Pith. sign in

REVIEW 3 major objections 5 minor 71 references

What is Adversarial Training for Diffusion Models?

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper argues that adversarial training for diffusion models must enforce equivariance—shifting the predicted noise by the same perturbation added to the input—rather than invariance.

desk verdict A genuinely new equivariance-based regularizer for robust diffusion training, with a flawed variational derivation and a partially circular attack evaluation. read the letter →

arxiv 2505.21742 v1 pith:FXRZYHXA submitted 2025-05-27 cs.CV cs.LG

Briglia Maria Rosaria , Mujtaba Hussain Mirza , Giuseppe Lisanti , Iacopo Masi This is my paper
classification cs.CVcs.LG
keywords adversarialtrainingdiffusionmodelsequivariancedenoisingrobustnessdatacorruptionmemorizationfastsampling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks what adversarial training should mean for diffusion models and answers that it should enforce equivariance, not invariance. Because the denoising network solves a regression problem, shifting the noisy input by δ should shift the predicted noise by δ, whereas classifier-style invariance makes the reverse process drift off the data manifold. The authors add a time-dependent regularization term to the standard DDPM objective that imposes this local equivariance, using either random noise or a single FGSM step, and they show that the resulting model generates clean samples even when 90% of the training data is corrupted. The same regularization reduces memorization and allows 500-step sampling to beat the 1000-step baseline.

What carries the argument

The load-bearing object is the time-dependent equivariance regularizer in Equation (9), combined with a scheduled perturbation. The perturbation δ is drawn uniformly in an $\ell_\infty$ ball of radius $r_\beta(t)$ and, in the adversarial variant, refined by one FGSM step with random start; the effective deviation added to $x_t$ scales as $(\sqrt{1-\alpha_t})^\omega + \gamma\beta$, so it is large in the noise phase, small in the content phase, and never below a floor. The regularization weight $\lambda_t = \lambda\sqrt{3}/(\beta r(t))$ is rescaled by the perturbation's standard deviation so that the smoothness constraint stays comparable across timesteps. The mechanism forces the denoising network to map $x_t+\delta$ to the same next state $x_{t-1}$ as the unperturbed point, which is what keeps the chain aligned with the data distribution while absorbing local noise.

What would settle it

Train with δ drawn from a genuinely independent zero-mean Gaussian with the same time-dependent radius, omitting the FGSM refinement, and compare FID on 90%-corrupted CIFAR-10; if the Gaussian version matches the uniform-plus-FGSM version, the FGSM component is not needed and the claimed derivation is not the mechanism. Alternatively, on held-out points measure the equivariance error $\|\epsilon_\theta(x_t+\delta,t)-\epsilon_\theta(x_t,t)-\delta\|$; if robustness to corruption persists where this error is large, the regularizer is not what produces the robustness.

Watch

Extended reading notes

Core claim

The central claim is that adversarial training for diffusion models is a smoothing operation on the diffusion flow, and it must be formulated as equivariance. Concretely, the paper proposes to minimize $L_{\rm AT} = \|\epsilon_\theta(x_t,t)-\epsilon\|_2^2 + \lambda_t \|\epsilon_\theta(x_t^{\rm adv},t)-[\epsilon_\theta(x_t,t)+\delta]\|_2^2$, where the first term is the usual denoising objective and the second term requires the network's noise prediction to shift by the same perturbation δ that was added to the input. The authors argue that the naive invariance objective $\|\epsilon_\theta(x_t+\delta,t)-\epsilon_\theta(x_t,t)\|_2^2$ causes the model to learn the wrong distribution. With the equivariant loss, a DDPM trained on up to 90% corrupted data with strong Gaussian noise generates samples close to the clean distribution, resists white-box trajectory attacks better, memorizes less, and supports faster sampling.

Load-bearing premise

The derivation of the equivariance loss assumes that the added perturbation δ is an independent Gaussian transition appended to the forward chain, so the corrupted chain remains a product of Gaussian kernels; in the actual algorithm δ is uniform and then refined by FGSM, so if that Gaussian model fails, the ELBO argument does not justify Equation (9) and the regularizer stands or falls on its empirical behavior.

Editorial extensions

If this is right

  • A DDPM trained with the equivariant regularizer can be trained on datasets in which 90% of the samples are corrupted by Gaussian noise at σ=0.2 and still produce images close to the clean distribution, where the unregularized baseline's FID rises above 100 on CIFAR-10.
  • The correct formulation of adversarial training for generative models is equivariance: enforcing invariance makes the reverse process diverge from the data manifold, as the paper shows on both synthetic and real data.
  • The regularized model memorizes less: on CIFAR-10 the similarity histogram of generated samples shifts left and has fewer near-duplicates above 0.9 similarity.
  • Smoother diffusion flow allows faster sampling: on clean CIFAR-10 the robust model reaches 24.34 FID with 500 inference steps, better than 28.68 with the standard 1000 steps.
  • The regularized model is more resistant to white-box trajectory attacks, keeping FID in a reasonable range when up to 50% of inference timesteps are attacked under both FGSM and PGD variants.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • I infer that the equivariance loss, being stated at the level of the noise-prediction field, should transfer to latent diffusion and consistency models, though the paper only tests DDPM.
  • Because the method never requires knowing the corruption level or distinguishing clean from noisy samples, it could be paired with blind denoising or used as a training-time defense before adversarial purification; the paper does not test these combinations.
  • The schedule that shrinks perturbation strength in the content phase suggests a general principle — regularization strength should track the signal-to-noise ratio — that could be tested on other generative frameworks, including the fully corrupted p=100% case the paper lists as future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper addresses the question in its title by proposing that adversarial training (AT) for diffusion models should enforce equivariance rather than invariance. The central proposal is the training objective in Eq. (9), which combines the standard DDPM denoising loss with a regularizer that pushes the epsilon-prediction at a perturbed input x_t+delta toward the prediction at x_t plus the perturbation delta. The perturbation is chosen from a time-dependent ray schedule r_beta(t) and can be random or adversarial (FGSM with random start). The authors argue that this 'equivariant' regularization smooths the diffusion flow, and they support the claim with experiments on synthetic low-dimensional and high-dimensional data with known distributions, as well as CIFAR-10, CelebA, and LSUN Bedroom under 90% Gaussian corruption. They also report reduced memorization, faster sampling, and improved robustness to FGSM and PGD trajectory attacks.

Significance. If the central claim were established, the paper would make a useful conceptual and practical contribution: it offers a simple regularization term that integrates into standard DDPM training and shows strong empirical gains in training on heavily corrupted data, without requiring knowledge of the noise level. The paper's strengths include the use of synthetic datasets with closed-form reconstruction error, the release of code, and a relatively broad evaluation across datasets and corruption levels. However, the theoretical derivation that is advertised as establishing the 'equivariance is required' claim does not actually yield Eq. (9), and the robustness evaluation attacks an objective closely aligned with the training regularizer. The contribution is therefore best regarded at present as an empirical regularizer with promising results, not as a formally grounded principle for AT in diffusion models.

major comments (3)
  1. [Appendix A.1.3, Eq. (9)] The variational derivation does not establish Eq. (9). The factorization between the penultimate and final lines of the ELBO computation replaces p_theta(x_{t-1}|x_t+delta_t) by p_theta(x_{t-1}|x_t) p'_theta(x_t|x_t+delta_t), which is not a valid conditional-probability identity. In addition, the ratio q'(x_t|x_0)/q'(x_t+delta_t|x_0) disappears without comment, and the sign of the boundary term log p'_theta(x_0|x_1+delta_1) changes incorrectly. More importantly, even if the ELBO algebra were correct, the two resulting KL terms do not reduce to the explicit equivariance regularizer ||epsilon_theta(x_t+delta) - [epsilon_theta(x_t)+delta]||^2: no step of the derivation maps the variational bound to Eq. (9). The abstract's assertion that AT for DMs 'requires equivariance' is therefore supported only by the experiments, not by the theory as written.
  2. [Appendix A.1.1 and Section 2.3 / Algorithm 1] The theoretical forward-chain model assumes the perturbation is an independent Gaussian transition, q''(x_t+delta_t|x_{t-1}) = q'(x_t+delta_t|x_t) q(x_t|x_{t-1}), with delta_t independent of x_t and of the model. The algorithm actually used draws delta from U[-r_beta(t), r_beta(t)] and then applies an FGSM step (Eq. (7)) whose gradient is computed through epsilon_theta; hence delta_adv is a deterministic function of the current weights theta and of x_t, is not Gaussian, and changes throughout training. The factorization and the subsequent ELBO manipulation therefore do not apply to the method in Algorithm 1, and Eq. (9) functions as an ad hoc regularizer whose justification is empirical. If the theoretical claim is to be kept, this gap must be closed, for example by treating the adversarial perturbation as an outer maximization over a Gaussian model or by deriving the regularizer directly from a different principle.
  3. [Section 3.4, Algorithm 2 and Appendix A.2] The robustness evaluation is partly circular. Algorithm 2, and its epsilon-prediction reformulation in Appendix A.2, define the attack cost as J_theta(x_t,delta,t) = ||epsilon_theta(x_t+delta,t) - epsilon_theta(x_t,t)||^2, which is the same pairwise output difference that the regularizer in Eq. (9) is designed to suppress (the regularizer's target is epsilon_theta(x_t)+delta rather than epsilon_theta(x_t), but for small delta the two objectives are closely aligned). Training on Eq. (9) therefore specifically reduces the quantity the attack maximizes, so the reported FID improvements under this attack do not demonstrate general trajectory robustness. I recommend evaluating robustness with an attack that is not derived from the training objective, such as attacking the final generated samples, or using a downstream classifier or perceptual metric, and reporting whether the gains persist.
minor comments (5)
  1. [Section 2.1, Eq. (3)] The sampling notation t ~ U(0,I) is a typo; it should be t ~ U({1,...,T}) or an equivalent discrete uniform distribution over timesteps.
  2. [Section 2.4, Eqs. (8) and (9)] The left-hand sides of Eqs. (8) and (9) use 'arg min_theta' although the right-hand sides are loss values; this notation is misleading and should be replaced by a plain loss definition.
  3. [Section 3, Table 2] The column layout of Table 2 is difficult to parse; in particular, the p=0 row and the separation between the columns for DDPM, Robust adv, DDIM, and Robust adv should be explicitly formatted so that each FID/IS pair is unambiguous.
  4. [Appendix B.4.1 and B.3.3] The text in B.4.1 says 'both with p=0.9%' and should read p=90%; B.3.3 contains the typo 'Instea,d DDPM'.
  5. [Appendix A.1.3] The notation q'(x_t|x_0) is used but q' was only defined as a transition q'(x_t+delta|x_t), not as a marginal distribution; this needs to be defined or the derivation needs to be rewritten.

Circularity Check

2 steps flagged · score 5.0 of 10

The attack-robustness experiment re-uses the exact pairwise-output cost the regularizer minimizes, and the central 'equivariance is required' claim restates the regularizer's defining constraint; the rest of the empirical study is independent.

  1. self definitional [Section 2.4 (Eq. 9) and Appendix B.1.1 (Eqs. 13-14)]
    "Being the diffusion a regression task, we formulated again the AT taking into account the need for input sensitivity of the model by enforcing equivariance. ... This objective is reached by taking into account δ in the AT loss as arg minθ ||ϵθ(xt+δ,t)-[ϵ+δ]||². While this equation enforces equivariance, it does not yet enforce smoothness ... Our final formulation is given in Equation (9)."

    Appendix B.1.1 defines equivariance as f(a∘x)=a∘f(x), which for the additive perturbation used in the paper is exactly f(xt+δ)=f(xt)+δ. Eq. (9)'s regularizer Lreg = λt||ϵθ(xadv_t,t)-[ϵθ(xt,t)+δ]||² is the squared-error loss for precisely that identity. The headline conclusion that AT for DMs 'requires equivariance' is therefore the defining constraint of the proposed loss stated as a result; the ELBO derivation in A.1.3 is never carried through algebraically to Eq. (9), so the conclusion is not a separately derived consequence. The invariance-vs-equivariance experiments provide empirical support, but the conceptual claim itself is largely a restatement of the regularizer's definition.

  2. fitted input called prediction [Section 2.3, Eq. (7); Section 3.4, Algorithm 2; Appendix A.2]
    "The final adversarial perturbation δadv is then computed by taking a step in the direction of the gradient of Jθ ... δadv = Prβ(t)(δran + rβ(t)/√3 S(∇xt Jθ(xt,δran,t))) ... This cost function, if considered in light of the model's prediction in the epsilon-prediction setting, can be formulated as: Jθ(xt,δ,t)=||ϵθ(xt+δ,t)-ϵθ(xt,t)||²."

    Training crafts δadv by maximizing Jθ, the squared norm of the pairwise output difference, and Eq. (9) trains ϵθ so that at this crafted δadv the output difference equals δadv. The evaluation attack in Algorithm 2 maximizes the perturbed-vs-unperturbed predicted-mean discrepancy, which Appendix A.2 explicitly reduces to the same Jθ. Under the trained equivariance, the attack's gradient is approximately zero, so the reported 'robustness to attacks' measures whether the model minimized the very quantity its own regularizer was built to shrink. This is a partial by-construction result rather than an independent adversarial probe; the PGD variant in A.3 maximizes the same cost.

full rationale

Most of the paper is a self-contained empirical study: the FID/IS comparisons on corrupted CIFAR-10, CelebA and LSUN, the memorization histogram against DINO-v2, and the faster-sampling tests are external benchmarks computed with standard metrics, and they do not reduce to the paper's inputs. There is no load-bearing self-citation chain; the only same-author citation appears in a list of AT methods and is not used to justify a uniqueness claim. The circularity concerns are concentrated in two places. First, the conceptual answer to the title question is definitional: 'equivariance' is defined as the additive consistency f(xt+δ)=f(xt)+δ, and Eq. (9) enforces exactly that identity, so the statement 'AT in DMs requires equivariance' restates the regularizer's construction rather than following from the ELBO. The ELBO in Appendix A.1 is not a clean derivation of Eq. (9); the paper concedes in A.1.2 that 'there is no modeling available' for the attack distribution, which depends on the model state, while A.1.1 treats the perturbation as an independent Gaussian transition. That inconsistency undermines the formal claim but is a rigor gap more than a circular reduction. Second, the adversarial-robustness experiment is partially circular: Appendix A.2 reduces the attack cost to the same Jθ used to craft training perturbations, and Eq. (9) was trained to make that cost's gradient vanish. The comparison against DDPM is still informative about relative behavior, and the PGD extension adds some transfer, but the headline robustness result is not an independent probe of the training objective. Overall the paper has substantial independent empirical content, so the circularity is partial rather than total.

Assumptions & free parameters 6 free parameters · 3 assumptions · 0 invented entities

The method's central claim rests on a hand-designed perturbation schedule (lambda, omega, gamma, beta), on the asserted Gaussianity of the perturbation for the theoretical derivation, and on the assumption that this schedule transfers to unseen corruption types. The theoretical appendix does not derive the proposed loss; it assumes the perturbation model and then manipulates the ELBO with a sign error.

free parameters (6)
  • lambda (lambda) = 0.3
    Regularization strength in Eq (9); the paper states that 0.5 over-smooths and lower values under-denoise (Section 3).
  • omega (omega) = 2
    Exponent controlling the time-dependent perturbation ray in Eq (5); chosen by hand (Section 3).
  • gamma (gamma) = 8/255
    Bias keeping the perturbation ray nonzero at t tending to 0 in Eq (5); chosen by hand (Section 3).
  • beta (beta) = sampled from U[0.5,2]
    Random scalar in the ray scheduler, default 1; adds stochasticity to the perturbation bound (Section 2.3).
  • attack strength phi (phi) = not specified in main text
    Controls the magnitude of the attack noise in Algorithm 2; the paper does not report its value, which affects the robustness numbers.
  • perturbation ray schedule r_beta(t) = time-dependent function
    The entire perturbation ray shape is an ad hoc design satisfying four stated qualitative requirements (Section 2.3).
assumptions (3)
  • ad hoc to paper The perturbation delta can be modeled as an independent Gaussian transition q'(xt+delta|xt), so the forward chain remains a product of Gaussians.
    Assumed in Section A.1.1 to justify the ELBO; contradicted by the actual uniform plus FGSM construction of delta.
  • ad hoc to paper The hand-designed ray r_beta(t) with omega=2 and gamma=8/255 is appropriate for all corruption levels and noise types.
    Underlies the claim of no noise-model assumptions; only tested with Gaussian corruption at sigma=0.1 and 0.2.
  • domain assumption Standard DDPM Gaussian transition and score matching assumptions.
    The paper builds on Ho et al. [15] and score-based SDE formulations (Sections 2.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of What is Adversarial Training for Diffusion Models?." pith.science (2026). https://pith.science/paper/FXRZYHXA

@misc{pith2026250521742,
  author       = {Pith},
  title        = {Pith review of: What is Adversarial Training for Diffusion Models?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FXRZYHXA}},
  note         = {Machine review of arXiv:2505.21742}
}
read the original abstract

We answer the question in the title, showing that adversarial training (AT) for diffusion models (DMs) fundamentally differs from classifiers: while AT in classifiers enforces output invariance, AT in DMs requires equivariance to keep the diffusion process aligned with the data distribution. AT is a way to enforce smoothness in the diffusion flow, improving robustness to outliers and corrupted data. Unlike prior art, our method makes no assumptions about the noise model and integrates seamlessly into diffusion training by adding random noise, similar to randomized smoothing, or adversarial noise, akin to AT. This enables intrinsic capabilities such as handling noisy data, dealing with extreme variability such as outliers, preventing memorization, and improving robustness. We rigorously evaluate our approach with proof-of-concept datasets with known distributions in low- and high-dimensional space, thereby taking a perfect measure of errors; we further evaluate on standard benchmarks such as CIFAR-10, CelebA and LSUN Bedroom, showing strong performance under severe noise, data corruption, and iterative adversarial attacks.

Figures

Figures reproduced from arXiv: 2505.21742 by the authors.

Figure 1
Figure 1. Inducing smoothness into diffusion trajectories. We train the denoising network to follow the score function i.e., xt 7→ xt−1 using just ϵθ(xt, t), but we also perturb locally the data point as xt+δ inside a ℓp ball centered on xt and then imposing equivariance: xt+δ 7→ ϵθ(xt, t) + δ ≜ xt−1. This equals to adding an intermediate step in the Markov Chain, behaving as an additional denoising step in the training, maki… view at source ↗
Figure 2
Figure 2. (a) Handling different types of noise. The leftmost shows training data either with strong inlier noise (top) or uniform outliers (bottom). The trajectories reveal that DDPM [15] struggles with both, while if you train with invariance (Invadv) the process diverges. Instead ours (Robustadv) is more robust, avoiding diverging trajectories and better reaching the data centroid. (b) Score vector fields: versors represen… view at source ↗
Figure 3
Figure 3. (left) On the linearized butterflies dataset, we measure closed-form reconstruction error. From top to bottom: training data, corrupted data, DDPM generations, and Robustadv results. (right) Metric plots: first column shows PSNR, second column the closed-form reconstruction error. First row: clean data; second row: 90% of data corrupted with Gaussian noise (σ = 0.1). We also include an ablation on invariance regular… view at source ↗
Figures from the paper (21 more)
Figure 4
Figure 4. Figure 4: (top-left) Despite 90% of training data being corrupted with Gaussian noise, Robustadv generates smooth objects without artifacts, while DDPM retains noise. σ = 0.2 equals adding 40% of CIFAR-10 variability (σdata = 0.5). (top-right) DDPM generates bedrooms that are ir…
Figure 5
Figure 5. Figure 5: Despite the FID increasing once trained on clean data, images by Robustadv appear smoother and background clutter is removed. Random or adversarial? We can also reply this question by ablating the use of δadv and δran [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: (left) The histogram shows similarities between generated samples and CIFAR-10, with values above 0.9 indicating near-duplicates. DDPM memorizes more, while Robustadv reduces near￾replicas. (right) Regular training tends to have diverging trajectories w.r.t. the data d…
Figure 7
Figure 7. Figure 7: (a) Robustness to Adversarial Attacks. While the baseline DDPM is susceptible to adversarial attacks, Robust DMs better resist them, yielding superior FID and IS for different percentages of time steps attacked (e.g., 25% means 250 out of 1000 DDPM steps are attacked).…
Figure 8
Figure 8. Figure 8: Not applying equivariance ϵ EQUIV θ (xt, t), the model drifts and ends up in a different point of the space than the desired one, learning then the perturbation that we added as in ϵ INV. θ (xt, t) to train on, and then we impose adversarial training, following the sam…
Figure 9
Figure 9. Figure 9: The application of invariance on 3D data highlights the incorrect behavior of the training [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: Diffusion flow: DMs vs Robustadv. Left column shows the results by Ho et al. [15] under two different types of noise. Regular training tends to incorporate the noise inside the diffusion flow, making it more prone to generate undesirable and unexpected results; Right …
Figure 11
Figure 11. Figure 11: Trained on clean CIFAR-10 with p = 0%. Despite the FID decreases once trained on clean data, generated images by Robustadv look smooth, and the clutter in the background has been canceled. 21 [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]
Figure 12
Figure 12. Figure 12: Trained on clean CIFAR-10 with p = 0% but comparing less steps (500) vs the default DDPM scheduler used for training (1000). Although we run Robustadv with a scheduler with fewer steps (500) and do not use it in training, the images on the right with 500 steps have be…
Figure 13
Figure 13. Figure 13: Trained on noisy CIFAR-10 with p = 90%, σ = 0.1. Despite added noise, Robustadv images look smooth, and the clutter in the background has been canceled along with the Gaussian noise added. Instea,d DDPM on the left propagates the noise back in the output. 23 [PITH_FU…
Figure 14
Figure 14. Figure 14: Trained on noisy CIFAR-10 with p = 90%, σ = 0.2. Despite added noise, Robustadv images look smooth and the clutter in the background has been canceled along with the Gaussian noise added. Instead DDPM on the left propagates the noise back in the output. 25 [PITH_FULL…
Figure 15
Figure 15. Figure 15: Trained on noisy Celeb-A with p = 90%, σ = 0.1. Despite added noise, Robustadv faces look smooth and the clutter in the background has been canceled along with the Gaussian noise added. Instead, DDPM on the left propagates the noise back in the output. 26 [PITH_FULL_…
Figure 16
Figure 16. Figure 16: Trained on noisy Celeb-A with p = 90%, σ = 0.2. Despite added noise, Robustadv faces look smooth and the clutter in the background has been canceled along with the Gaussian noise added. Instead DDPM on the left propagates the noise back in the output. 27 [PITH_FULL_I…
Figure 17
Figure 17. Figure 17: Trained on clean LSUN Bedroom. Despite the added noise, [PITH_FULL_IMAGE:figures/full_fig_p028_17.png]
Figure 18
Figure 18. Figure 18: Trained on noisy LSUN Bedroom with p = 90%, σ = 0.1. Despite added noise, Robustadv images look smooth and with fewer intricate details that have been canceled along with the Gaussian noise added. Instead, DDPM on the left propagates the noise back into the output. 29…
Figure 19
Figure 19. Figure 19: Trained on noisy LSUN Bedroom with p = 90%, σ = 0.2. Despite added noise, Robustadv images look smooth and with less intricate details that have been canceled along with the Gaussian noise added. Instead, DDPM on the left propagates the noise back into the output. 30 …
Figure 20
Figure 20. Figure 20: Trained on clean LSUN Bedroom. Despite added noise, [PITH_FULL_IMAGE:figures/full_fig_p031_20.png]
Figure 21
Figure 21. Figure 21: Trained on noisy LSUN Bedroom with p = 90%, σ = 0.1. With extended training, Robustadv not only effectively removes the noise introduced into the dataset—in contrast to DDPM— but also restores fine details, resulting in multi-view images with natural colors and enhanc…
Figure 22
Figure 22. Figure 22: Trained on noisy LSUN Bedroom with p = 90%, σ = 0.2. With extended training, Robustadv effectively removes the noise introduced into the dataset, in contrast to DDPM. As a result, it produces cleaner images, albeit with less intricate details. 33 [PITH_FULL_IMAGE:fig…
Figure 23
Figure 23. Figure 23: Qualitative results analysis on samples generated by [PITH_FULL_IMAGE:figures/full_fig_p035_23.png]
Figure 24
Figure 24. Figure 24: Robustadv trained on LSUN Bedroom dataset, with different noisy data (p = 90%, different σ are visible in the image). The first row sets the regularization hyperparameter λ to 0.1, the second to 0.2. 36 [PITH_FULL_IMAGE:figures/full_fig_p036_24.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

71 extracted references · 47 canonical work pages

  1. [1]

    Solving inverse problems with score-based generative priors learned from noisy data

    Asad Aali, Marius Arvinte, Sidharth Kumar, and Jonathan I Tamir. Solving inverse problems with score-based generative priors learned from noisy data. InAsilomar Conference on Signals, Systems, and Computers, 2023

    work page 2023

  2. [2]

    Extracting training data from diffusion models

    Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. InUSENIX Security Symposium, 2023

    work page 2023

  3. [3]

    (certified!!) adversarial robustness for free! InICLR, 2023

    Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free! InICLR, 2023

    work page 2023

  4. [4]

    Perception prioritized training of diffusion models

    Jooyoung Choi, Jungbeom Lee, Chaehun Shin, Sungwon Kim, Hyunwoo Kim, and Sungroh Yoon. Perception prioritized training of diffusion models. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11472–11481, 2022

    2022

  5. [5]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. InICML, pages 1310–1320. PMLR, 2019

    work page 2019

  6. [6]

    A high-quality robust diffusion framework for corrupted dataset

    Quan Dao, Binh Ta, Tung Pham, and Anh Tran. A high-quality robust diffusion framework for corrupted dataset. InECCV, 2024

    work page 2024

  7. [7]

    How much is a noisy image worth? data scaling laws for ambient diffusion.arXiv e-prints, pages arXiv–2411, 2024

    Giannis Daras, Yeshwanth Cherapanamjeri, and Constantinos Daskalakis. How much is a noisy image worth? data scaling laws for ambient diffusion.arXiv e-prints, pages arXiv–2411, 2024

    work page 2024

  8. [8]

    Soft diffusion: Score matching with general corruptions.TMLR, 2024

    Giannis Daras, Mauricio Delbracio, Hossein Talebi, Alex Dimakis, and Peyman Milanfar. Soft diffusion: Score matching with general corruptions.TMLR, 2024

    work page 2024

Show all 71 references
  1. [9]

    Consistent diffusion meets tweedie: Training exact ambient diffusion models with noisy data

    Giannis Daras, Alex Dimakis, and Constantinos Costis Daskalakis. Consistent diffusion meets tweedie: Training exact ambient diffusion models with noisy data. InICML, 2024

    2024

  2. [10]

    Ambient diffusion: Learning clean distributions from corrupted data

    Giannis Daras, Kulin Shah, Yuval Dagan, Aravind Gollakota, Alex Dimakis, and Adam Klivans. Ambient diffusion: Learning clean distributions from corrupted data. InNeurIPS, 2024

    2024

  3. [11]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. InNeurIPS, 2021

    2021

  4. [12]

    Explaining and harnessing adversarial examples

    Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. InICLR, 2015

    2015

  5. [13]

    Generative adversarial networks.Communications of the ACM, 63(11): 139–144, 2020

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks.Communications of the ACM, 63(11): 139–144, 2020

    2020

  6. [14]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. InNeurIPS, 2017

    2017

  7. [15]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. InNeurIPS, 2020

    2020

  8. [16]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. InNeurIPS, 2019

    2019

  9. [17]

    Measuring forgetting of memorized training examples

    Matthew Jagielski, Om Thakkar, Florian Tramer, Daphne Ippolito, Katherine Lee, Nicholas Carlini, Eric Wallace, Shuang Song, Abhradeep Guha Thakurta, Nicolas Papernot, et al. Measuring forgetting of memorized training examples. InICLR, 2023

    2023

  10. [18]

    Elucidating the design space of diffusion-based generative models

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. InNeurIPS, 2022

    2022

  11. [19]

    Analyzing and improving the training dynamics of diffusion models

    Tero Karras, Miika Aittala, Jaakko Lehtinen, Janne Hellsten, Timo Aila, and Samuli Laine. Analyzing and improving the training dynamics of diffusion models. InCVPR, 2024

    2024

  12. [20]

    Gsure-based diffusion model training with corrupted data.TMLR, 2024

    Bahjat Kawar, Noam Elata, Tomer Michaeli, and Michael Elad. Gsure-based diffusion model training with corrupted data.TMLR, 2024

    2024

  13. [21]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, CIFAR, 2009. 37

    2009

  14. [22]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. InICLR, 2017

    2017

  15. [23]

    ADBM: Adversarial diffusion bridge model for reliable adversarial purification

    Xiao Li, Wenxuan Sun, Huanran Chen, Qiongxiu Li, Yingzhe He, Jie Shi, and Xiaolin Hu. ADBM: Adversarial diffusion bridge model for reliable adversarial purification. InICLR, 2025

    2025

  16. [24]

    Celeb-df: A new dataset for deepfake forensics.arXiv preprint arXiv:1909.12962, 2019

    Yuezun Li, Xin Yang, Pu Sun, Honggang Qi, and Siwei Lyu. Celeb-df: A new dataset for deepfake forensics.arXiv preprint arXiv:1909.12962, 2019

    1909 arXiv

  17. [25]

    Mist: Towards improved adversarial examples for diffusion models

    Chumeng Liang and Xiaoyu Wu. Mist: Towards improved adversarial examples for diffusion models. arXiv preprint arXiv:2305.12683, 2023

    2023 arXiv

  18. [26]

    Adversarial example does good: preventing painting imitation from diffusion models via adversarial examples

    Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: preventing painting imitation from diffusion models via adversarial examples. InProceedings of the 40th International Conference on Ma...

    2023

  19. [27]

    Adversarial training on purification (ATop): Advancing both robustness and generalization

    Guang Lin, Chao Li, Jianhai Zhang, Toshihisa Tanaka, and Qibin Zhao. Adversarial training on purification (ATop): Advancing both robustness and generalization. InThe Twelfth International Conference on Learning Representations, 2024

    2024

  20. [28]

    Towards understanding the robustness of diffusion-based purification: A stochastic perspective

    Yiming Liu, Kezhao Liu, Yao Xiao, ZiYi Dong, Xiaogang Xu, Pengxu Wei, and Liang Lin. Towards understanding the robustness of diffusion-based purification: A stochastic perspective. InICLR, 2025

    2025

  21. [29]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In ICCV, 2015

    2015

  22. [30]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InICLR, 2018

    2018

  23. [31]

    Unsupervised learning with stein’s unbiased risk estimator.arXiv preprint arXiv:1805.10531, 202

    Christopher A Metzler, Ali Mousavi, Reinhard Heckel, and Richard G Baraniuk. Unsupervised learning with stein’s unbiased risk estimator.arXiv preprint arXiv:1805.10531, 202

    arXiv

  24. [32]

    Explicit tradeoffs between adversarial and natural distributional robustness

    Mazda Moayeri, Kiarash Banihashem, and Soheil Feizi. Explicit tradeoffs between adversarial and natural distributional robustness. InNeurIPS, 2022

    2022

  25. [33]

    A comprehensive study of image classifica- tion model sensitivity to foregrounds, backgrounds, and visual attributes

    Mazda Moayeri, Phillip Pope, Yogesh Balaji, and Soheil Feizi. A comprehensive study of image classifica- tion model sensitivity to foregrounds, backgrounds, and visual attributes. InCVPR, 2022

    2022

  26. [34]

    Shedding more light on robust classifiers under the lens of energy-based models

    Mirza Mujtaba Hussain, Briglia Maria Rosaria, Beadini Senad, and Masi Iacopo. Shedding more light on robust classifiers under the lens of energy-based models. InECCV, 2024

    2024

  27. [35]

    Spurious features everywhere-large-scale detection of harmful spurious features in imagenet

    Yannic Neuhaus, Maximilian Augustin, Valentyn Boreiko, and Matthias Hein. Spurious features everywhere-large-scale detection of harmful spurious features in imagenet. InICCV, 2023

    2023

  28. [36]

    Adversarial Attacks, Regression, and Numerical Stability Regular- ization

    Andre T Nguyen and Edward Raff. Adversarial Attacks, Regression, and Numerical Stability Regular- ization. InThe AAAI-19 Workshop on Engineering Dependable and Secure Machine Learning Systems, 2019

    2019

  29. [37]

    Improved denoising diffusion probabilistic models

    Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In ICML, 2021

    2021

  30. [38]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. InICML, 2022

    2022

  31. [39]

    Dinov2: Learning robust visual features without supervision.TMLR, 2023

    Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy V V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel HAZIZA, Francisco Massa, Alaaeldin El-Nouby, et al. Dinov2: Learning robust visual features without supervision.TMLR, 2023

    2023

  32. [40]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In ICLR, 2024

    2024

  33. [41]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. InCVPR, 2022

    2022

  34. [42]

    Improved techniques for training gans

    Tim Salimans, Ian Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, Xi Chen, and Xi Chen. Improved techniques for training gans. InNeurIPS, 2016. 38

    2016

  35. [43]

    Do adversarially robust imagenet models transfer better? InNeurIPS, 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? InNeurIPS, 2020

    2020

  36. [44]

    Denoised smoothing: A provable defense for pretrained classifiers.NeurIPS, 2020

    Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers.NeurIPS, 2020

    2020

  37. [45]

    Adversarial diffusion distillation

    Axel Sauer, Dominik Lorenz, Andreas Blattmann, and Robin Rombach. Adversarial diffusion distillation. InECCV, 2024

    2024

  38. [46]

    Adversarial training for free! InNeurIPS, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! InNeurIPS, 2019

    2019

  39. [47]

    Salient imagenet: How to discover spurious features in deep learning? In ICLR, 2022

    Sahil Singla and Soheil Feizi. Salient imagenet: How to discover spurious features in deep learning? In ICLR, 2022

    2022

  40. [48]

    Diffusion art or digital forgery? investigating data replication in diffusion models

    Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Diffusion art or digital forgery? investigating data replication in diffusion models. InCVPR, 2023

    2023

  41. [49]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. InICLR, 2021

    2021

  42. [50]

    Mimicdiffusion: Purifying adversarial perturbation via mimicking clean diffusion model

    Kaiyu Song, Hanjiang Lai, Yan Pan, and Jian Yin. Mimicdiffusion: Purifying adversarial perturbation via mimicking clean diffusion model. InCVPR, 2024

    2024

  43. [51]

    Generative modeling by estimating gradients of the data distribution

    Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In NeurIPS, 2019

    2019

  44. [52]

    Pixeldefend: Leveraging generative models to understand and defend against adversarial examples

    Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. InICLR, 2018

    2018

  45. [53]

    Score-based generative modeling through stochastic differential equations

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. InICLR, 2021

    2021

  46. [54]

    Consistency models

    Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. InICML, 2023

    2023

  47. [55]

    Venkatesh Babu

    Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, and R. Venkatesh Babu. Guided adversarial attack for evaluating and enhancing adversarial defenses. InNeurIPS, 2020

    2020

  48. [56]

    Towards efficient and effective adversarial training.NeurIPS, 2021

    Gaurang Sriramanan, Sravanti Addepalli, Arya Baburaj, et al. Towards efficient and effective adversarial training.NeurIPS, 2021

    2021

  49. [57]

    Unsure: Unknown noise level stein’s unbiased risk estimator.arXiv preprint arXiv:2409.01985, 2024

    Julián Tachella, Mike Davies, and Laurent Jacques. Unsure: Unknown noise level stein’s unbiased risk estimator.arXiv preprint arXiv:2409.01985, 2024

    2024 arXiv

  50. [58]

    A comprehensive survey on poisoning attacks and counter- measures in machine learning.ACM Computing Surveys, 55(8):1–35, 2022

    Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu. A comprehensive survey on poisoning attacks and counter- measures in machine learning.ACM Computing Surveys, 55(8):1–35, 2022

    2022

  51. [59]

    Improving out-of-distribution generalization by adversarial training with structured priors.NeurIPS, 2022

    Qixun Wang, Yifei Wang, Hong Zhu, and Yisen Wang. Improving out-of-distribution generalization by adversarial training with structured priors.NeurIPS, 2022

    2022

  52. [60]

    Improving adversarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversarial robustness requires revisiting misclassified examples. InICLR, 2020

    2020

  53. [61]

    Better diffusion models further improve adversarial training

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. InICML, 2023

    2023

  54. [62]

    Fast is better than free: Revisiting adversarial training

    Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. InICLR, 2020

    2020

  55. [63]

    Ddm ˆ2: Self- supervised diffusion mri denoising with generative diffusion models.arXiv preprint arXiv:2302.03018, 2023

    Tiange Xiang, Mahmut Yurt, Ali B Syed, Kawin Setsompop, and Akshay Chaudhari. Ddm ˆ2: Self- supervised diffusion mri denoising with generative diffusion models.arXiv preprint arXiv:2302.03018, 2023

    2023 arXiv

  56. [64]

    Structure-guided adversarial training of diffusion models

    Ling Yang, Haotian Qian, Zhilong Zhang, Jingwei Liu, and Bin Cui. Structure-guided adversarial training of diffusion models. InCVPR, 2024

    2024

  57. [65]

    Spurious correlations in machine learning: A survey.arXiv preprint arXiv:2402.12715, 2024

    Wenqian Ye, Guangtao Zheng, Xu Cao, Yunsheng Ma, Xia Hu, and Aidong Zhang. Spurious correlations in machine learning: A survey.arXiv preprint arXiv:2402.12715, 2024

    2024

  58. [66]

    Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop.arXiv preprint arXiv:1506.03365, 2015

    Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao. Lsun: Construction of a large-scale image dataset using deep learning with humans in the loop.arXiv preprint arXiv:1506.03365, 2015. 39

    2015 arXiv

  59. [67]

    A causal view on robustness of neural networks

    Cheng Zhang, Kun Zhang, and Yingzhen Li. A causal view on robustness of neural networks. InNeurIPS, 2020

    2020

  60. [68]

    Xing, Laurent El Ghaoui, and Michael I

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. InICML, 2019

    2019

  61. [69]

    Adversarial robustness through the lens of causality

    Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Adversarial robustness through the lens of causality. InICLR, 2022

    2022

  62. [70]

    Rethinking generative mode coverage: A pointwise guaranteed approach

    Peilin Zhong, Yuchen Mo, Chang Xiao, Pengyu Chen, and Changxi Zheng. Rethinking generative mode coverage: A pointwise guaranteed approach. InNeurIPS, 2019

    2019

  63. [71]

    Towards understanding the generative capability of adversarially robust classifiers

    Yao Zhu, Jiacheng Ma, Jiacheng Sun, Zewei Chen, Rongxin Jiang, Yaowu Chen, and Zhenguo Li. Towards understanding the generative capability of adversarially robust classifiers. InICCV, 2021. 40

    2021

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.