  Recently, diffusion-based purification (DBP) has emerged as a promising
approach for defending against adversarial attacks. However, previous studies
have used questionable methods to evaluate the robustness of DBP models, their
explanations of DBP robustness also lack experimental support. We re-examine
DBP robustness using precise gradient, and discuss the impact of stochasticity
on DBP robustness. To better explain DBP robustness, we assess DBP robustness
under a novel attack setting, Deterministic White-box, and pinpoint
stochasticity as the main factor in DBP robustness. Our results suggest that
DBP models rely on stochasticity to evade the most effective attack direction,
rather than directly countering adversarial perturbations. To improve the
robustness of DBP models, we propose Adversarial Denoising Diffusion Training
(ADDT). This technique uses Classifier-Guided Perturbation Optimization (CGPO)
to generate adversarial perturbation through guidance from a pre-trained
classifier, and uses Rank-Based Gaussian Mapping (RBGM) to convert adversarial
pertubation into a normal Gaussian distribution. Empirical results show that
ADDT improves the robustness of DBP models. Further experiments confirm that
ADDT equips DBP models with the ability to directly counter adversarial
perturbations.
