Perturbation Diffusion Technique

• Perturbation diffusion technique is a family of methods that decomposes a diffusion process into a baseline dynamic and a corrective perturbation to address nonlinear or adversarial effects.
• It is applied in varied domains—including fractional subdiffusion-reaction systems, machine learning pipelines, and graph dynamics—demonstrating versatility in handling complex systems.
• The structured perturbation enables precise analytic expansions, algorithmic guidance, and multiscale reuse, thereby improving robustness and practical performance.

Searching arXiv for recent and foundational uses of “perturbation diffusion” and closely related terms across domains. Perturbation diffusion technique is not a single universally standardized method. In the arXiv literature considered here, the expression denotes a family of procedures in which a diffusion process provides the baseline dynamics and a perturbation encodes the difficult, corrective, adversarial, or control-relevant component. In fractional transport, the perturbation is a weak nonlinear reaction added to subdiffusion (Lewandowska et al., 2012). In modern diffusion models, the perturbation may be applied to training inputs, initial noise, intermediate tokens, or frequency components in order to improve robustness, controllability, or alignment (Ning et al., 2023, Song et al., 7 Feb 2025, Rajabi et al., 10 Jun 2025). In single-cell biology, diffusion is lifted from cell states to distribution-valued embeddings so that perturbation response is modeled at the population level rather than the single-cell level (Yuan et al., 23 Feb 2026). This diversity suggests that the unifying content of the term is structural: a tractable diffusion backbone is retained, while the nontrivial effect is isolated as a controlled perturbation.

1. Terminological scope and recurring structure

The literature uses the phrase across several non-equivalent settings. One strand studies perturbative solution methods for diffusion or subdiffusion equations, especially when a nonlinear term is weak after a suitable rescaling (Lewandowska et al., 2012). A second strand, dominant in recent machine learning, perturbs some component of a diffusion model itself: the denoiser input, the initial latent noise, token representations, or spatially weighted noise levels (Ning et al., 2023, Song et al., 7 Feb 2025, Rajabi et al., 10 Jun 2025, Zhang et al., 24 Mar 2025). A third strand uses perturbation diffusion as an operational or adversarial device: prompt-agnostic image cloaking against customized diffusion models, diffusion-based recovery of perturbed federated gradients, adversarial purification, or purification-resistant protective perturbations (Wan et al., 2024, Liu et al., 2024, Song et al., 2023, Yang et al., 17 Sep 2025). The term also appears in graph dynamics, quantum transport, stochastic Riccati flows, NMR restricted diffusion, and numerical homogenization (Cox et al., 2020, Janiš et al., 2015, Bishop et al., 2017, Nordin et al., 2011, Hellman et al., 2019).

A plausible implication is that “perturbation diffusion” names a methodological pattern rather than a single algorithm. The surveyed papers repeatedly separate a base diffusion mechanism from a correction term that is either small, structured, or strategically chosen. In some cases the perturbation is analytic and asymptotic; in others it is algorithmic and training-free; in still others it is adversarial and intentionally designed to survive denoising or purification.

2. Fractional subdiffusion–reaction perturbation method

A canonical analytic formulation appears in the study of the subdiffusion–reaction system for two species $A$ and $B$ reacting by

$A + B \to \emptyset,$

with symmetric initial separation into opposite half-spaces (Lewandowska et al., 2012). The concentrations satisfy fractional-time subdiffusion–reaction equations with a Caputo derivative of order $0<\alpha<1$,

$$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$

$$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$

subject to step-like initial data and the symmetry relation $A(-x,t)\equiv B(x,t)$ (Lewandowska et al., 2012).

The paper emphasizes that standard perturbation cannot be applied directly in the dimensional variables, because in the reaction region the diffusion term $D\partial^2/\partial x^2$ and the nonlinear reaction term $kAB$ can be comparable (Lewandowska et al., 2012). The central step is therefore a nondimensionalization,

$$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$

together with normalized concentrations $B$0 and $B$1, so that the transformed system becomes

$B$2

In this form the reaction term is explicitly multiplied by a small parameter $B$3, and the nonlinear dynamics can be treated as a perturbation of pure subdiffusion (Lewandowska et al., 2012).

The method assumes power-series expansions

$B$4

At zeroth order one obtains pure subdiffusion equations with step-function initial data. For $B$5, the corrections satisfy inhomogeneous equations driven by lower-order products,

$B$6

$B$7

with homogeneous initial and boundary conditions for the higher-order terms; the paper states that the hierarchy is solved with the Laplace transform method (Lewandowska et al., 2012).

For $B$8, the approximation is truncated at first order,

$B$9

Returning to dimensional variables, the approximate concentrations are written as

$A + B \to \emptyset,$0

where the zeroth-order term is the diffusion-only profile and the first-order correction has the form

$A + B \to \emptyset,$1

with the rule that the correction is kept only when it decreases the concentration. The functions $A + B \to \emptyset,$2 are represented by explicit series with coefficients $A + B \to \emptyset,$3, $A + B \to \emptyset,$4, and recursively defined $A + B \to \emptyset,$5 (Lewandowska et al., 2012).

The numerical comparison is decisive for the paper’s interpretation. The zeroth-order approximation alone does not match the numerical data well; adding the first-order correction improves the agreement significantly; the agreement is reasonably accurate for the times shown in the figures; the similarity between perturbation and numerical solutions decreases as time increases; and smaller reaction rates $A + B \to \emptyset,$6 lead to better agreement, consistent with the assumption $A + B \to \emptyset,$7 (Lewandowska et al., 2012). The method is therefore useful in the weak-reaction regime and at not-too-large times, but it is not expected to remain accurate when the rescaled reaction strength is no longer small.

3. Diffusion-model engineering and algorithmic perturbation

Recent machine-learning work uses perturbation directly inside diffusion pipelines, but the perturbation locus varies substantially.

Method	Perturbation locus	Reported role
DDPM-IP (Ning et al., 2023)	Training input $A + B \to \emptyset,$8	Reduce exposure-bias-like mismatch
CCS (Song et al., 7 Feb 2025)	Initial noise $A + B \to \emptyset,$9	Controllable and constrained sampling
TPG (Rajabi et al., 10 Jun 2025)	Intermediate token representations	Training-free CFG-like guidance
UPSR (Zhang et al., 24 Mar 2025)	Spatially weighted forward noise	Uncertainty-guided super-resolution
FG-Diff (Tan et al., 2024)	Perturbative motion samples	Robust skeleton VAD in open-set settings
PerturbDiff (Yuan et al., 23 Feb 2026)	RKHS distribution embeddings	Distribution-level perturbation modeling

In DDPM-IP, the denoiser is trained on a perturbed input

$0<\alpha<1$0

while still predicting the original $0<\alpha<1$1. The paper interprets this as a regularizer that simulates inference-time prediction errors and reports that, on CelebA $0<\alpha<1$2, the method achieves FID $0<\alpha<1$3 with $0<\alpha<1$4 sampling steps while saving $0<\alpha<1$5 of the training time (Ning et al., 2023). The core claim is that perturbing the denoiser input, rather than the target, reduces the train-test discrepancy created by a long reverse chain.

CCS shifts the perturbation to the beginning of sampling. Under DDIM / diffusion ODE sampling, the paper reports a highly linear relationship between the scale of initial-noise perturbation and the change in the final generated sample. To preserve the geometry of the diffusion prior, CCS uses spherical interpolation

$0<\alpha<1$6

rather than naive additive noise, and tunes $0<\alpha<1$7 with a controller algorithm to match a target diversity or MSE. The reported linearity is strong, with $0<\alpha<1$8 values $0<\alpha<1$9 on FFHQ, $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$0 on CIFAR-10, $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$1 on Celeba-HQ, and $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$2 on fMoW (Song et al., 7 Feb 2025).

TPG moves the perturbation into the denoiser’s hidden states. An intermediate token matrix $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$3 is perturbed by a norm-preserving token permutation matrix $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$4, producing a second forward pass whose difference from the standard forward pass becomes the guidance residual. The method is training-free, condition-agnostic, and designed to resemble CFG more closely than prior training-free perturbation methods. On SDXL unconditional generation, the paper reports FID $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$5 for TPG, compared with $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$6 for vanilla SDXL, while in conditional generation TPG reaches CLIP score $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$7, closer to CFG’s $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$8 than PAG or SEG (Rajabi et al., 10 Jun 2025).

UPSR uses perturbation in the forward process of a super-resolution diffusion model. The perturbation is anisotropic and uncertainty-weighted: $$\frac{\partial^{\alpha}A(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 A(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$9 and the forward transition replaces isotropic variance by $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$0. Pixels with lower uncertainty receive reduced noise, while edge and texture regions receive larger weights. The paper reports about $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$1 smaller overall model size, training speed improving from $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$2 to $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$3, and memory dropping from $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$4 to $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$5 (Zhang et al., 24 Mar 2025).

FG-Diff combines perturbation training with DCT-based frequency separation for skeleton-based video anomaly detection. A lightweight perturbation generator $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$6 produces hard normal examples, while the diffusion model is guided by high-frequency observations and reconstructs low-frequency motion structure. The anomaly score remains a reconstruction error,

$$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$7

but the method is explicitly targeted at open-set robustness. The reported results are $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$8 on Avenue, $$\frac{\partial^{\alpha}B(x,t)}{\partial t^{\alpha}} = D\frac{\partial^2 B(x,t)}{\partial x^2} - k A(x,t)B(x,t),$$9 on HR-Avenue, $A(-x,t)\equiv B(x,t)$0 on HR-STC, $A(-x,t)\equiv B(x,t)$1 on UBnormal, and $A(-x,t)\equiv B(x,t)$2 on HR-UBnormal, with improvements of $A(-x,t)\equiv B(x,t)$3, $A(-x,t)\equiv B(x,t)$4, $A(-x,t)\equiv B(x,t)$5, and $A(-x,t)\equiv B(x,t)$6 over previous best reconstruction-based methods on four datasets (Tan et al., 2024).

PerturbDiff extends the same pattern from cell states to distributions. Control and perturbed cell populations are embedded by kernel mean embeddings in an RKHS, and a DDPM-like forward process is defined directly on the embedding: $A(-x,t)\equiv B(x,t)$7 The implemented training loss combines an MMD term and an MSE term,

$A(-x,t)\equiv B(x,t)$8

and the paper reports state-of-the-art performance on PBMC and Tahoe100M, strong DE-related metrics, and substantially better generalization to unseen perturbations (Yuan et al., 23 Feb 2026).

4. Adversarial, privacy, and purification uses

In another major usage, perturbation diffusion denotes methods that either protect against diffusion models or exploit diffusion to undo protective perturbations. PAP models the attacker’s prompt space for customized text-to-image systems by a Laplace approximation in text-embedding space,

$A(-x,t)\equiv B(x,t)$9

and optimizes perturbations against the expected diffusion loss over this prompt distribution rather than a single prompt. The paper reports implementation cost of about $D\partial^2/\partial x^2$0 minutes on an NVIDIA A800 80GB GPU, a default noise budget $D\partial^2/\partial x^2$1, and transfer across DreamBooth, LoRA, and Textual Inversion (Wan et al., 2024). This is a diffusion-based perturbation method in which the perturbation is protective rather than generative.

Mjolnir treats perturbation-protected federated gradients as noisy diffusion states and learns a reverse denoising model to recover a close approximation of the original gradient. The method constructs a surrogate client model to generate training gradients, then aligns the reverse diffusion start step to an estimated perturbation scale by

$D\partial^2/\partial x^2$2

The reported average cosine similarity exceeds $D\partial^2/\partial x^2$3, average PSNR is about $D\partial^2/\partial x^2$4 for recovered gradients, recovered-image PSNR improves by about $D\partial^2/\partial x^2$5 over conventional gradient leakage attacks, and inference is about $D\partial^2/\partial x^2$6 faster than the non-diffusion denoisers on average (Liu et al., 2024).

MimicDiffusion addresses adversarial purification by approximating the clean-image guidance trajectory that would have been produced if the clean image were available. The method replaces $D\partial^2/\partial x^2$7 guidance with Manhattan-distance guidance in a long-range regime and adds a super-resolution-based short-range guidance,

$D\partial^2/\partial x^2$8

with guidance applied only over a middle interval $D\partial^2/\partial x^2$9, where $kAB$0 and $kAB$1. The reported average robust accuracies are $kAB$2 on CIFAR-10, $kAB$3 on CIFAR-100, and $kAB$4 on ImageNet, improving by $kAB$5, $kAB$6, and $kAB$7, respectively, over the strongest baselines in those settings (Song et al., 2023).

AntiPure formalizes the anti-purification problem for the purification-customization workflow. Its two guidance mechanisms are Patch-wise Frequency Guidance and Erroneous Timestep Guidance,

$kAB$8

combined in a PGD objective designed to make the perturbation survive representative purification settings before DreamBooth or LoRA customization. On CelebA-HQ under DreamBooth, the paper reports FID $kAB$9, ISM $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$0, and BRISQUE $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$1; on VGGFace2, FID $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$2, ISM $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$3, and BRISQUE $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$4. It also reports the smallest LPIPS among compared methods, including $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$5 on CelebA-HQ and $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$6 on VGGFace2 across AlexNet/VGG backbones (Yang et al., 17 Sep 2025).

A common misconception would be to treat all of these as merely “adding noise.” The papers do not support that simplification. PAP attacks a prompt distribution; Mjolnir denoises perturbed gradients by learned reverse diffusion; MimicDiffusion perturbs guidance geometry; AntiPure attacks purification through frequency and timestep guidance. The perturbation may therefore be generative, protective, diagnostic, or explicitly adversarial.

5. Analytical and stochastic perturbation frameworks

Outside deep generative modeling, perturbation diffusion often means an analytic correction scheme for a stochastic or transport equation. In quantum diffusion with a random potential, the central issue is consistency of the diagrammatic expansion with the Ward identity. The paper constructs a corrected electron-hole irreducible vertex $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$7 from a perturbative auxiliary vertex $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$8 and the mismatch term $$x=\rho x_s,\qquad t=\tau t_s,\qquad x_s=\sqrt{D t_s^{\alpha}},\qquad \epsilon = k t_s^{\alpha} C_0,$$9, then derives the low-energy diffusion pole

$B$00

together with exact representations of the diffusion constant and weak-localization corrections from maximally crossed diagrams (Janiš et al., 2015). Here the perturbation is diagrammatic and conserving rather than asymptotically small in a scalar parameter.

For stochastic matrix Riccati diffusions, the perturbation parameter is explicit: $B$01 The paper develops non-asymptotic Taylor expansions of any order in $B$02, proves refined moment estimates, derives bias and variance estimates, and establishes a functional central limit theorem. In the EnKF interpretation, $B$03, so the perturbation quantifies finite-particle fluctuations around the deterministic Riccati flow (Bishop et al., 2017). The same paper reports the bias expansion

$B$04

and the sharp sign information $B$05 (Bishop et al., 2017).

For unstable SDEs, the path-kernel method provides a linear-response formula in which an adapted schedule $B$06 gradually moves perturbation from tangent dynamics into the probability kernel: $B$07 The method is designed precisely for the regime where pure pathwise sensitivity explodes and pure kernel methods have large variance, and it is demonstrated on the noisy Lorenz 96 system with $B$08 dimensions, $B$09, $B$10, $B$11, and, for the physical-measure response, $B$12 and $B$13 (Ni, 2 Mar 2025).

Non-Markovian quantum state diffusion supplies a related but distinct perturbative use. The $B$14-operator of the exact NMQSD equation is expanded either functionally in the noise history or in the coupling strength $B$15. The functional expansion begins with

$B$16

while the weak-coupling expansion writes

$B$17

For the dissipative two-qubit benchmark, the paper concludes that the zeroth-order functional approximation can be more accurate than a second-order weak-coupling truncation, becomes exact for initial states with zero population in $B$18, and retains fidelity with the lowest value around $B$19 in the tested regime (Xu et al., 2014).

These examples show that, in analytical physics, perturbation diffusion usually denotes a controlled expansion around a diffusion-like baseline semigroup, propagator, or stochastic flow. The perturbation is often introduced to preserve a structural property—conservation law, finite-particle fluctuation, memory effect, or linear response—rather than merely to accelerate computation.

6. Discrete, numerical, and mesoscopic transport interpretations

A sharply different usage appears in graph dynamics. In the chip-firing variant called Perturbation Diffusion, the system starts from the $B$20-configuration and a chosen subset $B$21 is forced to fire once, sending one chip to each neighbor regardless of chip comparison; after that, ordinary Diffusion resumes. The paper proves that $B$22 is $B$23-invoking if and only if it is complementary component dominant (CCD), and for path graphs $B$24 it derives

$B$25

together with the counting recurrence

$B$26

for the number of $B$27-invoking subsets (Cox et al., 2020). Here “diffusion” is a discrete load-balancing dynamics, and the perturbation is a one-step forced firing.

In pulsed spin-echo gradient NMR, a mixed-basis perturbation method approximates eigenvalues and eigenfunctions of the diffusion operator in the SGP limit by combining Laplace eigenfunctions with boundary-generated dipole functions. The resulting perturbation matrix has size $B$28 and is constructed in $B$29 time, where $B$30 is the number of boundary elements. The reported relative errors are about $B$31 for diffusion between two plates, of order $B$32 for randomly distributed discs in $B$33D, and of order $B$34 for a more challenging clustered parent/child geometry (Nordin et al., 2011).

For elliptic multiscale problems, perturbation enters through the coefficient rather than the state. The PG-LOD method reuses reference correctors for perturbed diffusion problems with local defects or domain mappings, guided by local indicators such as $B$35, $B$36, $B$37, and $B$38. The main error estimate is

$B$39

and the numerical study uses a $B$40 fine grid, a $B$41 coarse grid, $B$42, and $B$43. The paper concludes that the approach is strongest for localized perturbations, while global mappings reduce the amount of reusable information (Hellman et al., 2019).

At the mesoscopic level of many-particle Hamiltonian systems, perturbation spreading is modeled by a generalized Lévy walk in an active medium. The perturbation profile $B$44 is identified with a conserved excess-energy distribution confined largely בתוך a causal cone $B$45, and the ballistic humps are broadened by in-flight velocity fluctuations. For the hard-point gas and the FPU-$B$46 chain, the reported exponent is $B$47; for the hard-point gas the parameters satisfy

$B$48

The paper’s claim is that ergodic many-body perturbation spreading can be reproduced by a single-particle random walk through an active, fluctuating medium (Zaburdaev et al., 2011).

Taken together, these usages confirm that perturbation diffusion is best understood as a cross-domain methodological family. In some papers it is a small-parameter expansion of nonlinear subdiffusion; in others it is a training-free guidance mechanism, a privacy attack, a protective perturbation, a conserving diagrammatic correction, a graph-theoretic shock, or a multiscale reuse strategy. The common invariant is the decomposition of a diffusion-like process into a baseline evolution and a structurally meaningful perturbation that is either analyzed, controlled, or deliberately manipulated.