Pith. sign in

REVIEW 4 major objections 5 minor 44 references

Robust Representation Consistency Model via Contrastive Denoising

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A single forward-pass classifier trained with contrastive denoising can replace the two-stage purification-and-classification pipeline of diffusion-based randomized smoothing, giving higher certified accuracy at large radii at roughly 85×…

desk verdict A genuinely new training framework for certified robustness, but the abstract's headline numbers don't survive contact with the tables; the method itself still deserves review. read the letter →

arxiv 2501.13094 v2 pith:ZWACZPLS submitted 2025-01-22 cs.CV cs.AIcs.LG

Jiachen Lei , Julius Berner , Jiongxiao Wang , Zhongzhu Chen , Zhongjia Ba , Kui Ren , Jun Zhu , Anima Anandkumar This is my paper · ORCID
classification cs.CVcs.AIcs.LG
keywords randomizedsmoothingcertifiedrobustnessadversarialdiffusionmodelscontrastivelearningrepresentationconsistencyVisionTransformerImageNet
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Certified adversarial robustness normally comes from randomized smoothing: add Gaussian noise many times, classify each noisy copy, and aggregate. Diffusion-based variants purify each copy with a separate denoiser before classifying, which is slow and weak at large radii. This paper claims that both steps can be collapsed into one forward pass of a single Vision Transformer that has been pre-trained to give consistent representations to points on the same diffusion trajectory. After supervised fine-tuning, the network implicitly denoises and classifies in one shot. The reported result is a 5.3% average gain in certified accuracy over diffusion-based methods on ImageNet (up to 11.6% at large radii) with roughly 85× lower inference cost.

What carries the argument

The central object is a two-stage training objective. Pre-training combines an infoNCE-style consistency loss over temporally adjacent points on the same probability-flow trajectory with a contrastive loss over augmented views of the clean image (Eq. 9); fine-tuning applies the consistency-regularized cross-entropy loss of Eq. (12) at each smoothing noise level. Positive pairs are cheap because they are built from one Gaussian sample: $x_{t_n}=x_0+t_n\epsilon$ and $x_{t_{n-1}}=x_{t_n}+(t_{n-1}-t_n)\epsilon$, so the two points differ only by a known rescaling of the same noise. The network is a Vision Transformer with a time embedding and a learnable class token, and the class-token output is the single prediction used at certification time. An EMA-updated target model provides the contrastive targets, and a projector head is used only for the contrastive loss.

What would settle it

Train the same Vision Transformer with only the fine-tuning loss in Eq. (12), omitting the contrastive consistency pre-training, and compare certified accuracy at large radii; if it matches rRCM, the trajectory-alignment pre-training is not what carries the gain. Alternatively, construct positive pairs with a pretrained score model instead of the same-noise approximation in Eq. (11) and check whether certified accuracy at high noise levels changes.

Watch

Extended reading notes

Core claim

The central claim is that a discriminative objective over diffusion trajectories transfers denoising ability into a classifier, so the two-stage denoise-then-classify pipeline can be replaced by a single prediction. Positive pairs are noisy versions of the same clean image at adjacent time steps, generated with the same Gaussian noise via the approximate probability-flow step $x_{t_{n-1}} = x_{t_n} + (t_{n-1} - t_n)\epsilon$; the model pulls these pairs together in representation space and pushes apart points from other trajectories. After this pre-training, a supervised fine-tuning stage with a consistency-regularized cross-entropy loss aligns the representations with class labels. In the paper's experiments this yields better certified accuracy than diffusion-based baselines on ImageNet and CIFAR-10, with the ImageNet gains largest at large perturbation radii.

Load-bearing premise

The load-bearing premise is that two noisy versions of the same image made with the same Gaussian noise at adjacent noise levels behave like two points on the same denoising trajectory, so aligning their representations transfers denoising into the classifier; the paper concedes in Appendix E that such points share similar, not identical, semantics, and the gap grows with noise.

Editorial extensions

If this is right

  • Certification becomes one forward pass per smoothing sample, cutting ImageNet certification latency from minutes to seconds without majority voting or a separate purification network.
  • Because the model is trained across the diffusion noise schedule, certified accuracy is maintained at radii where two-stage purification degrades, the regime where the reported gains are largest.
  • The same pre-trained encoder is fine-tuned separately for each smoothing noise level, so one training pipeline serves all certified radii.
  • The ImageNet results continue to improve with model depth and batch size, indicating that the reported certified accuracy is not a performance plateau.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An extension the paper leaves open is to build positive pairs with a pretrained score model instead of the same-noise approximation in Eq. (11); if certified accuracy at high noise levels improves, the approximation is the limiting factor.
  • Because the consistency pre-training is independent of the classification head, the same encoder could be fine-tuned for noise-robust downstream tasks beyond classification, such as segmentation or detection under Gaussian noise.
  • Other two-stage defenses that currently purify with a diffusion model and then classify could in principle be re-engineered as single rRCM-style models, inheriting a large latency reduction without the exact training recipe.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes rRCM, a training framework that turns the generative denoising objective of diffusion models into a discriminative representation-alignment task. During pre-training, temporally adjacent points on approximate PF ODE trajectories are treated as positive pairs in an InfoNCE-style loss; after fine-tuning with class labels, the model performs implicit denoising-then-classification in a single forward pass. The authors report state-of-the-art certified accuracy under randomized smoothing on ImageNet and CIFAR-10, with large reductions in inference latency compared with diffusion-based purification methods such as DDS, DensePure, and DiffSmooth.

Significance. If the central claims hold, the paper makes a substantial practical contribution: it replaces the two-stage denoising-plus-classification pipeline of diffusion-based randomized smoothing with a single classifier, reducing certification cost by orders of magnitude while matching or exceeding the certified accuracy of prior diffusion-based methods at large radii. The work is also notable for its extensive experiments, including ablations on noise-level ranges, EMA schedules, and comparisons with MoCo-v3 with noise augmentation, as well as the appendix's quantitative analysis of semantic similarity along stochastic forward trajectories. These strengths are real and are part of my positive assessment. The main weakness is that the headline quantitative claims (5.3% average accuracy gain and 85× inference-cost reduction) are not supported by the tables as reported, because of a certification-budget mismatch and an unspecified latency-averaging protocol.

major comments (4)
  1. [Section 4.1, Table 1, and Abstract] The headline claim of a 5.3% average certified-accuracy improvement over diffusion-based methods (Abstract and Section 1) compares rRCM-B/rRCM-B-Deep evaluated with N=100,000 smoothing noises against DDS, DensePure, and DiffSmooth rows marked with ‡, which use N=10,000 smoothing noises. Because the certified radius in Eq. (5) is a finite-sample lower confidence bound, increasing N can itself raise certified accuracy even for a fixed base classifier. The paper's own matched-budget row, rRCM-B‡, shows gains of only 0.4–5.8 percentage points over DDS‡ (e.g., 45.2 vs 41.4 at r=1.0), far below the abstract's averages. Please report the primary comparison at matched N, or explicitly state that the 5.3% figure is an unmatched-budget comparison and revise the claims accordingly.
  2. [Abstract and Section 4.1] The claimed average inference-cost reduction of 85× is not recoverable from the latencies in Tables 1 and 2. For example, DDS‡ is reported at 3min52s (232s) and rRCM-B‡ at 6s, giving a ratio of about 39×; DensePure K=5 is 52min20s (3140s), which is about 59× relative to rRCM-B at 53s and about 523× relative to rRCM-B‡ at 6s; DiffSmooth m=15 is 5min35s (335s), about 6.3× relative to rRCM-B at 53s. No averaging protocol stated in the paper yields 85× across these baselines. Please specify the exact set of baseline latencies and the averaging procedure used to obtain the 85× figure, or correct the claim.
  3. [Section 3.3, Eq. (11), and Appendix E] The construction of positive pairs uses x_{t_{n-1}} = x_{t_n} + (t_{n-1} - t_n) ε, which is a same-noise forward-path step rather than a PF ODE step. The paper acknowledges in Appendix E that points on the stochastic forward trajectory "share similar, rather than identical, semantics" to the initial point. Because the pre-training objective's ability to transfer denoising ability into the classifier rests on this approximation, its validity is load-bearing. I ask for a quantitative evaluation of the approximation (e.g., measuring the actual PF ODE step error at the noise levels used) or a control experiment using a pretrained score model to generate the positive pairs, to establish that the approximation is not the source of the method's gains.
  4. [Table 4 and Section 3.3] The pre-training hyper-parameters in Table 4 list time steps in the range 20 to 80, while fine-tuning and certification use noise levels σ ∈ {0.25, 0.5, 1.0} (Section 3.4). If "time steps" here refers to the noise magnitudes t in Eq. (3), then the pre-training never aligns points at the small noise levels used during certification. The paper should clarify the meaning of this hyper-parameter and provide evidence or an explicit argument for why consistency learned at t ≥ 20 transfers to t ≤ 1. Without such clarification, the connection between the pre-training objective and the certified robustness at the evaluated radii is not fully established.
minor comments (5)
  1. [Section 4.2] The phrase "unwilling computation trade-off" appears to be a typo; it should likely be "unwieldy computation trade-off" or "undesirable computation trade-off."
  2. [Algorithm 1] The comment "Gassian noise sampled" contains a typo: it should be "Gaussian noise sampled."
  3. [Section 3.3, Eq. (9)] The notation pν for the projector head conflicts with the use of p for probability distributions (e.g., p(x0), pϕ(xσ)). Consider using a different symbol such as hν or qν to avoid confusion.
  4. [Appendix E] The sentence "Consequently, theses points share similar..." contains a typo: "theses" should be "these."
  5. [Section 5] The phrase "consistency model Song et al. (2023)" should be "consistency models (Song et al., 2023)" for grammatical correctness.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: certified accuracy is measured by an external randomized-smoothing protocol, and the training objectives are not fitted to the reported certified radii.

full rationale

The paper's central claim is that the rRCM classifier trained with a contrastive-denoising objective improves certified accuracy under randomized smoothing. The certified radii are computed with the standard finite-sample lower confidence bound in Eq. (5), using the model's own predictions on Gaussian-perturbed inputs; this is an external evaluation protocol that does not use any certified-accuracy number as a training target. The pre-training objective in Eqs. (7)-(9) and the fine-tuning objective in Eq. (12) are training losses with fixed hyperparameters; no parameter is fitted to the reported certified radii. The positive-pair construction in Eq. (11) uses the same Gaussian noise epsilon to define x_{t_{n-1}}, and the paper explicitly acknowledges in Appendix E that points on the stochastic forward trajectory share 'similar, rather than identical, semantics' to the clean image. That is a stated modeling approximation, not a circular reduction of the evaluation claim. The self-citations to DensePure and DiffSmooth are baseline comparisons, not load-bearing justification of rRCM's mechanism; no uniqueness theorem or prior result by the same authors is invoked to forbid alternatives. The 100k-versus-10k smoothing-noise comparison in the headline numbers is a reporting and fairness concern, but it involves the same external certification formula applied to all methods, so it is not a circularity pattern. Overall, the derivation is self-contained against external benchmarks and no circular step was identified.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical or conceptual entities. It rests on standard randomized smoothing, the PF ODE framework, and a practical approximation for generating positive pairs. The free parameters are hyperparameters of the training objectives, all chosen by hand or via ablations, and the central evaluation is benchmarked externally.

free parameters (4)
  • tau (temperature) = 0.2
    Used in both consistency and contrastive loss (Eq. 8). Chosen by the authors, ablated in Appendix G, affects the sharpness of the contrastive distribution.
  • EMA rates for target models = µ1=0 (consistency), µ2=0.99 (contrastive), with dynamic schedule S=0.99, E=0.9999, m=10
    Set manually in Section 3.3 and Appendix C. The dynamic schedule is a design choice affecting training stability and representation quality.
  • Fine-tuning coefficients = η1 = 10 at σ=0.25, 20 at σ=0.5/1.0; η2 = 0.5
    Hyperparameters in Eq. (12), chosen by hand. They balance cross-entropy, prediction consistency, and entropy regularization.
  • Pre-training noise range = Time steps uniformly in [20, 80] (T=80, EDM schedule)
    Table 4. The paper does not report an ablation on this range, but it determines the noise levels used for alignment and is a free choice.
assumptions (4)
  • standard math Randomized smoothing provides a valid certified radius via Eq. (5).
    The paper relies on Cohen et al. (2019) to convert the soft model's prediction distribution into a certified radius. This is an external theorem.
  • domain assumption PF ODE trajectories of the true score are non-crossing and uniquely associate each point with an initial clean image.
    Stated in Section 3.1 to justify treating points on the same trajectory as positive pairs. This holds for the ideal score, but the paper works with an approximate score.
  • ad hoc to paper The same-noise pair construction in Eq. (11) is a good approximation to a PF ODE trajectory.
    This is the paper's core practical trick. It uses a Monte Carlo estimate of the Tweedie score and one Euler step. The approximation is acknowledged in Appendix E.
  • domain assumption The fine-tuning objective in Eq. (12), borrowed from Jeong & Shin (2020), yields a soft classifier suitable for randomized smoothing.
    The paper adopts this loss without modification, and shows it works after pre-training. It is an empirical assumption, validated by experiments.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Robust Representation Consistency Model via Contrastive Denoising." pith.science (2026). https://pith.science/paper/ZWACZPLS

@misc{pith2026250113094,
  author       = {Pith},
  title        = {Pith review of: Robust Representation Consistency Model via Contrastive Denoising},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZWACZPLS}},
  note         = {Machine review of arXiv:2501.13094}
}
abstract

Robustness is essential for deep neural networks, especially in security-sensitive applications. To this end, randomized smoothing provides theoretical guarantees for certifying robustness against adversarial perturbations. Recently, diffusion models have been successfully employed for randomized smoothing to purify noise-perturbed samples before making predictions with a standard classifier. While these methods excel at small perturbation radii, they struggle with larger perturbations and incur a significant computational overhead during inference compared to classical methods. To address this, we reformulate the generative modeling task along the diffusion trajectories in pixel space as a discriminative task in the latent space. Specifically, we use instance discrimination to achieve consistent representations along the trajectories by aligning temporally adjacent points. After fine-tuning based on the learned representations, our model enables implicit denoising-then-classification via a single prediction, substantially reducing inference costs. We conduct extensive experiments on various datasets and achieve state-of-the-art performance with minimal computation budget during inference. For example, our method outperforms the certified accuracy of diffusion-based methods on ImageNet across all perturbation radii by 5.3% on average, with up to 11.6% at larger radii, while reducing inference costs by 85$\times$ on average. Codes are available at: https://github.com/jiachenlei/rRCM.

Figures

Figures reproduced from arXiv: 2501.13094 by the authors.

Figure 1
Figure 1. Performance vs. Inference Latency. Marker sizes correspond to relative model sizes. Deep neural networks (DNNs) have achieved unprecedented success in various visual appli￾cations. Yet, they are still vulnerable to small adversarial perturbations. This imposes a threat to the deployment of DNNs in real-world sys￾tems, in particular for security-critical scenar￾ios, such as human face identification and au￾tonomous d… view at source ↗
Figure 2
Figure 2. Illustration of our pre-training method and model forward pass. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Scaling up model size on ImageNet im￾proves performance. 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Radius r 10 20 30 40 50 Certified Accuracy (%) 128 512 1024 [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (7 more)
Figure 5
Figure 5. Figure 5: Comparisons of contrastive learning and consistency model training with our method. The [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Illustration of the dynamic EMA schedule when changing parameter [PITH_FULL_IMAGE:figures/full_fig_p015_6.png]
Figure 7
Figure 7. Figure 7: Images generated by conditioning on the output of our rRCM-B model. [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]
Figure 8
Figure 8. Figure 8: Images generated by conditioning on representations from rRCM-B. The representations [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Our method is remarkably different from MoCo-v3 that is additionally equipped with [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Ablation study on the hyper-parameter settings. By default, we use EMA2=0.0 and [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]
Figure 11
Figure 11. Figure 11: Training on restricted noise levels, including setting the rightmost endpoint at [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

44 extracted references · 17 canonical work pages

  1. [1]

    All are worth words: A VIT backbone for diffusion models

    Fan Bao, Shen Nie, Kaiwen Xue, Yue Cao, Chongxuan Li, Hang Su, and Jun Zhu. All are worth words: A VIT backbone for diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 22669--22679, 2023

    work page 2023

  2. [2]

    (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206.10550, 2022

    Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and J Zico Kolter. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206.10550, 2022

    arXiv 2022

  3. [3]

    A simple framework for contrastive learning of visual representations

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp.\ 1597--1607. PMLR, 2020

    2020

  4. [4]

    Exploring simple siamese representation learning

    Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 15750--15758, 2021

    work page 2021

  5. [5]

    An empirical study of training self-supervised vision transformers

    Xinlei Chen, Saining Xie, and Kaiming He. An empirical study of training self-supervised vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp.\ 9640--9649, 2021

    work page 2021

  6. [6]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pp.\ 1310--1320. PMLR, 2019

    2019

  7. [7]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  8. [8]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020

    arXiv 2010

Show all 44 references
  1. [9]

    Tweedie’s formula and selection bias

    Bradley Efron. Tweedie’s formula and selection bias. Journal of the American Statistical Association, 106 0 (496): 0 1602--1614, 2011

    2011

  2. [10]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  3. [11]

    Momentum contrast for unsupervised visual representation learning

    Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 9729--9738, 2020

    2020

  4. [12]

    Gans trained by a two time-scale update rule converge to a local nash equilibrium

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017

    2017

  5. [13]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 0 6840--6851, 2020

    2020

  6. [14]

    Boosting randomized smoothing with variance reduced classifiers

    Mikl \'o s Z Horv \'a th, Mark Niklas M \"u ller, Marc Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. arXiv preprint arXiv:2106.06946, 2021

    2021 arXiv

  7. [15]

    Consistency regularization for certified robustness of smoothed classifiers

    Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. Advances in Neural Information Processing Systems, 33: 0 10558--10570, 2020

    2020

  8. [16]

    Multi-scale diffusion denoised smoothing

    Jongheon Jeong and Jinwoo Shin. Multi-scale diffusion denoised smoothing. Advances in Neural Information Processing Systems, 36, 2024

    2024

  9. [17]

    Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness

    Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, Do-Guk Kim, and Jinwoo Shin. Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness. Advances in Neural Information Processing Systems, 34: 0 30153--30168, 2021

    2021

  10. [18]

    Elucidating the design space of diffusion-based generative models

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. Advances in Neural Information Processing Systems, 35: 0 26565--26577, 2022

    2022

  11. [19]

    Auto-encoding variational bayes

    Diederik P Kingma. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  12. [20]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Toronto, ON, Canada, 2009

    2009

  13. [21]

    Certified robustness to adversarial examples with differential privacy

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP), pp.\ 656--672. IEEE, 2019

    2019

  14. [22]

    Self-conditioned image generation via generating representations

    Tianhong Li, Dina Katabi, and Kaiming He. Self-conditioned image generation via generating representations. arXiv preprint arXiv:2312.03701, 2023

    2023 arXiv

  15. [23]

    Consistency purification: Effective and efficient diffusion purification towards certified robustness

    Yiquan Li, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Bo Li, and Chaowei Xiao. Consistency purification: Effective and efficient diffusion purification towards certified robustness. arXiv preprint arXiv:2407.00623, 2024

    2024 arXiv

  16. [24]

    Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35: 0 5775--5787, 2022

    2022

  17. [25]

    Latent consistency models: Synthesizing high-resolution images with few-step inference

    Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent consistency models: Synthesizing high-resolution images with few-step inference. arXiv preprint arXiv:2310.04378, 2023

    2023 arXiv

  18. [26]

    Towards deep learning models resistant to adversarial attacks

    Aleksander M a dry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. stat, 1050 0 (9), 2017

    2017

  19. [27]

    Representation learning with contrastive predictive coding

    Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv preprint arXiv:1807.03748, 2018

    2018 arXiv

  20. [28]

    Certified defenses against adversarial examples

    Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial examples. arXiv preprint arXiv:1801.09344, 2018 a

    2018 arXiv

  21. [29]

    Semidefinite relaxations for certifying robustness to adversarial examples

    Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness to adversarial examples. Advances in neural information processing systems, 31, 2018 b

    2018

  22. [30]

    Provably robust deep learning via adversarially trained smoothed classifiers

    Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. Advances in neural information processing systems, 32, 2019 a

    2019

  23. [31]

    A convex relaxation barrier to tight robustness verification of neural networks

    Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A convex relaxation barrier to tight robustness verification of neural networks. Advances in Neural Information Processing Systems, 32, 2019 b

    2019

  24. [32]

    Denoised smoothing: A provable defense for pretrained classifiers

    Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems, 33: 0 21945--21957, 2020

    2020

  25. [33]

    Defense-gan: protecting classifiers against adversarial attacks using generative models

    P Samangouei. Defense-gan: protecting classifiers against adversarial attacks using generative models. arXiv preprint arXiv:1805.06605, 2018

    2018 arXiv

  26. [34]

    Score-based generative modeling through stochastic differential equations

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020

    2011 arXiv

  27. [35]

    Consistency models

    Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. arXiv preprint arXiv:2303.01469, 2023

    2023 arXiv

  28. [36]

    Densepure: Understanding diffusion models towards adversarial robustness

    Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anandkumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint arXiv:2211.00322, 2022

    2022 arXiv

  29. [37]

    Macer: Attack-free and scalable robust training via maximizing certified radius

    Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-free and scalable robust training via maximizing certified radius. arXiv preprint arXiv:2001.02378, 2020

    2001 arXiv

  30. [38]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp.\ 7472--7482. PMLR, 2019

    2019

  31. [39]

    Efficient neural network robustness certification with general activation functions

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in neural information processing systems, 31, 2018

    2018

  32. [40]

    DiffSmooth : Certifiably robust learning via diffusion models and local smoothing

    Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, and Bo Li. DiffSmooth : Certifiably robust learning via diffusion models and local smoothing. In 32nd USENIX Security Symposium (USENIX Security 23), pp.\ 4787--4804, 2023

    2023

  33. [41]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  34. [42]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  35. [43]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  36. [44]

    The gray gray lines denote the PF ODE trajectories

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.