ICLR 2025

Published as a conference paper at ICLR 2025
ADBM: ADVERSARIAL DIFFUSION BRIDGE MODEL
FOR RELIABLE ADVERSARIAL PURIFICATION
Xiao Li1∗, Wenxuan Sun1,2∗, Huanran Chen1,3, Qiongxiu Li4,
Yining Liu1,5, Yingzhe He6, Jie Shi6, Xiaolin Hu1†
1Department of Computer Science and Technology, Tsinghua University
2Peking University
3Beijing Institute of Technology
4Aalborg University
5Harbin Institute of Technology, Weihai
6Huawei Technologies
lixiao20@mails.tsinghua.edu.cn, sunwenxuan@stu.pku.edu.cn
huanranchen@bit.edu.cn, qili@es.aau.dk
22S030184@stu.hit.edu.cn, {heyingzhe, shi.jie1}@huawei.com
xlhu@mail.tsinghua.edu.cn
ABSTRACT
Recently Diffusion-based Purification (DiffPure) has been recognized as an ef-
fective defense method against adversarial examples. However, we find DiffPure
which directly employs the original pre-trained diffusion models for adversarial
purification, to be suboptimal. This is due to an inherent trade-off between noise
purification performance and data recovery quality. Additionally, the reliability of
existing evaluations for DiffPure is questionable, as they rely on weak adaptive
attacks. In this work, we propose a novel Adversarial Diffusion Bridge Model,
termed ADBM. ADBM directly constructs a reverse bridge from the diffused ad-
versarial data back to its original clean examples, enhancing the purification capa-
bilities of the original diffusion models. Through theoretical analysis and experi-
mental validation across various scenarios, ADBM has proven to be a superior and
robust defense mechanism, offering significant promise for practical applications.
Code is available at https://github.com/LixiaoTHU/ADBM.
1
INTRODUCTION
An intriguing problem in machine learning models, particularly Deep Neural Networks (DNNs), is
the existence of adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015). These exam-
ples introduce imperceptible adversarial perturbations leading to significant errors, which has posed
severe threats to practical app...