mlsanityData to 7 Oct 2026

(Certified!!) Adversarial Robustness for Free!

arXiv 2206.10550 ↗First posted 21 Jun 2022cs.LG cs.CRcited by 130

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

In this paper we show how to achieve state-of-the-art certified adversarial robustness to 2-norm bounded perturbations by relying exclusively on off-the-shelf pretrained models. To do so, we instantiate the denoised smoothing approach of Salman et al. 2020 by combining a pretrained denoising diffusion probabilistic model and a standard high-accuracy classifier. This allows us to certify 71% accuracy on ImageNet under adversarial perturbations constrained to be within an 2-norm of 0.5, an improvement of 14 percentage points over the prior certified SoTA using any approach, or an improvement of 30 percentage points over denoised smoothing. We obtain these results using only pretrained diffusion models and image classifiers, without requiring any fine tuning or retraining of model parameters.

Key facts. Cited by 130 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 26 of its 31 references that are in the map. First posted on arXiv 21 Jun 2022.

Builds on

26 of 31 references.

Closest ancestors · 1

Same direction, newest first

  1. 2022Diffusion Models for Adversarial Purification16 May

Other references · 25

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2020Denoising Diffusion Implicit Modelscited by 9,655
  4. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  5. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  8. 2016Wide Residual Networkscited by 3,057
  9. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
  12. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
13 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  2. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  3. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  4. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  5. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  6. 2018Adversarially Robust Generalization Requires More Datacited by 318
  7. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  8. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  9. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  10. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  11. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  12. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  13. 2022Robust and Accurate -- Compositional Architectures for Randomized Smoothingcited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 6; 2023: 51; 2024: 47; 2025: 19; 2026: 7.

130 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  3. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  4. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  5. 2022Fast Sampling of Diffusion Models via Operator Learningcited by 173
  6. 2023Fast Training of Diffusion Models with Masked Transformerscited by 172
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  8. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 128
  9. 2023Robust Classification via a Single Diffusion Modelcited by 79
  10. 2023A Pilot Study of Query-Free Adversarial Attack against Stable Diffusioncited by 75
  11. 2024An Overview of Diffusion Models: Applications, Guided Generation, Statistical Rates and Optimizationcited by 72
  12. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 68
38 more
  1. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  2. 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 60
  3. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 37
  4. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
  5. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
  6. 2023Addressing Negative Transfer in Diffusion Modelscited by 33
  7. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  8. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  9. 2023Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shiftscited by 23
  10. 2022Denoising Masked AutoEncoders Help Robust Classificationcited by 21
  11. 2023Defending against Adversarial Audio via Diffusion Modelcited by 20
  12. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  13. 2023Enhancing Adversarial Robustness via Score-Based Optimizationcited by 19
  14. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
  15. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
  16. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  17. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  18. 2024PromptSmooth: Certifying Robustness of Medical Vision-Language Models via Prompt Learningcited by 16
  19. 2023LipSim: A Provably Robust Perceptual Similarity Metriccited by 15
  20. 20231-Lipschitz Layers Compared: Memory, Speed, and Certifiable Robustnesscited by 15
  21. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  22. 2024Espresso: Robust Concept Filtering in Text-to-Image Modelscited by 14
  23. 2023Unlocking Deterministic Robustness Certification on ImageNetcited by 13
  24. 2023Purify++: Improving Diffusion-Purification with Advanced Diffusion Models and Control of Randomnesscited by 13
  25. 2023Improving Interpretation Faithfulness for Vision Transformerscited by 12
  26. 2024PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attackscited by 11
  27. 2022CARE: Certifiably Robust Learning with Reasoning via Variational Inferencecited by 10
  28. 2023Single Image Backdoor Inversion via Robust Smoothed Classifierscited by 10
  29. 2023Robust One-Class Classification with Signed Distance Function using 1-Lipschitz Neural Networkscited by 10
  30. 2024On the Asymptotic Mean Square Error Optimality of Diffusion Modelscited by 10
  31. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  32. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  33. 2024Dormant: Defending against Pose-driven Human Image Animationcited by 9
  34. 2023Learning Provably Robust Estimators for Inverse Problems via Jitteringcited by 8
  35. 2024Adversarial Guided Diffusion Models for Adversarial Purificationcited by 8
  36. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspectivecited by 8
  37. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  38. 2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7

50 most cited of 130 All 130 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2023Raising the Bar for Certified Adversarial Robustness with Diffusion Models
  2. 2025Diffusion Models are Robust Pretrainers
  3. 2025CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models
  4. 2024ProTIP: Probabilistic Robustness Verification on Text-to-Image Diffusion Models against Stochastic Perturbation
  5. 2023Denoising Diffusion Probabilistic Models as a Defense against Adversarial Attacks
  6. 2025What is Adversarial Training for Diffusion Models?
  7. 2022Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance
  8. 2022Guided Diffusion Model for Adversarial Purification from Random Noise