{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/robust-classification-via-a-single-diffusion","title":"Robust Classification via a Single Diffusion Model","arxiv_id":"2305.15241","date":"2023-05-24","proceeding":null,"authors":["Huanran Chen","Yinpeng Dong","Zhengyi Wang","Xiao Yang","Chengqi Duan","Hang Su","Jun Zhu"],"abstract":"Diffusion models have been applied to improve adversarial robustness of image classifiers by purifying the adversarial noises or generating realistic data for adversarial training. However, diffusion-based purification can be evaded by stronger adaptive attacks while adversarial training does not perform well under unseen threats, exhibiting inevitable limitations of these methods. To better harness the expressive power of diffusion models, this paper proposes Robust Diffusion Classifier (RDC), a generative classifier that is constructed from a pre-trained diffusion model to be adversarially robust. RDC first maximizes the data likelihood of a given input and then predicts the class probabilities of the optimized input using the conditional likelihood estimated by the diffusion model through Bayes' theorem. To further reduce the computational cost, we propose a new diffusion backbone called multi-head diffusion and develop efficient sampling strategies. As RDC does not require training on particular adversarial attacks, we demonstrate that it is more generalizable to defend against multiple unseen threats. In particular, RDC achieves $75.67\\%$ robust accuracy against various $\\ell_\\infty$ norm-bounded adaptive attacks with $\\epsilon_\\infty=8/255$ on CIFAR-10, surpassing the previous state-of-the-art adversarial training models by $+4.77\\%$. The results highlight the potential of generative classifiers by employing pre-trained diffusion models for adversarial robustness compared with the commonly studied discriminative classifiers. Code is available at \\url{https://github.com/huanranchen/DiffusionClassifier}.","url_abs":"https://arxiv.org/abs/2305.15241v2","url_pdf":"https://arxiv.org/pdf/2305.15241v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"robust-classification-via-a-single-diffusion","repo_url":"https://github.com/huanranchen/diffusionclassifier","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null},{"paper_slug":"robust-classification-via-a-single-diffusion","repo_url":"https://github.com/huanranchen/AdversarialAttacks","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}},{"paper_slug":"robust-classification-via-a-single-diffusion","repo_url":"https://github.com/huanranchen/AdversarialAttacks/tree/main/experiments/DiffusionClassifier","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"},{"task_slug":"classification-1","task_name":"Classification"},{"task_slug":"robust-classification","task_name":"Robust classification"},{"task_slug":"model","task_name":"model"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[{"leaderboard":"/sota/adversarial-defense-on-cifar-10","task":"Adversarial Defense","dataset":"CIFAR-10","model":"Diffusion Classifier","rank_in_archive_order":2,"of":8,"metrics":{"Accuracy":"89.85","Robust Accuracy":"75.67"},"uses_additional_data":false}],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2305.15241","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2305.15241"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanranchen/AdversarialAttacks","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanranchen/diffusionclassifier","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanranchen/AdversarialAttacks/tree/main/experiments/DiffusionClassifier","reach":null}],"summary":{"unverified":3},"by_repo_kind":{"official":{"samples":3,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"9920e8fb0eac769c","entry":"DiffusionClassifier","repo":"huanranchen/diffusionclassifier","repo_kind":"official","path":"defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","file_url":"https://github.com/huanranchen/diffusionclassifier/blob/HEAD/defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9920e8fb0eac769c"}},{"code_sha256_prefix":"db1a3a587115bfc4","entry":"DiffusionClassifierSingleHeadBase","repo":"huanranchen/diffusionclassifier","repo_kind":"official","path":"defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","file_url":"https://github.com/huanranchen/diffusionclassifier/blob/HEAD/defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"db1a3a587115bfc4"}},{"code_sha256_prefix":"ba2b37185a927e7b","entry":"get_unet","repo":"huanranchen/diffusionclassifier","repo_kind":"official","path":"defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","file_url":"https://github.com/huanranchen/diffusionclassifier/blob/HEAD/defenses/PurificationDefenses/DiffPure/DiffusionClassifier/DiffusionClassifier.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ba2b37185a927e7b"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}