Recently, diffusion-based purification (DBP) has emerged as a promising
approach for defending against adversarial attacks. However, previous studies
have used questionable methods to evaluate the robustness of DBP models, their
explanations of DBP robustness also lack experimental support. We re-examine
DBP robustness using precise gradient, and discuss the impact of stochasticity
on DBP robustness. To better explain DBP robustness, we assess DBP robustness
under a novel attack setting, Deterministic White-box, and pinpoint
stochasticity as the main factor in DBP robustness. Our results suggest that
DBP models rely on stochasticity to evade the most effective attack direction,
rather than directly countering adversarial perturbations. To improve the
robustness of DBP models, we propose Adversarial Denoising Diffusion Training
(ADDT). This technique uses Classifier-Guided Perturbation Optimization (CGPO)
to generate adversarial perturbation through guidance from a pre-trained
classifier, and uses Rank-Based Gaussian Mapping (RBGM) to convert adversarial
pertubation into a normal Gaussian distribution. Empirical results show that
ADDT improves the robustness of DBP models. Further experiments confirm that
ADDT equips DBP models with the ability to directly counter adversarial
perturbations.

扩散基净化（DBP）是一种有希望对抗恶意攻击的方法，通过确定梯度来检验 DBP 的稳健性，研究表明随机性是 DBP 的主要稳健因素，提出了 Adversarial Denoising Diffusion Training（ADDT）来提高 DBP 模型的稳健性。