Research map / Adversarial robustness and security / Attacks on text and graphs
Efficient Image-to-Image Diffusion Classifier for Adversarial Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes an Image-to-Image Diffusion Classifier (IDC) that recasts classification as BBDM-style image translation to pre-defined orthogonal pixel-space labels, with a pruned U-Net, 4 diffusion timesteps, and an added inter-class loss, achieving robustness with far fewer FLOPs than DiffPure.
Problem
Diffusion-model-based adversarial defenses (DiffPure, robust diffusion classifiers) are computationally expensive at inference, making full-dataset robustness evaluation under strong attacks costly and hard to compare with CNN-based defenses; naively shrinking DMs harms generation quality.
Approach
Replace high-quality image generation with image-to-image translation from the input to orthogonal pre-defined image labels, so a small, pruned U-Net with few timesteps suffices; add an inter-class loss that pushes the translated output away from the nearest wrong class label, and classify by L1 distance to the labels.
Key results
- On CIFAR-10 under BPDA+EOT, IDC (9.39M params) reaches 82.97% robust accuracy versus 81.40% for DiffPure (244.30M params), with 86.10% standard accuracy.
- On CIFAR-10 under AutoAttack (eps=8/255), IDC achieves 59.9% robust accuracy without adversarial training, versus 48.5% for ResNet-18 with AT and 52.5% for WideResNet32 with AT.
- The inference FLOPs of IDC are reported as 27.09G versus 14.26T for DiffPure.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IDC instead of WideResNet32 with adversarial training | CIFAR-10 · CIFAR-10 | PGD^20 robust accuracy: 54.7 -> 84.8 | Helped |
| Use IDC instead of WideResNet32 with adversarial training | CIFAR-10 · CIFAR-10 | AutoAttack robust accuracy: 52.5 -> 59.9 | Helped |
| Use IDC instead of WideResNet32 with adversarial training | CIFAR-100 · CIFAR-100 | PGD^20 robust accuracy: 30.9 -> 33.4 | Helped |
| Use IDC instead of WideResNet32 with adversarial training | CIFAR-100 · CIFAR-100 | AutoAttack robust accuracy: 27.2 -> 17.7 | Hurt |
| Use IDC instead of DiffPure | CIFAR-10 · CIFAR-10 | BPDA+EOT robust accuracy: 81.40 -> 82.97 | Helped |
| Use IDC instead of DiffPure | CIFAR-10 · CIFAR-10 | PGD+EOT robust accuracy: 46.84 -> 84.70 | Helped |
| Add the inter-class loss to orthogonal image labels (ablation) | IDC · CIFAR-10 | PGD^20 robust accuracy: 81.0 -> 84.8 | Helped |
| Add the inter-class loss to orthogonal image labels (ablation) | IDC · CIFAR-10 | AutoAttack robust accuracy: 56.5 -> 59.9 | Helped |
| Use orthogonal image labels instead of non-orthogonal labels (ablation) | IDC with inter-class loss · CIFAR-10 | PGD^20 robust accuracy: 63.7 -> 84.8 | Helped |
| Use orthogonal image labels instead of non-orthogonal labels (ablation) | IDC with inter-class loss · CIFAR-10 | AutoAttack robust accuracy: 34.6 -> 59.9 | Helped |
| Change U-Net upscale list from [1,4] to [1,2,4] (ablation) | IDC · CIFAR-10 | AutoAttack robust accuracy: 56.5 -> 64.5 | Helped |
| Change U-Net upscale list from [1,4] to [1,2,4] (ablation) | IDC · CIFAR-10 | PGD^20 robust accuracy: 81.0 -> 80.4 | Hurt |
Surprising findings
- On Tiny-ImageNet, IDC without adversarial training underperforms the AT-trained WideResNet32 under PGD and AutoAttack, indicating the approach does not fully transfer to harder datasets.
Limitations
- Weaker performance on Tiny-ImageNet compared with AT-trained WideResNet32 and ResNet-18 under several attacks.
- Standard accuracy on CIFAR-100 (59.4%) is well below CNN baselines (76-80%), and robustness under AutoAttack is lower than WideResNet32 with AT (17.7% vs 27.2%).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny-ImageNet
Benchmarks: CIFAR-10 CIFAR-100 Tiny-ImageNet
Metrics: standard accuracy robust accuracy
Baselines: ResNet-18 WideResNet32 DiffPure RDC MimicDiffusion ContrastDiffPure
Builds on: BBDM Zero-shot Diffusion Classifier DiffPure PGD adversarial training
Closest papers by meaning
- Robust Classification via a Single Diffusion Model (ICML 2024 · similarity 0.91)
- Structure-Guided Adversarial Training of Diffusion Models (CVPR 2024 · similarity 0.90)
- Bridging Data Gaps in Diffusion Models with Adversarial Noise-Based Transfer Learning (ICML 2024 · similarity 0.88)
- CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models (ICML 2025 · similarity 0.88)
- Directional Label Diffusion Model for Learning from Noisy Labels (CVPR 2025 · similarity 0.88)
- Improved Diffusion-based Generative Model with Better Adversarial Robustness (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.