MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial
  Purification
Adversarial purification with diffusion models has emerged as a promising
defense strategy, but existing methods typically rely on uniform noise
injection, which indiscriminately perturbs all frequencies, corrupting semantic
structures and undermining robustness. Our empirical study reveals that
adversarial perturbations are not uniformly distributed: they are predominantly
concentrated in high-frequency regions, with heterogeneous magnitude intensity
patterns that vary across frequencies and attack types. Motivated by this
observation, we introduce MANI-Pure, a magnitude-adaptive purification
framework that leverages the magnitude spectrum of inputs to guide the
purification process. Instead of injecting homogeneous noise, MANI-Pure
adaptively applies heterogeneous, frequency-targeted noise, effectively
suppressing adversarial perturbations in fragile high-frequency, low-magnitude
bands while preserving semantically critical low-frequency content. Extensive
experiments on CIFAR-10 and ImageNet-1K validate the effectiveness of
MANI-Pure. It narrows the clean accuracy gap to within 0.59 of the original
classifier, while boosting robust accuracy by 2.15, and achieves the top-1
robust accuracy on the RobustBench leaderboard, surpassing the previous
state-of-the-art method.
68dcc85e4159d1f2418f9c43
Xiaoyi Huang
68dcc85e4159d1f2418f9c44
Junwei Wu
68dcc85e4159d1f2418f9c45
Kejia Zhang
claimed_verified
2025-10-01T15:29:15.983Z
655469586bc4180700cf7a34
/avatars/252392d0c45783d8f149feac7a6215ec.svg
Kejia Zhang
user
KejiaRobust
68dcc85e4159d1f2418f9c46
Carl Yang
68dcc85e4159d1f2418f9c47
Zhiming Luo
MANI-Pure: Magnitude-Adaptive Noise Injection for Adversarial
  Purification
Adversarial purification with diffusion models has emerged as a promising
defense strategy, but existing methods typically rely on uniform noise
injection, which indiscriminately perturbs all frequencies, corrupting semantic
structures and undermining robustness. Our empirical study reveals that
adversarial perturbations are not uniformly distributed: they are predominantly
concentrated in high-frequency regions, with heterogeneous magnitude intensity
patterns that vary across frequencies and attack types. Motivated by this
observation, we introduce MANI-Pure, a magnitude-adaptive purification
framework that leverages the magnitude spectrum of inputs to guide the
purification process. Instead of injecting homogeneous noise, MANI-Pure
adaptively applies heterogeneous, frequency-targeted noise, effectively
suppressing adversarial perturbations in fragile high-frequency, low-magnitude
bands while preserving semantically critical low-frequency content. Extensive
experiments on CIFAR-10 and ImageNet-1K validate the effectiveness of
MANI-Pure. It narrows the clean accuracy gap to within 0.59 of the original
classifier, while boosting robust accuracy by 2.15, and achieves the top-1
robust accuracy on the RobustBench leaderboard, surpassing the previous
state-of-the-art method.
MANI-Pure, a magnitude-adaptive purification framework using diffusion models, effectively suppresses high-frequency adversarial perturbations while preserving low-frequency content, enhancing robust accuracy.
adversarial purification diffusion models uniform noise high-frequency regions magnitude spectrum frequency-targeted noise CIFAR-10 ImageNet-1K RobustBench