Noise Bridge Distillation for Adversarial Purification

• Noise Bridge Distillation is a latent-space technique that constructs a time-dependent bridge aligning adversarially perturbed and clean latent trajectories.
• It employs a closed-form coefficient (kₜ) to cancel adversarial noise, enabling few-step purification via latent consistency distillation.
• By integrating probability-flow ODE steps with semantic conditioning, the method achieves robust and efficient adversarial purification with enhanced image quality.

Searching arXiv for the specified paper and closely related bridge/consistency distillation work. Noise Bridge Distillation is the central training principle in Diffusion Bridge Distillation for Purification (DBLP), where it denotes a latent-space consistency-distillation scheme that explicitly constructs a bridge between the adversarial-noise distribution and the clean-data distribution inside a latent consistency model. Its purpose is adversarial purification: given a noisy adversarial input, the model is trained to recover a clean-like latent with one to a few probability-flow ODE steps, rather than the long iterative denoising typical of diffusion-based purifiers (Huang et al., 1 Aug 2025).

1. Definition and conceptual scope

Within DBLP, Noise Bridge Distillation is not a generic synonym for diffusion distillation. It is a specific correction to standard latent consistency training motivated by the observation that adversarial examples do not follow the same latent trajectory as clean examples. In ordinary diffusion or latent consistency distillation, the model learns to map noisy clean samples along a probability-flow ODE back to the clean manifold. DBLP instead targets noisy adversarial samples, whose latent trajectories are shifted by the adversarial perturbation. If consistency distillation is applied naively to those adversarial latents, the model continues to retain the perturbation at small times, and the intended consistency property is violated (Huang et al., 1 Aug 2025).

The method therefore introduces an adjusted latent trajectory that cancels the adversarial perturbation along the forward noising process and then performs consistency distillation on that bridged trajectory. In the formulation given for DBLP, this construction serves three purposes simultaneously: it enables few-step purification, aligns adversarial inputs with clean-like latent dynamics, and supports an additional conditioning mechanism for semantic fidelity. This suggests that Noise Bridge Distillation is best understood as a trajectory-level alignment mechanism rather than merely a loss modification.

A common misconception is that adversarial purification can be obtained by directly reusing a clean latent consistency model on adversarial latents. DBLP argues that this is precisely the failure mode: near $t=0$, the latent consistency parameterization behaves like an almost identity skip connection, so adversarial information survives unless the trajectory itself is altered.

2. Latent-space bridge construction

DBLP operates in the latent space of Stable Diffusion v1.5, with encoder–decoder pair

$$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$

A clean latent is

$\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$

and an adversarial latent is formed during training as

$$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$

The adversarial perturbation $\boldsymbol{\epsilon}_a$ is generated via PGD on the classifier and induces an adversarial latent distribution that is a shifted version of the clean latent distribution (Huang et al., 1 Aug 2025).

Under the standard DDPM-style latent forward process,

$$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$

while the adversarial forward process is

$$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$

Hence

$$\mathbf{z}_t^a-\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\boldsymbol{\epsilon}_a,$$

so the adversarial trajectory is a time-dependent shift of the clean one.

The paper’s key negative result is that naïve consistency alignment fails in the small-time limit: $$\lim_{t\to 0}\Big(f_\theta(\mathbf{z}_t^a,t)-f_\theta(\mathbf{z}_t,t)\Big)=\boldsymbol{\epsilon}_a.$$ The stated intuition is that, near $t=0$, the LCM skip branch almost directly passes the input through because $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$0 and $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$1, so adversarial noise survives (Huang et al., 1 Aug 2025).

To repair this misalignment, DBLP defines the bridged latent

$$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$2

The coefficient $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$3 is chosen so that the posterior $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$4 no longer depends on $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$5. The derived closed form is

$$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$6

Substituting this yields

$$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$7

This bridge has three defining endpoint properties. At $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$8, $$\mathbf{z}=\mathcal{E}(\mathbf{x}), \qquad \mathbf{x}=\mathcal{D}(\mathbf{z}).$$9, so the trajectory begins exactly on the clean latent. At $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$0, $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$1, so $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$2, matching the adversarially noised endpoint. For intermediate $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$3, the construction removes explicit dependence of the reverse posterior on the unknown perturbation. In the paper’s interpretation, the adversarial perturbation is factored out of the latent reverse dynamics, allowing the latent consistency model to be trained on an effectively clean-noise trajectory even though the starting point is adversarial.

3. Distillation objective and reverse dynamics

Noise Bridge Distillation in DBLP is a consistency-distillation objective defined on the bridged latent trajectory. It combines a student–teacher consistency term with a reconstruction term anchored to the clean latent. Given a time grid $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$4, a sampled clean image $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$5, latent $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$6, adversarial perturbation $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$7, and a bridged latent $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$8, the method integrates a probability-flow ODE backward from $\mathbf{z}_0=\mathcal{E}(\mathbf{x}),$9 to $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$0 to obtain $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$1. The student and teacher are then aligned via

$$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$2

Here $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$3 is the student latent consistency model, $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$4 is its EMA teacher, and $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$5 is a distance metric such as $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$6 (Huang et al., 1 Aug 2025).

The second term explicitly ties the consistency map to purification: $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$7 where $$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$8 is the clean latent. The total objective is

$$\mathbf{z}_0^a=\mathbf{z}_0+\boldsymbol{\epsilon}_a.$$9

with the teacher updated by EMA: $\boldsymbol{\epsilon}_a$0

DBLP embeds this objective in the probability-flow ODE formalism. The underlying PF-ODE is written as

$\boldsymbol{\epsilon}_a$1

where the score model approximates $\boldsymbol{\epsilon}_a$2. The latent consistency model does not numerically integrate this ODE at sampling time; instead it learns a direct endpoint map from $\boldsymbol{\epsilon}_a$3 to a near-clean latent. During training, however, DBLP uses a leapfrog-inspired solver $\boldsymbol{\epsilon}_a$4 to generate the teacher-side earlier-time state. The leapfrog update is expressed as

$\boldsymbol{\epsilon}_a$5

The paper describes this as a stable one-step or few-step PF-ODE solver compatible with latent consistency inference.

The significance of this formulation is that the bridge and the distillation objective are co-designed. The bridge removes adversarial dependence from reverse dynamics; the consistency term distills those bridge dynamics; and the reconstruction term forces the distilled map to land on the clean latent manifold rather than merely on a self-consistent trajectory.

4. Training and inference in DBLP

The training pipeline begins with an LCM initialized from Stable Diffusion v1.5 and LCM-LoRA, a classifier $\boldsymbol{\epsilon}_a$6, the leapfrog solver, the latent encoder $\boldsymbol{\epsilon}_a$7, a noise schedule, an EMA teacher, and the reconstruction weight. For each iteration, a clean image is sampled and encoded, adversarial noise is generated by PGD-100 with $\boldsymbol{\epsilon}_a$8, a random pair of times $\boldsymbol{\epsilon}_a$9 is selected, the bridged latent is built via the closed-form bridge equation, and the leapfrog PF-ODE step produces the earlier-time teacher target. The combined loss is then minimized, while only low-rank adaptations on the SD v1.5 U-Net backbone are trained because the student is parameterized as LCM-LoRA (Huang et al., 1 Aug 2025).

At inference time, purification starts from an adversarial image $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$0, which is encoded as $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$1. The latent is forward-diffused to a high noise level $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$2, optional semantic conditioning is formed, and the learned LCM maps $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$3 to $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$4 using a few ODE steps, often $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$5. The purified image is then decoded by $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$6. The paper’s interpretation is that, although $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$7 is unknown at test time, the student has learned a trajectory that effectively cancels adversarial noise because training was performed on the bridged latent family.

This leads to a second misconception addressed by the method’s design: the bridge itself is not an inference-time estimation of the adversarial perturbation. Rather, it is a training-time latent construction that alters the consistency target so that the learned dynamics remain valid when only the adversarial input is observed at test time.

5. Semantic conditioning, empirical behavior, and robustness claims

DBLP supplements Noise Bridge Distillation with Adaptive Semantic Enhancement, described as a non-trainable conditioning mechanism. From the adversarial image $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$8, the method constructs an $$\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\mathbf{z}_0+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}, \qquad \boldsymbol{\epsilon}\sim\mathcal{N}(0,I),$$9-level Gaussian-blur pyramid and computes edge maps

$$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$0

with Canny thresholds selected by Otsu’s method. After upsampling all edge maps to the same resolution, weights are computed by gradient consistency with the adversarial image,

$$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$1

and the fused conditioning map is

$$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$2

The paper explicitly states that this conditioning is orthogonal to Noise Bridge Distillation: the bridge acts in latent-noise space, whereas fused edges act in image-structure space (Huang et al., 1 Aug 2025).

The reported ablation indicates that semantic enhancement improves both robustness and perceptual quality. Without edge maps, robust accuracy is 74.2%, LPIPS is 0.1386, and SSIM is 0.7409. With single-scale edges, these become 74.8%, 0.1172, and 0.7430. With multi-scale pyramid edges, the reported numbers are 75.6%, 0.1012, and 0.7655.

The broader empirical claims attributed to DBLP are framed in terms of robustness, image quality, and latency. On CIFAR-10 with WRN-70-16 + U-Net, the paper reports clean accuracy 94.8%, robust accuracy $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$3 under $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$4 attacks, and average robust accuracy 60.73%, compared with prior SOTA AP (ADBM) average 53.50%. On ImageNet with ResNet-50, reported robust accuracy is 75.6% under PGD-100 versus OSCP 73.89%, 74.8% under AutoAttack versus best prior approximately $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$5, and 74.2% under PGD-200 with $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$6. Under cross-architecture transfer attacks, DBLP is reported to outperform DiffPure and OSCP on ResNet-50/152, WRN-50-2, ConvNeXt-B, ViT-B-16, and Swin-B. The paper also states that these gains are achieved without adversarial training of the classifier, only purification. Inference time per ImageNet image on a single GPU is reported as approximately 25 s for DiffPure, approximately 19 s for GDMP, approximately 0.8 s for OSCP, and approximately 0.2 s for DBLP (Huang et al., 1 Aug 2025).

These results motivate DBLP’s claim that bridge-based consistency distillation can resolve the usual robustness–efficiency tension in diffusion purification. A plausible implication is that the bridge matters not only because it improves the terminal denoising objective, but because it makes few-step consistency sampling meaningful for adversarially shifted trajectories.

6. Relation to adjacent bridge-distillation formulations

Noise Bridge Distillation in DBLP belongs to a broader family of bridge-oriented distillation methods, but its object of alignment is unusually specific: an adversarially shifted latent diffusion trajectory. This distinguishes it from bridge distillation in ordinary image-to-image generation. “Consistency Diffusion Bridge Models” learns the consistency function of the PF-ODE of diffusion denoising bridge models and introduces consistency bridge distillation and consistency bridge training for data-to-data bridges, achieving $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$7 to $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$8 faster sampling than base DDBMs (He et al., 2024). “Inverse Bridge Matching Distillation” instead distills diffusion bridge models by matching inverse bridge dynamics and can distill both conditional and unconditional DBMs, including one-step generators trained using only corrupted images (Gushchin et al., 3 Feb 2025). Both are bridge distillation in generative translation, whereas DBLP’s bridge is explicitly constructed to cancel adversarial perturbation from latent reverse dynamics.

The DBLP paper’s own comparison emphasizes that standard diffusion distillation, consistency models, and latent consistency models assume clean data distributions and trajectories. DiffPure and GDMP rely on full iterative reverse SDE or ODE sampling and are slow; OSCP introduces “Adversarial Consistency Distillation” in state space; ADBM learns adversarial diffusion bridges under different assumptions. DBLP’s stated novelty is the explicit noise-space bridge defined by the closed-form $$\mathbf{z}_t^a=\sqrt{\bar{\alpha}_t}(\mathbf{z}_0+\boldsymbol{\epsilon}_a)+\sqrt{1-\bar{\alpha}_t}\,\boldsymbol{\epsilon}.$$9, together with reconstruction alignment and the leapfrog consistency framework (Huang et al., 1 Aug 2025).

A terminological caution is warranted because the phrase “noise bridge distillation” is used more loosely elsewhere. “Restoring Initial Noise Sensitivity in Text-to-Image Distillation via Geometric Alignment” does not use the literal term as its formal method name, but explicitly describes its Jacobian-vector-product matching as preserving the functional bridge from initial noise to output images (Huang et al., 1 Jun 2026). In quantum error mitigation, virtual distillation has also been described as a bridge from a noisy mixed state to an effectively purified state, implemented through cyclic permutation circuits rather than latent diffusion dynamics (Vikstål et al., 2022). These usages are conceptually related only at the level of bridge metaphors; they are not the same method.

In the strict sense established by DBLP, Noise Bridge Distillation denotes a latent adversarial-purification objective in which an explicit time-dependent bridge aligns adversarial and clean latent distributions so that consistency distillation remains valid under adversarial shift. Its defining ingredients are the bridge coefficient $$\mathbf{z}_t^a-\mathbf{z}_t=\sqrt{\bar{\alpha}_t}\boldsymbol{\epsilon}_a,$$0, bridged-latent consistency distillation, reconstruction to clean latents, and few-step purification in a latent consistency framework.