Research map / Adversarial robustness and security / Certified and empirical robustness
Robust Classification via a Single Diffusion Model
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Robust Diffusion Classifier (RDC), converting a pre-trained class-conditional diffusion model into a generative classifier via Bayes' theorem with a likelihood-maximization pre-step and a multi-head diffusion backbone for efficient all-class prediction, evaluated against adaptive attacks on CIFAR-10.
Problem
Adversarial robustness of image classifiers: diffusion purification is broken by adaptive attacks and adversarial training generalizes poorly to unseen threats. The paper asks how to turn a diffusion model into a robust generative classifier.
Approach
Classify using the diffusion model's conditional likelihood via Bayes' theorem (approximated by the negative conditional diffusion loss), first moving the input to higher-likelihood regions with a budget-constrained likelihood maximization step, and use a multi-head UNet that outputs noise predictions for all classes in one forward pass to cut the K-fold cost.
Key results
- RDC achieves 75.67% robust accuracy under l_inf (eps=8/255) adaptive attacks on CIFAR-10, +4.77% over AT-EDM.
- Under unseen threats (l_inf, l_2, StAdv), LM/DC/RDC average robust accuracy of 78.06/68.81/82.38% versus at most ~50% for baselines (table).
- Exact-gradient attack on RDC with N=1 gives 69.53% robust accuracy, only ~0.39% below BPDA, suggesting BPDA suffices.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add likelihood maximization before diffusion classification (ablation) | DC · CIFAR-10 test, ℓ∞, ε=8/255 | robust accuracy: 35.94 -> 75.67 | Helped |
| Add likelihood maximization before diffusion classification (ablation) | DC · CIFAR-10 test, ℓ2, ε=0.5 | robust accuracy: 76.95 -> 82.03 | Helped |
| Use one sampled timestep per LM iteration instead of all timesteps (ablation) | RDC · CIFAR-10 test, ℓ∞, ε=8/255, AutoAttack with BPDA, first 100 examples | robust accuracy: 73.24 -> 75.67 | Helped |
| Use one sampled timestep per LM iteration instead of all timesteps (ablation) | RDC · CIFAR-10 test, ℓ2, ε=0.5, AutoAttack with BPDA, first 100 examples | robust accuracy: 80.27 -> 82.03 | Helped |
| Use one sampled timestep per LM iteration instead of all timesteps (ablation) | LM · CIFAR-10 test, ℓ∞, ε=8/255, AutoAttack with BPDA, first 100 examples | robust accuracy: 2.34 -> 71.68 | Helped |
| Train multi-head diffusion with cross-entropy loss instead of diffusion loss (ablation) | Multi-head diffusion · CIFAR-10 test | robust accuracy: 0% | Hurt |
| Increase the optimization budget η (ablation) | RDC likelihood maximization · CIFAR-10 test, ℓ∞, ε=8/255 | robust accuracy | Mixed |
| Reduce the number of diffusion timesteps used by the classifier (ablation) | DC · CIFAR-10 test, ℓ∞, ε=8/255 | robust accuracy | Hurt |
| Sample ε multiple times, or reuse the same ε across timesteps or classes (ablation) | DC · CIFAR-10 test | robust accuracy | No clear effect |
| Increase CFG for multi-head diffusion (ablation) | Multi-head diffusion · CIFAR-10 | accuracy | No clear effect |
Surprising findings
- Training multi-head diffusion with cross-entropy instead of diffusion loss yields 0% robustness despite 82.48% test accuracy.
- Optimal diffusion classifier achieves 100% robust accuracy, while the trained empirical one gets only 35.94% under l_inf.
Limitations
- Multi-head diffusion alone reaches only about 60% clean accuracy on CIFAR-10 in the appendix, so it is not a drop-in replacement for the conditional UNet.
- Exact-gradient evaluation only feasible for N=1 likelihood-maximization steps due to second-order memory cost; RDC relies on BPDA for the main evaluation.
- Evaluation uses a 512-image subset of CIFAR-10 test set (100 images for ablations), so results have sampling variance.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10
Metrics: clean accuracy robust accuracy
Baselines: AT-DDPM AT-EDM DiffPure PAT-self SBGC HybViT JEM
Builds on: DiffPure AutoAttack classifier-guided diffusion (off-the-shelf conditional diffusion model) denoising diffusion probabilistic models BPDA
Closest papers by meaning
- Diffusion Models are Certifiably Robust Classifiers (NeurIPS 2024 · similarity 0.93)
- Efficient Image-to-Image Diffusion Classifier for Adversarial Robustness (AAAI 2025 · similarity 0.91)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.90)
- CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models (ICML 2025 · similarity 0.89)
- Improved Diffusion-based Generative Model with Better Adversarial Robustness (ICLR 2025 · similarity 0.88)
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.