When Does Diffusion Purification Amplify Perturbations?

Diffusion-based purification improves adversarial robustness by denoising perturbed inputs before classification, but the temporal behavior of the reverse process remains less understood. In this work, we study the temporal sensitivity of diffusion purification. Shared-noise clean and adversarial trajectories show a non-monotonic divergence pattern, increasing during early reverse stages and partially decreasing near the final output. To move beyond this trajectory-level observation, we perform controlled perturbation injection at different reverse steps. We observe that perturbations introduced earlier in the reverse process tend to have a larger effect on the final purified output than those introduced later, providing evidence for a temporally non-uniform sensitivity structure in this purification setting. We further show that a simple early-stage damping intervention systematically changes the trade-off between clean preservation and adversarial recovery. Our results suggest that, in the studied score-based purification setting, diffusion purification does not behave as a uniformly stabilizing process across time; instead, its robustness behavior appears strongly influenced by early reverse dynamics.