Title: Enhancing Adversarial Robustness via Score-Based Optimization
Venue: NeurIPS 2023
Accepted: yes
Keywords: Adversarial Defense

Adversarial Attack

Score-based Models

Diffusion Models
Abstract: Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce a novel adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data  in the direction guided by score-based priors. We conduct comprehensive experiments on multiple datasets, including CIFAR10, CIFAR100 and ImageNet. Our experimental results demonstrate that our approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.

Enhancing Adversarial Robustness via Score-Based Optimization

Abstract

Adversarial attacks have the potential to mislead deep neural network classifiers by introducing slight perturbations. Developing algorithms that can mitigate the effects of these attacks is crucial for ensuring the safe use of artificial intelligence. Recent studies have suggested that score-based diffusion models are effective in adversarial defenses. However, existing diffusion-based defenses rely on the sequential simulation of the reversed stochastic differential equations of diffusion models, which are computationally inefficient and yield suboptimal results. In this paper, we introduce a novel adversarial defense scheme named ScoreOpt , which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. We conduct comprehensive experiments on multiple datasets, including CIFAR10, CIFAR100 and ImageNet. Our experimental results demonstrate that our approach outperforms existing adversarial defenses in terms of both robustness performance and inference speed.

1 Introduction

In recent years, there have been breakthrough performance improvements with deep neural networks (DNNs), particularly in the realms of image classification, object detection, and semantic segmentation, as evidenced by the works of [31, 59, 53, 19, 13, 51]. However, DNNs have been shown to be easily deceived to produce incorrect predictions by simply adding human-imperceptible perturbations to inputs. These perturbations are called adversarial attacks [14, 36, 38, 7], resulting in safety concerns. Therefore, studies of mitigating the impact of adversarial attacks on DNNs, which is referred to as adversarial defenses , are significant for AI safety.

Various strategies have been proposed in order to enhance the robustness of DNN classifiers against adversarial attacks. One of the most effective forms of adversarial defense is adversarial training [36, 71, 16, 32, 71, 44], which involves training a classifier with both clean data and adversarial samples. However, adversarial training has its limitations as it necessitates prior knowledge of the specific attack method employed to generate adversarial examples, thus rendering it inadequate in handling previously unseen types of adversarial attacks or corruptions.

On the contrary, adversarial purification [48, 68, 52, 28, 69, 40, 21] is another form of promising defense that leverages a standalone purification model to eliminate adversarial signals before conducting downstream classification tasks. The primary benefit of adversarial purification is that it obviates the need to retrain the classifier, enabling adaptive defense against adversarial attacks at test time . Additionally, it showcases significant generalization ability in purifying a wide range of adversarial attacks, without affecting pre-existing natural classifiers. The integration of adversarial purification models into AI systems necessitates minor adjustments, making it a viable approach to enhancing the robustness of DNN-based classifiers.

OptimizationLoop

C

t~u(tmin,tmax)

ct

network output

Se

VL(ct,t,0)

Purificd Sample

Diffusion models [22, 54, 58], also known as score-based generative models, have demonstrated state-of-the-art performance in various applications, including image and audio generation [9, 30], molecule design [23], and text-to-image generation [39]. Apart from their impressive generation ability, diffusion models have also exhibited the potential to improve the robustness of neural networks against adversarial attacks. Specifically, they can function as adaptive test-time purification models [40, 16, 4, 63, 66].

Diffusion-based purification methods have shown great success in improving adversarial robustness, but still have their own limitations. For instance, they require careful selection of the appropriate hyper-parameters such as forward diffusion timestep [40] and guidance scale [63], which can be challenging to tune in practice. In addition, diffusion-based purification relies on the simulation of the underlying stochastic differential equation (SDE) solver. The reverse purification process requires iteratively denoising samples step by step, leading to heavy computational costs [40, 63].

In the hope of circumventing the aforementioned issues, we introduce a novel adversarial defense scheme that we call ScoreOpt . Our key intuition is to derive the posterior distribution of clean samples given a specific adversarial example. Then adversarial samples can be optimized towards the points that maximize the posterior distribution with gradient-based algorithms at test time. The prior knowledge is provided by pre-trained diffusion models. Our defense is independent of base classifiers and applicable across different types of adversarial attacks, making it flexible enough across various domains of applications. The illustration of our method is presented in Figure 1.

Our main contributions can be summarized in three aspects as follows:

We propose a novel adversarial defense scheme that optimizes adversarial samples to reach the points with the local maximum likelihood of the posterior distribution that is defined by pre-trained score-based priors.

We explore effective loss functions for the optimization process, introduce a novel score regularizer and propose corresponding practical algorithms.

We conduct extensive experiments to demonstrate that our method not only achieves start-of-the-art performance on various benchmarks but also improves the inference speed.

2 Preliminary

2.1 Score-based Diffusion Models

Score-based diffusion models [22, 58] learn how to transform complex data distributions to relatively simple ones such as the Gaussian distribution, and vice versa. Diffusion models consist of two processes, a forward process that adds Gaussian noise to input x from x 0 to x T , and a reverse generative process that gradually removes random noise from a sample until it is fully denoised. For the continuous-time diffusion models (see Song et al. [58] for more details and further discussions), we can use two SDEs to describe the above data-transformation processes, respectively. The forwardtime SDE is given by:

where f : R D → R D and g : R → R are drift and diffusion coefficients respectively, w denotes the standard Wiener process. While new samples are generated by solving the reverse-time SDE:

where ¯ w defines the reverse-time Wiener process. The score function term ∇ x t log p t ( x t ) is usually parameterized by a time-dependent neural network s θ ( x t ; t ) and trained by score-matching related techniques [25, 58, 61, 56, 41].

Diffusion Models as Prior Recent studies have investigated the incorporation of an additional constraint to condition diffusion models for high-dimensional data sampling. DDPM-PnP [17] proposed transforming diffusion models into plug-and-play priors, allowing for parameterized samples, and utilizing diffusion models as critics to optimize over image space. Building on the formulation in Graikos et al. [17], DreamFusion [43] further introduced a more stable training process. The main idea is to leverage a pre-trained 2D image diffusion model as a prior for optimizing a parameterized 3D representation model. The resulting approach is called score distillation sampling (SDS), which bypasses the computationally expensive backpropagation through the diffusion model itself by simply excluding the score-network Jacobian term from the diffusion model training loss. SDS uses the approximate gradient to train a parametric NeRF generator efficiently. Other works [35, 37, 62] followed similar approaches to extend SDS to the latent space of latent diffusion models [46].

2.2 Diffusion-based Adversarial Purification

Diffusion models have also gained significant attention in the field of adversarial purification recently. They have been employed not only for empirical defenses against adversarial attacks [69, 40, 63, 66], but also for enhancing certified robustness [5, 67]. The unified procedure for applying diffusion models in adversarial purification involves two processes. The forward process adds random Gaussian noise to the adversarial example within a small diffusion timestep t ∗ , while the reverse process recovers clean images from the diffused samples by solving the reverse-time stochastic differential equation. Implementing the aforementioned forward-and-denoise procedure, imperceptible adversarial signals can be effectively eliminated. Under certain conditions, the purified sample restores the original clean sample with a high probability in theory [40, 67].

However, diffusion-based purification methods suffer from two main drawbacks. Firstly, their robustness performance heavily relies on the choice of the forward diffusion timestep, denoted as t ∗ . Selecting an appropriate t ∗ is crucial because excessive noise can lead to the removal of semantic information from the original example, while insufficient noise may fail to eliminate the adversarial perturbation effectively. Secondly, the reverse process of these methods involves sequentially applying the denoising operation from timestep t to the previous timestep t -1 , which requires multiple deep network evaluations. In contrast to previous diffusion-based purification methods, our optimization framework departs from the sequential step-by-step denoising procedure.

3 Methodology

In this section, we present our proposed adversarial defense scheme in detail. Our method is motivated by solving an optimization problem of adversarial samples to remove the applied attacks. Therefore, we start by formally formulating the optimization objective, followed by exploring effective loss functions and introducing two practical algorithms.

3.1 Problem Formulation

Our main idea is to formulate the adversarial defense as an optimization problem given the perturbed sample and the pre-trained prior, in which the solution to the optimization problem is the recovered original sample that we want. We regard the adversarial example x a as a disturbed measurement of the original clean example x , and we assume that the clean example is generated by a prior probability distribution x ∼ p ( x ) . The posterior distribution of the original sample given the adversarial example is p ( x | x a ) ∝ p ( x ) p ( x a | x ) . The maximum a posteriori estimator that maximizes the above conditional distribution is given by:

In this work, we use the data distribution under pretrained diffusion models as the prior p θ ( x ) .

3.2 Loss Functions for Optimization Process

Following Graikos et al. [17], we introduce a variational posterior q ( x ) to approximate the true posterior distribution p ( x | x a ) in the original optimization objective. The variational upper bound on the negative log-likelihood -log p ( x a ) is:

As shown in Song et al. [57] and Vahdat et al. [60], we can further obtain an upper bound on the second Kullback-Leibler (KL) divergence term between the target variational posterior distribution q ( x ) and the prior distribution defined by the pre-trained diffusion models p θ ( x ) :

where w ( t ) = g ( t ) 2 / 2 is a time-dependent weighting coefficient, x t = x + σ t ϵ denotes the forward diffusion process, σ t is the pre-designed noise schedule, and s θ represents the pre-trained diffusion models.

The simplest approximation to the posterior is using a point estimate, i.e., the introduced variational posterior q ( x ) satisfies the Dirac delta distribution q ( x ) = δ ( x -x µ ) . Thus, the above upper bound can be rewritten as:

We simply use notation x instead of x µ throughout for convenience. The weighted denoising score matching objective in (4) is also equivalent to the diffusion model training loss [43].

According to Tweedie's formula: µ z = z +Σ z ∇ z log p ( z ) , where Σ denotes covariance matrix, we can obtain x = x t + σ 2 t ∇ x t log q ( x t ) . Defining D θ ( x t ; t ) := x t + σ 2 t s θ ( x t ; t ) , the KL term of our opimization objective converts to:

where ˜ w ( t ) = w ( t ) /σ 2 t . Note that D θ can be used to estimate the denoised image directly, which is called one-shot denoiser [33, 5].

In our work, we adopt the approach of setting ˜ w ( t ) = 1 for convenience and performance as in previous studies [22, 17]. Since we have no information about the conditional distribution p ( x a | x ) , we need a heuristic formulation for the first reconstruction term in (2). The simplest method is to initialize x by the adversarial sample x a and use the loss in (5) to optimize over x directly, eliminating the constraint term. The rationale behind this simplification is that leading x a towards the mode of the p θ ( x ) with the same ground-truth class label makes it easier for the natural classifier to produce a correct prediction. In this way, the loss function of our optimization process reduces to:

Randomized smoothing techniques typically assume that the adversarial perturbation follows a Gaussian distribution. Suppose the Gaussian assumption holds, we can instantiate the reconstruction term with the mean squared error (MSE) between x and x a . The optimization objective converts to the following MSE loss:

where λ is a weighting hyper-parameter to balance the two loss terms.

3.2.1 Score Regularization Loss

However, both Diff and MSE optimizations have their own drawbacks. Regarding the Diff loss, the optimization process solely focuses on the score prior p θ , and the update direction guided by the pre-trained diffusion models leads the samples towards the modes of the prior, gradually losing the semantic information of the original samples. As illustrated in Figure 2a, with a sufficient number of optimization steps, both standard and robust accuracies decline significantly. On the other hand,

100

100

100

Std AcC

Rob AcC

MSE Rob

90

95

SR Std

SR Rob

80

80

06

60

70

85

40

09

80

20

MSE Rob

SR Std

SR Rob

50

0

20

40

60

80

100

75

0

20

40

60

80

100

0

0.0

0.2

0.4

0.6

0.8

1.0

Number of Optimization Steps

Number of Optimization Steps

(a) Robustness performance via Diff optimization using different number of optimization steps.

(b) Comparison between MSE and SR with different optimization iterations.

(c) Comparison between MSE and SR with different regularizer hyperparameters.

the MSE loss maintains a high standard accuracy at the cost of a large drop in robust accuracy, as depicted in Figure 2b. Furthermore, Figure 2c demonstrates that the performance of MSE is highly dependent on the weighting hyper-parameter, which controls the intensity of the constraint term.

To address the above-mentioned issues, we propose to introduce a hyperparameter-free score regularization (SR) loss:

We use the introduced constraint to minimize the pixel-level distance between the denoised versions of the current sample x and initial adversarial sample x a . The additional regularization term can be expanded as:

The SR loss encourages consistency with the original sample in terms of not only the pixel values but also the score function estimations at the given noise level σ t . Since the two parts of SR loss correspond to the same noise magnitude t of score networks, there is no need to introduce an additional hyperparameter λ as in (7).

Figure 2b and 2c demonstrate the effectiveness of the SR loss. As the number of optimization steps increases, both the standard and robust accuracy converge to stable values, with the latter remaining close to the optimal. In contrast to the MSE loss, the SR loss shows insensitivity to the weighting hyperparameter and significantly outperforms MSE, particularly for larger values of λ .

3.3 Practical Algorithms

Algorithm 1: (ScoreOpt-O) Optimizing adversarial sample towards robustness with score-based prior.

Input: Adversarial image x a , pre-trained score-based diffusion model s θ , noise level range [ t , t ] , optimization iteration steps M, learning rate η .

Noise Schedule The perturbation introduced by adversarial attacks is often subtle and challenging for human perception. As a result, our optimization loop does not necessarily incorporate the complete

noise levels employed by the original diffusion models, which generate images from pure random noise. In fact, high noise levels will disrupt local structures and remove semantic information from the input image, leading to a decrease in accuracy. Many previous studies have focused on lower noise levels to conduct image editing tasks. Therefore, we center our pre-designed noise schedule σ t around lower noise levels to preserve the details of the original image as much as possible. Previous diffusion-based purification methods iteratively denoise the noisy image step by step (from x t to x t -1 ), following a predetermined noise schedule. In contrast, our optimization process does not rely on a sequential denoising schedule. Instead, at each iteration, we have the flexibility to randomly select a noise level. This approach allows us to concurrently explore different noise levels during the optimization process.

Update Rule Given a noise level σ t , we can utilize the aforementioned loss functions to compute the update direction of x . Noting that the objectives correspond to one single random chosen noise magnitude, we propose an alternative update rule to further improve inference speed and robustness performance. We can use the loss gradient to optimize over x t directly and then obtain the denoised image x using one-shot denoising. The loss gradients with respect to x and x t are equivalent in our forward process formulation. Experiments in Section 4 demonstrate that our approach significantly improves one-shot denoising with only a few optimization iterations. These two distinct update rules correspond to Algorithm 1 and Algorithm 2, respectively. Both algorithms are straightforward, effective, and easy to implement.

4 Experiments

This section presents the experimental evaluations conducted to assess the robustness of our proposed methodology against different adversarial attacks, across a range of datasets. Due to space constraints, we defer comprehensive details of the experimental settings, quantitative analysis, and additional results to the Appendix. For all experiments, we report the average results (and corresponding standard deviations) over 5 trials.

4.1 Experimental Settings

Attacks In this work, we evaluate the robustness performance of adversarial defenses mainly on ℓ p -norm bounded threat models. ϵ p denotes the perturbation budget under the ℓ p -norm. All of the attacks are based on Projected Gradient Descent (PGD) attack [36], a commonly used gradient-based whitebox attack, which iteratively perturbs input images along the direction of the gradient of the classifier

loss function and projects into some l p ϵ -ball: δ ← Π ϵ ( δ + α · sign ( ∇ x Loss( f ( x + δ ) , y ))) , where f represents a classifier.

Datasets and Baselines Three datasets are considered in our experiments: CIFAR10, CIFAR100, and ImageNet. Following previous works, the evaluation is conducted on the test set of each dataset. We adopt two kinds of adversarial defenses for comparison: adversarial training methods and adversarial purification methods, especially those also based on diffusion models [69, 40, 63]. In accordance with the settings in Nie et al. [40], we conduct evaluations against strong adaptive attacks using a fixed subset of 512 randomly sampled images.

Evaluation Metrics We leverage two evaluation metrics to assess the performance of our proposed defense method: standard accuracy and robust accuracy. Standard accuracy measures the performance of adversarial defenses on clean data, while robust accuracy measures the classification performance on adversarial examples generated by various attacks.

Models We consider different architectures for a fair comparison with previous works. We utilize the ResNet [19] and WideResNet (WRN) [70] backbones as our base classifiers. For CIFAR10 and CIFAR100 datasets, we employ WRN-28-10 and WRN-70-16, the two most common architectures on adversarial benchmarks. For the ImageNet dataset, we select WRN-50-2, ResNet-50, and ResNet152, which are extensively used in adversarial defenses. As for the pre-trained diffusion models, we incorporate two popular architectures, the elucidating diffusion model (EDM) [29] and the guided diffusion model [9]. The diffusion models and classifiers are trained independently on the same training dataset as in prior studies.

4.2 Main Results

In this section, we validate our defense method against two strong adaptive attacks: BPDA+EOT and adaptive white-box attack, i.e., PGD+EOT. The evaluation results of transfer-based attacks are deferred to Appendix B.

4.2.1 BPDA+EOT Attack

The combination of Backward Pass Differentiable Approximation (BPDA) [1] with Expectation over Transformation (EOT) [2] is commonly used for evaluating randomized adversarial purification methods. In order to compare with other test-time purification models, we follow the same settings in Hill et al. [20] with default hyperparameters for evaluation against BPDA+EOT attack. We conduct experiments under ℓ ∞ ( ϵ = 8 / 255) threat model on CIFAR10 and CIFAR100 datasets. Our method achieves high robust accuracies, outperforming existing diffusion-based purification methods by a significant margin, while maintaining high standard accuracies.

CIFAR10 Table 1 shows the robustness performance against BPDA+EOT attack under the ℓ ∞ ( ϵ = 8 / 255) threat models on CIFAR10 dataset. Mark o in parentheses denotes the practi-

cal method ScoreOpt-O in Algorithm 1, and mark n denotes the method ScoreOpt-N in Algorithm 2. Our methods achieve surprisingly good results. Specifically, we obtain 90.59% robust accuracy, with absolute improvements of 9.19% over previous SOTA adversarial purification methods. Our method is the first adaptive test-time defense to achieve robust accuracy over 90% against the BPDA+EOT attack. Meanwhile, the standard accuracy result is on par with the best-performing method.

CIFAR100 We also conduct robustness evaluations against strong adaptive attacks under the ℓ ∞ ( ϵ = 8 / 255) threat model on the CIFAR100 dataset. The results of ScoreOpt and other adaptive purification methods are presented in Table 2. To showcase the superiority of our method over previous diffusion-based purification algorithms, we perform experiments using the approach proposed in Nie et al. [40] with varying reverse denoising steps. The optimal hyperparameter t ∗ , representing the forward timestep, is carefully tuned based on experimental results. As indicated in Table 2, increasing the reverse denoising steps only leads to marginal improvements over the one-shot denoising method. Even when the number of denoising steps is increased to 80, which will incur a large computational cost, no further improvement in robust accuracy is observed. In contrast, our ScoreOpt method achieves a notable improvement of 18.16% in robust accuracy.

4.2.2 Adaptive White-box Attack

In order to evaluate our method against white-box attacks, it is necessary to compute the exact gradient of the entire defense framework. However, our optimization process involves backpropagation through the U-net architecture of diffusion models, making it challenging to directly apply PGD attack. Taking inspiration from Lee and Kim [34], we approximate the full gradient using the one-shot denoising process in our experiments. The performance against PGD+EOT is shown in Table 3. Most results for baselines are taken from Lee and Kim [34]. Notably, our method significantly outperforms other diffusion-based purification methods. Specifically, compared to Nie et al. [40], our method improves robust accuracy by 16.43% under ℓ ∞ and by 4.67% under ℓ 2 on WideResNet-28-10, and by 14.45% under ℓ ∞ and by 2.31% under ℓ 2 on WideResNet-70-16, respectively. Compared with previous SOTA adversarial training methods, ScoreOpt achieves better robust accuracies on both WideResNet-28-10 and WideResNet-70-16 under ℓ 2 . Furthermore, under ℓ ∞ threat model, ScoreOpt outperforms AT baselines on WideResNet-28-10 and achieves comparable robust accuracy on WideResNet-70-16 with the top-rank model.

Approximate Gradient. To show the effectiveness of our approximate gradients for sufficient robustness evaluation, we evaluate ScoreOpt (with only one single optimization step) on a fixed 512 CIFAR-10 subset. We use exact gradients and approximate gradients obtained by backpropagating through the one-shot denoising surrogate process, respectively. The attack success rates of PGD+EOT are 33.99% (w/ exact gradients) vs 34.11% (w/ approximate gradients) under ℓ 2 , and 50.976563% vs 50.976562% under ℓ ∞ . Therefore, this kind of approximate gradients obtained by the one-shot denoising surrogate process can be considered as effective as computing the exact gradient to sufficiently evaluate the robustness of ScoreOpt.

4.3 Generalization to Different Types of Attacks

Defense against Unseen Threats A significant advantage of adversarial purification is that it can defend against unseen threats in a plug-and-play fashion, while most adversarial training methods exhibit robustness only against the specific threat trained with. Following Nie et al. [40], we conduct evaluations with three threat models: ℓ ∞ , ℓ 2 , and the spatially transformed adversarial examples (StAdv). Table 4 illustrates the poor generalization of AT methods to unseen attacks and the significant generalization ability of our proposed method. The performance of AT baselines drops significantly when confronted with unseen attacks while ScoreOpt demonstrates robustness across all three threat models.

Score-based Black-box Attack We further assess the effectiveness of our method against the score-based black-box attack, SPSA. This evaluation is conducted on CIFAR10 with the WRN-28-10 classifier, adopting the same experimental setup as described in Yoon et al. [69], using 1,280 queries. Notably, our ScoreOpt method achieves a robust accuracy of 91.797%, in contrast to the reported 80.8% robust accuracy in Yoon et al. [69]. This demonstrates a significant performance improvement of 10% over the previous method.

Common Corruption To further highlight the generalization ability of ScoreOpt against various types of perturbations, we test the robustness of ScoreOpt and AT baselines on CIFAR10-C, a dataset comprising 75 frequently encountered visual distortions. The evaluation results are summarized in Table 5. where ScoreOpt consistently outperforms the AT baselines across most corruptions.

4.4 Further Analysis

4.4.1 Combining with adversarial training methods

ScoreOpt can also be seamlessly combined with existing stronger classifiers in a plug-and-play manner to further improve robustness performance. To see this, we conduct an additional experiment by combining ScoreOpt with adversarially trained classifiers [64]. We evaluate against the PGD+EOT attack and observe improvements under both l ∞ (from 71.48% to 72.57%) and l 2 (from 87.11% to 89.06%), respectively.

4.4.2 Optimization Steps

Since our defense is an iterative optimization process, we conduct ablation experiments on our ScoreOpt algorithm with different optimization steps under ℓ ∞ ( ϵ = 8 / 255) threat model against BPDA+EOT on CIFAR10. Figure 3 shows that the standard accuracy and robust accuracy continuously increase as the number of optimization steps increases. As the number of iterations increases further, the accuracies gradually stabilize. This phenomenon shows the effectiveness of our optimization process.

4.4.3 Inference Speed

We compare the inference speed of ScoreOpt with diffusion purification methods that use a sequential multiple-step denoising process. We compute the inference time cost per image. As shown in Table 6, our time cost is about twice under the same steps. However, ScoreOpt needs only a few steps (about 5) to obtain significantly better results than the multi-step denoising method, which requires nearly 100 denoising steps. Therefore, compared to diffusion-based AP baselines, our method further improves the inference speed substantially in practice.

5 Concluding Remarks

In this work, we have proposed a novel adversarial defense framework ScoreOpt, which optimizes over the input image space to recover original images. We have introduced three optimization objectives using pre-trained score-based priors, followed by practical algorithms. We have shown that ScoreOpt can quickly purify attacked images within a few optimization steps. Experimentally, we have shown that our approach yields significant improvements over prior works in terms of both robustness performance and inference speed. We would believe our work further demonstrates the powerful capabilities of pre-trained generative models for downstream tasks.

Acknowledgments and Disclosure of Funding

This work has been supported by the National Key Research and Development Project of China (No. 2022YFA1004002) and the National Natural Science Foundation of China (No. 12271011).

References

Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning , pages 274-283. PMLR, 2018.

Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In International conference on machine learning , pages 284-293. PMLR, 2018.

Maximilian Augustin, Alexander Meinke, and Matthias Hein. Adversarial robustness on in- and out-distribution improves explainability. In European Conference on Computer Vision , 2020.

Tsachi Blau, Roy Ganz, Bahjat Kawar, Alex Bronstein, and Michael Elad. Threat modelagnostic adversarial defense using diffusion models. arXiv preprint arXiv:2207.08089 , 2022.

Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free! In The Eleventh International Conference on Learning Representations , 2023.

Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adversarial robustness. In Advances in Neural Information Processing Systems , volume 32, 2019.

Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning , pages 2206-2216. PMLR, 2020.

Debayan Deb, Xiaoming Liu, and Anil K Jain. Faceguard: A self-supervised defense against adversarial face images. arXiv preprint arXiv:2011.14218 , 2020.

Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In Advances in Neural Information Processing Systems , 2021.

Gavin Weiguang Ding, Yash Sharma, Kry Yik Chau Lui, and Ruitong Huang. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations , 2020.

Yilun Du and Igor Mordatch. Implicit generation and modeling with energy based models. In Neural Information Processing Systems , 2019.

Partha Ghosh, Arpan Losalka, and Michael J Black. Resisting adversarial attacks using gaussian mixture variational autoencoders. In Proceedings of the AAAI conference on artificial intelligence , volume 33, pages 541-548, 2019.

Ross B. Girshick, Jeff Donahue, Trevor Darrell, and Jitendra Malik. Rich feature hierarchies for accurate object detection and semantic segmentation. 2014 IEEE Conference on Computer Vision and Pattern Recognition , pages 580-587, 2013.

Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations , 2015.

Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against norm-bounded adversarial examples. arXiv preprint arXiv:2010.03593 , 2020.

Sven Gowal, Sylvestre-Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. Advances in Neural Information Processing Systems , 34, 2021.

Alexandros Graikos, Nikolay Malkin, Nebojsa Jojic, and Dimitris Samaras. Diffusion models as plug-and-play priors. In Advances in Neural Information Processing Systems , 2022.

Will Grathwohl, Kuan-Chieh Wang, Joern-Henrik Jacobsen, David Duvenaud, Mohammad Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. In International Conference on Learning Representations , 2020.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 770-778, 2016.

Mitch Hill, Jonathan Craig Mitchell, and Song-Chun Zhu. Stochastic security: Adversarial defense using long-run dynamics of energy-based models. In International Conference on Learning Representations , 2021.

Chih-Hui Ho and Nuno Vasconcelos. DISCO: Adversarial defense with local implicit functions. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho, editors, Advances in Neural Information Processing Systems , 2022.

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems , 33:6840-6851, 2020.

Emiel Hoogeboom, Vıctor Garcia Satorras, Clément Vignac, and Max Welling. Equivariant diffusion for molecule generation in 3d. In International Conference on Machine Learning , pages 8867-8887. PMLR, 2022.

Uiwon Hwang, Jaewoo Park, Hyemi Jang, Sungroh Yoon, and Nam Ik Cho. Puvae: A variational autoencoder to purify adversarial examples. IEEE Access , 7:126582-126593, 2019.

Aapo Hyvärinen. Estimation of non-normalized statistical models by score matching. J. Mach. Learn. Res. , 6:695-709, 2005.

Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 6084-6092, 2019.

Dvij Kalaria, Aritra Hazra, and Partha Pratim Chakrabarti. Towards adversarial purification using denoising autoencoders. arXiv preprint arXiv:2208.13838 , 2022.

Qiyu Kang, Yang Song, Qinxu Ding, and Wee Peng Tay. Stable neural ode with lyapunov-stable equilibrium points for defending against adversarial attacks. Advances in Neural Information Processing Systems , 34:14925-14937, 2021.

Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. In Advances in Neural Information Processing Systems , 2022.

Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: A versatile diffusion model for audio synthesis. In International Conference on Learning Representations , 2021.

Alex Krizhevsky, Ilya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM , 60:84 - 90, 2012.

Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations , 2017.

Kyungmin Lee. Provable defense by denoised smoothing with learned score function. In ICLR Workshop on Security and Safety in Machine Learning Systems , 2021.

Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification. arXiv preprint arXiv:2303.09051 , 2023.

Chen-Hsuan Lin, Jun Gao, Luming Tang, Towaki Takikawa, Xiaohui Zeng, Xun Huang, Karsten Kreis, Sanja Fidler, Ming-Yu Liu, and Tsung-Yi Lin. Magic3d: High-resolution text-to-3d content creation. arXiv preprint arXiv:2211.10440 , 2022.

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations , 2018.

Gal Metzer, Elad Richardson, Or Patashnik, Raja Giryes, and Daniel Cohen-Or. Latent-nerf for shape-guided generation of 3d shapes and textures. arXiv preprint arXiv:2211.07600 , 2022.

Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 427-436, 2015.

Alexander Quinn Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob Mcgrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. In International Conference on Machine Learning , pages 16784-16804. PMLR, 2022.

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In Proceedings of the 39th International Conference on Machine Learning , pages 16805-16827, 2022.

Tianyu Pang, Kun Xu, Chongxuan Li, Yang Song, Stefano Ermon, and Jun Zhu. Efficient learning of generative models via finite-difference score matching. Advances in Neural Information Processing Systems , 33:19175-19188, 2020.

Tianyu Pang, Min Lin, Xiao Yang, Junyi Zhu, and Shuicheng Yan. Robustness and accuracy could be reconcilable by (proper) definition. In International Conference on Machine Learning , 2022.

Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. Dreamfusion: Text-to-3d using 2d diffusion. In The Eleventh International Conference on Learning Representations , 2023.

Sylvestre-Alvise Rebuffi, Sven Gowal, Dan A Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Fixing data augmentation to improve adversarial robustness. arXiv preprint arXiv:2103.01946 , 2021.

Leslie Rice, Eric Wong, and J. Zico Kolter. Overfitting in adversarially robust deep learning. In International Conference on Machine Learning , 2020.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10684-10695, 2022.

J. Rony, L. G. Hafemann, L. S. Oliveira, I. Ben Ayed, R. Sabourin, and E. Granger. Decoupling direction and norm for efficient gradient-based l2 adversarial attacks and defenses. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 4317-4325. IEEE Computer Society, 2019.

Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Representations , 2018.

L Schott, J Rauber, M Bethge, and W Brendel. Towards the first adversarially robust neural network model on mnist. In Seventh International Conference on Learning Representations (ICLR 2019) , pages 1-16, 2019.

Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal. Robust learning meets generative models: Can proxy distributions improve adversarial robustness? In International Conference on Learning Representations , 2021.

Evan Shelhamer, Jonathan Long, and Trevor Darrell. Fully convolutional networks for semantic segmentation. 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , pages 3431-3440, 2014.

Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-supervised learning. In International Conference on Learning Representations , 2021.

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 , 2014.

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations , 2021.

Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In International Conference on Learning Representations , 2018.

Yang Song, Sahaj Garg, Jiaxin Shi, and Stefano Ermon. Sliced score matching: A scalable approach to density and score estimation. In Conference on Uncertainty in Artificial Intelligence , 2019.

Yang Song, Conor Durkan, Iain Murray, and Stefano Ermon. Maximum likelihood training of score-based diffusion models. Advances in Neural Information Processing Systems , 34, 2021.

Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations , 2021.

Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 1-9, 2015.

Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based generative modeling in latent space. In Neural Information Processing Systems , 2021.

Pascal Vincent. A connection between score matching and denoising autoencoders. Neural computation , 23(7):1661-1674, 2011.

Haochen Wang, Xiaodan Du, Jiahao Li, Raymond A Yeh, and Greg Shakhnarovich. Score jacobian chaining: Lifting pretrained 2d diffusion models for 3d generation. arXiv preprint arXiv:2212.00774 , 2022.

Jinyi Wang, Zhaoyang Lyu, Dahua Lin, Bo Dai, and Hongfei Fu. Guided diffusion model for adversarial purification. arXiv preprint arXiv:2205.14969 , 2022.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In International Conference on Machine Learning (ICML) , 2023.

Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In Advances in Neural Information Processing Systems , volume 33, pages 2958-2969, 2020.

Quanlin Wu, Hang Ye, and Yuntian Gu. Guided diffusion model for adversarial purification from random noise. arXiv preprint arXiv:2206.10875 , 2022.

Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.00322 , 2022.

Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. In International Conference on Machine Learning , 2019.

Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference on Machine Learning , pages 12062-12072. PMLR, 2021.

Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In British Machine Vision Conference 2016 . British Machine Vision Association, 2016.

Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning , pages 7472-7482. PMLR, 2019.

A Related Work

A.1 Adversarial attack

Adversarial attacks are aimed at manipulating or deceiving machine learning models by introducing imperceptible perturbations to input data, which can lead to misclassification. These attacks can be categorized into three types: black-box, gray-box, and white-box attacks, with increasing intensity.

In a black-box attack setting, the attacker has no knowledge of the internal structure of both the defender and the classifier. Conversely, white-box attacks have full access to all information about the pre-processor and the target classifier. Defending against white-box attacks is the most difficult task.

And gray-box attacks have partial information about the whole target model. Attackers usually have full access to the classifier but lack knowledge about the pre-processor. Adversarial examples are generated exclusively based on the classifier and evaluated using the entire model. This type of malicious perturbation is inherently limited in its effectiveness compared to white-box attacks. It is important to note that gray-box attacks can be seen as transfer-based black-box attacks, where the raw classifier serves as the source model, and the entire model (including the pre-processor) represents the target model.

A.2 Adversarial defense

To enhance the resistance of classifiers against adversarial attacks, two primary approaches have been employed. The first approach is adversarial training (AT), which has proven to be highly effective in defending against such attacks [36, 32, 71, 44]. AT involves training classifiers using both clean data with ground-truth labels and adversarially perturbed samples. However, a notable limitation of AT is that it can only defend against attacks that the model has been specifically trained on, necessitating retraining the classifier when confronted with new attack types.

Purification, which involves applying a pre-processing procedure to input data before it is fed into classifiers, is another approach for enhancing adversarial robustness. Several existing studies have explored the effectiveness of different purification models, such as denoising auto-encoders [24, 27], sets of image filters [8], and compression-and-recovery models [26], among others. Among these purification methods, generative models [55, 12, 49] have demonstrated significant effectiveness in transforming adversarial data into clean data. The underlying idea of this technique is to learn the underlying distribution of clean data and use it to transform adversarial examples.

B Attack Transferred from Base Classifier

We evaluate our defense against adversarial images generated from the PGD attack only on the base classifier. The attack process does not incorporate the pre-processing model. We conduct experiments against Transfer-PGD attacks for both CIFAR10 and ImageNet datasets. The experimental settings adhere to previous purification methods. In summary, our proposed method exhibits substantial improvements in both standard and robust accuracy measures.

CIFAR10 Table 7 and 8 show the robustness results against Transfer-PGD attack under the ℓ ∞ ( ϵ = 8 / 255) and ℓ 2 ( ϵ = 0 . 5) threat models on CIFAR10 dataset, respectively. We compare our method with two kinds of defenses: adversarial training and adversarial purification methods. The results demonstrate that the robust accuracies of our two methods achieve state-of-the-art performance, with comparable standard accuracies. Specifically, our method outperforms existing adversarial purification methods, including diffusion-based multi-step denoising models. Under the ℓ ∞ ( ϵ = 8 / 255) threat models, our proposed method improves robust accuracy by 2.2%. As for the ℓ 2 ( ϵ = 0 . 5) threats, our algorithms still achieve a substantial improvement over existing methods in terms of both standard accuracy 93.1% and robust accuracy 92.52%.

IMAGENET Table 9 presents the robustness performance of our method on the Imagenet dataset. We evaluate our method under ℓ ∞ ( ϵ = 4 / 255) threat model with different perturbation budgets on three different backbones with different natural classification accuracies. Results show that the effectiveness of our method is not affected by the underlying classifier architecture. Even under larger attack budgets, we find that our method still keeps the ability to purify adversarial perturbations and generally achieves over 60% robust accuracy.

Based on the results from Table 7 to 9, we can summarize that ScoreOpt achieves better performance than previous defenses consistently and purify adversarial examples on transfer-based attacks successfully, across various datasets.

C Experimental Details

Code is available at https://github.com/zzzhangboya/ScoreOpt.git .

C.1 Computing resources

All of our experiments are conducted using GPUs. Specifically, the diffusion models and base classifiers are trained in parallel on eight GPUs. Each test-time robustness evaluation is performed on a single GPU. The GPUs used in our experiments are NVIDIA TITAN RTX with 24GB of memory.

C.2 Dataset descriptions

We utilize three datasets in our experiments: CIFAR-10, CIFAR-100, and ImageNet. CIFAR-10 and CIFAR-100 datasets contain 50,000 training images and 10,000 test images, with 10 and 100 classes respectively. All CIFAR images have a resolution of 32x32 pixels and three color channels (RGB). On the other hand, ImageNet consists of a validation set with 50,000 examples, featuring 1,000 classes and images with a resolution of 256x256 pixels and three color channels.

C.3 Attack details

We conduct evaluations against the BPDA+EOT attack using 50 BPDA iteration steps and 15 EOT attack samples. Regarding the white-box PGD+EOT attack discussed in Section 4.2.2, we employ 20 PGD steps and 20 replicates for EOT attacks, consistent with the setup used in Lee and Kim [34].

For the Transfer-PGD attack, we adopt 40 PGD update iterations to generate adversarial examples, following previous studies [69, 63]. The step size α is set to ϵ/ 4 .

C.4 Training details

Diffusion models We utilize pre-trained class-unconditional diffusion models obtained from Karras et al. [29] for CIFAR-10 and from Dhariwal and Nichol [9] for ImageNet. For the CIFAR-100 dataset, we train our own class-unconditional EDM using the ddpm++ model architecture. The training configuration and network architecture for CIFAR-100 align with the settings used in Karras et al. [29] for CIFAR-10.

Classifiers Our classifiers are trained alone on the training set of each dataset. For CIFAR-10, WRN-28-10 and WRN-70-16 classifiers both achieve 95.19% natural accuracy on the whole test set. For CIFAR-100, the WRN-28-10 model achieves 81.45% natural accuracy and WRN-70-16 achieves 81.28% natural accuracy.

C.5 Implementation details of our methods

We evaluate our ScoreOpt method using the Adam optimizer in all experiments. During our experiments, we observed that both the Diff loss and the SR loss can yield satisfactory results when the number of optimization steps is relatively small. However, in comparison to SR optimization, Diff optimization offers faster inference speed and requires less memory. Unless otherwise stated, all experiments in the main text are conducted using the WRN-28-10 classifier architecture. Please refer to Table 10 for the optimization hyper-parameters we used to obtain the final evaluation results in Section 4 and Appendix B.

D Ablation Studies and Additional Results

D.1 Different classifier architectures

To showcase the effectiveness and reliability of incorporating our method into any off-the-shelf classifiers, we conduct additional evaluations using the WideResNet-70-16 classifier architecture. All of these experiments are conducted using the same optimization hyper-parameters as those employed for the WRN-28-10 architecture. Table 11 demonstrates that our method with WRN-7016 consistently achieves high robust accuracy against various attacks on both the CIFAR-10 and CIFAR-100 datasets.

D.2 Number of EOT attack replicates

Wepresent additional results for our ScoreOpt defense by varying the number of EOT attack replicates. All experiments are conducted using the same settings as described in Section 4, except the EOT number. Figure 4 illustrates the robustness performance against PGD+EOT attacks with different numbers of EOT replicates, while Figure 5 showcases the results against BPDA+EOT attacks. The evaluations are performed using the WRN-28-10 architecture on the CIFAR-10 dataset. Interestingly, our findings indicate that the number of EOT replicates does not significantly impact the standard and robust accuracy of our method.

(a)

ℓ

∞

(

ϵ

= 8

/

255)

100

StandardAccuracy

RobustAccuracy

80

Accuracy%

%

60

40

20

0

5

10

15

20

25

30

NumberofEOTreplicates

(b)

ℓ

2

(

ϵ

= 0

.

5)

100

StandardAccuracy

RobustAccuracy

80

Accuracy%

%

60

40

20

0

5

10

15

20

25

30

100

StandardAccuracy

RobustAccuracy

80

%

60

40

20

0

5

10

15

20

25

30

NumberofEOTreplicates

D.3 Hyper-parameter choices of the optimization process

To further assess the effectiveness of our methods, we conduct additional experiments presented in Table 12. In these experiments, we use different optimization hyper-parameters compared to the ones used in Table 10. It is worth noting that varying the optimization hyper-parameters typically does not have a significant impact on the final robustness results. This observation suggests that our defense mechanism remains effective and consistent across different choices of optimization hyper-parameters, further reinforcing its reliability.

D.4 More results on the whole ImageNet test set

The experimental results presented in Table 9 are evaluated on a fixed subset of 512 randomly sampled images. To provide a more comprehensive assessment, we include additional results on the complete 50,000 test set of ImageNet in Table 13.

E Discussions and Limitations

The experiments conducted demonstrate the significant improvements achieved by our method in terms of both robustness performance and inference speed compared to previous methods. Our approach can be seamlessly integrated into various off-the-shelf classifiers. However, it is important to acknowledge a few potential drawbacks of our method.

Firstly, the computational memory cost remains a challenge that needs to be addressed. Although our method requires only a small number of optimization steps, the inclusion of the U-Net Jacobian term in the loss function introduces additional computational overhead. This memory constraint limits the evaluation of our method on stronger adversarial benchmarks like RobustBench.

Secondly, while we have experimentally demonstrated that our test-time optimization process converges to a certain local optimum within a small number of steps, we have not provided a theoretical convergence analysis.

Our future work will focus on addressing these limitations and further exploring the theoretical aspects of our method. By addressing these issues, we can enhance the practicality and theoretical understanding of our approach, paving the way for more robust and efficient adversarial defense mechanisms.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a dynamic defense named ScoreOpt, which maximizes the likelihood of input images by minimizing the score-matching loss. To regulate the optimization, the authors propose Score Regularization Loss which bound the distance between the denoised original images and denoised purified images.\n\nSTRENGTHS:\n1. This paper proposes a novel test time defense, which is much more efficient than previous diffusion-based purification methods.\n2. This paper is well written.\n\nWEAKNESSES:\n1. The baseline model, DiffPure with Wide-ResNet-28, achieves 81.40% robustness in your paper. However, according to [1], the original paper where this baseline was proposed, it only achieves 70.64% robustness. This suggests that the robustness of the baselines and proposed method in your paper may be greatly over-estimated.\n2. The proposed method contains an optimization that is typically considered hard to evaluate due to indifferentiability. \n\n[1] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022.\n\nQUESTIONS:\nI would recommend using more advanced evaluation methods for DiffPure and your proposed method, as suggested in [1], [2], and [3]. These methods could provide a more comprehensive evaluation and a fair comparison with state-of-the-art methods.\nI would like to request a detailed derivation of  Equation (1) and an explanation of why it is the variational upper bound of -logp(x).  \n\n[1] Nie, Weili, et al. \"Diffusion Models for Adversarial Purification.\" International Conference on Machine Learning. PMLR, 2022.\n[2] Chen, Huanran, et al. \"Robust Classification via a Single Diffusion Model.\" arXiv preprint arXiv:2305.15241 (2023).\n[3] Lee, Minjong, and Dongwoo Kim. \"Robust evaluation of diffusion-based adversarial purification.\" arXiv preprint arXiv:2303.09051 (2023).\n\nLIMITATIONS:\nLimitation is not mentioned in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces an adversarial defense scheme named ScoreOpt, which optimizes adversarial samples at test-time, towards original clean data in the direction guided by score-based priors. Comprehensive experiments are conducted on multiple datasets, including CIFAR10/100 and ImageNet, demonstrating that ScoreOpt outperforms existing adversarial defenses in terms of both robustness performance and inference speed.\n\nSTRENGTHS:\nI like the problem formulation in Section 3.1 (although there are some questions that need to be clarified as mentioned in Questions) and a principle perspective from variational inference. Although heuristic, I think the formulation of SR loss is reasonable, especially the send term that minimizing the pixel-level distance between the denoised versions of the current sample $x$ and initial adversarial sample $x_a$. The empirical improvements compared to previous AP baselines are also promising.\n\nWEAKNESSES:\n- I cannot find the values of iteration steps $M$ and $N$ used for Ours(o) and Ours(n) in, e.g., Tables 1, 2 and 4. Do the Ours methods and other AT/AP baselines require comparable inference time to achieve the results reported in Tables 1, 2 and 4? The authors should report inference time for both Ours methods and other AT/AP baselines in these Tables, because in practice, higher inference cost is a much bigger concern than higher training cost.\n\n- Each computation of the SR loss in Equation (5) actually include two forward passes through the scorenet (one for $x_{t}$ and another for $x_{a,t}$). So it is unfair to just compare diffusion steps with previous baselines, the authors should report the actual inference time as mentioned above.\n\n- The proposed ScoreOpt applies EDM, while the considered diffusion-based baselines (both AT and AP) still mainly apply DDPM. Therefore, the authors should add comparisons with more advanced baselines that also apply EDM, such as [1] listed in RobustBench.\n\n[1] Better Diffusion Models Further Improve Adversarial Training\n\nQUESTIONS:\n- The second term in Equation (1) is the KL divergence between the conditional distribution $q(x|x_a)$ and model distribution $p_{\\theta}(x)$, then how it could be equivalent to the diffusion loss in Equation (2) that formulated between the marginal distribution $q(x)$ and model distribution $p_{\\theta}(x)$?\n\n- Equation (2) is NOT training loss of diffusion models since there is no expectation over $x$. Specifically, denoising score matching (DSM) used for training diffusion models includes expectation over $x$ (i.e., $\\mathbb{E}_{x}$), and this expectation over $x$ is necessary such that the optimal solution of minimizing DSM is equal to the optimal solution of minimizing score matching (SM, or Fisher divergence).\n\n- The weighting coefficient $\\omega(t)$ in Equation (2) should be $g(t)^{2}$ to make it a bound for log-likelihood, thus it is not guaranteed the relationship between  Equation (3) and log-likelihood.\n\n- Equation (4) is only reasonable for $\\ell_{2}$ threat model, but it is not justified why this loss could be effective under, e.g., $\\ell_{\\infty}$ threat model.\n\nLIMITATIONS:\nLimitations and potential negative societal impact are not discussed in this paper.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-06"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes an adversarial defense scheme named ScoreOpt, which uses purification technology to eliminate adversarial perturbations. Specifically, ScoreOpt formulates the adversarial defense as an optimization problem, which optimizes adversarial examples based on pre-trained score-based priors. And experimental results show that the adversarial robustness of the proposed method outperforms existing adversarial defenses against both transfer-based attacks and adaptive white-box attacks.\n\nSTRENGTHS:\n1. This paper is well-written and easy to follow.\n2. The proposed ScoreOpt departs from the sequential step-by-step denoising procedure, which doesn’t involve the process of carefully selecting the forward diffusion timestep.\n3. The proposed hyperparameter-free score regularization loss function takes into account not only the alignment between pixels but also the alignment between score estimations.\n\nWEAKNESSES:\n1. In this paper, the pre-designed noise plan is focused on lower noise levels. However, some clear explanations are necessary for this lower noise level. For example, how this lower noise level is defined, whether it is relevant to the dataset and whether too low noise level will affect the effectiveness of the proposed method.\n2. This paper evaluates the robustness performance of adversarial defenses against transfer-based attacks and adaptive white-box attacks. To further illustrate the effectiveness of the proposed method, this paper should also test performance against some other advanced attack methods, such as score-based black-box attacks.\n\nQUESTIONS:\n1. The authors may need to discuss the selection method of the noise level range, that is, how the values of $t_{min}$ and $t_{max}$ are determined, and the impact of the noise level range on the proposed algorithm.\n2. It is recommended to test performance against some other advanced attack methods to enhance the credibility and universality of the method.\n\nLIMITATIONS:\nThe authors point out the limitations of the proposed method in terms of computational memory cost and theoretical convergence analysis.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a new approach for defending against adversarial attacks using adversarial purification, i.e., removing the adversarial noise from the input image at test time. To that end, the authors leverage diffusion models -- which have been used recently for adversarial purification -- and propose several modifications to previous approaches in order to 1) improve performance and 2) speed up the process.\n\nTwo big problems faced by previous diffusion-based approaches for adversarial purification include the sensitivity to the choice of hyperparameters for the diffusion model, and the long runtime since many denoising steps need to be applied.\n\nTo solve the first problem, the authors propose a new hyper-parameter-free objective function for the adversarial purification using diffusion models. In order to solve the inference speed problem, the authors propose using a one-step denoiser, rather than employing the diffusion model denoise for several steps.\n\nThe authors test their proposed defense in several setups, including standard adversarial attacks and adaptive adversarial attacks. The authors compare their results with previous baselines from the adversarial training literature and the adversarial purification literature. The evaluation shows the effectiveness of the defense, as the proposed method outperforms previous approaches in robust accuracy, while being faster.\n\nSTRENGTHS:\nStrengths:\n\n- The paper addresses one important problem with previous diffusion-based adv purification approaches: the sensitivity to the choice of hyperparameters. To solve this problem, the authors propose a new objective function for the denoising, where they remove explicit dependence on hyperparameters.\n\n- The paper recognizes that previous approaches for adv purification using diffusion models are slow since the denoising step needs to be applied several times. To solve this issue, the authors propose using a one-shot denoiser.\n\n- The authors notice that some of the components needed for their objective function computation are absent, and propose choices to get circumvent the problem. For example, the authors notice the absence of the distribution of clean images conditioned on adversarial images, and propose an initialization to circumvent this issue.\n\n- The proposed approach is simple and intuitive. \n\n- The proposed approach outperforms previous methods in defending against adversarial attacks on a range of classification tasks. \n\n- The propose approach works well under traditional and adaptive attacks.\n\nWEAKNESSES:\n- The presentation of the ideas needs to be improved. In particular, the methodology section can be confusing, especially when the authors propose new approaches to circumvent some problems. For example, the paragraph about the choice of the noise update rule is very confusing. \n\n- The authors mix notation a lot. For example, the authors use $q(x)$ and $q(x|x_a)$ interchangeably, even though they are not the same. \n\n- Some of the choices made need a slightly better explanation/intuition behind them. For example, the choice of taking gradient in the SR loss w.r.t. $\\mathbf{x}_t$ instead of w.r.t. $\\mathbf{x}$ lacks intuition. \n\n- There seems to be no proofs to the some of the statements of the paper. Are they provided in the appendix, or are they referencing proofs from previous papers?\n\n- The pseudocodes for the two proposed algorithms could be made clearer. First, having a clear explanation what each term represents would be helpful. Furthermore, in alg 1, it would be nice to show the term (5) rather than referencing it. Similarly, in alg 2, show the full term. Also the term $\\mathbf{x}_{j,t}$ doesn't seem to be defined?\n\nQUESTIONS:\n- How's Tweedie's formula used in the paper?\n\n- How much time in total the proposed approach requires?\n\n- Which converges faster: ScoreOpt(n) or ScoreOpt(o)?\n\n- Why does ScoreOpt(n) perform better? The intuition is not very clear.\n\n- The regularization term in the SR loss is not parametrized by a hyper-param. This works well in practice. I am not sure I agree about the reasoning of having similar order of magnitude, since a hyperparameter to control this regularization term can keep the same order of magnitude. Did the authors test adding a hyperparameter to the regularization term, and explore the sensitivity of the method to the choice?\n\n- Does having a different noise level during every iteration help? Have the authors tested having a fixed noise level?\n\n-\n\nLIMITATIONS:\n- The authors identified some of the missing terms needed for their approximation, and proposed simple solutions to fix the issue. For example, the authors initialize the optimization variable $\\mathbf{x}$ to the adv image $\\mathbf{x}_a$ since they cannot take expectation over $q(\\mathbf{x}|\\mathbf{x}_a)$ in (1). However, this choice doesn't seem very convincing.\n\n- The method has not been fully tested against adaptive whitebox attacks since the computation cost of differentiation through the U-Net is very expensive. As a result, the authors only differentiate through one step. The results might look a bit different when the attack differentiates through multiple denoising steps.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-18"}