ADBM: Adversarial diffusion bridge model for reliable adversarial purification

About

Recently Diffusion-based Purification (DiffPure) has been recognized as an effective defense method against adversarial examples. However, we find DiffPure which directly employs the original pre-trained diffusion models for adversarial purification, to be suboptimal. This is due to an inherent trade-off between noise purification performance and data recovery quality. Additionally, the reliability of existing evaluations for DiffPure is questionable, as they rely on weak adaptive attacks. In this work, we propose a novel Adversarial Diffusion Bridge Model, termed ADBM. ADBM directly constructs a reverse bridge from the diffused adversarial data back to its original clean examples, enhancing the purification capabilities of the original diffusion models. Through theoretical analysis and experimental validation across various scenarios, ADBM has proven to be a superior and robust defense mechanism, offering significant promise for practical applications.

Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yining Liu, Yingzhe He, Jie Shi, Xiaolin Hu · 2024

Related benchmarks

Task	Dataset	Result
Adversarial Robustness	CIFAR-10 (test)	Attack Success Rate (ASR)—	76
Adversarial Purification	CIFAR-10	Standard Accuracy91.93	68
Adversarial Robustness	CIFAR-100 (test)	Natural Acc—	46
Adversarial Purification	CIFAR-100	Average Accuracy64.76	38
Adversarial Robustness	CIFAR-10	FGSM Robust Accuracy—	30
Image Classification	CIFAR-10 (test)	Clean Accuracy91.93	12
Adversarial Robustness	CIFAR-100	APGD Avg Score61.01	7
Adversarial Purification	SVHN (test)	Accuracy93.5	7
Image Classification	SVHN	Standard Accuracy93.49	7
Adversarial Robustness Classification	CIFAR-10	Robust Accuracy (C&W + EOT)78.4	6