There is an increasing concern about adversarial attacks on contemporary AI systems such as deep neural networks. Adversaries generate adversarial perturbations that can significantly reduce the prediction accuracy of deep learning models. This paper introduces a diffusion–osmosis PDE model to capture the dynamics of the generation and elimination of adversarial perturbations. Specifically, we formulate the diffusion term to model the spreading of the adversarial energy, and osmosis term to purify the perturbation energy selectively. Different from existing empirical approaches, the introduced mathematical model enjoys theoretical stability guarantees obtained based on energy analysis. Theorems prove that when parameters meet specific constraints, the coupled PDE system ensures the decay of the adversarial perturbations asymptotically. Experimental results on synthetic data and image data verify the effectiveness of the proposed model in decreasing the perturbation energy and recovering the classification ability of CNNs. In addition, we incorporate the proposed model into a CNN defense architecture for pre-processing adversarial samples and evaluate its performance on the popular benchmark dataset, CIFAR-10, under the FGSM and PGD attacks.