Pith. sign in

REVIEW 7 cited by

Robust Classification via a Single Diffusion Model

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2305.15241 v2 pith:ZD7UYIUN submitted 2023-05-24 cs.CV cs.CRcs.LG

Robust Classification via a Single Diffusion Model

Huanran Chen , Yinpeng Dong , Zhengyi Wang , Xiao Yang , Chengqi Duan , Hang Su , Jun Zhu This is my paper
classification cs.CV cs.CRcs.LG
keywords diffusionadversarialmodelsrobusttrainingattacksclassifiersmodel
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved
0 comments
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Diffusion models have been applied to improve adversarial robustness of image classifiers by purifying the adversarial noises or generating realistic data for adversarial training. However, diffusion-based purification can be evaded by stronger adaptive attacks while adversarial training does not perform well under unseen threats, exhibiting inevitable limitations of these methods. To better harness the expressive power of diffusion models, this paper proposes Robust Diffusion Classifier (RDC), a generative classifier that is constructed from a pre-trained diffusion model to be adversarially robust. RDC first maximizes the data likelihood of a given input and then predicts the class probabilities of the optimized input using the conditional likelihood estimated by the diffusion model through Bayes' theorem. To further reduce the computational cost, we propose a new diffusion backbone called multi-head diffusion and develop efficient sampling strategies. As RDC does not require training on particular adversarial attacks, we demonstrate that it is more generalizable to defend against multiple unseen threats. In particular, RDC achieves $75.67\%$ robust accuracy against various $\ell_\infty$ norm-bounded adaptive attacks with $\epsilon_\infty=8/255$ on CIFAR-10, surpassing the previous state-of-the-art adversarial training models by $+4.77\%$. The results highlight the potential of generative classifiers by employing pre-trained diffusion models for adversarial robustness compared with the commonly studied discriminative classifiers. Code is available at \url{https://github.com/huanranchen/DiffusionClassifier}.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 7 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Revisiting Autoregressive Models for Generative Image Classification

    cs.CV 2026-03 accept novelty 6.5

    Order-marginalized any-order AR models (RandAR) outperform diffusion generative classifiers on ImageNet and OOD sets and match strong SSL models at far lower cost.

  2. Self-Improving Diffusion Classifiers with Minority Preference Optimization

    cs.CV 2026-07 conditional novelty 6.0

    Fine-tuning a diffusion model with a reconstruction-error minority reward via LoRA+GRPO improves zero-shot diffusion classification by expanding low-density coverage.

  3. FlowCIR: Semantic Transport via Flow Matching for Zero-Shot Composed Image Retrieval

    cs.CV 2026-07 unverdicted novelty 6.0

    FlowCIR frames ZS-CIR as conditional flow matching transport on fixed VLM embeddings plus an inference-time Multi-Negative Steering fix for negation, reporting competitive benchmark results at far lower training cost.

  4. DiffoR: A Unified Continuous Generative Framework for Universal Ordinal Regression

    cs.LG 2026-05 unverdicted novelty 6.0

    DiffOR reformulates ordinal regression as continuous generative modeling using diffusion models with dual-decoupling to capture soft semantic transitions.

  5. Memory Efficient Full-gradient Attacks (MEFA) Framework for Adversarial Defense Evaluations

    cs.LG 2026-05 unverdicted novelty 5.0

    MEFA enables exact full-gradient white-box attacks on iterative stochastic purification defenses like diffusion and Langevin EBMs by trading recomputation for lower memory, revealing vulnerabilities missed by approxim...

  6. NAPPure: Adversarial Purification for Robust Image Classification under Non-Additive Perturbations

    cs.CV 2025-10 conditional novelty 5.0

    By modeling the attack as a known transformation with unknown parameters, NAPPure jointly recovers the clean image and the perturbation through likelihood maximization, beating additive-only purification baselines on ...

  7. Adaptive Routing for Efficient Diffusion Transformer-Based PNI Prediction

    cs.CV 2026-07 conditional novelty 4.5

    DiT-RC predicts cholangiocarcinoma PNI from tumor-centered 3D MRI with AUC 0.731 at 257.57 GFLOPs by routing attention heads, tokens, and MLP width in a diffusion classifier.