{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/diffattack-evasion-attacks-against-diffusion-1","title":"DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purification","arxiv_id":"2311.16124","date":"2023-10-27","proceeding":"NeurIPS 2023 11","authors":["Mintong Kang","Dawn Song","Bo Li"],"abstract":"Diffusion-based purification defenses leverage diffusion models to remove crafted perturbations of adversarial examples and achieve state-of-the-art robustness. Recent studies show that even advanced attacks cannot break such defenses effectively, since the purification process induces an extremely deep computational graph which poses the potential problem of gradient obfuscation, high memory cost, and unbounded randomness. In this paper, we propose a unified framework DiffAttack to perform effective and efficient attacks against diffusion-based purification defenses, including both DDPM and score-based approaches. In particular, we propose a deviated-reconstruction loss at intermediate diffusion steps to induce inaccurate density gradient estimation to tackle the problem of vanishing/exploding gradients. We also provide a segment-wise forwarding-backwarding algorithm, which leads to memory-efficient gradient backpropagation. We validate the attack effectiveness of DiffAttack compared with existing adaptive attacks on CIFAR-10 and ImageNet. We show that DiffAttack decreases the robust accuracy of models compared with SOTA attacks by over 20% on CIFAR-10 under $\\ell_\\infty$ attack $(\\epsilon=8/255)$, and over 10% on ImageNet under $\\ell_\\infty$ attack $(\\epsilon=4/255)$. We conduct a series of ablations studies, and we find 1) DiffAttack with the deviated-reconstruction loss added over uniformly sampled time steps is more effective than that added over only initial/final steps, and 2) diffusion-based purification with a moderate diffusion length is more robust under DiffAttack.","url_abs":"https://arxiv.org/abs/2311.16124v2","url_pdf":"https://arxiv.org/pdf/2311.16124v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"diffattack-evasion-attacks-against-diffusion-1","repo_url":"https://github.com/kangmintong/diffattack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-purification","task_name":"Adversarial Purification"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2311.16124","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2311.16124"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/kangmintong/DiffAttack","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/kangmintong/diffattack","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":10,"ran":5,"ran_fixture":1,"ran_honours":1,"ran_violates":1,"unverified":6},"by_repo_kind":{"official":{"samples":21,"ran":16,"repositories":1},"community":{"samples":3,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":21,"samples":[{"code_sha256_prefix":"c3a6b977022957cb","entry":"Normalize","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c3a6b977022957cb"}},{"code_sha256_prefix":"cfd76fd0d89574a4","entry":"approx_standard_normal_cdf","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/guided_diffusion/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cfd76fd0d89574a4"}},{"code_sha256_prefix":"ad12a494674d23fb","entry":"compute_n_params","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_Score_Based/utils.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_Score_Based/utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ad12a494674d23fb"}},{"code_sha256_prefix":"bd1f17e427bf51a5","entry":"dict2namespace","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_Score_Based/utils.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_Score_Based/utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"bd1f17e427bf51a5"}},{"code_sha256_prefix":"cd33283d615fb3d7","entry":"discretized_gaussian_log_likelihood","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/guided_diffusion/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cd33283d615fb3d7"}},{"code_sha256_prefix":"ecfdcb7de66cc30f","entry":"encoder","repo":"WindVChen/DiffAttack","repo_kind":"community","path":"diff_latent_attack.py","file_url":"https://github.com/WindVChen/DiffAttack/blob/HEAD/diff_latent_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ecfdcb7de66cc30f"}},{"code_sha256_prefix":"8ff7c24dade9904c","entry":"get_optimizer","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/losses.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8ff7c24dade9904c"}},{"code_sha256_prefix":"fac494cec4301110","entry":"get_sde_loss_fn","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/losses.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"fac494cec4301110"}},{"code_sha256_prefix":"cb49209c125de1b4","entry":"get_timestep_embedding","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cb49209c125de1b4"}},{"code_sha256_prefix":"195d635db8eb778b","entry":"lerp_clip","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/classifiers/attribute_net.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/classifiers/attribute_net.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"195d635db8eb778b"}},{"code_sha256_prefix":"d5eb57879ef1704e","entry":"max_res_from_state_dict","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/classifiers/attribute_net.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/classifiers/attribute_net.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d5eb57879ef1704e"}},{"code_sha256_prefix":"3137073275f8c21a","entry":"nonlinearity","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/ddpm/unet_ddpm.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3137073275f8c21a"}},{"code_sha256_prefix":"cf2798b666b231ca","entry":"normal_kl","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/guided_diffusion/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cf2798b666b231ca"}},{"code_sha256_prefix":"366bb8c7035a2fc8","entry":"optimization_manager","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/losses.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/losses.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"366bb8c7035a2fc8"}},{"code_sha256_prefix":"fa609ac1c290e653","entry":"preprocess","repo":"WindVChen/DiffAttack","repo_kind":"community","path":"diff_latent_attack.py","file_url":"https://github.com/WindVChen/DiffAttack/blob/HEAD/diff_latent_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fa609ac1c290e653"}},{"code_sha256_prefix":"a05b1d0cf3f508b4","entry":"register_corrector","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/sampling.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/sampling.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a05b1d0cf3f508b4"}},{"code_sha256_prefix":"473066ddf62a075a","entry":"register_predictor","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/sampling.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/sampling.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"473066ddf62a075a"}},{"code_sha256_prefix":"7c508037b40522af","entry":"str2bool","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_Score_Based/utils.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_Score_Based/utils.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7c508037b40522af"}},{"code_sha256_prefix":"d84e0830078f5a50","entry":"DiffAttack","repo":"kangmintong/diffattack","repo_kind":"official","path":"DiffAttack_Score_Based/diffattack/DiffAttack.py","file_url":"https://github.com/kangmintong/diffattack/blob/HEAD/DiffAttack_Score_Based/diffattack/DiffAttack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d84e0830078f5a50"}},{"code_sha256_prefix":"8749fc2e6cd3b1c8","entry":"check_randomized","repo":"kangmintong/diffattack","repo_kind":"official","path":"DiffAttack_Score_Based/diffattack/DiffAttack.py","file_url":"https://github.com/kangmintong/diffattack/blob/HEAD/DiffAttack_Score_Based/diffattack/DiffAttack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8749fc2e6cd3b1c8"}},{"code_sha256_prefix":"2cd3e1d64ab9a5bb","entry":"check_square_sr","repo":"kangmintong/diffattack","repo_kind":"official","path":"DiffAttack_Score_Based/diffattack/DiffAttack.py","file_url":"https://github.com/kangmintong/diffattack/blob/HEAD/DiffAttack_Score_Based/diffattack/DiffAttack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2cd3e1d64ab9a5bb"}},{"code_sha256_prefix":"f2778069fba3bee4","entry":"ddim_reverse_sample","repo":"WindVChen/DiffAttack","repo_kind":"community","path":"diff_latent_attack.py","file_url":"https://github.com/WindVChen/DiffAttack/blob/HEAD/diff_latent_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f2778069fba3bee4"}},{"code_sha256_prefix":"0dd156dfa78cac88","entry":"from_state_dict","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/classifiers/attribute_net.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/classifiers/attribute_net.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0dd156dfa78cac88"}},{"code_sha256_prefix":"a58facb8fe71823a","entry":"get_predictor","repo":"kangmintong/DiffAttack","repo_kind":"official","path":"DiffAttack_DDPM_Based/score_sde/sampling.py","file_url":"https://github.com/kangmintong/DiffAttack/blob/HEAD/DiffAttack_DDPM_Based/score_sde/sampling.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a58facb8fe71823a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}