TARO: Temporal Adversarial Rectification Optimization Using Diffusion Models as Purifiers

TL;DR

TARO is a novel inference-time purification method using diffusion models that balances global structure and detailed semantics to improve adversarial robustness.

Contribution

It introduces a temporally guided score prior leveraging multiple denoising views, enhancing robustness against adaptive attacks in a zero-shot setting.

Findings

TARO improves robust accuracy across datasets and threat models.

TARO balances global rectification with semantic preservation.

Compatible with additional adversarial-likelihood objectives.

Abstract

Adversarial purification with diffusion models seeks to project adversarial examples back toward the data manifold, but balancing semantic preservation and robustness against adaptive attacks remains challenging. Recent work shows that standard diffusion purification can fail under adaptive evaluation, while test-time score-based optimization is more resilient. Existing optimization defenses, however, typically rely on a single diffusion noise regime or treat timesteps uniformly, overlooking the distinct roles of coarse and fine denoising scales. We propose Temporal Adversarial Rectification Optimization (TARO), an inference-time purification method that builds a temporally guided score prior from multiple denoising views along the diffusion trajectory. TARO forms a coarse-to-fine residual target: high-noise experts provide globally smoothed structure with reduced adversarial sensitivity, while low-noise experts restore image-specific, class-relevant details. A guidance strength controls this temporal correction, allowing TARO to balance robust global rectification with semantic preservation. Empirically, TARO improves robust accuracy across datasets and adaptive threat models in a zero-shot setting, while remaining compatible with complementary adversarial-likelihood objectives for further robustness gains.