How and how well do diffusion models improve adversarial robustness?

Replies to Weaknesses

• We would like to first clarify that the sentence is not essential to our key results, as it is just a tentative interpretation of our results. We would be happy to modify or remove it. Here, we are referring to the results from [1] (Figure 2), and the idea is very simple: when the training set is small, diffusion models tend to memorize individual samples in the training set, which is harmful for generalization on the testing set. As the training set increases, diffusion models transition to the generalization phase. The diffusion models typically used are already in this generalization phase, and our experiments further confirmed this observation (not shrinking the $\ell_p$ distances).

In addition, reviewers 7QBf and cqB1 suggested measuring perceptual distances in addition to $\ell_p$ distances, and we consider this to be a great idea. We have now measured the structural similarity index measure (SSIM) [2] relative to clean images, with the results as follows:

As shown, we observed an approximately 20% decrease under perceptual distances after diffusion purification. This is an interesting complementary result that we will include in the final version of the paper. However, we feel that the $\ell_p$ distance measurements are still important for understanding adversarial purification, as adversarial attacks are calculated based on $\ell_p$ distances.

• Here we are referring to the Pearson correlation coefficients. Regarding the x-y axes, we sampled either (a) 100 different starting points within the initial adversarial ball using the same random seed during diffusion, or (b) started with the original image but used 100 different random seeds during diffusion. For both settings, we acquired 100 purified states and subtracted the original image to obtain 100 purified vectors. We calculated the Pearson correlation matrix (np.corrcoef), resulting in the 100-by-100 matrix shown in the figure.

• We appreciate the reviewer’s deep understanding of Carlini’s work and their clarification, which helped us clarify this issue. We have rephrased the claim “randomness is a bug” as “randomness may obscure gradients, making evaluations challenging” in Sec. 4.1 accordingly.

• While developing the idea, we also felt it would be beneficial to establish a stronger linkage between randomized smoothing and fuzzy robustness. Despite similarities, there are key differences between these concepts:

1. Randomized smoothing [3] does not necessarily conduct adversarial attacks but relies on numerous evaluations with Gaussian-noisy inputs, categorizing it under certified robustness. In contrast, fuzzy adversarial robustness evaluates the probability (fuzziness) of adversarial examples for a stochastic system, requiring adversarial attacks first and falling under empirical adversarial robustness.
2. The source of randomness differs: randomized smoothing adds noise to inputs for classifier smoothing, while fuzzy robustness arises inherently from stochastic systems without input noise (no smoothing). Fuzziness is meaningful only for stochastic systems.
3. SmoothAdv [4], though calculating adversarial attacks, aims to enhance robustness via adversarial training with randomized smoothing, remaining under certified robustness. Fuzzy robustness, however, evaluates robustness directly from the stochastic behavior of the model, without smoothing.

We believe linking the grades of the strongest empirical attack (PGD-EOT) to the certified bound of randomized smoothing would significantly strengthen the concept of fuzzy adversarial robustness. We will add a discussion on this point and add the relevant citations in Sec. 4.1.

We sincerely appreciate your constructive reviews and found them highly insightful. We especially thank you for recognizing the main contributions of our paper, despite the problems in comprehensively interpreting prior works.

Update on the Misclaim

Before addressing specific questions, we would like to provide an update regarding a misclaim about the previous explanations of robustness improvement under diffusion models , as this was also a major concern raised by reviewer aGTV. Our intent was to convey that prior works have offered intuitive explanations, which motivated us to investigate whether diffusion models increase or decrease the $\ell_p$ norms.

By "intuitive explanations", we are referring to statements such as those in the DiffPure framework illustration (Figure 1), where the authors describe diffusion models as “recovering clean images through the reverse denoising process.” We fully acknowledge that prior works did not claim that “diffusion models improve robustness by decreasing $\ell_p$ norms to clean images,” as they did not perform such experiments.

To clarify this point, we plan to rephrase Sec 3.1 as follows:

While the exact mechanisms for robustness improvement under diffusion models remain unclear, intuitive explanations have been discussed in the DiffPure paper [Nie et al., 2022], e.g., diffusion models ``recover clean images through the reverse denoising process.'' This motivates us to test a simple hypothesis: diffusion models shrink the $\ell_p$ distances towards clean images during adversarial purification.

We thank both reviewers for pointing out this ambiguity. Please feel free to suggest any further refinements to this section. We believe this rephrasing will adequately resolve the concern and ensure clarity without affecting our experimental results or main arguments.

Replies to Questions

• The y-axis in Fig. 1(c) represents the “distances to the original clean image” of purified states using diffusion models. This corresponds to a diffusion model with $t^*=0.1$ in DiffPure on CIFAR-10, involving 100 forward diffusion steps and 100 reverse denoising steps. From steps 0–100, the distances increase due to noise injection; from steps 100–200, the image becomes clearer as the model denoises. The distance at step 0 reflects the initial adversarial perturbation ($\ell_\infty=8/255$, corresponding in $\ell_2$).

• Your intuition is correct: diffusion models perform suboptimally without desired noise levels. This is evident from a drop in clean accuracy when omitting the forward process and only performing the reverse process. This behavior varies by dataset (e.g., a greater drop on ImageNet than CIFAR-10) and checkpoint quality. Below are data from prior experiments:

Note: Noise was fixed in these experiments to isolate randomness effects (thus affecting robustness but not clean accuracy).

Overall, reverse-only diffusion achieved better clean accuracy and robustness on CIFAR-10, with a slightly worse robust accuracy on ImageNet. These findings align with our claims, and additional results will be included in the Appendix of the final version.

• Yes, Fig 5(b) shows the explained variance of the PC eigenvectors, corresponding to the PCA analysis. Fig 5(c) displays the eigenvalues of Jacobian matrices, corresponding to the Jacobian analysis. “Explained” refers to the variances of data once projected onto corresponding PC directions.

Thanks again for your review. Please feel free to ask any further questions and we are always happy to discuss.

References

[1] Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat. Generalization in diffusion models arises from geometry-adaptive harmonic representations. In The Twelfth International Conference on Learning Representations, 2024.

[2] Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4), 600-612.

[3] Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." International Conference on Machine Learning. PMLR, 2019.

[4] Salman, Hadi, et al. "Provably robust deep learning via adversarially trained smoothed classifiers." Advances in Neural Information Processing Systems 32 (2019).

[5] Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. The space of transferable adversarial examples. arXiv preprint arXiv:1704.03453, 2017.

We thank the reviewer for the thoughtful feedback and appreciate the opportunity to address the concerns raised. Below, we provide detailed responses to the key weaknesses identified.

Replies to Weaknesses

Clarification on the Misclaim

• We would like to clarify regarding the misclaim about prior explanations of robustness improvement under diffusion models, which was also highlighted by reviewer aGTV. Our intent was to highlight that prior works offered intuitive explanations, which motivated us to investigate whether diffusion models increase or decrease $\ell_p$ norms during adversarial purification. This question remains under-investigated to the best of our knowledge.

  We agreed that prior works did not claim, nor experimentally demonstrate, that “diffusion models improve robustness by decreasing $\ell_p$ norms to clean images.” To ensure clarity, we plan to rephrase Sec. 3.1 as follows:

  “While the exact mechanisms for robustness improvement under diffusion models remain unclear, intuitive explanations have been discussed in the DiffPure paper [Nie et al., 2022], e.g., diffusion models ``recover clean images through the reverse denoising process.'' This motivates us to test a simple hypothesis: diffusion models shrink the $\ell_p$ distances towards clean images during adversarial purification. ”

  We thank both reviewers for pointing out this ambiguity. If there are further suggestions for refining this section, we welcome your input. We believe this revision will effectively address the concern while preserving the integrity of our experiments and main arguments.

• Regarding the theoretical explanation in Theorem 3.1 of DiffPure [1], we appreciate the reviewer drawing attention to its significance. However, we believe it does not fully explain how diffusion models enhance adversarial robustness. Specifically, the theorem addresses the forward process and shows that adding Gaussian noise reduces the $\ell_p$ distances between two distributions. However, it does not account for the fact that diffusion models with only the reverse denoising process can also improve robustness (line 172 of our paper, a finding also reported in DensePure [2]). Additional experimental results highlighting this phenomenon will be included in the Appendix, as suggested by reviewers 7QBf and iBpK.

  Our proposed explanations of the adversarial compression effect and the hyperspherical cap model provide alternative perspectives on the reverse denoising process and its role in adversarial robustness. We view these results as complementary insights of the original theoretical work developed in the DiffPure paper.

• In response to suggestions from reviewers 7QBf and cqB1, we evaluated the structural similarity index measure (SSIM) [2], a perceptual metric, in addition to $\ell_p$ distances. The results are summarized below:

  Distance (to clean images)	Adversarial (PGD-EOT, $\ell_\infty=8/255$)	Random (uniform, $\ell_\infty=8/255$)	Purified states
  SSIM	0.963 $\pm$ 0.030	0.966 $\pm$ 0.032	0.791 $\pm$ 0.085

  As shown, we observed an approximately 20% decrease in SSIM after diffusion purification. This interesting complementary finding will be incorporated into the final version of the paper.

  However, we continue to emphasize the importance of $\ell_p$ distance measurements in the context of adversarial purification. This is because adversarial attacks are inherently constructed based on $\ell_p$ distances. Diffusion models do not merely convert adversarial perturbations into smaller $\ell_p$ distances, which would simplify the problem; instead, they purify states, making them perceptually closer to the original images while potentially increasing $\ell_p$ distances. This highlights a unique aspect of their operation that we believe warrants further exploration.

The Hyperspherical Cap Model

• We appreciate the reviewer’s concern. For the classifier we studied (WideResNet-28-10, standard classifier from RobustBench [4]) on CIFAR-10, we did not observe multiple crossings of the decision boundary along the adversarial direction within the typical scale of adversarial perturbations. Specifically, we observed such effects (e.g., flipping to other classes) only when the $\ell_2$ norm exceeded 5—much larger than the radius of adversarial examples typically considered (e.g., $\ell_\infty=8/255$, roughly corresponding to $\ell_2=1$). Most class vs. $\ell_2$ distance curves along adversarial directions were step functions, indicating no transitions or at most a single transition within the adversarial ball.

  We consider this to be an interesting result. Indeed, one might have expected a different outcome before these experiments were done. We will formally quantify these findings in the final version to further support the validity of Assumption 2.

• The above observations should address the reviewer’s concern. If OpenReview permits, we are happy to share the class vs. $\ell_2$ curves directly. Alternatively, we welcome suggestions on specific metrics the reviewer considers important. These results are reproducible, and we will include details of our experimental settings in the paper (WideResNet-28-10, "Standard" $\ell_\infty$ classifier from RobustBench on CIFAR-10, scanning along PGD attacks up to $\ell_2=1$).

• We acknowledge the difficulty of sampling points around adversarial directions in high-dimensional spaces due to their sparsity. Inspired by [5], we projected adversarial directions onto 2D planes defined by random directions to study the loss landscape. To address this concern, we refined our methods by sampling multiple 2D slices. Instead of one 2D slice per image, we now use 100 slices, with the same 1000 points per slice. This new method allows us to sample high-dimensional space around the adversarial direction, addressing a key limitation of the previous method we used that was pointed out by the reviewer.

  This refinement slightly changed the estimated slope of the psychometric function, with $\bar{k} = 5.9106 \pm 1.0737$. Importantly, the new result still supports our claim that the transition is sharp. We will include this new analysis in the revised manuscript. We believe the refined analysis makes this point stronger. We thank you for this suggestion.

Adversarial Compression

• We clarify that the critical threshold (Assumption 2) reflects the distance to decision boundaries along adversarial directions and is an inherent property of the classifier. The purification system (e.g., diffusion models) does not alter this threshold. Instead, purification compresses the distances of adversarial examples toward the anchor point $f(x_0)$, preventing them from crossing the threshold. Two factors influence robust/non-robust outcomes:
  1. The amount of compression induced by the diffusion model for each image.
  2. The critical threshold of the purified clean image $f(x_0)$.
  As illustrated in Fig. 6, increased compression moves samples further from decision boundaries, leading to improved robustness. The reviewer’s intuition is correct that distances to the decision boundary at $f(x_0)$ significantly affect robustness outcomes.

• We emphasize that our paper identifies two critical effects:
  1. Adversarial compression rate (a property of the purification system).
  2. Critical threshold (a property of the classification system).
  As shown in Fig. 6, both effects strongly correlate with robustness outcomes, and robustness is not solely determined by compression.

Notations

• We thank the reviewer for pointing out the notation issue. To clarify, we propose replacing the small-o notation with the "much less than" symbol ($\lll$). By "considerably large," we refer to changes in logits along random projections that are negligible compared to changes along adversarial directions. We hope this adjustment makes our argument clearer.

Replies to Questions

• Compression in JPEG vs. Diffusion Models

  We acknowledge the potential confusion between "compression" in our context and in JPEG. In JPEG, compression refers to reducing storage bits, often by applying a discrete cosine transform and removing high-frequency components, effectively acting as a low-pass filter. In contrast, our use of "compression" refers to shrinking distances in the image space toward purified clean images $f(x_0)$.

  Regarding the potential robustness of JPEG compression, previous studies [6] suggest that adversarial training biases models toward low-frequency information, which may explain why JPEG could improve robustness. However, we are more interested in studying robustness as an emergent property of learning systems (e.g., denoising or diffusion models) rather than from engineered constraints like low-pass filters or JPEG compression.

We hope our responses address the reviewer’s concerns satisfactorily. Please feel free to provide further feedback or raise additional questions.

References

[1] Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., & Anandkumar, A. (2022, June). Diffusion Models for Adversarial Purification. In International Conference on Machine Learning (pp. 16805-16827). PMLR.

[2] Xiao, C., Chen, Z., Jin, K., Wang, J., Nie, W., Liu, M., ... & Song, D. (2023). Densepure: Understanding diffusion models for adversarial robustness. In The Eleventh International Conference on Learning Representations.

[3] Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4), 600-612.

[4] Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., ... & Hein, M. (2020). Robustbench: a standardized adversarial robustness benchmark. arXiv preprint arXiv:2010.09670.

[5] Li, H., Xu, Z., Taylor, G., Studer, C., & Goldstein, T. (2018). Visualizing the loss landscape of neural nets. Advances in neural information processing systems, 31.

[6] Yin, D., Gontijo Lopes, R., Shlens, J., Cubuk, E. D., & Gilmer, J. (2019). A fourier perspective on model robustness in computer vision. Advances in Neural Information Processing Systems, 32.

Replies to Questions

• One-Step Denoising
  We conducted experiments using the one-step denoising approach [6] and obtained the following results:

One-step denoising significantly reduced computation time, making adversarial attack evaluations more tractable. While clean accuracy remained comparable, adversarial robustness (PGD-EOT) decreased slightly, consistent with our findings. These results reinforce the broader applicability of our conclusions.

• Perceptual-Based Metrics Calculating the perceptual-related distances is a great idea, as also suggested by the reviewer 7QBf (FID score). To study this question, we evaluated the structural similarity index measure (SSIM) [7], a widely used perceptual metric in computer vision, in addition to $\ell_p$ distances. The results are summarized below:

The results reveal an approximate 20% decrease in perceptual distances (SSIM) after diffusion purification, indicating that purified images become perceptually closer to clean images despite the increase in $\ell_p$ distances. This observation complements our findings and will be included in the final paper.

However, we would like to emphasize the importance of $\ell_p$ distance measurements in the context of adversarial purification. This is because adversarial attacks are inherently constructed based on $\ell_p$ distances. Diffusion models do not merely convert adversarial perturbations into smaller $\ell_p$ distances, which would simplify the problem; instead, they purify states, making them perceptually closer to the original images while potentially increasing $\ell_p$ distances. This highlights a unique aspect of their operation that we believe warrants further exploration.

References

[1] Song, Y., Sohl-Dickstein, J., Kingma, D. P., Kumar, A., Ermon, S., & Poole, B. (2020). Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456.

[2] Huang, Y., Yu, Y., Zhang, H., Ma, Y., & Yao, Y. (2022, April). Adversarial robustness of stabilized neural ode might be from obfuscated gradients. In Mathematical and Scientific Machine Learning (pp. 497-515). PMLR.

[3] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020a

[4] Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat. Generalization in diffusion models arises from geometry-adaptive harmonic representations. In The Twelfth International Conference on Learning Representations, 2024.

[5] Mohan, S., Kadkhodaie, Z., Simoncelli, E. P., & Fernandez-Granda, C. (2019). Robust and interpretable blind image denoising via bias-free convolutional neural networks. arXiv preprint arXiv:1906.05478.

[6] Carlini, N., Tramer, F., Dvijotham, K. D., Rice, L., Sun, M., & Kolter, J. Z. (2022). (certified!!) Adversarial robustness for free!. arXiv preprint arXiv:2206.10550.

[7] Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4), 600-612.

We thank the reviewer for providing thoughtful comments and constructive feedback. Below, we address your questions and concerns in detail.

Replies to Weaknesses

• Advanced Sampling Techniques Sampling techniques beyond DDPG generally involve continuous or deterministic methods. Continuous methods, such as those solving stochastic differential equations (SDEs) [1], may introduce gradient masking effects during adversarial purification, as observed in adversarial purification with neural ODEs [2]. Hence, our study focuses on discrete sampling methods. To evaluate deterministic methods, we measured the $\ell_p$ distances of purified images using the DDIM sampling approach [3]:

The results show that DDIM achieves comparable clean accuracy to DDPG on CIFAR-10, with $\ell_2$ and $\ell_\infty$ distances to clean images smaller than DDPG but still greater than the initial adversarial perturbations. These findings are consistent with our general results and highlight the robustness of our observations across different sampling methods. We will include these results in the revised manuscript.

• Future Directions for Diffusion-Based Defenses

• The observed increase in $\ell_p$ distances (Fig. 1) and the decisive effect of randomness (Fig. 2) suggest that conventional diffusion models, targeted for image generation, operate on variance scales much larger than typical adversarial perturbations. A potential avenue for future work is to train diffusion models tailored to the low-noise regime, transitioning into the $\ell_p$ shrinkage regime (Fig. 1d) to establish true attractor dynamics.

• A recent study [4] explored the transition from memorization to generalization in diffusion models, using the bias-free denoising framework [5]. This framework demonstrated that denoising CNNs trained on specific noise levels struggle to generalize to unseen noise levels, an issue mitigated by removing bias terms. Similarly, it is plausible that the lack of $\ell_p$ shrinkage behavior in diffusion models under low noise conditions stems from the presence of bias terms within the U-Net architecture.

• Recent studies on the generalization properties of diffusion models [4], using bias-free denoising frameworks [5], suggest that bias terms in U-Net architectures may contribute to $\ell_p$ distance increases and limit robustness improvements. Investigating these biases systematically may lead to more effective defenses.

• The identified adversarial compression effect offers a practical metric for evaluating purification systems without relying on computationally intensive empirical adversarial attacks. This insight could guide the development of more efficient adversarial purification strategies.

We appreciate your positive feedback and are glad to see that our work might be insightful for the community. As you mentioned being interested in other reviewers’ opinions, we would like to first summarize our updates based on common questions raised by the reviewers.

Summary of Updates

• Clarification on the Misclaim
  As noted by reviewers aGTV and iBpK, we clarified the misclaim regarding $\ell_p$ norms in Sec. 3.1. Specifically, we rephrased that paragraph:

  While the exact mechanisms for robustness improvement under diffusion models remain unclear, intuitive explanations have been discussed in the DiffPure paper [Nie et al., 2022], e.g., diffusion models ``recover clean images through the reverse denoising process.'' This motivates us to test a simple hypothesis: diffusion models shrink the $\ell_p$ distances towards clean images during adversarial purification.

This addresses concerns about ambiguity and better aligns with prior works without impacting experimental results or key arguments.

• New Perceptual Distance Measurements
  Responding to feedback from reviewers 7QBf and cqB1, we included structural similarity index measure (SSIM) [1] results alongside $\ell_p$ distances. These measurements provide complementary insights into the purification process and will be incorporated into the final version.

  Distance (to clean images)	Adversarial (PGD-EOT, $\ell_\infty=8/255$)	Random (uniform, $\ell_\infty=8/255$)	Purified states
  SSIM	0.963 $\pm$ 0.030	0.966 $\pm$ 0.032	0.791 $\pm$ 0.085

• Additional Results of Reverse-Only Diffusion and DDIM Sampling
  Responding to feedback from reviewers 7QBf and iBpK, we included additional experimental results with reverse-only diffusion models in the appendix. Results with other sampling techniques, such as DDIM [2], were also appended in response to reviewer cqB1, as other SDE-based samplings may raise concerns in gradient masking from the numerical solver [3].

• Discussion on Fuzzy Adversarial Robustness
  We elaborated on the distinction between randomized smoothing [4] and fuzzy adversarial robustness, emphasizing differences in their motivation, procedure, and source of randomness. The added discussion strengthens the conceptual framing and includes citations to related works, such as SmoothAdv [5] and DensePure [6].

The remaining questions are addressed separately in our detailed responses.

Replies to the Weaknesses

• Yes, we acknowledge that the theoretical explanation in our work is not entirely comprehensive. However, we believe it represents a step forward toward understanding the role of diffusion models in adversarial purification. Specifically:

  • We developed the hyperspherical cap model of adversarial regions (Sec. 5).
  • We identified the adversarial compression effect (Sec. 6).
    These insights allowed us to pinpoint two key factors influencing robustness differences across individual images:
  1. Adversarial Compression Rate—dictated by the purification system.
  2. Critical Threshold—determined by the classification system.
     Together with the decisive effect of randomness (Fig. 2), these aspects were not sufficiently recognized by previous studies.

• Following the suggestions from [7], we implemented PGD-EOT attacks as an approximation of AutoAttack and found them generally effective. Additionally, we want to emphasize the distinctions between fuzzy robustness and DensePure [6]:

  • DensePure uses the reverse process of diffusion models as an off-the-shelf denoiser within the denoised smoothing framework [8]. It relies on numerous evaluations with Gaussian-noisy inputs and belongs to the category of certified robustness.
  • In contrast, fuzzy adversarial robustness evaluates the probability (fuzziness) of adversarial examples in stochastic systems. It requires conducting adversarial attacks first and thus falls under empirical adversarial robustness.
    While there are some conceptual connections, applying the notion of fuzzy adversarial robustness to DensePure may not be entirely appropriate.

Replies to the Questions

• PGD-EOT attacks on ImageNet
  Unfortunately, calculating full gradients on ImageNet with diffusion models would not be feasible given our our computational resources. As noted in Appendix B, it took around 10 days to compute full PGD-EOT gradients on CIFAR-10 with 100 denoising steps. ImageNet images are 64 times larger and require 1.5× times of denoising steps, which would not be pratical with our current setup.
  This limitation has been highlighted in prior works and underscores the challenge of properly estimating robustness at this scale [7]. As a result, we only included BPDA-EOT results for ImageNet in our submission.

• Behavior of $\ell_p$ distances in latent space
  This is an excellent question. We assume you were referring to latent structures similar to those studied in diffusion models [9]. We speculate that the behavior would likely depend on the relative scale of the latent space:

  • If the latent space scale is similar to the image space, there may be an increase in $\ell_p$ distances.
  • If the latent space has a larger scale comparable to the inherent variation induced by the diffusion process (as in Fig. 1d), there may be a decrease in $\ell_p$ distances.
    This opens an interesting avenue for future investigation.

Please feel free to ask any further questions and we are always happy to discuss.

References

[1] Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4), 600-612.

[2] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations, 2020a

[3] Huang, Y., Yu, Y., Zhang, H., Ma, Y., & Yao, Y. (2022, April). Adversarial robustness of stabilized neural ode might be from obfuscated gradients. In Mathematical and Scientific Machine Learning (pp. 497-515). PMLR.

[4] Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." International Conference on Machine Learning. PMLR, 2019.

[5] Salman, Hadi, et al. "Provably robust deep learning via adversarially trained smoothed classifiers." Advances in Neural Information Processing Systems 32 (2019).

[6] Xiao, C., Chen, Z., Jin, K., Wang, J., Nie, W., Liu, M., ... & Song, D. (2023). Densepure: Understanding diffusion models for adversarial robustness. In The Eleventh International Conference on Learning Representations.

[7] Robust Evaluation of Diffusion-Based Adversarial Purification, ICCV 2023.

[8] Salman, H., Sun, M., Yang, G., Kapoor, A., & Kolter, J. Z. (2020). Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems, 33, 21945-21957.

[9] Chen, X., Liu, Z., Xie, S., & He, K. (2024). Deconstructing denoising diffusion models for self-supervised learning. arXiv preprint arXiv:2401.14404.

3. Future Directions for Diffusion-Based Defenses

• The observed increase in $\ell_p$ distances (Fig. 1) and the decisive effect of randomness (Fig. 2) suggest that conventional diffusion models, targeted for image generation, operate on variance scales much larger than typical adversarial perturbations. A potential avenue for future work is to train diffusion models tailored to the low-noise regime, transitioning into the $\ell_p$ shrinkage regime (Fig. 1d) to establish true attractor dynamics.

• A recent study [4] explored the transition from memorization to generalization in diffusion models, using the bias-free denoising framework [5]. It was shown that the bias terms in U-Net architectures hindered the denoising model from generalizing to other unseen noise levels. As we illustrated the scales of adversarial perturbation were considerably larger than the inherent randomness of diffusion models, the bias terms in the diffusion model might limit robustness improvements. Investigating these biases could lead to more effective defenses.

• The identified adversarial compression effect offers a practical metric for evaluating purification systems without relying on computationally intensive empirical adversarial attacks. This insight could guide the development of more efficient adversarial purification strategies.

Please feel free to ask further questions and we are happy to receive your feedback.

References

[1] Wang, Z., Bovik, A. C., Sheikh, H. R., & Simoncelli, E. P. (2004). Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4), 600-612.

[2] Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." International Conference on Machine Learning. PMLR, 2019.

[3] Xiao C, Chen Z, Jin K, et al. Densepure: Understanding diffusion models towards adversarial robustness[J]. arXiv preprint arXiv:2211.00322, 2022.

[4] Zahra Kadkhodaie, Florentin Guth, Eero P Simoncelli, and Stéphane Mallat. Generalization in diffusion models arises from geometry-adaptive harmonic representations. In The Twelfth International Conference on Learning Representations, 2024.

[5] Mohan, S., Kadkhodaie, Z., Simoncelli, E. P., & Fernandez-Granda, C. (2019). Robust and interpretable blind image denoising via bias-free convolutional neural networks. arXiv preprint arXiv:1906.05478.

We thank the reviewer for providing invaluable suggestions on improvements. Below, we address the weaknesses and concerns in detail.

Replies to Weaknesses

1. Follow-up Experiments on $\ell_p$ Distances Measurements

• Perceptual-based metrics

Calculating the perceptual-related distances is a great idea, as also suggested by the reviewer cqB1 (perceptual loss). To study this question, we evaluated the structural similarity index measure (SSIM) [1], a classical perceptual metric in image processing and vision neuroscience, in addition to $\ell_p$ distances. The results are summarized below:

The results reveal an approximate 20% decrease in perceptual distances (SSIM) after diffusion purification, indicating that purified images become perceptually closer to clean images despite the increase in $\ell_p$ distances. This observation complements our findings and will be included in the final paper.

However, we emphasize the importance of $\ell_p$ distance measurements in the context of adversarial purification. This is because adversarial attacks are constructed inherently based on $\ell_p$ distances. Diffusion models do not merely convert adversarial perturbations into smaller $\ell_p$ distances, which would simplify the problem; instead, they purify states, making them perceptually closer to the original images while potentially increasing $\ell_p$ distances. This highlights a unique aspect of their operation that we believe warrants further exploration in the future.

• Reverse-only diffusion

Thanks for pointing it out. We have performed these analyses, and add the results of reverse-only diffusion in Appendix C2. A brief summary is provided below:

As shown, reverse-only diffusion also results in increased $\ell_p$ distances and decreased SSIM after purification. This consistency supports the generalizability of our conclusions.

• Denoiser-based defense

While we have not conducted experiments to compare $\ell_p$ distances in denoiser-based defenses, we clarify that our goal is not to claim that increased $\ell_p$ distances are either (i) unique to diffusion models, or (ii) critical for robustness improvements. Instead, our findings rule out the conventional hypothesis that diffusion models act as $\ell_p$ denoisers to convert adversarial perturbations into smaller norms. We hypothesize that differences in robustness may be attributable to adversarial compression rates (Sec 6), though the inherent randomness of diffusion models poses additional challenges in evaluation (Sec 3.2 and Sec 4).

2. Discussion on Fuzzy Robustness

This point is also suggested by reviewer iBpK. To address this question, we add a discussion with our fuzzy adversarial robustness with randomized smoothing [2] (including DensePure [3]). Despite similarities, there is a key difference between these concepts: randomized smoothing does not necessarily conduct adversarial attacks but relies on numerous evaluations with Gaussian-noisy inputs, categorizing it under certified robustness. In contrast, fuzzy adversarial robustness evaluates the probability (fuzziness) of adversarial examples for a stochastic system, requiring adversarial attacks first and falling under empirical adversarial robustness.

We believe linking the grades of the strongest empirical attack (PGD-EOT) to the certified bound of randomized smoothing would significantly strengthen the concept of fuzzy adversarial robustness. We will add a discussion on this point and add the relevant citations in the final version.