{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/your-diffusion-model-is-secretly-a","title":"Diffusion Models are Certifiably Robust Classifiers","arxiv_id":"2402.02316","date":"2024-02-04","proceeding":null,"authors":["Huanran Chen","Yinpeng Dong","Shitong Shao","Zhongkai Hao","Xiao Yang","Hang Su","Jun Zhu"],"abstract":"Generative learning, recognized for its effective modeling of data distributions, offers inherent advantages in handling out-of-distribution instances, especially for enhancing robustness to adversarial attacks. Among these, diffusion classifiers, utilizing powerful diffusion models, have demonstrated superior empirical robustness. However, a comprehensive theoretical understanding of their robustness is still lacking, raising concerns about their vulnerability to stronger future attacks. In this study, we prove that diffusion classifiers possess $O(1)$ Lipschitzness, and establish their certified robustness, demonstrating their inherent resilience. To achieve non-constant Lipschitzness, thereby obtaining much tighter certified robustness, we generalize diffusion classifiers to classify Gaussian-corrupted data. This involves deriving the evidence lower bounds (ELBOs) for these distributions, approximating the likelihood using the ELBO, and calculating classification probabilities via Bayes' theorem. Experimental results show the superior certified robustness of these Noised Diffusion Classifiers (NDCs). Notably, we achieve over 80% and 70% certified robustness on CIFAR-10 under adversarial perturbations with \\(\\ell_2\\) norms less than 0.25 and 0.5, respectively, using a single off-the-shelf diffusion model without any additional data.","url_abs":"https://arxiv.org/abs/2402.02316v3","url_pdf":"https://arxiv.org/pdf/2402.02316v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"your-diffusion-model-is-secretly-a","repo_url":"https://github.com/huanranchen/NoisedDiffusionClassifiers","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"robust-classification","task_name":"Robust classification"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"},{"method_slug":"randomized-smoothing","method_name":"Randomized Smoothing"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2402.02316","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.02316"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanranchen/NoisedDiffusionClassifiers","reach":{"status":"ok"}}],"summary":{"ran_draft_wrong":1,"ran":1,"unverified":2},"by_repo_kind":{"official":{"samples":4,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"6007bd5812bfaa0f","entry":"clamp","repo":"huanranchen/NoisedDiffusionClassifiers","repo_kind":"official","path":"attacks/utils.py","file_url":"https://github.com/huanranchen/NoisedDiffusionClassifiers/blob/HEAD/attacks/utils.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"6007bd5812bfaa0f"}},{"code_sha256_prefix":"508ada73b3187beb","entry":"inplace_clamp","repo":"huanranchen/NoisedDiffusionClassifiers","repo_kind":"official","path":"attacks/utils.py","file_url":"https://github.com/huanranchen/NoisedDiffusionClassifiers/blob/HEAD/attacks/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"508ada73b3187beb"}},{"code_sha256_prefix":"f995d502b1dc9eac","entry":"get_net","repo":"huanranchen/NoisedDiffusionClassifiers","repo_kind":"official","path":"defenses/HighLevelGuidedDenoiser/inceptionresnet.py","file_url":"https://github.com/huanranchen/NoisedDiffusionClassifiers/blob/HEAD/defenses/HighLevelGuidedDenoiser/inceptionresnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f995d502b1dc9eac"}},{"code_sha256_prefix":"d84e622ec1d0d9f7","entry":"get_net","repo":"huanranchen/NoisedDiffusionClassifiers","repo_kind":"official","path":"defenses/HighLevelGuidedDenoiser/resnet.py","file_url":"https://github.com/huanranchen/NoisedDiffusionClassifiers/blob/HEAD/defenses/HighLevelGuidedDenoiser/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d84e622ec1d0d9f7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}