mlsanityData to 7 Oct 2026

Robustifying Diffusion-Denoised Smoothing Against Covariate Shift

arXiv 2509.10913 ↗First posted 13 Sep 2025cs.LG cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Randomized smoothing is a well-established method for achieving certified robustness against l2-adversarial perturbations. By incorporating a denoiser before the base classifier, pretrained classifiers can be seamlessly integrated into randomized smoothing without significant performance degradation. Among existing methods, Diffusion Denoised Smoothing - where a pretrained denoising diffusion model serves as the denoiser - has produced state-of-the-art results. However, we show that employing a denoising diffusion model introduces a covariate shift via misestimation of the added noise, ultimately degrading the smoothed classifier's performance. To address this issue, we propose a novel adversarial objective function focused on the added noise of the denoising diffusion model. This approach is inspired by our understanding of the origin of the covariate shift. Our goal is to train the base classifier to ensure it is robust against the covariate shift introduced by the denoiser. Our method significantly improves certified accuracy across three standard classification benchmarks - MNIST, CIFAR-10, and ImageNet - achieving new state-of-the-art performance in l2-adversarial perturbations. Our implementation is publicly available at https://github.com/ahedayat/Robustifying-DDS-Against-Covariate-Shift

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 33 of its 41 references that are in the map. First posted on arXiv 13 Sep 2025.

Builds on

33 of 41 references.

Closest ancestors · 1

Same direction, newest first

  1. 2022(Certified!!) Adversarial Robustness for Free!21 Jun

Other references · 32

  1. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2020Denoising Diffusion Implicit Modelscited by 9,655
  4. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  5. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2013Intriguing properties of neural networkscited by 5,114
  9. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  10. 2023Consistency Modelscited by 1,778
  11. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  12. 2022CoCa: Contrastive Captioners are Image-Text Foundation Modelscited by 1,265
20 more
  1. 2022PaLI: A Jointly-Scaled Multilingual Language-Image Modelcited by 762
  2. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  3. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  4. 2020Overfitting in adversarially robust deep learningcited by 504
  5. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  6. 2017Certifying Some Distributional Robustness with Principled Adversarial Trainingcited by 333
  7. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  8. 2018Adversarially Robust Generalization Requires More Datacited by 318
  9. 2022BEiT v2: Masked Image Modeling with Vector-Quantized Visual Tokenizerscited by 298
  10. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  11. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  12. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  13. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  14. 2023ONE-PEACE: Exploring One General Representation Model Toward Unlimited Modalitiescited by 117
  15. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  16. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  17. 2015Learning with a Strong Adversarycited by 68
  18. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  19. 2022Towards All-in-one Pre-training via Maximizing Multi-modal Mutual Informationcited by 31
  20. 2023MoCaE: Mixture of Calibrated Experts Significantly Improves Object Detectioncited by 17

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Robust Representation Consistency Model via Contrastive Denoising
  2. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  3. 2023Multi-scale Diffusion Denoised Smoothing
  4. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustness
  5. 2025Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion
  6. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing
  7. 2022Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance
  8. 2025What is Adversarial Training for Diffusion Models?