Diffusion Bridge Distillation for Purification (DBLP)

• The paper introduces DBLP, a few-step latent-space purifier that cancels adversarial perturbations via a closed-form noise bridge and consistency distillation.
• It integrates adaptive semantic enhancement using multi-scale edge maps to preserve fine-grained structural details during aggressive denoising.
• Experimental results on CIFAR-10, ImageNet, and CelebA show that DBLP achieves robust accuracy and near real-time inference compared to existing methods.

to=arxiv_search.query 天天中彩票会 {"query":"(Huang et al., 1 Aug 2025) DBLP Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification", "max_results": 5} to=arxiv_search.query 平台开号 {"query":"(Li et al., 2024) ADBM Adversarial diffusion bridge model reliable adversarial purification", "max_results": 5} to=arxiv_search.query оПjson {"query":"(Abbasihafshejani et al., 5 Jan 2026) VocalBridge latent diffusion-bridge purification", "max_results": 5} Diffusion Bridge Distillation for Purification (DBLP) is a diffusion-based adversarial purification framework that combines a latent consistency model backbone, a closed-form noise bridge between adversarial and clean latent trajectories, and adaptive semantic conditioning from multi-scale edge maps. In "DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purification" (Huang et al., 1 Aug 2025), the method is formulated as a few-step latent-space purifier that aligns adversarially diffused inputs with clean-data trajectories inside a probability flow ordinary differential equation (PF-ODE) framework, with the stated goals of efficient inference, robust classification recovery, and semantic fidelity.

1. Problem setting and framework definition

DBLP addresses adversarial purification as a preprocessing problem. The setting is defined by adversarial examples $x^{adv} = x + \delta$ such that $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$ under the constraint $\|x^{adv} - x\| \le \epsilon$, and purification is framed as maximizing $\max_P C(y^{true} \mid P(x^{adv}))$, where $C$ is the victim classifier (Huang et al., 1 Aug 2025). The training configuration uses white-box PGD-100 with $\ell_\infty$-norm $\epsilon = 4/255$ against a ResNet-50 classifier, while evaluation spans CIFAR-10, ImageNet, CelebA, and transferability settings.

The framework integrates three named components: a Latent Consistency Model (LCM) backbone distilled via LoRA for few-step sampling, Noise Bridge Distillation, and Adaptive Semantic Enhancement. Operationally, a clean image $x$ is perturbed to $x^a$, encoded to a latent $z$ through encoder $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$0, noised according to the forward schedule, and processed by a consistency function $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$1 so that PF-ODE integration returns $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$2 irrespective of adversarial noise. At inference, the latent solver is conditioned on a fused edge map and the purified latent is decoded by $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$3 back to image space (Huang et al., 1 Aug 2025).

Component	Function	Specific mechanism
LCM backbone	Few-step latent purification	LCM-LoRA with Stable Diffusion v1.5 encoder/decoder
Noise Bridge Distillation	Adversarial-noise cancellation in latent space	Closed-form bridge with time-dependent $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$4
Adaptive Semantic Enhancement	Structure-preserving conditioning	Multi-scale pyramid edge fusion

This organization places DBLP within diffusion-based adversarial purification, but specifically within the branch that replaces long iterative denoising with consistency distillation. The paper emphasizes that the framework is intended to make purification practical for near real-time deployment (Huang et al., 1 Aug 2025).

2. Noise bridge distillation and bridge geometry

The core bridge construction modifies the noising path so that adversarial perturbations are explicitly canceled from the sampling distribution. The latent adversarial endpoint is defined as

$\arg\max_y C(y \mid x^{adv}) \neq y^{true}$5

The adversarial forward process is then

$\arg\max_y C(y \mid x^{adv}) \neq y^{true}$6

DBLP constructs a bridged latent by subtracting a time-dependent adversarial component,

$\arg\max_y C(y \mid x^{adv}) \neq y^{true}$7

with boundary conditions $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$8 and $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$9, and with closed-form coefficient

$\|x^{adv} - x\| \le \epsilon$0

The stated intuition is that the bridge makes the consistency mapping independent of adversarial perturbations by canceling the adversarial component from the sampling distribution (Huang et al., 1 Aug 2025).

The consistency objective is teacher–student distillation in latent space. DBLP adopts the LCM distillation loss but evaluates consistency on bridged latent variables and PF-ODE solver estimates:

$\|x^{adv} - x\| \le \epsilon$1

It also includes a reconstruction-like term,

$\|x^{adv} - x\| \le \epsilon$2

The combined objective is optimized with an EMA teacher update $\|x^{adv} - x\| \le \epsilon$3.

A key theoretical motivation appears in the supplement: without the bridge,

$\|x^{adv} - x\| \le \epsilon$4

so adversarial perturbations induce a consistency mismatch. The bridge is introduced precisely to eliminate that mismatch while preserving the probability flow trajectory (Huang et al., 1 Aug 2025). This makes DBLP a diffusion-bridge method in the strict sense that its latent trajectory is explicitly altered by a closed-form bridge coefficient.

3. Consistency-model backbone, PF-ODE dynamics, and solver design

DBLP is built on the consistency-model formulation of diffusion trajectories. The forward stochastic differential equation is written as

$\|x^{adv} - x\| \le \epsilon$5

and the PF-ODE with the same marginals is

$\|x^{adv} - x\| \le \epsilon$6

Consistency models then learn a self-consistent mapping along this PF-ODE trajectory,

$\|x^{adv} - x\| \le \epsilon$7

The parameterization reported in the paper is

$\|x^{adv} - x\| \le \epsilon$8

with boundary conditions $\|x^{adv} - x\| \le \epsilon$9 and $\max_P C(y^{true} \mid P(x^{adv}))$0, ensuring $\max_P C(y^{true} \mid P(x^{adv}))$1 (Huang et al., 1 Aug 2025).

DBLP instantiates this in latent space through an LCM. The encoder and decoder $\max_P C(y^{true} \mid P(x^{adv}))$2 are taken from a pretrained Stable Diffusion v1.5 backbone, and LCM-LoRA is used to reduce trainable parameters and training cost. The paper states that distillation runs for 20,000 iterations with batch size $\max_P C(y^{true} \mid P(x^{adv}))$3, learning rate $\max_P C(y^{true} \mid P(x^{adv}))$4, and a 500-step warm-up. The skip interval in Eq. (13) is $\max_P C(y^{true} \mid P(x^{adv}))$5.

Sampling is few-step PF-ODE integration with a leapfrog-inspired solver. The update is

$\max_P C(y^{true} \mid P(x^{adv}))$6

where $\max_P C(y^{true} \mid P(x^{adv}))$7, $\max_P C(y^{true} \mid P(x^{adv}))$8, and the midpoint velocity estimate is derived from the predicted noise term. The stated role of this solver is improved dynamical stability and faster convergence in few steps (Huang et al., 1 Aug 2025).

The inference path is therefore not a long reverse diffusion chain in the DDPM sense. It is a distilled PF-ODE latent solver conditioned on semantic priors and trained so that the adversarial component is removed through the bridge geometry rather than by brute-force iterative denoising.

4. Adaptive semantic enhancement and structural conditioning

DBLP augments bridge distillation with Adaptive Semantic Enhancement, a conditioning mechanism designed to preserve semantics and fine-grained structure during aggressive few-step purification. Given an adversarial image $\max_P C(y^{true} \mid P(x^{adv}))$9, the method constructs an $C$0-level Gaussian-blur pyramid and extracts Canny edges with adaptive Otsu thresholds:

$C$1

Each edge map is upsampled to a common resolution, and scale weights are computed by gradient consistency:

$C$2

The fused edge map is then

$C$3

This fused map is injected as the conditioning input $C$4 to the latent consistency model at inference (Huang et al., 1 Aug 2025).

The paper describes this mechanism as a way to preserve structure and fine-grained details despite few steps and aggressive denoising. In ablations on ImageNet, removing edge maps yields Robust $C$5, LPIPS $C$6, and SSIM $C$7; single-scale edge maps yield Robust $C$8, LPIPS $C$9, and SSIM $\ell_\infty$0; pyramid edge maps in the full DBLP configuration yield Robust $\ell_\infty$1, LPIPS $\ell_\infty$2, and SSIM $\ell_\infty$3 (Huang et al., 1 Aug 2025). These results are presented in the paper as evidence that adaptive multi-scale structural priors improve both robustness and perceptual fidelity.

A limitation is also stated explicitly: the conditioning interface is not detailed beyond the generic use of $\ell_\infty$4 as a condition. The paper notes that richer conditioning interfaces or learned fusion could further improve fidelity (Huang et al., 1 Aug 2025).

5. Evaluation, efficiency, and reported performance

DBLP is evaluated on CIFAR-10, ImageNet, and CelebA-HQ subsets, with clean accuracy, robust accuracy, LPIPS, PSNR, SSIM, and inference time as reported metrics. On CIFAR-10, the paper reports for DBLP (UNet+WRN-70-16): Clean Acc $\ell_\infty$5; Robust Acc $\ell_\infty$6 under $\ell_\infty$7, $\ell_\infty$8 under $\ell_\infty$9, and $\epsilon = 4/255$0 under $\epsilon = 4/255$1, for an Avg $\epsilon = 4/255$2 (Huang et al., 1 Aug 2025). The paper describes this as outperforming prior adversarial purification baselines and achieving competitive robustness compared to adversarial training, especially on unseen $\epsilon = 4/255$3 threats.

On ImageNet, the reported DBLP results against a ResNet-50 victim are Standard Acc $\epsilon = 4/255$4, Robust Acc $\epsilon = 4/255$5 under PGD-100 ($\epsilon = 4/255$6), Standard Acc $\epsilon = 4/255$7, Robust Acc $\epsilon = 4/255$8 under AutoAttack, and Standard Acc $\epsilon = 4/255$9, Robust Acc $x$0 under PGD-200 ($x$1) (Huang et al., 1 Aug 2025). On CelebA under PGD-10, the reported robust accuracies are ArcFace $x$2, FaceNet $x$3, and MobileFaceNet $x$4.

Image-quality measurements are also central to DBLP’s presentation. Relative to clean $x$5, the paper reports for adversarial $x$6: LPIPS $x$7, PSNR $x$8, SSIM $x$9; for DiffPure: LPIPS $x^a$0, PSNR $x^a$1, SSIM $x^a$2; for OSCP: LPIPS $x^a$3, PSNR $x^a$4, SSIM $x^a$5; and for DBLP: LPIPS $x^a$6, PSNR $x^a$7, SSIM $x^a$8 (Huang et al., 1 Aug 2025). These values position DBLP close to the adversarial input in perceptual distortion while substantially improving robustness.

Setting	Reported DBLP result	Comparator values
CIFAR-10 Avg Robust Acc	60.73%	$x^a$9: 58.4%, $z$0: 59.4%, $z$1: 64.4%
ImageNet inference time	$z$2 s	GDMP $z$3 s, DiffPure $z$4 s, OSCP $z$5 s
Image quality on ImageNet	LPIPS 0.1012, PSNR 26.03, SSIM 0.7655	DiffPure: 0.2616 / 24.11 / 0.7155

The efficiency claim is explicit. The paper reports near real-time inference with runtime per image of approximately $z$6 s on ImageNet, compared with approximately $z$7 s for GDMP, approximately $z$8 s for DiffPure, and approximately $z$9 s for OSCP (Huang et al., 1 Aug 2025). The stated source of this acceleration is the combination of LCM distillation, LoRA, and the leapfrog PF-ODE solver.

Transferability is evaluated under Diff-PGD-10 with $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$00 on ImageNet. The reported robust accuracies are ResNet-50 $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$01, ResNet-152 $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$02, WideResNet-50-2 $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$03, ConvNeXt-B $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$04, ViT-B-16 $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$05, and Swin-B $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$06 (Huang et al., 1 Aug 2025). This suggests that the method is not restricted to a single classifier family, although the paper does not claim universal robustness.

6. Relation to ADBM, VocalBridge, and broader bridge-distillation research

DBLP belongs to a broader diffusion-bridge lineage, but it is not interchangeable with all bridge-based purification methods. ADBM introduced a direct adversarial-to-clean reverse bridge for image purification by fine-tuning a pre-trained diffusion model with a bridge loss

$\arg\max_y C(y \mid x^{adv}) \neq y^{true}$07

and showed that the bridge can improve robust accuracy over DiffPure while remaining effective even with 1–5 DDIM steps (Li et al., 2024). DBLP inherits the bridge idea at the level of the time-dependent coefficient $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$08, but differs procedurally: it is a consistency-distilled latent purifier rather than a DDPM fine-tuning approach.

The distinction from speech-domain bridge purification is sharper. "VocalBridge: Latent Diffusion-Bridge Purification for Defeating Perturbation-Based Voiceprint Defenses" explicitly states that no distillation is used, and characterizes its method as a non-distilled diffusion-bridge purifier operating in EnCodec latent space with optional Whisper-guided phoneme timing (Abbasihafshejani et al., 5 Jan 2026). The paper further states that if "DBLP" is intended to mean "Diffusion Bridge Distillation," VocalBridge should be viewed as a non-distilled instance of diffusion-bridge purification rather than a DBLP system. This resolves a common terminological confusion: diffusion bridge purification and diffusion bridge distillation are related but not identical categories.

DBLP also differs from the more general "Inverse Bridge Matching Distillation" framework, which distills diffusion bridge models into one-step or few-step generators for image-to-image translation tasks such as super-resolution, JPEG restoration, sketch-to-image, and inpainting (Gushchin et al., 3 Feb 2025). IBMD is broader with respect to bridge matching and teacher–student distillation, but it is not itself presented as an adversarial purification framework with the specific combination of latent consistency modeling, noise-bridge cancellation, and adaptive semantic enhancement that defines DBLP.

The limitations reported for DBLP are correspondingly specific. Training depends on access to a victim classifier during training to estimate $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$09 with white-box PGD; robustness under very strong or structured perturbations and under distribution shifts is presented as promising but not guaranteed universally; the conditioning design is underspecified beyond generic injection of $\arg\max_y C(y \mid x^{adv}) \neq y^{true}$10; and increasing solver steps can improve robustness at the cost of runtime (Huang et al., 1 Aug 2025). A plausible implication is that DBLP should be understood as a particular synthesis of bridge geometry and consistency distillation rather than as the definitive form of diffusion-bridge purification.

Within the research landscape, DBLP therefore occupies a specific position: it is a latent consistency, teacher–student, bridge-based adversarial purifier designed for efficient image-space deployment; ADBM is a non-distilled diffusion-bridge purifier for adversarial examples in images; VocalBridge is a non-distilled latent diffusion-bridge purifier for speech; and IBMD is a general bridge-distillation framework whose applicability extends beyond purification.