mlsanityData to 14 Oct 2026

DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing

arXiv 2308.14333 ↗First posted 28 Aug 2023cs.LG cs.AIcited by 20

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Diffusion models have been leveraged to perform adversarial purification and thus provide both empirical and certified robustness for a standard model. On the other hand, different robustly trained smoothed models have been studied to improve the certified robustness. Thus, it raises a natural question: Can diffusion model be used to achieve improved certified robustness on those robustly trained smoothed models? In this work, we first theoretically show that recovered instances by diffusion models are in the bounded neighborhood of the original instance with high probability; and the "one-shot" denoising diffusion probabilistic models (DDPM) can approximate the mean of the generated distribution of a continuous-time diffusion model, which approximates the original instance under mild conditions. Inspired by our analysis, we propose a certifiably robust pipeline DiffSmooth, which first performs adversarial purification via diffusion models and then maps the purified instances to a common region via a simple yet effective local smoothing strategy. We conduct extensive experiments on different datasets and show that DiffSmooth achieves SOTA-certified robustness compared with eight baselines. For instance, DiffSmooth improves the SOTA-certified accuracy from 36.0% to 53.0% under ℓ2 radius 1.5 on ImageNet. The code is available at [https://github.com/javyduck/DiffSmooth].

Key facts. Cited by 20 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 52 of its 63 references that are in the map. First posted on arXiv 28 Aug 2023.

Builds on

52 of 63 references.

Closest ancestors · 4

Same direction, newest first

  1. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness1 Nov
  2. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  3. 2022Guided Diffusion Model for Adversarial Purification30 May
  4. 2022Diffusion Models for Adversarial Purification16 May

Other references · 48

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2020Denoising Diffusion Implicit Modelscited by 9,781
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  8. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  10. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,183
  11. 2013Intriguing properties of neural networkscited by 5,155
  12. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
36 more
  1. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,761
  2. 2021Convex optimizationcited by 2,515
  3. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  5. 2021Image Super-Resolution via Iterative Refinementcited by 1,511
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  9. 2020Improved Techniques for Training Score-Based Generative Modelscited by 1,043
  10. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  11. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  12. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  13. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  14. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  15. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
  16. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  17. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  18. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  19. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
  20. 2018Certified Defenses against Adversarial Examplescited by 306
  21. 2022Cold Diffusion: Inverting Arbitrary Image Transforms Without Noisecited by 276
  22. 2020Learning Gradient Fields for Shape Generationcited by 245
  23. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
  24. 2019Algorithms for Verifying Deep Neural Networkscited by 221
  25. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 205
  26. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  27. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 179
  28. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 125
  29. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  30. 2020SoK: Certified Robustness for Deep Neural Networkscited by 105
  31. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  32. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  33. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  34. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  35. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  36. 2020Extensions and limitations of randomized smoothing for robustness guaranteescited by 15

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 10; 2025: 6; 2026: 1.

20 papers.

Sort:

By area:

  1. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 27
  2. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  3. 2025SafeAuto: Knowledge-Enhanced Safe Autonomous Driving with Multimodal Foundation Modelscited by 23
  4. 2024Espresso: Robust Concept Filtering in Text-to-Image Modelscited by 14
  5. 2024DiffBreak: Is Diffusion-Based Purification Robust?cited by 6
  6. 2025CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothingcited by 6
  7. 2024Adversarial Feature Alignment: Balancing Robustness and Accuracy in Deep Learning via Adversarial Trainingcited by 5
  8. 2023Investigating the Adversarial Robustness of Density Estimation Using the Probability Flow ODEcited by 4
  9. 2024Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustnesscited by 2
  10. 2023Exploring Transferability for Randomized Smoothingcited by 1
  11. 2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
  12. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
8 more
  1. 2024Pre-trained Multiple Latent Variable Generative Models are good defenders against Adversarial Attackscited by 1
  2. 2025Robust Representation Consistency Model via Contrastive Denoisingcited by 1
  3. 2025Towards Strong Certified Defense with Universal Asymmetric Randomizationcited by 1
  4. 2023Provably Cost-Sensitive Adversarial Defense via Randomized Smoothingcited by 0
  5. 2024LightPure: Realtime Adversarial Image Purification for Mobile Devices Using Diffusion Modelscited by 0
  6. 2025Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusioncited by 0
  7. 2025Dual Randomized Smoothing: Beyond Global Noise Variancecited by 0
  8. 2026DeepFix: Debugging and Fixing Machine Learning Workflow using Agentic AIcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Demystifying Adversarial Robustness in Diffusion Models: Compression, Randomness, and Geometry
  2. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  3. 2023Robust Classification via a Single Diffusion Model
  4. 2025Diffusion Models are Robust Pretrainers
  5. 2024Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective
  6. 2025Robustifying Diffusion-Denoised Smoothing Against Covariate Shift
  7. 2022Guided Diffusion Model for Adversarial Purification from Random Noise
  8. 2023Raising the Bar for Certified Adversarial Robustness with Diffusion Models