# Guided Diffusion Model for Adversarial
Purification from Random Noise

Quanlin Wu
Yuanpei College
Peking University
<EMAIL_ADDRESS>
&Hang Ye
Yuanpei College
Peking University
<EMAIL_ADDRESS>
&Yuntian Gu
Yuanpei College
Peking University
<EMAIL_ADDRESS>

###### Abstract

In this project, we propose a novel guided diffusion purification approach to
provide a strong defense against adversarial attacks. Our model achieves
$89.62\%$ robust accuracy under PGD-$\ell_{\infty}$ attack ($\epsilon=8/255$)
on the CIFAR-10 dataset. We first explore the essential correlations between
unguided diffusion models and randomized smoothing, enabling us to apply the
models to certified robustness. The empirical results show that our models
outperform randomized smoothing by $5\%$ when the certified $\ell_{2}$ radius
$r$ is larger than $0.5$.

##  1 Introduction

While deep neural networks have demonstrated remarkable capabilities in
complicated tasks, it has been noticed by the community that they are
vulnerable to adversarial attacks [4, 16]. Specifically, altering images with
slight perturbations that are imperceptible to humans, can mislead trained
neural networks to unexpected predictions, which poses a security threat in
real-world scenarios. Various kinds of defense strategies have been proposed
to protect DNN-based classifiers from adversarial attacks. Among them,
_adversarial training_ [10] has become a widely-used defense form. Despite
their effectiveness, most adversarial training methods fail against suitably
powerful and unseen attacks. In addition, it often requires higher
computational complexity for training.

Another class of defense methods, often termed with _adversarial purification_
, aimed at using the generative models to recover corrupted examples in a pre-
processing manner. Recently, denoising diffusion probabilistic models [7] have
shown impressive performance as powerful generative models, beating GANs in
image generation [2]. Both works [17, 12] propose a novel purification
approach based on diffusion models. In sharp contrast with prevalent
generative models, including GANs [3] and VAEs [8], diffusion models define
two processes: (i) a forward diffusion process that converts inputs into
Gaussian noises step by step, and (ii) a reverse generative process recovering
clean images from noises. Leveraging diffusion models for adversarial
purification is a natural fit, as the adversarial perturbations will be
gradually smoothed and dominated by the injected Gaussian noises. In addition,
the stochasticity of diffusion models provides a powerful defense against
adversarial attacks.

We summarize our main contributions as follows:

  * •

Inspired by recent works, we propose a novel guided diffusion-based approach
to purify adversarial images. Empirical results demonstrate the effectiveness
of our method.

  * •

We reveal the fundamental correlations between the unguided diffusion-model-
based adversarial purification and randomized smoothing, enabling a provable
defense mechanism.

  * •

We present a theoretical analysis of the diffusion process in adversarial
purification, which can provide some insights into its properties.

  * •

We also include denoising diffusion implicit models (DDIM) and study the
trade-off between the inference speed and robustness.

##  2 Backgrounds

###  2.1 Adversarial Robustness

Adversarial Training. Adversarial training is an empirical defense method,
which involves adversarial examples during the training of neural networks.
Let $g_{\phi}:\mathcal{X}\rightarrow\mathcal{Y}$ denote the target classifier.
Worst-case risk minimization can be formulated as the following saddle-point
problem

$\min_{\phi}\mathbb{E}_{(x,y)\sim p_{\text{data}}}[\max_{x^{\prime}\in
B(x)}\mathcal{L}(g_{\phi}(x^{\prime}),y)]$ (1)

where $\mathcal{L}$ is a loss function and $\mathcal{B}(x)$ is the set of
allowed perturbations in the neighborhood of $x$.

Adversarial Purification. Recently, leveraging generative models to purify the
images from adversarial perturbations before classification has become a
promising counterpart of adversarial training. In this manner, neither
assumptions on the form of attacks nor the architecture details of classifiers
are required. The generative models for purification can be trained
independently and paired with standard classifiers, which is less time-
consuming compared with adversarial training. We just need to slightly modify
the formula above to represent adversarial purification

$\min_{\phi,\theta}\mathbb{E}_{(x,y)\sim p_{\text{data}}}[\max_{x^{\prime}\in
B(x)}\mathcal{L}(g_{\phi}(f_{\theta}(x^{\prime}),y)]$ (2)

where $f_{\theta}$ denotes the generative models as a pre-processor. [13]
propose defense-GAN, [15] utilize pre-trained PixelCNN for purification and
[18] rely on denoising score-based model to remove adversarial perturbations.
More recently, diffusion models have been applied to adversarial purification
[12, 17]. We base our works on [12, 17] and make attempts to improve the
efficiency of this defense mechanism. Furthermore, our models can be
generalized to provide certified guarantees of robustness.

###  2.2 DDPM

Generally speaking, diffusion models approximate a target distribution $q(x)$
by reversing a gradually Gaussian diffusion. Denoising diffusion probabilistic
models (DDPMs[7]) define a Markov diffusion process formulated by

$q(x_{1:T}|x_{0}):=\prod_{t=1}^{T}q(x_{t}|x_{t-1}),\quad
q(x_{t}|x_{t-1}):=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}\boldsymbol{I})$
(3)

where $\\{\beta_{t}\in(0,1)\\}_{t=1}^{T}$. In the diffusion process, $x_{t}$
can be seen as a mixture of $x_{t-1}$ and a Gaussian noise, which means the
data sample $x_{0}$ gradually loses its distinguishable features and finally
becomes a random noise. By define
$\alpha_{t}=1-\beta_{t},\bar{\alpha}_{t}=\prod_{s=1}^{t}\alpha_{s}$, we can
get a closed form expression of $q(x_{t}|x_{0})$ like

$q(x_{t}|x_{0})=\mathcal{N}(x_{t};\sqrt{\bar{\alpha}_{t}}x_{0},(1-\bar{\alpha}_{t})\boldsymbol{I})$
(4)

And then the model constructs a reverse process by learning to predict a
"slightly less noised" $x_{t-1}$ given $x_{t}$. Let $x_{T}$ be a latent
variable (usually a random noise), a sample of the target distribution
$q(x_{0})$ can by got through a Markov process defined as

$p_{\theta}(x_{0:T}):=p(x_{T})\prod_{t=1}^{T}p_{\theta}(x_{t-1}|x_{t}),\quad
p_{\theta}(x_{t-1}|x_{t}):=\mathcal{N}(x_{t-1};\mu_{\theta}(x_{t},t),\Sigma_{\theta}(x_{t},t))$
(5)

According to Ho et al.[7], the mean $\mu_{\theta}(x_{t},t)$ is a neural
network parameterized by $\theta$ while the variance
$\Sigma_{\theta}(x_{t},t))$ is a set of time-dependent constants.

###  2.3 DDIM

Although diffusion models can generate high-quality samples, they have a
critical drawback in generative speed because they require many iterations to
reverse the diffusion process. [14] accelerate the generation by changing the
Markov process to a non-Markovian one. They rewrite the reverse process with a
desired variation $\sigma^{2}_{t}$.

$x_{t-1}=\sqrt{\bar{\alpha}_{t-1}}(\dfrac{x_{t}-\sqrt{1-\bar{\alpha}_{t}}\epsilon_{\theta}(x_{t},t)}{\sqrt{\bar{\alpha}_{t}}})+\sqrt{1-\bar{\alpha}_{t-1}-\sigma_{t}^{2}}\cdot\epsilon_{\theta}(x_{t},t)+\sigma_{t}\epsilon_{t}$
(6)

Without re-training a DDPM, we can accelerate the inference by only sampling a
subset of $S$ diffusion steps $\\{\tau_{1},\tau_{2},\cdots,\tau_{S}\\}$ where
$\tau_{1}<\tau_{2}<\cdots<\tau_{S}\in[T]$ and $S<T$.

$x_{\tau_{i-1}}=\sqrt{\bar{\alpha}_{\tau_{i-1}}}(\dfrac{x_{\tau_{i}}-\sqrt{1-\bar{\alpha}_{\tau_{i}}}\epsilon_{\theta}(x_{\tau_{i}},\tau_{i})}{\sqrt{\bar{\alpha}_{\tau_{i}}}})+\sqrt{1-\bar{\alpha}_{\tau_{i-1}}-\sigma_{\tau_{i}}^{2}}\cdot\epsilon_{\theta}(x_{\tau_{i}},\tau_{i})+\sigma_{\tau_{i}}\epsilon$
(7)

The desired variation $\\{\sigma_{t}^{2}\\}_{t=1}^{T}$ is controlled by a
hyper-parameter $\eta\in\mathbb{R}_{\geq 0}$

$\sigma_{t}(\eta)=\eta\sqrt{(1-\bar{\alpha}_{t-1})/(1-\bar{\alpha}_{t})}\sqrt{1-\bar{\alpha}_{t}/\bar{\alpha}_{t-1}}$
(8)

Note that the DDPM reverse process is a special case of the DDIM reverse
process ($\eta$ = 1). And when $\eta=0$ the denoising processes become
deterministic and such a model is named denoising diffusion implicit model
(DDIM [14]).

##  3 Methods

###  3.1 Diffusion Purification

We now present the details of our method. As the diffusion length of the
forward process $T$ increases, the adversarial perturbations will be dominated
by added Gaussian noises. And the reverse process can be viewed as a
purification process to recover clean images. Therefore, the restoring step is
fundamental for adversarial robustness. Most importantly, we need to deal with
the tension between retaining the semantic content of clean images and
filtering the adversarial perturbations.

Figure 1: An illustration of our diffusion purification methods.

Both works [17, 12] feed the diffused adversarial inputs into the reverse
process. [12] regards the reverse process as solving stochastic differential
equations (SDE). In our works, we propose a novel approach inspired by
conditional image generation [2]. We sample the initial input $x_{T}$ from
pure Gaussian noises and gradually denoise it with the guidance of the
adversarial image $x_{0}^{\prime}$. The intuition here is that the diffused
image $x_{T}^{\prime}$ still carries corrupted structures, the reverse process
is likely to get stuck in the local blind spots, which are susceptible to
adversarial attacks. On contrary, if the magnitude of the guidance is suitably
adjusted, strong enough to recover semantic contents but not too large to
resemble the adversarial image, starting from pure Gaussian noises often leads
to better results.

Now we explain the guidance mechanism. Let $x_{0}^{\prime}$ be the adversarial
input, the conditional backward process can be defined as

$p_{\theta,\phi}(x_{t-1}|x_{t},x_{0}^{\prime})=Z_{1}p_{\theta}(x_{t-1}|x_{t})p_{\phi}(x_{0}^{\prime}|x_{t-1})$
(9)

where $Z_{1}$ is a normalizing factor. It has been proved in [2] that we can
approximate the distribution using a Gaussian with shifted mean

$p_{\theta}(x_{t-1}|x_{t})p_{\phi}(x_{0}^{\prime}|x_{t-1})=\mathcal{N}(\mu+\Sigma\nabla_{x_{t}}\log
p_{\phi}(x_{0}^{\prime}|x_{t}),\Sigma)$ (10)

Following [9, 17], we use a heuristic formulation here. First we sample the
diffused outputs $x_{t}^{\prime}$ with the adversarial image $x_{0}^{\prime}$
according to 4. Suppose $\mathcal{D}$ is a distance metric and $s$ is a
scaling factor controlling the magnitude of guidance, we have

$p_{\phi}(x_{0}^{\prime}|x_{t})=Z_{2}\exp(-s\mathcal{D}(x_{t},x_{t}^{\prime}))$
(11)

Therefore, the mean of the conditional distribution is shifted by
$-s\Sigma\nabla_{x_{t}}\mathcal{D}(x_{t},x_{t}^{\prime})$. Apparently,
introducing an extra neural network, which generates feature embeddings to
measure the distances between images, is still vulnerable to white-box
attacks. So we adopt the simple Mean Square Error as the distance metric
$\mathcal{D}$ in our experiments. As for the guidance scale $s$, we follow the
formula used in [17]. Suppose the adversarial image
$x_{0}^{\prime}=x_{0}+\Delta x$, we have

$x_{t}^{\prime}=\sqrt{\bar{\alpha}_{t}}x_{0}+\sqrt{\bar{\alpha}_{t}}\Delta
x+\sqrt{1-\bar{\alpha}_{t}}\epsilon$ (12)

The scaling factor $s$ should be time-dependent, proportional to the ratio of
the magnitude of Gaussian noises to adversarial perturbations. A higher ratio
suggests that the adversarial perturbation gets dominated by Gaussian noise,
thus it’s safe to increase the strength of the guidance signal. Suppose the
perturbation $\Delta x$ is bounded by $\ell_{\infty}$ norm $r$, We define
$s_{t}$ using the following formula

$s_{t}=a\cdot\dfrac{\sqrt{1-\bar{\alpha}_{t}}}{r\sqrt{\bar{\alpha}_{t}}}$ (13)

where $a$ is an empirically determined hyperparameter. Above all, the pseudo-
code of our method is shown in Algorithm 1. An illustration of our method is
shown in Fig. 1.

Algorithm 1 Guided Adversarial Purification Using Diffusion Models

Input: an adversarial image $x_{0}^{\prime}$, diffusion length $T$, distance
metric $\mathcal{D}$, scaling factor $s$

$x_{T}\leftarrow$ sample from $\mathcal{N}(0,\boldsymbol{I})$

for $t=T$ to $1$ do

$x_{t}^{\prime}\leftarrow$ sample from
$\mathcal{N}(\sqrt{\bar{\alpha}_{t}}x_{0}^{\prime},(1-\bar{\alpha}_{t})\boldsymbol{I})$

$\mu,\Sigma\leftarrow\mu_{\theta}(x_{t},t),\sigma_{t}^{2}\boldsymbol{I}$

$x_{t-1}\leftarrow$ sample from
$\mathcal{N}(\mu-s\Sigma\nabla_{x_{t}}\mathcal{D}(x_{t},x_{t}^{\prime}),\Sigma)$

end for

return $x_{0}$

###  3.2 Certifying $\ell_{2}$ Robustness

Now we shift our attention to the unguided purification model proposed in
[12]. As pointed out by [12, 17], we can purify the adversarial inputs
multiple times to gradually eliminate the perturbations. Let $M$ be the number
of purification runs, we restate the algorithm as shown in pseudo-code 2. One
main contribution of our works is to explore the inherent connections between
unguided diffusion models and randomized smoothing [1]. We discover that a
provable defense mechanism becomes plausible based on diffusion purification.
However, we leave certifying the robustness of the proposed guided diffusion
model for future works.

Before diving into the certified $\ell_{2}$ robustness, we first analyze the
properties of the method 2 to provide a deeper understanding. Following the
key concepts in _Differential Privacy_ , we characterize the robustness of our
models using $(\epsilon,\delta)$ notations.

######  Definition 1 ($(\epsilon,\delta)$-Robustness).

Let $\mathcal{A}:\mathcal{X}\rightarrow\mathcal{Y}$ be a randomized algorithm,
we say $\mathcal{A}$ satisfies $(\epsilon,\delta)$- Robustness under
$\ell_{2}$ radius $r$, for a training sample $(x,y)$ and $\forall||\Delta
x||_{2}<r$, if we have

$\mathbb{P}(\mathcal{A}(x+\Delta x)\neq
y)<e^{\epsilon}\cdot\mathbb{P}(\mathcal{A}(x)\neq y)+\delta$ (14)

Algorithm 2 Unguided Adversarial Purification Using Diffusion Models

Input: an adversarial image $x_{0}^{\prime}$, diffusion length $T$,
purification run $M$

for $i=1$ to $M$ do

$x_{T}^{\prime}\leftarrow$ sample from
$\mathcal{N}(\sqrt{\bar{\alpha}_{T}}x_{0}^{\prime},(1-\bar{\alpha}_{T})\boldsymbol{I})$

for $t=T$ to $1$ do

$\mu,\Sigma\leftarrow\mu_{\theta}(x_{t}^{\prime},t),\sigma_{t}^{2}\boldsymbol{I}$

$x_{t-1}^{\prime}\leftarrow$ sample from $\mathcal{N}(\mu,\Sigma)$

end for

end for

return $x_{0}^{\prime}$

Now we list the notations used in the following arguments. Let
$Q:\mathcal{X}\rightarrow\mathcal{X}$ and
$R:\mathcal{X}\rightarrow\mathcal{X}$ denote the diffusion process and the
reverse process. And we have a base classifier
$G:\mathcal{X}\rightarrow\mathcal{Y}$, which maps the purified images to the
predicted labels. In our framework, the overall randomized algorithm
$\mathcal{A}$ can be decomposed as $\mathcal{A}=G\circ R\circ Q$. We use
$\Phi$ to denote the standard Gaussian CDF and $\Phi^{-1}$ for its inverse. We
also stick to the notations in the last section, i.e. $x_{0}$ represents the
clean image while $x_{0}^{\prime}$ denotes the adversarial one.

######  Theorem 1.

Our randomized algorithm $\mathcal{A}$ satisfies
$(\epsilon,\delta)$-Robustness under $\ell_{2}$ radius $r$, where
$\delta=\Phi(\frac{r\sqrt{\bar{\alpha}_{T}}}{2(1-\bar{\alpha}_{T})}-\frac{\epsilon}{r\sqrt{\bar{\alpha}_{T}}})$.

Intuitively, a large diffusion length $T$ will help remove adversarial
perturbation $\Delta x$. In addition, more purification iterations $M$ lead to
a cleaner image after filtering. We have the following theorem

######  Theorem 2.

If we keep the radius $r$ and $\epsilon$ fixed, with the increase of diffusion
length $T$ and purification iterations $M$, the escape probability $\delta$
will strictly decrease when $\delta>0$, which provides a stronger robustness
guarantee.

The detailed proofs of theorem 1 and theorem 2 are presented in the appendix.
We can also revisit the concept of robustness through a perspective of KL-
divergence.

######  Theorem 3.

Let $p(x),q(x)$ denote the probability density function of
$\mathcal{A}(x_{0})$ and $A(x_{0}^{\prime})$ respectively.
$D_{KL}(p(x)||q(x))$ strictly decreases as the diffusion length $T$ and
purification run $M$ increases.

Please refer to the appendix for the details. Note that the entire diffusion
process $Q$ corresponds to adding Gaussian noises to the inputs, which is
identical to randomized smoothing [1]. And it’s safe to regard the reverse
process $R$ adjoined with the classifier $G$ as a randomized post-processing
step. Therefore, the certified guarantees in the original paper [1] can be
generalized directly to our methods. To the best of our knowledge, we first
propose a verifiable adversarial defense via diffusion models. Similarly, we
now define a smoothed classifier $\tilde{\mathcal{A}}$ with the following
formula

$\tilde{\mathcal{A}}(x)=\arg\max_{c\in\mathcal{Y}}\mathbb{P}(\mathcal{A}(x)=c)$
(15)

Now we present the theorem of our $\ell_{2}$ robustness guarantee:

######  Theorem 4.

Suppose $c_{A}\in\mathcal{Y}$ and $\underline{p_{A}},\overline{p_{B}}\in[0,1]$
satisfy:

$\mathbb{P}(\mathcal{A}(x)=c_{A})\geq\underline{p_{A}}\geq\overline{p_{B}}\geq\max_{c\not=c_{A}}\mathbb{P}(\mathcal{A}(x)=c)$
(16)

Then $\tilde{\mathcal{A}}(x+\Delta x)=c_{A}$ for all $\|\Delta x\|_{2}<R$,
where

$R=\dfrac{\sqrt{1-\bar{\alpha}_{T}}}{2}(\Phi^{-1}(\underline{p_{A}})-\Phi^{-1}(\overline{p_{B}}))$
(17)

The proofs are quite straightforward based on the conclusion in [1].
Fundamentally, we can interpret the reverse process $R$ plus the classifier
$G$ as a powerful “noise” classifier, which generates predictions given the
diffused images. However, the reverse process is capable of recovering clean
inputs gradually from tricky images, which are close to pure noises and lack
evident semantic attributes visually. In other words, our methods are more
noise-tolerant and robust compared with randomized smoothing. We can increase
the scale of noises without worrying too much about losing semantic
information, which helps maintain the accuracy of the base classifier.

In addition, as the generative models are trained on the natural data, the
corrupted images will be pushed towards the real distribution, eliminating the
adversarial perturbations. Furthermore, classifiers utilizing randomized
smoothing [1] require Gaussian data augmentation in training while our
diffusion models can be trained independently without compromising
performance. Above all, our models are more likely to provide a better
certified guarantee. The empirical studies in Sec.4 show that diffusion
purification achieves better results than randomized smoothing.

Table 1: CIFAR-10 results against preprocessor-blind PGD $\ell_{\infty}$ attacks ($\epsilon=8/255$). The diffusion length $T=1000$ with reverse steps $50$. Methods | Standard Acc | Robust Acc | Architecture
---|---|---|---
Ours | $91.40$ | $89.62$ | ResNet-50
GDMP(SSIM) [17] | $93.50$ | $90.10$ | WRN-28-10
ADP($\sigma=0.1$) [18] | $93.09$ | $85.45$ | WRN-28-10
Hill et al. [6] | $84.12$ | $78.91$ | WRN-28-10
Madry et al. [10] | $87.30$ | $70.20$ | ResNet-56

##  4 Experiments

Our works are based on the official codes of diffusion models [7, 11]. And we
implemented the guidance mechanism on our own. Due to the limitation of time,
we only conduct several toy experiments using ResNet-50 [5] classifier against
PGD attacks [10].

###  4.1 Evaluation Results

Robust Accuracy. Table 1 shows the robustness performance against
$\ell_{\infty}$ threat model ($\epsilon=8/255$) with PGD attack. Our methods
utilizing ResNet-50 attain a robust accuracy of $89.62\%$, very close to the
results reported in [17]. We will conduct additional experiments on
architectures such as WideResNet and try stronger adaptive attacks like
AutoAttack in the future.

Certified Robustness. In Sec.3.2 we emphasize that our main contribution is to
apply the diffusion-model-based adversarial purification to certified
robustness. We follow [1] to use the binomial hypothesis test to compute the
certified radius $R$ for test examples. We set $N_{0}=20,N=1,000,\alpha=0.001$
in our experiments. Please refer to the original paper for the definitions.
For the fairness of comparison, we recompute the certified radius using the
released codes [1] in an identical setting. Since we sample fewer points than
the original implementation, the lower bound on the certified radius is less
tight. If a given example is correctly classified and the certified radius $R$
is larger than $r$, it will be counted to measure the approximate certified
test accuracy. The results are shown in Table 2. We set the diffusion length
to $T=2000$, the corresponding variance is $\sqrt{1-\bar{\alpha}_{T}}=0.59$.
Our methods improve the certified accuracy by about $5\%$ for $r\geq 0.5$,
which demonstrates the strength of the diffusion-model-based purification.

Table 2: Approximate certified test accuracy on CIFAR-10 compared with randomized smoothing [1]. Each row is a setting of the hyperparameter $\sigma$, each column is an $\ell_{2}$ radius. We evaluate the models on $10\%$ of the test examples. For comparison, random guessing would attain 0.1 accuracy. | $r=0.0$ | $r=0.25$ | $r=0.5$ | $r=0.75$ | $r=1.0$
---|---|---|---|---|---
$\sigma=0.25$ | $\mathbf{0.73}$ | $\mathbf{0.57}$ | $0.37$ | $0.00$ | $0.00$
$\sigma=0.50$ | $0.63$ | $0.51$ | $0.40$ | $0.27$ | $0.16$
$\sigma=1.00$ | $0.43$ | $0.37$ | $0.31$ | $0.25$ | $0.19$
Ours ($\sigma=0.59$) | $0.65$ | $0.55$ | $\mathbf{0.44}$ | $\mathbf{0.33}$ | $\boldsymbol{0.24}$

###  4.2 Ablation Studies

Our ablation studies are based on a diffusion model trained with total steps
of $5000$ and under the attack of PGD-$\ell_{2}$ with a radius of 8/255, some
results may be different from that under PGD-$\ell_{\inf}$. In order to
reserve the major information, our diffusion and generation process only uses
the first thousand steps ($T=1000$).

Table 3: From noise vs.from adversarial image. Methods | From Noise | Guided | Robust Acc
---|---|---|---
Baseline | ✓ | ✓ | $91.89$
(a) | ✗ | ✓ | $83.68$
(b) | ✗ | ✗ | $79.54$

Starting from random noise. Our first finding is that generating with guidance
from random noise can get better results than generating from the adversarial
data itself 3. This really surprised us. We think it is because the diffusion
model is enough powerful to generate high-quality images with resolution 32x32
from random noise and by this way it can eliminate more adversarial
perturbation.

Table 4: The randomness experiment results. $\eta$ | $0$ | $0.1$ | $0.2$ | $0.5$ | $1$
---|---|---|---|---|---
Robust Accuracy | $10.03$ | $11.23$ | $86.34$ | $90.68$ | $\mathbf{91.41}$

The stochastic parameter $\eta$. The same with DDIM [14], we use hyper-
parameter $\eta\in\mathbb{R}_{\geq 0}$ to control the randomness of
generation. When $\eta=0$ the reverse process is deterministic and when
$\eta=1$ it is the same with DDPMs [7]. The results 4 show that the robust
accuracy drops when $\eta$ decreases since less randomness makes the model
more fragile to PGD attacks.

Table 5: The acceleration experiment results. Respacing steps | $25$ | $50$ | $100$ | $200$
---|---|---|---|---
Acceleration ratio | $40\times$ | $20\times$ | $10\times$ | $5\times$
Robust Accuracy | 9.17 | 91.41 | 91.65 | $\mathbf{91.89}$

Time Respacing. To accelerate the generation process, we only sample on a
subset of the total $T$ steps. The diffusion model needs some steps to
generate a sensible image while too many steps take too much time. We consider
setting respace steps to $50$ an optimal choice in terms of both speed and
accuracy.

##  5 Conclusion

In this project, we propose a novel approach for adversarial purification
based on diffusion models. Diffusion models are an ideal candidate for
adversarial purification, as the forward process of adding Gaussian noises can
be regarded as local smoothing. In the denoising process, diffusion models are
capable of recovering clean images, eliminating the Gaussian noises and
adversarial perturbations simultaneously. Different from recent works [17,
12], we argue that generating from random noises with the guidance of
adversarial inputs leads to better purification effects. The experimental
results show the advantages of our method. Furthermore, we first generalize
the unguided diffusion purification to certified learning. As diffusion models
are more noise-tolerant, we are more likely to obtain a larger certified
radius. It achieves higher certified test accuracy compared with randomized
smoothing.

However, the limitations of diffusion purification are also obvious. To start
with, it takes about $0.92$s to purify an adversarial image of size $32\times
32$ in the CIFAR-10 dataset with reverse step $50$. Meanwhile, the certified
smooth classifier requires Monte-Carlo sampling. When we increase the
resolution of images and the diffusion length $T$, the inference speed becomes
unbearably slow. Perhaps boosting the efficiency of diffusion models can be
explored in the future. In our theoretical analysis, we directly apply the
unguided diffusion model to certified learning. But our experiments
demonstrate that guided purification from random noise outperforms the
previous method. Since the guidance involves extra information, it’s more
difficult to present a tight bound of certified radius. It might be a future
direction as well.

## References

  * Cohen et al. [2019] J. Cohen, E. Rosenfeld, and Z. Kolter.  Certified adversarial robustness via randomized smoothing.  In _International Conference on Machine Learning_ , pages 1310–1320. PMLR, 2019.
  * Dhariwal and Nichol [2021] P. Dhariwal and A. Nichol.  Diffusion models beat gans on image synthesis.  _Advances in Neural Information Processing Systems_ , 34:8780–8794, 2021.
  * Goodfellow et al. [2014a] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio.  Generative adversarial nets.  _Advances in neural information processing systems_ , 27, 2014a.
  * Goodfellow et al. [2014b] I. J. Goodfellow, J. Shlens, and C. Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014b.
  * He et al. [2016] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 770–778, 2016.
  * Hill et al. [2020] M. Hill, J. Mitchell, and S.-C. Zhu.  Stochastic security: Adversarial defense using long-run dynamics of energy-based models.  _arXiv preprint arXiv:2005.13525_ , 2020.
  * Ho et al. [2020] J. Ho, A. Jain, and P. Abbeel.  Denoising diffusion probabilistic models.  _Advances in Neural Information Processing Systems_ , 33:6840–6851, 2020.
  * Kingma and Welling [2013] D. P. Kingma and M. Welling.  Auto-encoding variational bayes.  _arXiv preprint arXiv:1312.6114_ , 2013.
  * Liu et al. [2021] X. Liu, D. H. Park, S. Azadi, G. Zhang, A. Chopikyan, Y. Hu, H. Shi, A. Rohrbach, and T. Darrell.  More control for free! image synthesis with semantic diffusion guidance.  _arXiv preprint arXiv:2112.05744_ , 2021.
  * Madry et al. [2017] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ , 2017.
  * Nichol and Dhariwal [2021] A. Nichol and P. Dhariwal.  Improved Denoising Diffusion Probabilistic Models.  _arXiv e-prints_ , art. arXiv:2102.09672, Feb. 2021.
  * Nie et al. [2022] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar.  Diffusion models for adversarial purification.  _arXiv preprint arXiv:2205.07460_ , 2022.
  * Samangouei et al. [2018] P. Samangouei, M. Kabkab, and R. Chellappa.  Defense-gan: Protecting classifiers against adversarial attacks using generative models.  _arXiv preprint arXiv:1805.06605_ , 2018.
  * Song et al. [2020] J. Song, C. Meng, and S. Ermon.  Denoising diffusion implicit models.  _arXiv preprint arXiv:2010.02502_ , 2020.
  * Song et al. [2017] Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman.  Pixeldefend: Leveraging generative models to understand and defend against adversarial examples.  _arXiv preprint arXiv:1710.10766_ , 2017.
  * Szegedy et al. [2013] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ , 2013.
  * Wang et al. [2022] J. Wang, Z. Lyu, D. Lin, B. Dai, and H. Fu.  Guided diffusion model for adversarial purification.  _arXiv preprint arXiv:2205.14969_ , 2022.
  * Yoon et al. [2021] J. Yoon, S. J. Hwang, and J. Lee.  Adversarial purification with score-based generative models.  In _International Conference on Machine Learning_ , pages 12062–12072. PMLR, 2021.

## References

  * Cohen et al. [2019] J. Cohen, E. Rosenfeld, and Z. Kolter.  Certified adversarial robustness via randomized smoothing.  In _International Conference on Machine Learning_ , pages 1310–1320. PMLR, 2019.
  * Dhariwal and Nichol [2021] P. Dhariwal and A. Nichol.  Diffusion models beat gans on image synthesis.  _Advances in Neural Information Processing Systems_ , 34:8780–8794, 2021.
  * Goodfellow et al. [2014a] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio.  Generative adversarial nets.  _Advances in neural information processing systems_ , 27, 2014a.
  * Goodfellow et al. [2014b] I. J. Goodfellow, J. Shlens, and C. Szegedy.  Explaining and harnessing adversarial examples.  _arXiv preprint arXiv:1412.6572_ , 2014b.
  * He et al. [2016] K. He, X. Zhang, S. Ren, and J. Sun.  Deep residual learning for image recognition.  In _Proceedings of the IEEE conference on computer vision and pattern recognition_ , pages 770–778, 2016.
  * Hill et al. [2020] M. Hill, J. Mitchell, and S.-C. Zhu.  Stochastic security: Adversarial defense using long-run dynamics of energy-based models.  _arXiv preprint arXiv:2005.13525_ , 2020.
  * Ho et al. [2020] J. Ho, A. Jain, and P. Abbeel.  Denoising diffusion probabilistic models.  _Advances in Neural Information Processing Systems_ , 33:6840–6851, 2020.
  * Kingma and Welling [2013] D. P. Kingma and M. Welling.  Auto-encoding variational bayes.  _arXiv preprint arXiv:1312.6114_ , 2013.
  * Liu et al. [2021] X. Liu, D. H. Park, S. Azadi, G. Zhang, A. Chopikyan, Y. Hu, H. Shi, A. Rohrbach, and T. Darrell.  More control for free! image synthesis with semantic diffusion guidance.  _arXiv preprint arXiv:2112.05744_ , 2021.
  * Madry et al. [2017] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu.  Towards deep learning models resistant to adversarial attacks.  _arXiv preprint arXiv:1706.06083_ , 2017.
  * Nichol and Dhariwal [2021] A. Nichol and P. Dhariwal.  Improved Denoising Diffusion Probabilistic Models.  _arXiv e-prints_ , art. arXiv:2102.09672, Feb. 2021.
  * Nie et al. [2022] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar.  Diffusion models for adversarial purification.  _arXiv preprint arXiv:2205.07460_ , 2022.
  * Samangouei et al. [2018] P. Samangouei, M. Kabkab, and R. Chellappa.  Defense-gan: Protecting classifiers against adversarial attacks using generative models.  _arXiv preprint arXiv:1805.06605_ , 2018.
  * Song et al. [2020] J. Song, C. Meng, and S. Ermon.  Denoising diffusion implicit models.  _arXiv preprint arXiv:2010.02502_ , 2020.
  * Song et al. [2017] Y. Song, T. Kim, S. Nowozin, S. Ermon, and N. Kushman.  Pixeldefend: Leveraging generative models to understand and defend against adversarial examples.  _arXiv preprint arXiv:1710.10766_ , 2017.
  * Szegedy et al. [2013] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus.  Intriguing properties of neural networks.  _arXiv preprint arXiv:1312.6199_ , 2013.
  * Wang et al. [2022] J. Wang, Z. Lyu, D. Lin, B. Dai, and H. Fu.  Guided diffusion model for adversarial purification.  _arXiv preprint arXiv:2205.14969_ , 2022.
  * Yoon et al. [2021] J. Yoon, S. J. Hwang, and J. Lee.  Adversarial purification with score-based generative models.  In _International Conference on Machine Learning_ , pages 12062–12072. PMLR, 2021.

## Appendix

### A: Proofs of Theorem 1

######  Theorem.

1 Our randomized algorithm $\mathcal{A}$ satisfies
$(\epsilon,\delta)$-Robustness under $\ell_{2}$ radius $r$, where
$\delta=\Phi(\frac{r\sqrt{\bar{\alpha}_{T}}}{2(1-\bar{\alpha}_{T})}-\frac{\epsilon}{r\sqrt{\bar{\alpha}_{T}}})$.

###### Proof.

Recall that we use $Q$ to denote the forward process. Let
$x_{T}^{\prime}=Q(x+\Delta x)$ and $x_{T}=Q(x)$ denote the outputs of the
diffusion process with the adversarial image and clean image. Suppose $p(x)$
and $q(x)$ are their probability density functions, respectively. We have

$p\sim\mathcal{N}(\sqrt{\bar{\alpha}_{T}}x_{0},(1-\bar{\alpha}_{T})\boldsymbol{I_{d}}),~{}q\sim\mathcal{N}(\sqrt{\bar{\alpha}_{T}}(x_{0}+\Delta
x),(1-\bar{\alpha}_{T})\boldsymbol{I_{d}})$

Now we use the set $S=\\{x:q(x)\geq e^{\epsilon}\cdot p(x)\\}$ to describe the
“bad events”. Equivalently

$S=\\{x:[x-\sqrt{\bar{\alpha}_{T}}(x_{0}+\Delta x)]^{\mathrm{T}}\Delta
x\geq-\frac{\sqrt{\bar{\alpha}_{T}}}{2}||\Delta
x||_{2}^{2}+\dfrac{1-\bar{\alpha}_{T}}{\sqrt{\bar{\alpha}_{T}}}\epsilon\\}$

Using the property of Gaussian distribution and the condition that $\|\Delta
x\|_{2}<r$, we have

$\mathbb{P}(Q(x+\Delta x)\in
S)\leq\Phi(\dfrac{r\sqrt{\bar{\alpha}_{T}}}{2(1-\bar{\alpha}_{T})}-\dfrac{\epsilon}{r\sqrt{\bar{\alpha}_{T}}})$

For any possible event $E$, We can obtain that

$\mathbb{P}(Q(x+\Delta x)\in E)\leq e^{\epsilon}\cdot\mathbb{P}(Q(x)\in
E)+\Phi(\dfrac{r\sqrt{\bar{\alpha}_{T}}}{2(1-\bar{\alpha}_{T})}-\dfrac{\epsilon}{r\sqrt{\bar{\alpha}_{T}}})$

Using the post-processing theorem, we have

$\mathbb{P}(\mathcal{A}(x+\Delta x)\in E)\leq
e^{\epsilon}\cdot\mathbb{P}(\mathcal{A}(x)\in
E)+\Phi(\dfrac{r\sqrt{\bar{\alpha}_{T}}}{2(1-\bar{\alpha}_{T})}-\dfrac{\epsilon}{r\sqrt{\bar{\alpha}_{T}}})$

Set the event $E$ to $\\{\mathcal{A}(x)\not=y\\}$, the proof is completed. ∎

### B: Proofs of Theorem 2

######  Theorem.

2 If we keep the radius $r$ and $\epsilon$ fixed, with the increase of
diffusion length $T$ and purification iterations $M$, the escape probability
$\delta$ will strictly decrease when $\delta>0$, which provides a stronger
robustness guarantee.

###### Proof.

Using the post-processing theorem, no matter what the reverse process does,
the robustness is not going to lose. So we only need to prove robustness
increases each step of the forward process.
The forward process is given by

$q(x_{t}|x_{t-1})=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}\boldsymbol{I})$

Denote $p_{t-1}(x)$ as the density function of $\sqrt{1-\beta_{t}}x_{t-1}$ of
the original image and $q_{t-1}(x)$ as the density function of
$\sqrt{1-\beta_{t}}x_{t-1}$ of the adversarial image, $z\prime(x)$ as the
density function of $\mathcal{N}(0,\beta_{t}\boldsymbol{I})$, $p_{t}(x)$ as
the density function of $x_{t}$ of original image and $q_{t}(x)$ as the
density function of $x_{t}$ of the adversarial image.
$\forall S\subseteq\mathcal{R}^{d}$, using convolution theorem, we have

$\displaystyle P(q_{t}\in S)-e^{\epsilon}P(p_{t}\in S)$
$\displaystyle=\int_{S}q_{t}(x)-e^{\epsilon}p_{t}(x)\mathrm{d}x$
$\displaystyle=\int_{S}\int_{-\infty}^{\infty}q_{t-1}(y)z\prime(x-y)-e^{\epsilon}p_{t-1}(y)z\prime(x-y)\mathrm{d}y\mathrm{d}x$
$\displaystyle=\int_{-\infty}^{\infty}[q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)]\int_{S}z\prime(x-y)\mathrm{d}x\mathrm{d}y$
$\displaystyle\leq\int_{-\infty}^{\infty}[q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)]\mathbb{I}[q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)>0]\mathrm{d}y$
$\displaystyle=\int_{q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)>0}[q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)]\mathrm{d}y$
$\displaystyle\leq\delta_{t-1}$

So if $\epsilon$ is fixed, we have $\delta_{t}\leq\delta_{t-1}$, where equal
is possible only if $\forall
y,\mathbb{I}[q_{t-1}(y)-e^{\epsilon}p_{t-1}(y)>0]=0$. In conclusion, the
robustness will increase monotonically unless $\delta=0$. ∎

### C: Proofs of Theorem 3

######  Lemma.

Let $x(t)$ be the diffusion process defined as
$\mathrm{d}x=f(x,t)\mathrm{d}t+g(t)\mathrm{d}w$, where $w$ is standard wiener
process. Diffuse two distribution $p(x)$ and $q(x)$ from $p_{0}(x)$ and
$q_{0}(x)$, we have

$\dfrac{\partial D_{KL}(p_{t}||q_{t})}{\partial
t}=-\frac{1}{2}g^{2}(t)D_{F}(p_{t}||q_{t})$

where $D_{F}$ is Fisher divergence, $D_{F}(p_{t}||q_{t})=0$ if and only if
$p_{t}=q_{t}$.

###### Proof.

The Fokker-Planck equation for forward SDE is given by

$\displaystyle\dfrac{\partial p_{t}(x)}{\partial t}$
$\displaystyle=-\nabla_{x}(f(x,t)p_{t}(x)-\dfrac{1}{2}g^{2}(t)\nabla_{x}p_{t}(x))$
$\displaystyle=\nabla_{x}(h_{p}(x,t)p_{t}(x))$

where $h_{p}(x,t)=\frac{1}{2}g^{2}(t)\nabla_{x}\log p_{t}(x)-f(x,t)$.

We can evaluate that

$\displaystyle\dfrac{\partial D_{KL}(p_{t}||q_{t})}{\partial t}$
$\displaystyle=\dfrac{\partial}{\partial t}\int
p_{t}(x)\log\dfrac{p_{t}(x)}{q_{t}(x)}\mathrm{d}t$
$\displaystyle=\int\dfrac{\partial p_{t}(x)}{\partial
t}\log\dfrac{p_{t}(x)}{q_{t}(x)}\mathrm{d}t-\int\dfrac{p_{t}(x)}{q_{t}(x)}\dfrac{\partial
q_{t}(x)}{\partial t}$ $\displaystyle=-\int
p_{t}(x)[h_{p}(x,t)-h_{q}(x,t)]^{T}[\nabla_{x}\log p_{t}(x)-\nabla_{x}\log
q_{t}(x)]\mathrm{d}t$ $\displaystyle=-\frac{1}{2}g^{2}(t)D_{F}(p_{t}||q_{t})$

∎

######  Theorem.

3 Let $p(x),q(x)$ denote the probability density function of
$\mathcal{A}(x_{0})$ and $A(x_{0}^{\prime})$ respectively.
$D_{KL}(p(x)||q(x))$ strictly decreases as the diffusion length $T$ and
purification run $M$ increases.

###### Proof.

When $T$ is large enough, we can approximate the forward and reverse process
as continuous.
The forward process is given by

$q(x_{t}|x_{t-1})=\mathcal{N}(x_{t};\sqrt{1-\beta_{t}}x_{t-1},\beta_{t}\boldsymbol{I})$

The corresponding continuous process is given by

$\mathrm{d}x=(\sqrt{1-\beta_{t}}-1)x\mathrm{d}t+\sqrt{\beta_{t}}\mathrm{d}w$

w is standard wiener process.
The reverse process is given by

$p(x_{t-1}|x_{t})=\mathcal{N}(x_{t-1};\frac{1}{\sqrt{\alpha_{t}}}(x_{t}-\dfrac{\beta_{t}}{\sqrt{1-\bar{\alpha}_{t}}}z_{\theta}(x_{t},t)),\tilde{\beta_{t}}I_{d})$

The corresponding continuous process is given by

$\mathrm{d}x=-(\frac{1}{2}\beta_{t}x-\dfrac{\beta_{t}}{\sqrt{(1-\beta_{t})(1-\bar{\alpha}_{t})}}z_{\theta}(x,t))\mathrm{d}t+\sqrt{\beta_{t}}\mathrm{d}w$

Using the lemma above, we immediately know that the KL term strictly decreases
as diffusion length $T$ and purification iterations $M$ increase.

∎