Research map / Adversarial robustness and security / Certified and empirical robustness
Diffusion Models are Certifiably Robust Classifiers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proves diffusion classifiers have O(1) Lipschitzness and extends them to classify Gaussian-corrupted inputs via noised ELBOs (EPNDC/APNDC), combining them with randomized smoothing for state-of-the-art certified robustness on CIFAR-10 and ImageNet-64 without extra data.
Problem
Diffusion classifiers show strong empirical adversarial robustness but lack theoretical certification; standard randomized smoothing requires a base classifier that works on Gaussian-corrupted inputs, which off-the-shelf diffusion classifiers do not support.
Approach
Derive the Lipschitz constant of diffusion classifiers and generalize them to noisy inputs x_tau by deriving ELBOs for log p(x_tau|y), yielding Noised Diffusion Classifiers (EPNDC exact posterior, APNDC approximate posterior) that plug into randomized smoothing; also reduce cost via shared noise across classes and a sift-and-refine class search.
Key results
- Achieves 82.2%, 70.7%, and 54.5% certified accuracy on CIFAR-10 at l2 radii 0.25, 0.5, 0.75, surpassing prior state of the art (DensePure) by 5.6, 6.1, and 4.1 points.
- Clean accuracy of 91.2% on CIFAR-10, 3.6 points above DensePure.
- On ImageNet-64x64 the APNDC sift-and-refine method reaches 46.3% certified accuracy at radius 0.25 with no extra data, outperforming prior off-the-shelf and training-based methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use APNDC instead of DensePure | Diffusion classifier · CIFAR-10 | certified accuracy at R=0.25: +5.6% | Helped |
| Use APNDC instead of DensePure | Diffusion classifier · CIFAR-10 | certified accuracy at R=0.5: +6.1% | Helped |
| Use APNDC instead of DensePure | Diffusion classifier · CIFAR-10 | certified accuracy at R=0.75: +4.1% | Helped |
| Use APNDC instead of DensePure | Diffusion classifier · CIFAR-10 | clean accuracy: +3.6% | Helped |
| Use APNDC instead of DensePure | Diffusion classifier · ImageNet-64x64 | certified accuracy: 46.3 vs 35.4; 38.3 vs 29.3; 35.2 vs 26.0; 32.8 vs 18.6 | Helped |
| Increase APNDC timestep count from T′=100 to T′=1000 (ablation) | APNDC · CIFAR-10 | certified accuracy: 80.7 -> 82.2; 68.8 -> 70.7; 50.8 -> 54.5; 35.2 -> 38.2 | Helped |
| Replace EPNDC with APNDC (ablation) | Noised Diffusion Classifier · CIFAR-10 | certified accuracy: 77.4 -> 80.7; 60.0 -> 68.8; 35.7 -> 50.8; 24.4 -> 35.2 | Mixed |
| Use the same noisy samples across all classes (ablation) | Diffusion classifier · CIFAR-10 | accuracy | Helped |
| Reduce selected diffusion timesteps with the variance-reduction technique (ablation) | Diffusion classifier · CIFAR-10 | time complexity: 10 | Helped |
| Apply time-complexity reduction techniques (ablation) | Diffusion classifier · ImageNet | time complexity: 1000 | Helped |
| Use DiffPure followed by a diffusion classifier rather than APNDC (ablation) | Diffusion classifier · CIFAR-10 | certified accuracy: 68.8 vs 80.7; 53.1 vs 68.8; 41.2 vs 50.8; 25.6 vs 35.2 | Hurt |
| Use truncated derived loss weight instead of derived weight in EPNDC (ablation) | EPNDC · CIFAR-10 test subset, σ=0.25 | accuracy: 67.5 -> 82.8 | Helped |
Surprising findings
- The weak-law randomized smoothing bound caps certified radius (about 1.253 for the Lipschitz-constant argument; their diffusion bound gives at most about 0.39), so the constant-Lipschitz analysis alone is insufficient, motivating the noised classifiers.
- Using the same noisy sample across all classes at each timestep reduces variance enough to use far fewer timesteps (e.g., 8) without sacrificing accuracy.
Limitations
- Uses N=10,000 Monte Carlo samples (vs 100,000 in prior work) and a non-optimal loss weight that is not theoretically determined.
- Certification uses pB = 1 - pA rather than estimating pB, and ImageNet evaluated at 64x64 resolution due to lack of conditional 256x256 models.
- Computational cost scales with number of classes, requiring a sift-and-refine heuristic for large class counts.
Experimental setup
Datasets: CIFAR-10 ImageNet 64x64
Benchmarks: CIFAR-10 ImageNet-64x64
Metrics: certified accuracy clean accuracy
Baselines: DensePure Carlini et al. (diffusion denoiser + ImageNet-21k classifier) Xiao et al. DensePure DiffPure+DC SmoothAdv Consistency MACER Boosting
Builds on: Chen et al. diffusion classifier (DiffPure/DC) randomized smoothing (Cohen et al.) SmoothAdv DDPM ELBO (Ho et al.) EDM (Karras et al.)
Closest papers by meaning
- Robust Classification via a Single Diffusion Model (ICML 2024 · similarity 0.93)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.88)
- Robust Representation Consistency Model via Contrastive Denoising (ICLR 2025 · similarity 0.88)
- DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.88)
- Improved Diffusion-based Generative Model with Better Adversarial Robustness (ICLR 2025 · similarity 0.88)
- Assessing the quality of denoising diffusion models in Wasserstein distance: noisy score and optimal bounds (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.