# DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification Source: [DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification]() Collection index: [llms.txt]() Data updated: 2026-01-04T04:38:13.156Z Authors: Mintong Kang, Dawn Song, Bo Li Published: 2023-10-27T15:17:50.000Z ## Abstract Diffusion-based purification defenses leverage diffusion models to remove crafted perturbations of adversarial examples and achieve state-of-the-art robustness. Recent studies show that even advanced attacks cannot break such defenses effectively, since the purification process induces an extremely deep computational graph which poses the potential problem of gradient obfuscation, high memory cost, and unbounded randomness. In this paper, we propose a unified framework DiffAttack to perform effective and efficient attacks against diffusion-based purification defenses, including both DDPM and score-based approaches. In particular, we propose a deviated-reconstruction loss at intermediate diffusion steps to induce inaccurate density gradient estimation to tackle the problem of vanishing/exploding gradients. We also provide a segment-wise forwarding-backwarding algorithm, which leads to memory-efficient gradient backpropagation. We validate the attack effectiveness of DiffAttack compared with existing adaptive attacks on CIFAR-10 and ImageNet. We show that DiffAttack decreases the robust accuracy of models compared with SOTA attacks by over 20% on CIFAR-10 under $\\ell\_\\infty$ attack $(\\epsilon=8/255)$, and over 10% on ImageNet under $\\ell\_\\infty$ attack $(\\epsilon=4/255)$. We conduct a series of ablations studies, and we find 1) DiffAttack with the deviated-reconstruction loss added over uniformly sampled time steps is more effective than that added over only initial/final steps, and 2) diffusion-based purification with a moderate diffusion length is more robust under DiffAttack. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Image Classification on CIFAR-10 (test) (Cl-Acc/Rob-Acc)](): Image Classification; CIFAR-10 (test); Classification Accuracy (Cl-Acc): 92.68. - [Robust Image Classification on CIFAR-10 (test)](): Robust Image Classification; CIFAR-10 (test); Classification Accuracy: 92.19. - [Adversarial Attack on ImageNet (test)](): Adversarial Attack; ImageNet (test); Success Rate: not recorded. - [Adversarial Robustness on CIFAR-10 (test)](): Adversarial Robustness; CIFAR-10 (test); Attack Success Rate (ASR): not recorded. ## Original sources and implementation [Original paper]() [PDF]() [Implementation]()