that sequentially takes six inputs: initial value, drift coefficient, diffusion coefficient, Wiener process, initial time, end time; and
f(x, t) of(a.t) 2
f( f( z),t)
g(
g(()
O₂
w0 - t)
(())
w
with 1, and O, representing the d-dimensional vectors of all ones and all zeros, respectively.
The gradient in the joint attack (score) is a weighted sum of the approximate gradient and the estimated score function:
sign V, Asign[s>( (1 A)sign( VoL),
(25)
where so(x)) is the estimated balance factor set as 0.5 in the evaluation. The gradient in the joint attack (full) utilizes the difference between the original sample and the purified sample:
function V. log p(z), V is the approximate gradient, and is
sign( V C) Asign|ø(z) x| + (1 A)sign(V
(26)
While substitute gradient methods can produce gradients based on diffusion purification with lower time complexity, they have been found to inadequately evaluate robustness [16] [3]. We assess the
17

---

192%
1009
97%
Wee
V01
975
UM
V18
S08t
42%
477
40%
22%
20%
(a) DiffPure
(b) GDMP 26
(c) LM
Figure 6: Avg. Rob and Wob for the first 75 steps of transfer based attacks in CIFARIO with Loo 8/255.
1926
1.314
110%5
6.2
41%
079
87%
4079
40.
37
20
0%
10
23
0%
20
10
(a) DiffPure
(b) GDMP 26
(c) LM 3
Figure 7: Avg.Rob and Wor.Rob for the first 75 steps in CIFARIO with coo 4/255.
97%
97%
47%
87%
27%
2750
PUTLA
POD
P013
DH
2014
(a) DiftPure 22
(b) GDMP 26
(c) LM
Figure 8: Rvb. and Wor.Rob for the first 75 steps in CIFAR10 with 0.5.
PDD
PSD
Ang
40%
42%
411
4055
27%
20%
20%
(a) DiffPure
(b) GDMP 26
(c) L.M 3
Figure 9: Avg.Rob and Wor.Rob for the first 75 steps in CIFAR100 with too 4/255.
192%
135%
100%
428
47%
47%
20
30
0%
10
0%
30
(a) DiffPure [22
(b) GDMP 26
(c) LM
3
Figure 10: Rob and Wor for the first 75 steps in ImageNette with t0o : 44/255.
18

---

(a) Illustration of toy example
(b) Proportion of S
Figure 11: toy model of Gaussian mixing. Diffusion-baas based purification can be attacked toward unclustered features, leading to inconsistent gradients.
effectiveness of substitute gradients across different defenses, as shown in the Table 7 The substitute gradient fails to achieve 90% of DiftHammer effect in all settings, indicating notable overestimation of model robustness. Specifically, the joint attack (score/full) only enhances the approximate gradient by the difference between samples and score function, lacking information from the diffusion process. Although the adjoint method theoretically provides an accurate gradient, in practice, numerical errors accumulate, leading to inaccurate estimates.
To address this, we utilize computational graph reconstruction proposed in 13 to obtain accurate gradients for DiffPure [22 and GDMP (26]. We progressively backpropagate the gradient by saving intermediate variables during iterations. Additionally, we derive the gradient the optimization process in LM [3] using the Hessian vector product trick. This approach enhances existing gradient- based attacks with accurate gradient computation, establishing more reliable baseline.
C.5 Attack process with different settings
We present performance curves of the attack under various settings. Figure T compares DiffHam- mer with a transfer-based attack, showing that DiftHammer achieves superior results and faster convergence. Momentum- based attacks like DMI (29) and TMI [8] demonstrate good efficiency. However, transfer-basee attacks yield sub-optimal results due to attempts to generalize across all purifications. Figure 7 and illustrate performance curves under different constraints (Exc : 4/255 and & 0.5). Notably, DiffHammer significantly improves performance and efficiency under the lx : 4/255 setting. With a limited attack budget, DiffHammer leverages the EM algorithm's 's fast convergence to quickly identify vulnerable set of Φ. In contrast, attack performances are more similar under the f2 0.5 setting, likely because the & constraint allows greater attack intensity on certain pixels, targeting shared vulnerabilities. revealing that Dimmrr excels in the ImageNette task, where complex purification processes seem more prone to introducing gradient dilemmas.
(anure/aandTTo TO attack effectiveness across datasets,
C.6 Toy example of the gradient dilemma
To investigate the origins of the gradient dilemma, we constructed Gaussian mixture toy example where the two diagonal components belong to the same category shown in Figure] [[ We use ReFlow [19 as our diffusion model to produce near-linear purification trajectories. In this scenario, diffusion-based purification pulls samples slightly towards the origin (dashed line in Figure before diffusing them back into the data distribution (pink line in Figure [a).. Given that the optimal classifier is heteroscedastic classifier aligned with the coordinate axes, sample's 's gradient direction is either horizontal or vertical, depending on which cluster the noised sample closer to.
We demonstrated the proportion of Sj for each sampled point in Figure [a] where values nearing 50% indicate the presence gradient dilemma. Simulation results revealed that samples along the diagonal experience severe gradient dilemmas, which is consistent with intuition. In this toy example, the gradient dilemma arises from non-clustered data distribution, which imposes divergent gravitational pulls for purification. Consequently, we hypothesize that real-world data distributions
19

---

70
Durs
N-Grad
60
DifPPree
GDMP
LM
40
Time
10
15
18
N
Figure 12: Time spent on gradient grafting and full gradient under different N.
85%
1E5
716
489
65%
(a) DiffPure 22
(b) GDMP 26
(c) LM 3
Figure 13: MLE estimation of the risk of resubmit attacks for different N -evalluation. The reference value is represented by the solid line and its standard deviation by the dashed line.
may also exhibit non-clustered features. For instance, in the misclassification of a cat as dog, considering the existence of various dog breeds, it is more efficient and effective to distort the features of one specific breed rather than all breeds collectively.
C.7 Time complexity analysis
Our gradient grafting method enables the acquisition of gradients with lower time complexity for efficient attacks. We utilize only byproducts of N N-evaluation, with the primary overhead being the computation of approximate gradients, which is less costly than full gradients. Our algorithm's computational cost involves approximate gradients and one full gradient, whereas full gradient- based al algorithm with 1-evaluation requires N full gradients. When comparing computational times for varying N, we find that increasing slightly raises costs as the result shown in Figure [2] Compared to the N full gradient computations in the EOT-based attack, DiffHammer computes the full gradient only once, and the cost of approximate gradients acceptable. As N increases, the efficiency gain from gradient grafting becomes more significant.
C.8 Resubmit risk estimator
In a threat model where an attacker tries to obtain at least one successful attack by resubmitting, inappropriate evaluation can lead an underestimated risk. For example, in labs that use facial recognition as authentication, users have up to five attempts. Therefore, the estimation of the 5- resubmit risk is critical for the defender. The defender can perform N resubmit evaluations and use MLE an estimator. We quantify the MLE-estimated risk for DiffHammer with N-evaluation, N V 1,..... 10 on a 5-resubmit attack, where the reference value is empirical average of multiple trials. As the results in Figure 13] show, as the number of resubmissions increases, the estimation gets closer to reference value with smaller variance and tends to be stable and accurate when N > M. It is worth noting that when N & M, the estimation is either significantly underestimated (N 1) or suffers from large variance (N 2). Therefore, we recommend at least N-evaluation
with N > M means of evaluation.
20

---

deer
deer
ship
dog
truck
dog
airplane bird
cat
cat
bird
airplane bird
automabile
truck
frog
horse
airplane
frog
truck
airplane
ship
cat
dog
airplane
truck
bird
airplane
bird
ship
airplane
dog
horse
cat
Figure 14: Example of visualization of adversarial samples on CIFAR10 (foc 4/255). Original labels shown in green and adversarial labels shown in red.
cal:
ship
ship
airplane
frag
frog
automobile
frog
cat
automobile
airplane
bird
truck bird
truck
airplane
dog
ship
dag
ship
deer
dog
dog
cat
airplane
airplane
deer
airplane
airplane
rat
truck
truck
Figure 15: Example visualization of adversarial samples on CIFARIO (lxc labels are shown in green and ad adversarial labels are shown in red.
8/255). Original
C.9 Visualization
We visualize adversarial samples generated by DifiHammer against DiffPure [22 under various settings (CIFAR: Figure 14]15 CIFARI00: Figure 17 ImageNette: Figure 18) These samples are
imperceptible even with perturbation budget of 8/255. However, subtle adversarial perturbations can lead to significant differences in model decisions, highlighting the need for stronger adversarial defenses.
21

---

airpiane ship
frog
ship
airplan ne
dog
airplane
dog
frog
ship
airplane
airplane
frog
cat
cat
frog
bird
cot
dog
dog
cat
cat
cat
ship
airpiane
airplane
horse
horse
horse
horse
horse
airplane
Figure 16: Example of visualization of adversarial samples on CIFAR10 (E2 0.5). Original labels are shown green and adversarial labels are shown in red.
plain
maple
bridge maple
hamster telephone
telephone
bridge
bicycle
flatfish
ray
caterpillar
leopard willow
worm
dolphin
tulip
aquarium
wernan
aquarium
Figure 17: Example of visualization of adversarial samples CIFAR100 (f 4/255). Original labels are shown in green and adversarial labels are shown in red.
hom
tench
truck
pump
springer
springer
golf ball
ball
church
church
galf ball
truck
golf ball
cassettte
Cassette
golf
parachute
Figure 18: Example of visualization of adversarial samples ImageNette (foc 4/255)). Original labels are shown in green and adversarial labels are shown in red.
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
In the introduction, summarize our main contributions in the last para- graphs.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of the work the second paragraph of Appendix A
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
23

---

Justification:
We state Theorem 1 and Theorem 2 with necessary assumptions in Section 3.1
and 3.2 and provide the proofs for them in Appendix B.1 and B.2
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Following the information in Section 4 and Appendix C the experiments of the paper can be reproduced.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of a model checkpoint, or other means that appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
24

---

reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
Our
codes are publicly available at htttp:///githbb.com//aaa
DiffHammer
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.c cc/
public/guides/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/
Coaee//ddeeeebmmmcia ssi onPolicy) for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section 4 states the basic experimental settings and Appendix C. includes more details.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification:
We include error bars in experimental results shown in Figure and 13
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
25

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
show in tables or
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: All experiments are performed on NVIDIA GeForce RTX 4090 with a memory of 24564 MB.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: httpiiggghrr/////ooooooooo/o///o
Answer: [Yes]
Justification:
We have reviewed the NeurlPS Code of Ethics and our research confirms it.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We make broader impacts in the first paragraph of Appendix A
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
26

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
We don't include data or models that have a high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: We cite properly the dataset and code of original owners in Section
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in package should be provided. For popular datasets, paperswithcone com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
27

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/moodl as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
28


Reviews:
[{"review_id": "MiAL9bo9qh", "reviewer": "Reviewer_HpZi", "summary": "This paper reveals two limitations of Eot-based attacks in diffusion-based purification: gradient dilemma and underestimation of resubmit attacks' risk. The authors introduce N-time evaluation to evaluate the risk of resubmitted attacks sufficiently. Then, they propose an EM-based attack to solve the gradient dilemma, which achieves satisfactory results compared to both Eot-based and transfer-based attacks. Finally, this paper guides the future improvement of diffusion-based purification.", "questions": "Please check weaknesses part.", "limitations": "I think that the authors have adequately addressed the limitations mentioned in this paper and the potential negative societal impact of their work is controllable.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. This paper has well originality: a novel N-time evaluation is introduced to sufficiently evaluate diffusion-based purification, and an effective EM-based attack is proposed to overcome the shortcomings of existing attacks.\n2. The authors revealed two important obstacles in the evaluation of diffusion-based purification and the causes are clearly explained. Moreover, they propose effective evaluation and attack methods to solve the revealed obstacles.", "weaknesses": "In experiments:\n\n- In line 232, the author would better explain why they chose \"BPDA [1], PGD [21], and AA [6]\" as baselines. The published years of [1], [6], and [21] are 2018, 2020, and 2017, it seems these methods are relatively old works. The authors would better consider a comparison with newer methods, such as \"Diffusion models for adversarial purification. ICML 2022, https://arxiv.org/abs/2205.07460\".\n- In lines 239 and 240, the author would better provide the measuring unit of time.\n- The authors would better add horizontal and vertical labels for the figures in their paper, including figures 2, 4, 5, and 6.\n- In line 268, \"as shown in DiffHammer retains the memory of...\", it seems to be \"as shown in Figure 4, DiffHammer retains the memory of...\". In addition, the author would better explain why the transfer-based attack DTI only appears in Table 1 and is not compared in Figure 5 and Figure 4. In subsection 4.3, the authors also don't analysis DTI.\n- In line 253, the author would better explain how is \"14%\" and \"28%\" calculated or obtained from the experimental results.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the valuable feedback, here's our response to the concerned problems.\n## Comparison with newer methods\n**Summary:** We adhere to the literature's naming conventions for these methods, but our evaluation incorporates the enhancements proposed in \\[1,2\\] (2023), upgrading PGD and AA to **SOTA evaluation** with exact gradients. Additionally, we test complementary attacks.\n\nStochastic and iterative algorithms for diffusion-based purification yield challenging gradients, so a line of works aimed at approximating gradients in attack algorithms. This includes the Adjoint method \\[3\\] and Joint methods (score/full) \\[4\\]. \\[1,2\\] obtained exact gradients of DiffPure and GDMP via computational graph reconstruction, and we further derive exact gradients for the optimization in LM using the Hessian vector product trick. It was shown that approximate gradients lead to inadequate robustness evaluation in \\[1,2\\]. Therefore, we utilize exact gradient algorithms as a better baseline, with complementary experiments on approximate gradients validating this point. We will clarify our evaluation in the paper.\n\nMethod|DiffPure|GDMP|LM\n---|---|---|---\nAdjoint|41.4/68.0|42.3/59.6|N/A\nJoint (full)|35.7/62.7|37.3/54.9|53.1/73.2\nJoint (score)|22.3/56.4|17.5/43.0|36.0/60.9\nExact Gradient|46.7/69.0|50.6/63.3|82.0/90.4\nDH|53.8/75.2|57.9/72.5|83.3/91.4\n\n## Transfer-based attack DTI\n\n\nWe include a demonstration and discussion of DTI, a representative transfer-based attack approach. We will compare DTI's performance with other algorithms in Figures 4 and 5 of the paper. DTI performs well in transfer-based attacks, likely due to its emphasis on translation and transformation (scaling and affine) invariance. Since most stochastic purifications do not share vulnerabilities, assuming global optimality can invalidate some transfer-based algorithms (VMI and CWA). Whereas DTI does not rely on this assumption, but it only considers simple transformations such as translation and scaling, which limits its performance.\n\n## Typos and presentation issues\n\n- Since the time spent per step is comparable for the different methods, we directly report the number of iterations required to reach 90% of the optimal metric. We will unify the statements as iterations rather than time to avoid ambiguity.\n- We define the robustness of the defense as the proportion of data that is not misclassified in 10 resubmit attacks, which is 1-Wor.ASR (the proportion of attacks that succeed at least once).\n- We will add horizontal and vertical axis labels to the image to enhance legibility.\n- We will check and correct typos in the paper.\n\n\\[1\\] Robust Evaluation of Diffusion-Based Adversarial Purification, ICCV, 2023.\n\n\\[2\\] DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification, NeurIPS, 2023.\n\n\\[3\\] Diffusion models for adversarial purification, ICML, 2022.\n\n\\[4\\] Adversarial purification with score-based generative models, ICML, 2021.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "7Klb5pGJgS", "reviewer": "Reviewer_wBtm", "summary": "Diffusion-based purification methods have gained recognition for their robustness against adversarial attacks. However, concerns arise regarding the adequacy of current evaluation methods, particularly in addressing the gradient dilemma inherent in these techniques. This paper introduces DiffHammer, an advanced evaluation framework utilizing an EM-based attack and N-time evaluation to overcome these challenges. DiffHammer identifies vulnerabilities in purification clusters more effectively than traditional methods, significantly enhancing the assessment of diffusion-based purification robustness. Their experiments demonstrate that DiffHammer outperforms existing approaches by identifying more adversarial samples and highlighting previously underestimated security risks.", "questions": "See weaknesses.", "limitations": "The authors have clearly described the limitations.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-sturctrued.\n\n2. They identified the limitations of the N + 1 evaluation for diffusion-based adversarial purification and proposed an EM-based attack and the 1 + N evaluation method, which demonstrated effectiveness.\n\n3. The theoretical foundation of this paper is comprehensive, with detailed proofs provided in the appendix. Extensive experiments further validate the reasonableness of the authors’ method, revealing underestimated risks of diffusion-based adversarial purification.", "weaknesses": "1. The paper describes that when the purification process contains unshared vulnerabilities, existing EoT-based N-averaging can encounter the gradient dilemma. This gradient dilemma might lead to the inability to generate effective attack samples, resulting in insufficient evaluation of diffusion-based purification methods. However, the paper lacks theoretical proof or experimental validation for this gradient dilemma.\n\n2. The paper mentions that diffusion model-based purification methods like Diffpure, GDMP, and LM have issues with resisting resubmit attacks. However, to my knowledge, DiffSmooth[1], another diffusion model-based purification method, takes into account multiple denoised outputs for the same input sample when making predictions, and it claims to have a certifiably robust pipeline. This defense method appears to be more powerful, and the authors should consider including such methods when evaluating the robustness of diffusion-based adversarial purification techniques. Additionally, it would be valuable to investigate whether resubmit attacks still pose a problem for such robust defense methods.\n\n[1] Zhang J, Chen Z, Zhang H, et al. {DiffSmooth}: Certifiably robust learning via diffusion models and local smoothing[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 4787-4804.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the valuable feedback, here's our response to the concerned problems.\n## Validation of the gradient dilemma\n**Summary:** By conducting cluster analysis on the gradients of the purification process, we observed that the gradients have multiple clustering centers with low inter-cluster similarity, leading to what we term the *\"gradient dilemma\"* in attacks. This phenomenon is illustrated using a simple Gaussian mixture model, suggesting that the gradient dilemma may stem from non-clustered features in the data.\n\nFor our analysis, we sampled 500 gradients for each of the defenses. We employed a Gaussian mixture model (GMM) as the clustering algorithm, consistent with our paper's methodology. The optimal number of clusters is determined using the Akaike Information Criterion (AIC) within the range of 1 to 5. Our experiment revealed that 47% of the sampled gradients (across 3 defenses) possess more than one clustering center as shown in Rebuttal Figure 1. For these samples, we further analyzed the distribution of the cosine similarity between the top two cluster centers as shown in Rebuttal Figure 2, which was often in (-0.2 $\\sim$ 0.3), thereby confirming the presence of the gradient dilemma.\n\nTo investigate the origins of the gradient dilemma, we constructed a Gaussian mixture toy example where the two diagonal components belong to the same category. In this scenario, diffusion-based purification pulls samples slightly towards the origin before diffusing them back into the data distribution. Given that the optimal classifier is a heteroscedastic classifier aligned with the coordinate axes, a sample's gradient direction is either horizontal or vertical, depending on which cluster the sample is closer to. \n\nWe demonstrated the probability of a sample's most frequent gradient direction in Rebuttal Figure 3, where values nearing 50% indicating the presence of a gradient dilemma. Simulation results revealed that samples along the diagonal experience severe gradient dilemmas, which is consistent with intuition. In this toy example, the gradient dilemma arises from a non-clustered data distribution, which imposes divergent gravitational pulls for purification. Consequently, we hypothesize that real-world data distributions may also exhibit non-clustered features. For instance, in the misclassification of a cat as a dog, considering the existence of various dog breeds, it is more efficient and effective to distort the features of one specific breed rather than all breeds collectively.\n\n## Analysis of DiffSmooth vulnerability\n\n**Summary:** The robustness of DiffSmooth benefits from majority voting, a mechanism that enables certifiable robustness. However, its smoothed classifier remains vulnerable to DiffHammer. Although DiffSmooth is robust to resubmit attacks, this occurs at the expense of significant computational cost.\n\nDiffSmooth employs a smoothing classifier in the inner loop and a certification algorithm in the outer loop. The inner loop's smoothing classifier can be viewed as an aggregation of multiple 1-step DiffPure processes. We evaluated DiffSmooth's performance under the $\\ell_2$-norm using a ResNet-110 model trained with Gaussian smoothing, adhering to the paper's parameter settings. As illustrated in Figure 1, DiffSmooth's classifier alone is not sufficiently robust; DiffHammer achieves worst-case robustness of 57.0% and 86.7% (out of 10 evaluations) with perturbation budgets of 0.5 and 1, respectively.\n\nTable 1: Experiment results on DiffSmooth classifier\n| Attack | $r=0.5$ |      | $r=1$ |      |\n| ------ | ------- | ---- | ----- | ---- |\n| ASR    | Avg.    | Wor. | Avg.  | Wor. |\n| BPDA   | 25.6    | 46.9 | 50.1  | 86.9 |\n| PGD    | 34.0    | 53.9 | 53.0  | 89.8 |\n| DA     | 25.7    | 45.7 | 49.4  | 86.1 |\n| DH     | 36.8    | 57.6 | 54.7  | 89.8 |\n\nThe outer loop's certification algorithm derives robustness through majority voting, providing a lower bound on DiffSmooth's robustness and resisting resubmit adversarial samples with small attack success rate. Although majority voting suppresses resubmit attacks, it encounters several issues:\n\n1. Achieving theoretical certification requires a vast number of samples (N = 100,000), limiting its practicality.\n2. DiffSmooth can falsely certify a class when DiffHammer submits adversarial samples with higher ASR. Our experiments show that DiffSmooth will even falsely certify DiffHammer-generated adversarial samples with a radius of 0.175.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1RXIAS9t9D", "reviewer": "Reviewer_knbF", "summary": "The paper proposes a new adversarial attack framework against diffusion-based purification defenses. The paper first explains the advantage of using N-time evaluation as the metric for randomized defenses. Then, it proposes an E-M based adversarial attack, which empirically shows SOTA ASR.", "questions": "Please refer to the weakness part for concrete questions.", "limitations": "Discussed in Appendix A.", "rating": 6, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "1. Attacking diffusion-based purification defenses (SOTA defenses) is noteworthy to the community.\n2. The attack framework is novel to me, and the empirical evidence is sufficient.", "weaknesses": "I think the randomness of diffusion purification is worthy of noticing and exploring in an EM framework with distribution-level analysis, which is a viable way from a high level. However, the major concern is that the paper does not convey the attack analysis in the EM framework very clearly. It might be a problem of presentation, but additional explanations are definitely needed for a fair judgment of the method.\n\n1. Some definitions are not clear and rigorous. Line 141: missing rigorous definition of $g$. Line 143 says that $g(\\phi)$ depends on a cluster, but the formulation does not show dependence on the cluster. Also, definition of “cluster” is missing.\n2. Since sec 3.2 is not quite clearly written to me, I guess that you assume the adversarial perturbations for a given sample $x$ for a given defense $\\phi_i$ follows a Gaussian with mean $r$ and covariance $\\Sigma$. Is that correct? If so, the Gaussian assumption should be clearly emphasized with motivations of why you use Gaussian. Will assumptions of other distribution work? Is Gaussian important here? Empirical evidence would be beneficial.\n3. Here’s another question: if you assume $g(\\phi_i)$ denotes Gaussian perturbation regarding $\\phi_i$ (according to equation 6, which include multiple $\\phi_i$), then there should be $N$ Gaussians for $N$ defenses $\\phi_1,..,\\phi_N$? But there is just one $r$ and $\\Sigma$ here.   \n4. Also, line 156 indicates that $q_i$ denote $N$ independent distribution on $z$, then should there be $N$ Bernoulli distribution param $\\alpha$ here?\n5. $q^{(t)}$ seems not defined in line 159.\n6. Line 160: what does optimizing $r$ with higher $z$ mean? Should it be optimizing $r$ towards a high objective in eq. (6)?\n7. In line 143, the paper indicates that $g(\\phi)$ follows a normal distribution, which means that $g(\\phi)$ is a random vector. But in equation (8), $g(\\phi_i)$ is treated like a deterministic vector. Should $g()$ be inside the expectation?\n8. In E-step, the constant $C$ looks quite important in Equation (9), how to select it? What is the rationale for approximation with a constant?\n9. Logging in problem is one practical case for N-times evaluation, but is there any practical scenario for image misclassification?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the valuable feedback, here's our response to the concerned problems. We will describe our EM framework more clearly and rigorously in response to concerned problems, and we will also update this part of the exposition in our paper.\n\n Given a sample $x\\in\\mathbb{R}^d$ and its label $y\\in [K]$, a stochastic purification $\\phi:\\mathbb{R}^d\\to \\mathbb{R}^d$ and a deterministic classifier $f:\\mathbb{R}^d\\to \\mathbb{R}^K$ will classify it as $f[\\phi(x)]$. Denotes the normalized gradient $g(\\phi):=\\nabla_x \\mathcal{L}(f[\\phi(x)];y) /\\lVert \\nabla_x \\mathcal{L}(f[\\phi(x)];y) \\rVert_2$, we suspect that $g(\\phi)$ may obey a multi-peaked distribution, where $g(\\phi)$ can be divided into clusters that have high intraclass similarity and low interclass similarity.\n\nOur goal is to find the cluster center with the highest attack success rate. At each step of the attack, we can observe $N$ $g(\\phi_i)$ and $\\mathcal{A}_i, i=1,...,N$ (whether $f\\circ \\phi_i$ is attacked or not), We identify the parameters in the distribution of $g(\\phi)$ by maximizing the likelihood function of $g(\\phi_i)$ and $\\mathcal{A}_i$.\n\nWe make the following assumptions about the distribution of $g(\\phi)$: (1) There exists a master cluster of $g(\\phi)$ that obeys a Gaussian distribution. Let the hidden variable $z$ denote whether $g(\\phi)$ comes from this cluster, then $p(g(\\phi)|z=1) = \\mathcal{N}(r,\\Sigma)$ and the prior distribution of $z$ is the Bernoulli distribution with parameter $\\alpha$. The proportion $\\alpha$, mean $r$, and variance $\\Sigma$ of this cluster are the parameters of the underlying model that we desired. (2) We use a null information prior for whole $g(\\phi)$, i.e., we assume that $p(g(\\phi))=c$ and $c$ will be eliminated in subsequent analyses. We make these assumptions because the normal distribution is flexible in modeling similarity between $g(\\phi)$, and the zero-information prior avoids over-designing our model. Furthermore, these assumptions facilitate subsequent theoretical derivations, and we will show how certain steps of the algorithm can be modified to accommodate other assumptions.\n\nSince the hidden variable $z_i$ for each $g(\\phi_i)$ is unknown, we use $q_i^{(t)}$ as an approximation of the $z_i$ posterior distribution at each stage $t$. Due to the properties of the Gaussian mixture model, the update involves only the mean of $q_i^{(t)}$ (i.e., the posterior mean of $z_i$: $\\mathbb{E}[z_i|g(\\phi_i)]=p(z_i=1|g(\\phi_i))$), so in practice, $\\mathbb{E}q_i^{(t)}$ can be viewed as an approximation of the posterior probability that $g(\\phi_i)$ belongs to the main cluster. Then in M-step, $\\mathbb{E}q_i^{(t)}$ is fixed and the parameters $r,\\Sigma,\\alpha$ are updated; in E-step, $\\mathbb{E}q_i^{(t)}$ is updated to approximate $p(z_i=1|g(\\phi_i))$.\n\n**M-step.** In M-step, maximizing our objective (Eq. 6 in the paper) can be achieved by gradient ascent in Eq. 8 in the paper, where the observed $g(\\phi)$ is weighted by $\\mathbb{E}q_i^{(t)}$, and $r$ moves towards the weighted center.\n\n**E-step.** As we discussed in Section 3.2.1 of the paper, we set $\\Sigma$ as a hyperparameter, so we are only concerned with the update of $r$, where the previously assumed constant $c$ is eliminated.\n\n$$\n\\mathbb{E}q_i^{(t)}=\\frac{\\alpha \\mathcal{N}(g(\\phi_i);r^{(t),\\lambda^{-1}I})}{c}=A\\exp(-\\frac{\\lVert g(\\phi_i)-r^{(t)}\\rVert_2^2}{2})=A\\exp(\\cos\\langle g(\\phi_i), r^{(t)} \\rangle)\n$$\nwhere $A$ denotes (not a same) constants  independent of $i$. In the last term of Eq. 8 in the paper, due to the $\\alpha$ of the denominator, it will become $\\sum_i[\\exp(\\cos\\langle g(\\phi_i), r^{(t)} \\rangle)g(\\phi_i)]/\\sum_i\\exp(\\cos\\langle g(\\phi_i), r^{(t)} \\rangle) $. We can find that this is a result weighted by a normalized similarity function w.r.t. $g(\\phi_i), r^{(t)}$, and the function $\\exp\\cos\\langle \\cdot, \\cdot \\rangle$ is the result of our assumption.\n\nTable1: DiffHammer in different assumption.\n| Attack | DiffPure |      |GDMP |      |LM||\n| ------ | ------- | ---- | ----- | ---- |-|-|\n| ASR    | Avg.    | Wor. | Avg.  | Wor. | Avg.  | Wor. |\n|DH2 | 53.5|73.4 | 56.0| 76.9 |78.0|87.9\n| DH| 53.8     | 75.2 | 57.9 | 72.5 | 83.3 | 91.4 |\n\n- Response to question 1: We will define $g(\\phi)$ as the gradient and call a set with high intraclass similarity and low interclass similarity a cluster.\n- Response to question 2 & 8: We adopt the assumption of Gaussian distribution for flexibility and convenience, which provides a theoretical reference for our algorithm. We experimented with other customized similarity functions in the above E-step, e.g. we directly defined the similarity of $g(\\phi_i)$ to $r$ as the expectation of the loss boost (the closer of these indicates the stronger the attack). As shown in Table 1 below, proper similarity function choices leads to good results in practice, which in theory corresponds to similar but different cluster modeling. \n- Response to question 3 & 4: Since $r,\\Sigma$, and $\\alpha$ are parameters of the underlying model, they are shared and unique among the $g(\\phi)$.\n- Response to question 5: $q_i^{(t)}$ is an approximation of the $z_i$ posterior distribution at each stage $t$ and only $\\mathbb{E}q_i^{(t)}$ is involved and updated.\n- Response to question 6: Maximizing the target with Eq. 6 is equivalent to making $r$ close to the $\\mathbb{E}q_i^{(t)}$-weighted average $g(phi_i)$, which means that attacking a purifications with higher $\\mathbb{E}q_i^{(t)}$.\n- Response to question 7: In Eq. 8, $g(\\phi_i)$ denotes the observed random variable and is therefore deterministic.\n- Misclassification of models can constrain the deployment of models in safety-critical domains, for example, misclassification in autonomous driving can lead to catastrophic consequences. Diffusion-based sanitization serves as a promising solution, but may be undermined by resubmit attacks. Therefore, we reveal this risk to inspire subsequent research.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1tU6xTjSro", "reviewer": "Reviewer_ZG3o", "summary": "This work proposes a new attack evaluation for diffusion-based purification methods: the 1 + N evaluation, which incorporates expectation maximization-based attacks and N-time evaluation. This method is helpful to evaluate the worst-case robustness of stochasticity-based defense methods.", "questions": "Please see comments above.", "limitations": "N/A", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This paper is well-written, with elaborative article organization and clear illustrations.\n2. This paper gives a theoretical analysis of the advantages of N-time evaluation.", "weaknesses": "1.\tOne of the main conclusions on the advantages of N-evaluation is not that impressive. In fact, I think it is quite intuitive and the innovation is questionable.  \n2.\tThis setting will significantly increase the attack cost. If N is large enough, nearly all stochasticity-based defense methods have the risk of being broken. However, I do not think this is a practical and meaningful setting.\n3.\tThe results cannot be compared with other methods directly. In addition to ASR, the absolute robustness should be reported in Table 1 so that these numbers can be directly compared with the results in other related literature [1, 2].\n4.\tInsufficient experimental results. Only the simple dataset, CIFAR-10, is considered. More datasets, especially ImageNet, should be incorporated.\n\n[1] Robust Evaluation of Diffusion-Based Adversarial Purification, ICCV, 2023.\n\n[2] Robust Classification via a Single Diffusion Model, ICML, 2024", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the valuable feedback, here's our response to the concerned problems.\n## Advantages and costs of N-evaluation\n\n**Summary:** We were the first to propose using $N$-evaluation to enhance evaluation accuracy and improve attack effectiveness and efficiency. In terms of evaluation, we demonstrate that 1-evaluation underestimates resubmission risk. An appropriate $N$ (e.g., 10) is acceptable to attackers, making the risk realistically alarming. We'll include a discussion of this section in the paper.\n\nIn terms of attack, we leverage the byproduct of $N$-evaluation, which incurs minimal additional overhead compared to the $N$-EOT attack. Our algorithm only require a small $N$ to overcome the gradient dilemma for sufficient attacks.\n\nCurrent robustness evaluations typically rely on 1-evaluation. However, in diffusion-based purification, the attack success rate for about 50% of samples ranges between 0 and 1, suggesting that attackers can undermine defenses by resubmitting. Evaluating resubmit attack risk depends on estimating attack probability, which 1-evaluation's non-zero-or-one result fails to provide. Even for samples with a 10-20% success rate (around 20% in our experiments), attackers can expect more than one successful attack out of 10 resubmissions with a feasible cost. Our analysis shows that 1-evaluation underestimate this risk statistically, as discussed in Section 3.1. Therefore, our proposed $N$-evaluation is practical amid the rise of diffusion-based defenses.\n\nAnother contribution is using $N$-evaluation to aid the attack algorithm, which isn't burdensome because (1) increasing $N$ slightly raises costs, and (2) our algorithm remains stable without a large $N$. We use only the byproducts of $N$-evaluation, with the main overhead being the computation of approximate gradients, which is less costly than full gradients. Our algorithm's computational cost involves $N$ approximate gradients and one full gradient, whereas the EOT-based algorithm requires $N$ full gradients. Comparing computational times for varying $N$, we find that increasing $N$ doesn't significantly raise costs as shown in Rebuttal Figure.4. We also assess different $N$ values on algorithm performance, fixing evaluations at 10 for fairness. Results in Rebuttal Figure.5,6 show that a small $N$ (e.g. $N=5$) allows our algorithm to address the gradient dilemma and improve attack. Thus, $N$-evaluation effectively enhances attack efficiency at minimal cost.\n## Direct comparison with other papers\nWe computed robustness metrics using 1-ASR for direct comparison with other studies. Our differing results arise because the original paper reports the best historical robustness in 1-evaluation, while we focus on N-evaluations. Let $M$ denote iterations, and $n^{(N)}_m$ the successful attacks in the $m$-th iteration's N-evaluation. Our Avg.Rob is $1 - \\max_m \\sum n^{(N)}_m / N$, Wor.Rob is $1 - \\max_m 1(n^{(N)}_m >0)$, while their Rob is $1 - \\max_m 1(n^{(1)}_m >0)$. Their Rob is more akin to our Wor.Rob but from different samples, which can't assess model robustness for a given sample. After comparing methods consistently, most attack results align with the paper, except GDMP shows lower robustness due to the smaller WRN-28-10 classifier compared to DiffPure's WRN-70-16. To ensure fair benchmarking, we use WRN-70-16. Replacing it with WRN-28-10 reproduces GDMP results. Inconsistencies with LM results are due to numerical explosions in gradient computation which may disable the attack, we resolved it by gradient clipping.\n\nTable 1: Comparison with other papers.\n eps |Defense|Attack|Avg.Rob|Wor.Rob|Rob|Rob (reported)\n-|-|-|-|-|-|-\n4|\tDiffPure|\tDiffAttack|\t70.80|\t40.04|\t65.04|\t67.19\n4\t|DiffPure|\tPGD|\t71.27\t|39.06|\t65.82|\tN/A\n4\t|DiffPure\t|DiffHammer\t|69.06|\t35.94|\t63.48|\tN/A\t\t\n4\t|GDMP\t|DiffAttack\t|73.98\t|52.54|\t69.73\t|N/A\n4\t|GDMP\t|PGD\t|77.77|\t55.08\t|74.61|\tN/A\n4\t|GDMP\t|DiffHammer\t|72.29\t|51.56|\t68.75|\tN/A\t\n4|\tLLHD_maximize|\tAA|\t49.22\t|27.34|\t44.14|\tN/A\n4|\tLLHD_maximize|\tPGD|\t59.04|\t33.40|\t54.30|\tN/A\n4|\tLLHD_maximize|\tDiffHammer|\t45.76|\t20.31|\t39.84|\tN/A\t\t\n8|\tDiffPure|\tDiffAttack|\t56.00|\t33.01|\t54.56|\t59.38\n8|\tDiffPure|\tPGD|\t60.27|\t33.01|\t54.69|\t55.82\n8|\tDiffPure|\tDiffHammer\t|51.99|\t27.93|\t45.90|\tN/A\t\t\t\t\n8|\tGDMP|\tDiffAttack|\t54.90|\t39.65|\t51.56|\tN/A\n8|\tGDMP|\tPGD|\t65.37|\t47.66|\t60.55|\t46.84\n8|\tGDMP|\tDiffHammer|\t50.37|\t34.96|\t45.90|\tN/A\t\t\n8|\tLLHD_maximize|\tAA\t|36.43\t|18.75|\t31.84|\t71.68\n8|\tLLHD_maximize\t|PGD\t|48.48|\t26.76|\t44.34|\tN/A\n8|\tLLHD_maximize|\tDiffHammer|\t30.61|\t14.06|\t26.76|\tN/A\n\n## Other dataset\n\nCIFAR10 is the primary dataset for evaluating adversarial defenses, so we focus on it. We also include results on other datasets, like restricted ImageNet and CIFAR100, where restricted ImageNet's 9 superclasses present more challenges. We reduced the attack budget to 4/255. Results show our algorithm's ASR significantly surpasses others, indicating the gradient dilemma's presence across datasets.\n\nTable 2: Experiment result on restricted Imagenet\n\n| Method | DiffPure |      | GDMP |      | LM   |      |\n| ------ | -------- | ---- | ---- | ---- | ---- | ---- |\n| ASR    | Avg.     | Wor. | Avg. | Wor. | Avg. | Wor. |\n| BPDA   | 41.0     | 49.2 | 42.3 | 48.4 | 71.7 | 77.3 |\n| DA/AA  | 46.9     | 53.9 | 53.4 | 60.9 | 48.6 | 57.8 |\n| PGD    | 45.7     | 53.1 | 51.7 | 61.7 | 44.7 | 54.7 |\n| DH     | 61.6     | 68.8 | 66.0 | 71.1 | 73.8 | 78.1 |\n\nTable 3: Experiment result on CIFAR100\n\n| Method | DiffPure |      | GDMP |       | LM   |      |\n| ------ | -------- | ---- | ---- | ----- | ---- | ---- |\n| ASR    | Avg.     | Wor. | Avg. | Wor.  | Avg. | Wor. |\n| BPDA   | 67.2     | 93.6 | 55.2 | 85.4  | 58.6 | 80.7 |\n| DA     | AA       | 69.4 | 94.5 | 58.9  | 85.2 | 52.4 | 79.1 |\n| PGD    | 69.5     | 94.3 | 59.0 | 85.4  | 51.4 | 78.9 |\n| DH     | 72.2     | 95.3 | 62.4 | 87.50 | 54.4 | 80.5 |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Thank you for the valuable feedback, here's our response to the concerned problems. We have provided some additional images attached to the pdf.

Meta-review: The authors propose a sufficient and efficient attack named DiffHammer against diffusion-based purification.
The reviewers agree that the paper makes interesting analysis and conclusions and please make sure to incorporate the improvements in the final version of the paper/
Decision: Accept (poster)