This work presents an information-theoretic examination of diffusion-based purification methods, the state-of-the-art adversarial defenses that utilize diffusion models to remove malicious perturbations in adversarial examples. By theoretically characterizing the inherent purification errors associated with the Markov-based diffusion purifications, we introduce LoRID, a novel Low-Rank Iterative Diffusion purification method designed to remove adversarial perturbation with low intrinsic purification errors. LoRID centers around a multi-stage purification process that leverages multiple rounds of diffusion-denoising loops at the early time-steps of the diffusion models, and the integration of Tucker decomposition, an extension of matrix factorization, to remove adversarial noise at high-noise regimes. Consequently, LoRID increases the effective diffusion time-steps and overcomes strong adversarial attacks, achieving superior robustness performance in CIFAR-10/100, CelebA-HQ, and ImageNet datasets under both white-box and black-box settings.

本研究解决了扩散基础净化方法在处理对抗性示例中的固有净化误差问题。提出的LoRID方法通过多阶段净化过程和Tucker分解，实现在高噪声条件下有效去除对抗性噪声。研究表明，LoRID显著提高了在CIFAR-10/100、CelebA-HQ和ImageNet数据集中的对抗性攻击鲁棒性。

LoRID：低秩迭代扩散用于对抗性净化