# MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model Source: [MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model]() Collection index: [llms.txt]() Data updated: 2026-01-04T04:40:12.946Z Authors: Kaiyu Song, Hanjiang Lai Published: 2023-12-08T02:32:47.000Z ## Abstract Deep neural networks (DNNs) are vulnerable to adversarial perturbation, where an imperceptible perturbation is added to the image that can fool the DNNs. Diffusion-based adversarial purification focuses on using the diffusion model to generate a clean image against such adversarial attacks. Unfortunately, the generative process of the diffusion model is also inevitably affected by adversarial perturbation since the diffusion model is also a deep network where its input has adversarial perturbation. In this work, we propose MimicDiffusion, a new diffusion-based adversarial purification technique, that directly approximates the generative process of the diffusion model with the clean image as input. Concretely, we analyze the differences between the guided terms using the clean image and the adversarial sample. After that, we first implement MimicDiffusion based on Manhattan distance. Then, we propose two guidance to purify the adversarial perturbation and approximate the clean diffusion model. Extensive experiments on three image datasets including CIFAR-10, CIFAR-100, and ImageNet with three classifier backbones including WideResNet-70-16, WideResNet-28-10, and ResNet50 demonstrate that MimicDiffusion significantly performs better than the state-of-the-art baselines. On CIFAR-10, CIFAR-100, and ImageNet, it achieves 92.67\\%, 61.35\\%, and 61.53\\% average robust accuracy, which are 18.49\\%, 13.23\\%, and 17.64\\% higher, respectively. The code is available in the supplementary material. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Adversarial Robust Image Classification on CIFAR-10 (test)](): Image Classification; CIFAR-10 (test); Accuracy (Clean): not recorded. - [Image Classification on CIFAR-10 24 (test)](): Image Classification; CIFAR-10 24 (test); Standard Accuracy: not recorded. - [Image Classification on CIFAR-100 (test) (Standard and Robust Accuracy)](): Image Classification; CIFAR-100 (test); Standard Accuracy: not recorded. - [Image Classification on ImageNet (test val) (Standard and Robust Accuracy)](): Image Classification; ImageNet (test val); Standard Accuracy: not recorded. - [Image Classification on CIFAR-10 (Standard & Robustness Evaluation)](): Image Classification; CIFAR-10; Standard Accuracy: not recorded. ## Original sources and implementation [Original paper]() [PDF]()