Robustifying Diffusion-Denoised Smoothing Against Covariate Shift

Abdol-Hossein Vahabie; Ali Hedayatnia; Babak Nadjar Araabi; Mostafa Tavassolipour

REVIEW 3 major objections 4 minor 44 references

Robustifying Diffusion-Denoised Smoothing Against Covariate Shift

T0 review · 3 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper shows that adversarially fine-tuning the base classifier on the denoiser's added-noise perturbations improves certified l2 robustness of diffusion-denoised smoothing on MNIST, CIFAR-10, and ImageNet.

desk verdict A simple, honest extension of diffusion-denoised smoothing that buys real gains at large radii, but the SOTA claim outruns the evidence. read the letter →

arxiv 2509.10913 v1 pith:RYMYQKCX submitted 2025-09-13 cs.LG cs.CV

Ali Hedayatnia , Mostafa Tavassolipour , Babak Nadjar Araabi , Abdol-Hossein Vahabie This is my paper

classification cs.LGcs.CV

keywords certifiedrobustnessrandomizedsmoothingdiffusiondenoiseddenoisingmodelscovariateshiftadversarialtrainingl2averageradius

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the main bottleneck in diffusion-denoised smoothing is not the denoiser itself but a covariate shift it induces: the single-shot denoiser's error in estimating the added Gaussian noise moves denoised inputs away from the clean-data distribution, so a pretrained base classifier sees out-of-distribution inputs. It proposes an adversarial training objective in which the added noise, not the image, is the adversary: starting from standard Gaussian noise, projected gradient ascent on the classification loss finds noise configurations that create extreme covariate shifts, and the base classifier is fine-tuned on the resulting denoised examples. This is shown to improve certified accuracy and average certified radius on MNIST, CIFAR-10, and ImageNet, with the paper claiming state-of-the-art l2 certified robustness. A sympathetic reader would care because the fix is a cheap fine-tune of the base classifier, leaving the expensive pretrained diffusion model untouched.

What carries the argument

The load-bearing mechanism is the single-shot denoiser identity x0|t = x + sqrt(1-alpha_t)/sqrt(alpha_t)(epsilon - eps_theta(xt,t)), which converts noise-estimation error into an input-space covariate shift, together with the adversarial objective in Eq. (19) and Algorithm 1, which run PGD on epsilon to create hard covariate-shift examples for fine-tuning the base classifier. The single-shot denoiser is a one-step estimate of the clean image from a noisy image using a pretrained diffusion model's predicted noise. The identity explains where the shift comes from; the PGD procedure is what makes the classifier robust to its extreme cases.

What would settle it

Train Algorithm 1 with M=10 and r_adv unbounded, then evaluate certified accuracy on MNIST at radius 0.25 and radius 1.25. The paper's Table B.4 already shows the large-M model loses small-radius accuracy; if a matched test that draws evaluation noise from the M=10 PGD distribution restores the small-radius accuracy, the transfer assumption is confirmed. If it does not, the method's gains at large radii come at a real cost that the certification procedure hides.

Watch

Extended reading notes

Core claim

The core claim is that the noisy-then-denoised input satisfies x0|t = x + sqrt(1-alpha_t)/sqrt(alpha_t) (epsilon - eps_theta(xt,t)), so any mismatch between the true added noise and the diffusion model's estimate appears as a scaled additive shift of the clean input. As sigma grows, this mismatch is large enough to move the classifier input outside its training manifold, which the paper calls covariate shift. The proposed remedy is to fine-tune the base classifier on examples generated by solving an inner maximization over epsilon: epsilon is initialized as N(0,I) and updated by PGD to maximize cross-entropy loss, then clamped to stay within radius r_adv of the initial sample. The paper repo

Load-bearing premise

The load-bearing assumption is that robustness learned on PGD-perturbed noise vectors transfers back to the standard Gaussian noise used at certification time; if the training noise distribution and the evaluation N(0,I) distribution drift apart, the certified-accuracy gains could be an artifact of distribution mismatch.

Editorial extensions

If this is right

Fine-tuning only the base classifier on adversarially chosen noise perturbations can recover and surpass the certified accuracy of diffusion-denoised smoothing with a pretrained classifier.
The gains grow with sigma: larger smoothing noise produces larger noise misestimation, so the adversarial fine-tune matters most in the high-sigma regime.
Average certified radius improves on MNIST, CIFAR-10, and ImageNet, with the paper reporting the best numbers among the methods it compares.
More PGD steps M helps large-radius certified accuracy but can reduce small-radius accuracy, so M acts as a trade-off knob rather than a free lunch.
The method is compatible with existing certification pipelines, so the robustness certification itself is unchanged; only the base classifier weights change.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural testable extension is to swap the diffusion denoiser for another MSE-trained denoiser and re-run Algorithm 1: if the adversarial-noise objective transfers, it should improve certified accuracy for any denoiser with non-negligible noise-estimation error.
The paper's own hyperparameter analysis suggests the PGD-perturbed training noise is not a perfect proxy for test-time N(0,I) noise, since unbounded r_adv and larger M push training noise far outside the evaluation distribution; a curriculum over M or r_adv could tune the transfer trade-off instead of fixing M=1.
The Jensen-inequality argument in Section 3.4 shows random covariate-shift augmentation minimizes an upper bound on the smoothed-classifier loss; adversarial noise selection is a harder version of the same bound, so measuring the gap between the two sides of that inequality could predict when adversarial selection helps most.
The method could be combined with denoiser-side stability training rather than treated as an alternative; since the paper only fine-tunes the classifier, the two interventions target different parts of the same shift and may be additive.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper does one simple thing: instead of fine-tuning the base classifier on randomly sampled diffusion noise (Carlini et al.), it runs PGD on the noise to maximize the classifier's loss on the denoised image, then fine-tunes on those hard examples. That is a legitimate extension, and the code is public. The empirical gains at large radii are consistent across all three benchmarks—on ImageNet, for instance, certified accuracy at radius 2.5 goes from 32% to 38% (sigma=1.0). Section 4.5 is candid about the trade-off between M and radii. The Jensen argument in Section 3.4 correctly shows that random-noise augmentation is an upper bound on the smoothed classifier's loss, though the adversarial objective itself is a heuristic, not a bound.

The soft spots are in the evaluation, not the idea. The DDS Finetuned baselines are taken from the original paper rather than re-run under the same training schedule, so part of the reported gain could be just extra fine-tuning compute. There are no error bars or multiple seeds, and the test sets are small—500 samples for MNIST/CIFAR-10, 100 for ImageNet. The headline ACR for MNIST (2.886 at sigma=1.0) comes from M=4, while the M=1 configuration is not uniformly better: at sigma=0.5, M=1 actually has a lower ACR than DDS Finetuned (1.546 vs 1.547). Similarly, the 'new SOTA' claim in the abstract is not true at small radii where denoiserless methods like SmoothMix and Consistency still win. The choice of M and r_adv is clearly made using the test-set curves in Tables B.4–B.6; there is no pre-registered protocol.

The stress-test's worry about transfer is fair but not fatal. Section 4.5 shows that training on extreme PGD-shifted noise transfers only partially: larger M helps large radii and hurts small ones, and r_adv=+inf sends training noise far from N(0,I). That trade-off is exactly what you would expect from an adversarial training heuristic, and the paper does not pretend otherwise. What it does not do is show that the improvement is robust to the choice of M or that the selected configuration is justified beyond 'it worked best on the test set.'

Worth a serious referee? Yes. The method is simple, reproducible, and gives a real boost at large radii where diffusion-denoised smoothing is strongest. A revision that re-runs the Carlini baseline under the same budget, reports confidence intervals, and commits to hyperparameters before seeing test curves would make the case solid. As is, it is a useful incremental contribution to cite, but 'state-of-the-art' needs a qualifier.

Referee Report

3 major / 4 minor

Summary. The paper targets diffusion-denoised smoothing (DDS), where a pretrained denoiser (DDPM) is used before a base classifier in randomized smoothing. It argues that single-shot diffusion denoising introduces a covariate shift caused by misestimation of the added noise, and proposes to fine-tune the base classifier on adversarially chosen noise perturbations (Eq. 19, Algorithm 1) so that the classifier becomes robust to such shifts. The method is evaluated on MNIST, CIFAR-10, and ImageNet, reporting improved certified accuracy and average certified radius (ACR) over DDS and claiming state-of-the-art performance. A Jensen-inequality argument is given to justify random covariate-shift augmentation, and the adversarial objective is presented as an extension targeting extreme shifts.

Significance. If the claims hold, the method is attractive: it is a simple, code-released fine-tuning procedure that can be applied to any existing DDS pipeline, requires no modification of the diffusion denoiser, and improves certified accuracy at larger radii. The paper also provides a useful empirical analysis of the distance between clean and denoised inputs. However, the central 'state-of-the-art' claim is not currently supported by the evidence as presented: the comparison with the DDS (Finetuned) baseline relies on numbers from the original paper rather than a controlled re-run; the headline MNIST results use different hyperparameters (M values) selected with test-set information; and the transfer from PGD-shifted training noise to the N(0,I) test-time noise is only partially demonstrated and, by the paper's own Section 4.5, is incomplete. The underlying idea is plausible and the experiments suggest a real effect, but the load-bearing claims need stronger validation.

major comments (3)

[§4.2 and Table B.4] The headline MNIST claim at radii >= 1.0 is not obtained with the default configuration. Table 1 reports several 'Ours' rows, and the largest gains at r=1.25 (92.0%) come from M=2, while M=1 gives 90.4%. Section 4.5 states that 'larger M reduces certified accuracy at small radii but improves it at larger radii,' and Table B.4 confirms this non-monotonic trade-off. The text does not fix a single configuration, and the hyperparameters (M, r_adv) appear to be selected based on test-set ACR. This makes the claimed improvement potentially an artifact of test-set selection. Please report results for a pre-specified configuration, use a validation split for hyperparameter selection, and provide multiple seeds with error bars.
[§3.2, §3.4, §4.5] The method's core assumption is that fine-tuning on PGD-perturbed noise vectors transfers to the standard normal smoothing noise used at certification time. No theoretical argument is given: Eq. (19) maximizes the base classifier's loss on a single denoised input, not the smoothed classifier's top-class probability, which is what determines the certified radius. The Jensen argument in §3.4 only justifies random covariate-shift augmentation, not the adversarial objective. Section 4.5 itself shows the transfer is partial: increasing M improves large-radius certified accuracy but degrades small-radius accuracy, and r_adv=+inf pushes training noise far outside the test-time distribution. Please provide a controlled comparison with the same training budget using random noise (Eq. 21) and analyze quantitatively how the distribution of training epsilon_M differs from N(0,I).
[§4, Tables 1-3] The baseline 'DDS (Finetuned)' numbers are taken from Carlini et al. (2022) without re-running under the same fine-tuning schedule, same diffusion model, and same certification seed/sample set. Since the claimed gains are modest (e.g., 92.0 vs 89.8 on MNIST at r=1.25), they could be within certification noise or due to additional training compute rather than the adversarial objective. Please re-run the DDS finetuned baseline in the same code environment, report multiple seeds, and state the certification set size and variance. Currently the 'state-of-the-art' claim is not supported by a like-for-like comparison.

minor comments (4)

[§2.1, Eq. (6)] The notation 't∈U(0,T)' should be a uniform distribution over time steps, not set membership; also the sum in the definition of alpha_t should use a product index.
[§3.2, Eq. (20)] The projection operator is described as a clamp, but the precise radius semantics for r_adv=+inf should be stated (no clamping). Also 'r_adv=+0.1' should be written as 'r_adv=0.1'.
[Appendix B, Figures B.8/B.9] The caption says 'varying the step size M=1', but the varying quantity is eta (step size), not M. Please clarify.
[References] The Carlini et al. reference appears as 'Tramer' instead of 'Tramèr' in the text; please ensure consistent spelling. Also the GitHub link in the abstract should be a full URL.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the covariate-shift decomposition is definitional, and the adversarial training objective is validated by independent certification benchmarks.

full rationale

The paper's derivation chain is self-contained. Eq. (17) is obtained by substituting the forward corruption equation xt = sqrt(alpha_bar_t)x + sqrt(1-alpha_bar_t)epsilon into the single-shot denoiser expression; the residual epsilon - epsilon_theta is defined, not assumed, as the covariate-shift term. Eq. (19) and Algorithm 1 propose an adversarial fine-tuning objective; this is an empirical heuristic whose success is checked by an independent certification procedure (CERTIFY with fixed sampling parameters) against external baselines on MNIST, CIFAR-10, and ImageNet. The Jensen-inequality argument in Eq. (22) is a standard upper bound: -log E[f] <= E[-log f], used only to justify the random-noise augmentation baseline (Carlini et al.), not to derive the paper's own adversarial objective. There are no load-bearing self-citations; all cited results (Cohen et al., Salman et al., Carlini et al.) are external prior work with public implementations. The hyperparameter analysis in Sec. 4.5 reveals that increasing M improves large-radius accuracy but hurts small-radius accuracy, and that r_adv = +infinity is selected empirically from MNIST test-set observations; this is a generalization/selection concern, not circularity, because the reported certified accuracies are not equal by construction to the training objective. The central claim, that adversarial noise selection improves certified accuracy, is an empirical result rather than a tautology.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method does not introduce new entities. Its theoretical payload is a decomposition (Eq. 17) and a Jensen upper bound (Eq. 22); neither is a derivation of the method. The free hyperparameters (eta, M, r_adv) were selected on the MNIST test set and then applied to other datasets.

free parameters (3)

eta (PGD step size) = 0.1 for MNIST/CIFAR-10, 0.05 for ImageNet
Chosen empirically; the paper says 'Empirically, we find that setting eta=0.1 yields favorable results' (Sec 4.5). Affects the magnitude of induced covariate shift.
M (number of PGD steps) = 1 for all datasets; M=2,4 explored on MNIST
Set to 1 to reduce training time; larger M improves large-radius accuracy but hurts small-radius accuracy (Sec 4.5, Table B.4). Headline MNIST ACR 2.886 uses M=4, so the claim depends on which M is selected.
r_adv (perturbation radius for epsilon) = +infinity (unbounded) for default; +0.1 explored
Chosen based on MNIST observations: 'optimization performs best when the radius is unrestricted' (Sec 4.5). An unbounded radius can produce noise vectors far from the test-time N(0,I) distribution.

assumptions (4)

standard math Cohen et al. randomized smoothing theorem: the smoothed classifier has a certified l2 radius determined by the top-1 and top-2 class probabilities.
Invoked in Theorem 1, Section 2.2. The certification holds for any base classifier, so training the base classifier does not break the guarantee.
domain assumption The single-shot denoiser x0|t* = (xt* - sqrt(1-alpha_bar) eps_theta(xt*,t*))/sqrt(alpha_bar) is an accurate enough approximation of the true posterior mean E[x0|xt*] that the smoothed classifier's vote distribution is well approximated.
Used throughout (Eq. 14). The method's effectiveness assumes this denoiser is fixed and meaningful, even though its output deviates from clean data.
ad hoc to paper Minimizing the min-max objective (19) via PGD on epsilon transfers to improved certified accuracy under the test-time standard-normal noise distribution.
This is the core premise of the method (Sec 3.2). It is not proven; the paper provides an upper-bound argument for the random-augmentation version and argues by analogy for extreme shifts.
domain assumption The base classifier's gradients with respect to epsilon, computed through the frozen denoiser, are a useful ascent direction for finding covariate-shift examples.
Algorithm 1 backpropagates loss through eps_theta to update epsilon. If the denoiser is non-differentiable or gradients are uninformative, the selected noise vectors would not maximize the loss. The paper does not discuss this.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Robustifying Diffusion-Denoised Smoothing Against Covariate Shift." pith.science (2026). https://pith.science/paper/RYMYQKCX

@misc{pith2026250910913,
  author       = {Pith},
  title        = {Pith review of: Robustifying Diffusion-Denoised Smoothing Against Covariate Shift},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RYMYQKCX}},
  note         = {Machine review of arXiv:2509.10913}
}

read the original abstract

Randomized smoothing is a well-established method for achieving certified robustness against l2-adversarial perturbations. By incorporating a denoiser before the base classifier, pretrained classifiers can be seamlessly integrated into randomized smoothing without significant performance degradation. Among existing methods, Diffusion Denoised Smoothing - where a pretrained denoising diffusion model serves as the denoiser - has produced state-of-the-art results. However, we show that employing a denoising diffusion model introduces a covariate shift via misestimation of the added noise, ultimately degrading the smoothed classifier's performance. To address this issue, we propose a novel adversarial objective function focused on the added noise of the denoising diffusion model. This approach is inspired by our understanding of the origin of the covariate shift. Our goal is to train the base classifier to ensure it is robust against the covariate shift introduced by the denoiser. Our method significantly improves certified accuracy across three standard classification benchmarks - MNIST, CIFAR-10, and ImageNet - achieving new state-of-the-art performance in l2-adversarial perturbations. Our implementation is publicly available at https://github.com/ahedayat/Robustifying-DDS-Against-Covariate-Shift

Figures

Figures reproduced from arXiv: 2509.10913 by the authors.

**Figure 2.** Mean (a) l2 and (b) LPIPS distances between clean samples (x0) and noisy-thendenoised samples (x0|t∗ ) at varying noise standard deviations. A total of 3,000 samples were randomly selected from the CIFAR-10 dataset. For each sample, the noisy-then-denoised counterpart was computed using the time formulation described in Equation (13). smoothed classifier performance. To address this challenge, we introduce a novel … view at source ↗

**Figure 3.** Certified accuracy as a function of the l2 adversarial perturbation bound for (a) σ = 0.25, (b) σ = 0.50, and (c) σ = 1.00 on the MNIST dataset. Thus, employing denoised smoothing-based methods becomes more effective at larger radii. However, at larger radii, noise misestimation by the diffusion model can introduce significant covariate shift, leading to a decline in the smoothed classifier’s performance. To addres… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Certified accuracy as a function of the l2 adversarial perturbation bound for (a) σ = 0.25, (b) σ = 0.50, and (c) σ = 1.00 on the CIFAR-10 dataset. of any pretrained classifier, its performance at radii less than 1.00 is inferior compared to other methods. its certifie…

**Figure 5.** Figure 5: Certified accuracy as a function of the l2 adversarial perturbation bound for (a) σ = 0.50, and (b) σ = 1.00 on the ImageNet dataset. erage Certified Radius (ACR) of diffusion denoised smoothing for σ = 0.25, σ = 0.50, and σ = 1.00 [PITH_FULL_IMAGE:figures/full_fig_p0…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 17 linked inside Pith

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in ":" * " " * FUNCTION f...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize "" * " " * ...
[3]

, author Corona, I

author Biggio, B. , author Corona, I. , author Maiorca, D. , author Nelson, B. , author S rndi \'c , N. , author Laskov, P. , author Giacinto, G. , & author Roli, F. ( year 2013 ). title Evasion attacks against machine learning at test time . In booktitle Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, C...

2013
[4]

, author Tramer, F

author Carlini, N. , author Tramer, F. , author Dvijotham, K. D. , author Rice, L. , author Sun, M. , & author Kolter, J. Z. ( year 2022 ). title (certified!!) adversarial robustness for free! journal arXiv preprint arXiv:2206.10550 \/ ,

arXiv 2022
[5]

, author Wang, X

author Chen, X. , author Wang, X. , author Changpinyo, S. , author Piergiovanni, A. , author Padlewski, P. , author Salz, D. , author Goodman, S. , author Grycner, A. , author Mustafa, B. , author Beyer, L. et al. ( year 2022 ). title Pali: A jointly-scaled multilingual language-image model . journal arXiv preprint arXiv:2209.06794 \/ ,

arXiv 2022
[6]

, author Rosenfeld, E

author Cohen, J. , author Rosenfeld, E. , & author Kolter, Z. ( year 2019 ). title Certified adversarial robustness via randomized smoothing . In booktitle international conference on machine learning \/ (pp. pages 1310--1320 ). organization PMLR

2019
[7]

, & author Nichol, A

author Dhariwal, P. , & author Nichol, A. ( year 2021 ). title Diffusion models beat gans on image synthesis . journal Advances in neural information processing systems \/ , volume 34 \/ , pages 8780--8794

2021
[8]

author Ding, G. W. , author Sharma, Y. , author Lui, K. Y. C. , & author Huang, R. ( year 2018 ). title Mma training: Direct input space margin maximization through adversarial training . journal arXiv preprint arXiv:1812.02637 \/ ,

arXiv 2018

Show all 44 references

[9]

author Goodfellow, I. J. , author Shlens, J. , & author Szegedy, C. ( year 2014 ). title Explaining and harnessing adversarial examples . journal arXiv preprint arXiv:1412.6572 \/ ,

2014 arXiv
[10]

, author Jain, A

author Ho, J. , author Jain, A. , & author Abbeel, P. ( year 2020 ). title Denoising diffusion probabilistic models . journal Advances in neural information processing systems \/ , volume 33 \/ , pages 6840--6851

2020
[11]

, author Xu, B

author Huang, R. , author Xu, B. , author Schuurmans, D. , & author Szepesv \'a ri, C. ( year 2015 ). title Learning with a strong adversary . journal arXiv preprint arXiv:1511.03034 \/ ,

2015 arXiv
[12]

, author Park, S

author Jeong, J. , author Park, S. , author Kim, M. , author Lee, H.-C. , author Kim, D.-G. , & author Shin, J. ( year 2021 ). title Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness . journal Advances in Neural Information Processing Syst...

2021
[13]

, & author Shin, J

author Jeong, J. , & author Shin, J. ( year 2020 ). title Consistency regularization for certified robustness of smoothed classifiers . journal Advances in Neural Information Processing Systems \/ , volume 33 \/ , pages 10558--10570

2020
[14]

, author Kang, D

author Kaufmann, M. , author Kang, D. , author Sun, Y. , author Basart, S. , author Yin, X. , author Mazeika, M. , author Arora, A. , author Dziedzic, A. , author Boenisch, F. , author Brown, T. et al. ( year 2019 ). title Testing robustness against unforeseen adversaries . jo...

2019 arXiv
[15]

, author Bottou, L

author LeCun, Y. , author Bottou, L. , author Bengio, Y. , & author Haffner, P. ( year 1998 ). title Gradient-based learning applied to document recognition . journal Proceedings of the IEEE \/ , volume 86 \/ , pages 2278--2324

1998
[16]

, author Makelov, A

author Madry, A. , author Makelov, A. , author Schmidt, L. , author Tsipras, D. , & author Vladu, A. ( year 2017 ). title Towards deep learning models resistant to adversarial attacks . journal stat \/ , volume 1050 \/

2017
[17]

, author Gehr, T

author Mirman, M. , author Gehr, T. , & author Vechev, M. ( year 2018 ). title Differentiable abstract interpretation for provably robust neural networks . In booktitle International Conference on Machine Learning \/ (pp. pages 3578--3586 ). organization PMLR

2018
[18]

author Nichol, A. Q. , & author Dhariwal, P. ( year 2021 ). title Improved denoising diffusion probabilistic models . In booktitle International conference on machine learning \/ (pp. pages 8162--8171 ). organization PMLR

2021
[19]

, author Kuzucu, S

author Oksuz, K. , author Kuzucu, S. , author Joy, T. , & author Dokania, P. K. ( year 2023 ). title Mocae: Mixture of calibrated experts significantly improves object detection . journal arXiv preprint arXiv:2309.14976 \/ ,

2023 arXiv
[20]

, author Dong, L

author Peng, Z. , author Dong, L. , author Bao, H. , author Ye, Q. , & author Wei, F. ( year 2022 ). title Beit v2: Masked image modeling with vector-quantized visual tokenizers . journal arXiv preprint arXiv:2208.06366 \/ ,

2022 arXiv
[21]

, author Wong, E

author Rice, L. , author Wong, E. , & author Kolter, Z. ( year 2020 ). title Overfitting in adversarially robust deep learning . In booktitle International conference on machine learning \/ (pp. pages 8093--8104 ). organization PMLR

2020
[22]

, author Li, J

author Salman, H. , author Li, J. , author Razenshteyn, I. , author Zhang, P. , author Zhang, H. , author Bubeck, S. , & author Yang, G. ( year 2019 ). title Provably robust deep learning via adversarially trained smoothed classifiers . journal Advances in neural information p...

2019
[23]

, author Sun, M

author Salman, H. , author Sun, M. , author Yang, G. , author Kapoor, A. , & author Kolter, J. Z. ( year 2020 ). title Denoised smoothing: A provable defense for pretrained classifiers . journal Advances in Neural Information Processing Systems \/ , volume 33 \/ , pages 21945--21957

2020
[24]

, author Santurkar, S

author Schmidt, L. , author Santurkar, S. , author Tsipras, D. , author Talwar, K. , & author Madry, A. ( year 2018 ). title Adversarially robust generalization requires more data . journal Advances in neural information processing systems \/ , volume 31 \/

2018
[25]

, author Namkoong, H

author Sinha, A. , author Namkoong, H. , author Volpi, R. , & author Duchi, J. ( year 2017 ). title Certifying some distributional robustness with principled adversarial training . journal arXiv preprint arXiv:1710.10571 \/ ,

2017 arXiv
[26]

, author Meng, C

author Song, J. , author Meng, C. , & author Ermon, S. ( year 2020 a ). title Denoising diffusion implicit models . journal arXiv preprint arXiv:2010.02502 \/ ,

2020 arXiv
[27]

, author Dhariwal, P

author Song, Y. , author Dhariwal, P. , author Chen, M. , & author Sutskever, I. ( year 2023 ). title Consistency models . journal arXiv preprint arXiv:2303.01469 \/ ,

2023 arXiv
[28]

, author Sohl-Dickstein, J

author Song, Y. , author Sohl-Dickstein, J. , author Kingma, D. P. , author Kumar, A. , author Ermon, S. , & author Poole, B. ( year 2020 b ). title Score-based generative modeling through stochastic differential equations . journal arXiv preprint arXiv:2011.13456 \/ ,

2020 arXiv
[29]

, author Zhu, X

author Su, W. , author Zhu, X. , author Tao, C. , author Lu, L. , author Li, B. , author Huang, G. , author Qiao, Y. , author Wang, X. , author Zhou, J. , & author Dai, J. ( year 2023 ). title Towards all-in-one pre-training via maximizing multi-modal mutual information . In b...

2023
[30]

( year 2013 )

author Szegedy, C. ( year 2013 ). title Intriguing properties of neural networks . journal arXiv preprint arXiv:1312.6199 \/ ,

2013 arXiv
[31]

, & author Boneh, D

author Tramer, F. , & author Boneh, D. ( year 2019 ). title Adversarial training and robustness for multiple perturbations . journal Advances in neural information processing systems \/ , volume 32 \/

2019
[32]

, author Wang, S

author Wang, P. , author Wang, S. , author Lin, J. , author Bai, S. , author Zhou, X. , author Zhou, J. , author Wang, X. , & author Zhou, C. ( year 2023 a ). title One-peace: Exploring one general representation model toward unlimited modalities . journal arXiv preprint arXiv...

2023 arXiv
[33]

, author Bao, H

author Wang, W. , author Bao, H. , author Dong, L. , author Bjorck, J. , author Peng, Z. , author Liu, Q. , author Aggarwal, K. , author Mohammed, O. K. , author Singhal, S. , author Som, S. et al. ( year 2023 b ). title Image as a foreign language: Beit pretraining for vision...

2023
[34]

, author Dai, J

author Wang, W. , author Dai, J. , author Chen, Z. , author Huang, Z. , author Li, Z. , author Zhu, X. , author Hu, X. , author Lu, T. , author Lu, L. , author Li, H. et al. ( year 2023 c ). title Internimage: Exploring large-scale vision foundation models with deformable conv...

2023
[35]

, author Zhang, H

author Weng, L. , author Zhang, H. , author Chen, H. , author Song, Z. , author Hsieh, C.-J. , author Daniel, L. , author Boning, D. , & author Dhillon, I. ( year 2018 ). title Towards fast computation of certified robustness for relu networks . In booktitle International Conf...

2018
[36]

( year 2019 )

author Wightman, R. ( year 2019 ). title Pytorch image models . howpublished https://github.com/rwightman/pytorch-image-models . :10.5281/zenodo.4414861

2019 doi
[37]

, & author Kolter, Z

author Wong, E. , & author Kolter, Z. ( year 2018 ). title Provable defenses against adversarial examples via the convex outer adversarial polytope . In booktitle International conference on machine learning \/ (pp. pages 5286--5295 ). organization PMLR

2018
[38]

, author Ilharco, G

author Wortsman, M. , author Ilharco, G. , author Gadre, S. Y. , author Roelofs, R. , author Gontijo-Lopes, R. , author Morcos, A. S. , author Namkoong, H. , author Farhadi, A. , author Carmon, Y. , author Kornblith, S. et al. ( year 2022 ). title Model soups: averaging weight...

2022
[39]

, author Wang, Z

author Yu, J. , author Wang, Z. , author Vasudevan, V. , author Yeung, L. , author Seyedhosseini, M. , & author Wu, Y. ( year 2022 ). title Coca: Contrastive captioners are image-text foundation models . journal arXiv preprint arXiv:2205.01917 \/ ,

2022 arXiv
[40]

, author Dan, C

author Zhai, R. , author Dan, C. , author He, D. , author Zhang, H. , author Gong, B. , author Ravikumar, P. , author Hsieh, C.-J. , & author Wang, L. ( year 2020 ). title Macer: Attack-free and scalable robust training via maximizing certified radius . journal arXiv preprint ...

2020 arXiv
[41]

, author Chen, H

author Zhang, H. , author Chen, H. , author Xiao, C. , author Gowal, S. , author Stanforth, R. , author Li, B. , author Boning, D. , & author Hsieh, C.-J. ( year 2019 ). title Towards stable and efficient training of verifiably robust neural networks . journal arXiv preprint a...

2019 arXiv
[42]

, author Weng, T.-W

author Zhang, H. , author Weng, T.-W. , author Chen, P.-Y. , author Hsieh, C.-J. , & author Daniel, L. ( year 2018 a ). title Efficient neural network robustness certification with general activation functions . journal Advances in neural information processing systems \/ , vo...

2018
[43]

, author Isola, P

author Zhang, R. , author Isola, P. , author Efros, A. A. , author Shechtman, E. , & author Wang, O. ( year 2018 b ). title The unreasonable effectiveness of deep features as a perceptual metric . In booktitle Proceedings of the IEEE conference on computer vision and pattern r...

2018
[44]

, author Song, G

author Zong, Z. , author Song, G. , & author Liu, Y. ( year 2023 ). title Detrs with collaborative hybrid assignments training . In booktitle Proceedings of the IEEE/CVF international conference on computer vision \/ (pp. pages 6748--6758 )

2023

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in ":" * " " * FUNCTION f...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize "" * " " * ...

[3] [3]

, author Corona, I

author Biggio, B. , author Corona, I. , author Maiorca, D. , author Nelson, B. , author S rndi \'c , N. , author Laskov, P. , author Giacinto, G. , & author Roli, F. ( year 2013 ). title Evasion attacks against machine learning at test time . In booktitle Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, C...

2013

[4] [4]

, author Tramer, F

author Carlini, N. , author Tramer, F. , author Dvijotham, K. D. , author Rice, L. , author Sun, M. , & author Kolter, J. Z. ( year 2022 ). title (certified!!) adversarial robustness for free! journal arXiv preprint arXiv:2206.10550 \/ ,

arXiv 2022

[5] [5]

, author Wang, X

author Chen, X. , author Wang, X. , author Changpinyo, S. , author Piergiovanni, A. , author Padlewski, P. , author Salz, D. , author Goodman, S. , author Grycner, A. , author Mustafa, B. , author Beyer, L. et al. ( year 2022 ). title Pali: A jointly-scaled multilingual language-image model . journal arXiv preprint arXiv:2209.06794 \/ ,

arXiv 2022

[6] [6]

, author Rosenfeld, E

author Cohen, J. , author Rosenfeld, E. , & author Kolter, Z. ( year 2019 ). title Certified adversarial robustness via randomized smoothing . In booktitle international conference on machine learning \/ (pp. pages 1310--1320 ). organization PMLR

2019

[7] [7]

, & author Nichol, A

author Dhariwal, P. , & author Nichol, A. ( year 2021 ). title Diffusion models beat gans on image synthesis . journal Advances in neural information processing systems \/ , volume 34 \/ , pages 8780--8794

2021

[8] [8]

author Ding, G. W. , author Sharma, Y. , author Lui, K. Y. C. , & author Huang, R. ( year 2018 ). title Mma training: Direct input space margin maximization through adversarial training . journal arXiv preprint arXiv:1812.02637 \/ ,

arXiv 2018