{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/diffusion-models-for-adversarial-purification","title":"Diffusion Models for Adversarial Purification","arxiv_id":"2205.07460","date":"2022-05-16","proceeding":null,"authors":["Weili Nie","Brandon Guo","Yujia Huang","Chaowei Xiao","Arash Vahdat","Anima Anandkumar"],"abstract":"Adversarial purification refers to a class of defense methods that remove adversarial perturbations using a generative model. These methods do not make assumptions on the form of attack and the classification model, and thus can defend pre-existing classifiers against unseen threats. However, their performance currently falls behind adversarial training methods. In this work, we propose DiffPure that uses diffusion models for adversarial purification: Given an adversarial example, we first diffuse it with a small amount of noise following a forward diffusion process, and then recover the clean image through a reverse generative process. To evaluate our method against strong adaptive attacks in an efficient and scalable way, we propose to use the adjoint method to compute full gradients of the reverse generative process. Extensive experiments on three image datasets including CIFAR-10, ImageNet and CelebA-HQ with three classifier architectures including ResNet, WideResNet and ViT demonstrate that our method achieves the state-of-the-art results, outperforming current adversarial training and adversarial purification methods, often by a large margin. Project page: https://diffpure.github.io.","url_abs":"https://arxiv.org/abs/2205.07460v1","url_pdf":"https://arxiv.org/pdf/2205.07460v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"diffusion-models-for-adversarial-purification","repo_url":"https://github.com/NVlabs/DiffPure","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"diffusion-models-for-adversarial-purification","repo_url":"https://github.com/zshsh98/eps-ad","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"adversarial-purification","task_name":"Adversarial Purification"}],"methods":[{"method_slug":"1x1-convolution","method_name":"1x1 Convolution"},{"method_slug":"average-pooling","method_name":"Average Pooling"},{"method_slug":"batch-normalization","method_name":"Batch Normalization"},{"method_slug":"bottleneck-residual-block","method_name":"Bottleneck Residual Block"},{"method_slug":"convolution","method_name":"Convolution"},{"method_slug":"diffusion","method_name":"Diffusion"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"global-average-pooling","method_name":"Global Average Pooling"},{"method_slug":"kaiming-initialization","method_name":"Kaiming Initialization"},{"method_slug":"max-pooling","method_name":"Max Pooling"},{"method_slug":"relu","method_name":"ReLU"},{"method_slug":"residual-block","method_name":"Residual Block"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"wide-residual-block","method_name":"Wide Residual Block"},{"method_slug":"wideresnet","method_name":"WideResNet"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2205.07460","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2205.07460"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/point0bar1/ebm-defense","reach":null},{"provenance":"deterministic:regex_extraction","url":"https://github.com/yang-song/score_sde","reach":null},{"provenance":"deterministic:regex_extraction","url":"https://github.com/openai/guided-diffusion","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/ermongroup/SDEdit","reach":null},{"provenance":"deterministic:regex_extraction","url":"https://github.com/eladrich/pixel2style2pixel","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/chail/gan-ensembling","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zshsh98/eps-ad","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/NVlabs/DiffPure","reach":null}],"summary":{"ran":4,"ran_honours":3,"ran_fixture":2,"ran_draft_wrong":2,"unverified":12},"by_repo_kind":{"official":{"samples":2,"ran":2,"repositories":1},"found_in_text":{"samples":19,"ran":8,"repositories":4}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"53b522e213c74c83","entry":"EBM","repo":"point0bar1/ebm-defense","repo_kind":"found_in_text","path":"nets.py","file_url":"https://github.com/point0bar1/ebm-defense/blob/HEAD/nets.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"53b522e213c74c83"}},{"code_sha256_prefix":"809d6a4eb92a37c4","entry":"betas_for_alpha_bar","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"809d6a4eb92a37c4"}},{"code_sha256_prefix":"2ab2316ac6fdd869","entry":"betas_for_alpha_bar","repo":"NVlabs/DiffPure","repo_kind":"official","path":"guided_diffusion/gaussian_diffusion.py","file_url":"https://github.com/NVlabs/DiffPure/blob/HEAD/guided_diffusion/gaussian_diffusion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"2ab2316ac6fdd869"}},{"code_sha256_prefix":"a56784666af5bd6d","entry":"downsample","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_utils.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_utils.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a56784666af5bd6d"}},{"code_sha256_prefix":"8d7ec010c29e813b","entry":"format_time","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/cifar10_utils.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/cifar10_utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8d7ec010c29e813b"}},{"code_sha256_prefix":"29b9a890f149a3a6","entry":"get_keys","repo":"eladrich/pixel2style2pixel","repo_kind":"found_in_text","path":"models/psp.py","file_url":"https://github.com/eladrich/pixel2style2pixel/blob/HEAD/models/psp.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"29b9a890f149a3a6"}},{"code_sha256_prefix":"a59556109795f95c","entry":"get_logit","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_utils.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_utils.py","link_basis":"harvester_set","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a59556109795f95c"}},{"code_sha256_prefix":"3cbdd3b190b16350","entry":"get_mean_and_std","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/cifar10_utils.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/cifar10_utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3cbdd3b190b16350"}},{"code_sha256_prefix":"a086d6286a40b889","entry":"get_named_beta_schedule","repo":"NVlabs/DiffPure","repo_kind":"official","path":"guided_diffusion/gaussian_diffusion.py","file_url":"https://github.com/NVlabs/DiffPure/blob/HEAD/guided_diffusion/gaussian_diffusion.py","link_basis":"first_harvest_node","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"a086d6286a40b889"}},{"code_sha256_prefix":"195d635db8eb778b","entry":"lerp_clip","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_classifier.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_classifier.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"195d635db8eb778b"}},{"code_sha256_prefix":"d5eb57879ef1704e","entry":"max_res_from_state_dict","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_classifier.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_classifier.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d5eb57879ef1704e"}},{"code_sha256_prefix":"3b923ff790cbbc0b","entry":"Model","repo":"ermongroup/SDEdit","repo_kind":"found_in_text","path":"models/diffusion.py","file_url":"https://github.com/ermongroup/SDEdit/blob/HEAD/models/diffusion.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3b923ff790cbbc0b"}},{"code_sha256_prefix":"41e902f9c7c2e2eb","entry":"define_classifier","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/domain_classifier.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/domain_classifier.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"41e902f9c7c2e2eb"}},{"code_sha256_prefix":"773b8b462df07b05","entry":"define_generator","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/domain_generator.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/domain_generator.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"773b8b462df07b05"}},{"code_sha256_prefix":"3dfd61c7077a1607","entry":"get_named_beta_schedule","repo":null,"repo_kind":null,"path":null,"file_url":null,"link_basis":"identical_code_first_harvested_elsewhere","language":"python","status":"unverified","verification_level":0,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":null,"inline_ok":false,"mcp_get_code":{"code_sha256":"3dfd61c7077a1607"}},{"code_sha256_prefix":"839a62fe894a78a3","entry":"get_softmaxed","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_utils.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"839a62fe894a78a3"}},{"code_sha256_prefix":"45be190c3dfd3c8f","entry":"is_legal","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"utils/LBFGS.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/utils/LBFGS.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"45be190c3dfd3c8f"}},{"code_sha256_prefix":"8659b4900a4273d0","entry":"modify_layers","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"utils/customnet.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/utils/customnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8659b4900a4273d0"}},{"code_sha256_prefix":"a55a9c6d78060f5a","entry":"polyinterp","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"utils/LBFGS.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/utils/LBFGS.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a55a9c6d78060f5a"}},{"code_sha256_prefix":"6774ed80906f2f42","entry":"postprocess","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/domain_classifier.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/domain_classifier.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6774ed80906f2f42"}},{"code_sha256_prefix":"a7def332eb991665","entry":"run_on_batch","repo":"eladrich/pixel2style2pixel","repo_kind":"found_in_text","path":"predict.py","file_url":"https://github.com/eladrich/pixel2style2pixel/blob/HEAD/predict.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a7def332eb991665"}},{"code_sha256_prefix":"1835534046b4b465","entry":"state_dict_from_tf_parameters","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/classifiers/attribute_classifier.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/classifiers/attribute_classifier.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1835534046b4b465"}},{"code_sha256_prefix":"2f887a37af9d3f65","entry":"stylegan_setting","repo":"chail/gan-ensembling","repo_kind":"found_in_text","path":"networks/stylegan2/stylegan2_networks.py","file_url":"https://github.com/chail/gan-ensembling/blob/HEAD/networks/stylegan2/stylegan2_networks.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2f887a37af9d3f65"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}