It seems that the understanding of the surrogate process might be incorrect.

[892446631]

The ICCV original paper describes the surrogate process as follows:”The surrogate process utilizes the fact that given the total amount of noise, we can denoise the same amount of noise with different numbers of denoising steps [33].“
However,your code is as follows:
# Set diffusion process for attack and defense
attack_forward = PurificationForward(
clf, diffusion, att_max_timesteps, att_diffusion_steps, args.att_sampling_method, is_imagenet, device)
defense_forward = PurificationForward_mimic(
clf, diffusion, def_max_timesteps, def_diffusion_steps, args.def_sampling_method, is_imagenet, device)
I think that's completely wrong, right?