[Paper Review] Denoising Diffusion Probabilistic Models as a Defense against Adversarial Attacks

Lars Ankile, Anna Midgley+1 more|arXiv (Cornell University)|Jan 17, 2023

Cell Image Analysis TechniquesBiochemistry, Genetics and Molecular Biology3 citations

TL;DR

This paper proposes using Denoising Diffusion Probabilistic Models (DDPMs) as a defense against adversarial attacks by purifying adversarial examples through noise addition and reverse denoising. It achieves up to 88% of the original model's accuracy on the PatchCamelyon dataset, significantly outperforming vanilla and baseline defenses while enabling fast inference with only 40 steps at a low noise level of $ t^* = 0.04 $.

ABSTRACT

Neural Networks are infamously sensitive to small perturbations in their inputs, making them vulnerable to adversarial attacks. This project evaluates the performance of Denoising Diffusion Probabilistic Models (DDPM) as a purification technique to defend against adversarial attacks. This works by adding noise to an adversarial example before removing it through the reverse process of the diffusion model. We evaluate the approach on the PatchCamelyon data set for histopathologic scans of lymph node sections and find an improvement of the robust accuracy by up to 88\% of the original model's accuracy, constituting a considerable improvement over the vanilla model and our baselines. The project code is located at https://github.com/ankile/Adversarial-Diffusion.

Motivation & Objective

• To evaluate the effectiveness of DDPMs as a general-purpose defense against adversarial attacks in medical image classification.
• To address the challenge of robustness in biomedical AI, where small perturbations can indicate critical pathological features like metastatic tissue.
• To improve upon existing defenses by leveraging the generative capabilities of diffusion models to purify adversarial inputs without requiring model-specific retraining.
• To reduce inference time by using a low noise level ($ t^* = 0.04 $) and only 40 steps, making the method practical for real-world deployment.
• To demonstrate that diffusion-based purification can maintain high standard accuracy while significantly improving robust accuracy on a sensitive medical dataset.

Proposed method

• Apply the forward diffusion process to add Gaussian noise to adversarial inputs, using a learned noise schedule $ \beta_t $ and cumulative noise level $ \bar{\alpha}_t $.
• Use the reverse diffusion process, parameterized by a neural network $ \mu_\theta(x_t, t) $, to reconstruct the original image from the noisy input.
• Train the DDPM to maximize the Evidence Lower Bound (ELBO), enabling the model to learn the reverse denoising process that recovers clean data distributions.
• Integrate the trained DDPM as a preprocessor before a classifier (e.g., ResNet101), applying purification at inference time without fine-tuning the classifier.
• Use a low noise level $ t^* = 0.04 $ to enable fast inference with only 40 reverse steps, reducing computational cost compared to prior work.
• Apply adaptive $ \ell_\infty $-bounded adversarial attacks using projected gradient descent to generate perturbations for evaluation.

Experimental results

Research questions

• RQ1 Can DDPMs effectively purify adversarial examples in a medical imaging context where small perturbations are diagnostically meaningful?
• RQ2 How does the robust accuracy of a DDPM-based defense compare to vanilla models and adversarial training baselines on the PatchCamelyon dataset?
• RQ3 To what extent can a low-noise, low-step diffusion process maintain high standard accuracy while improving robustness?
• RQ4 Does the diffusion model’s ability to reconstruct images faithful to the original distribution translate to better generalization on adversarial inputs?
• RQ5 Can the defense generalize to unseen attack types without requiring retraining, given its model-agnostic nature?

Key findings

• The DDPM-based defense improved robust accuracy by up to 88% of the original model’s standard accuracy on the PatchCamelyon dataset, significantly outperforming both the vanilla model and baseline defenses.
• The method achieved high standard accuracy (comparable to the vanilla model) after purification, indicating that the diffusion process preserves diagnostically relevant features.
• Robust accuracy reached 75% under adaptive $ \ell_\infty $ attacks, demonstrating strong defense performance despite the sensitivity of the data to small perturbations.
• The use of a low noise level $ t^* = 0.04 $ enabled fast inference with only 40 steps, making the method computationally efficient compared to prior diffusion-based defenses.
• The defense was effective without requiring model-specific adaptation, showing strong generalization to unseen attacks due to the stochastic and distribution-aware nature of diffusion models.
• The method outperformed adversarial training, which suffered from model collapse and high computational cost, especially on the sensitive PatchCamelyon dataset.