MANI-PURE: MAGNITUDE-ADAPTIVE NOISE INJECTION FOR ADVERSARIAL PURIFICATION
Abstract
Adversarial purification with diffusion models has emerged as a promising defense strategy, but existing methods typically rely on uniform noise injection, which indiscriminately perturbs all frequencies, corrupting semantic structures and undermining robustness. Our empirical study reveals that adversarial perturbations are not uniformly distributed: they are predominantly concentrated in high-frequency regions, with heterogeneous magnitude intensity patterns that vary across frequencies and attack types. Motivated by this observation, we introduce MANI-Pure, a magnitude-adaptive purification framework that leverages the magnitude spectrum of inputs to guide the purification process. Instead of injecting homogeneous noise, MANI-Pure adaptively applies heterogeneous, frequency-targeted noise, effectively suppressing adversarial perturbations in fragile high-frequency, low-magnitude bands while preserving semantically critical low-frequency content. Extensive experiments on CIFAR-10 and ImageNet-1K validate the effectiveness of MANI-Pure. It narrows the clean accuracy gap to within 0.59% of the original classifier, while boosting robust accuracy by 2.15%, and achieves the top-1 robust accuracy on the RobustBench leaderboard, surpassing the previous state-of-the-art method.
The pipeline of MANI-Pure
(I)MANI.Starting from an adversarial sample, we apply DFT to obtain its frequency representation,
partition it into bands, compute average magnitudes, and derive band-wise and spatial weights.
These weights modulate Gaussian noise to produce heterogeneous perturbations.
(II)FreqPure.During the reverse process, the magnitude and phase spectra of the adversarial input and generated image are separated and recombined as shown,
with the reconstructed image iteratively fed into subsequent denoising steps.
Main Results
Classification accuracy on CIFAR-10 under adversarial attacks using CLIP ViT-L/14.
Classification accuracy on ImageNet-1K under adversarial attacks using CLIP ViT-L/14.
To evaluate the quality of the generated images, we compute the SSIM and LPIPS scores between the images purified by different AP methods and the clean images.Third image description.
