DensePure: Understanding Diffusion Models for Adversarial Robustness
Authors: Chaowei Xiao
Zhongzhu Chen
Kun Jin
Jiongxiao Wang
Weili Nie
Mingyan Liu
Anima Anandkumar
Bo Li
Dawn Song
Venue: ICLR 2023 poster (2023)
Keywords: adversarial robustness
certified robustness
diffusion model

Abstract: Diffusion models have been recently employed to  improve certified robustness through the process of denoising.  However, the theoretical understanding of why diffusion models are able to improve the certified robustness is still lacking, preventing from further improvement.  In this study, we close this gap by analyzing the fundamental properties of diffusion models and  establishing the conditions under which they can enhance certified robustness. This deeper understanding allows us to propose a new method   DensePure,  designed to improve the certified robustness of a pretrained model (i.e. classifier).   Given an (adversarial) input, DensePure consists of multiple runs of denoising via the reverse process of the diffusion model (with different random seeds) to get multiple reversed samples, which are then passed through the classifier, followed by majority voting of inferred labels to make the final prediction.  This design of using multiple runs of denoising is informed by our theoretical analysis of the conditional distribution of the reversed  sample. Specifically, when the data density of a clean sample is high, its conditional density under the reverse process in a diffusion model is also high;  thus sampling from the latter conditional distribution can purify the adversarial example and return the corresponding clean sample with a high probability. By using the highest density point in the conditional distribution as the reversed sample, we identify the robust region of a given instance under the diffusion model's reverse process. We show that this robust region is a union of multiple convex sets, and is potentially much larger than the robust regions identified in previous works. In practice, DensePure can approximate the label of the high density region in the conditional distribution so that it can enhance certified robustness. We conduct extensive experiments to demonstrate the effectiveness of DensePure by evaluating its certified robustness  given a standard model via randomized smoothing. We show that DensePure is consistently better than existing methods on ImageNet, with 7% improvement on average. 

Published as a conference paper at ICLR 2023
DENSEPURE: UNDERSTANDING DIFFUSION MODELS FOR ADVERSARIAL ROBUSTNESS
Chaowei Xiao Zhongzhu Chen +. Kun Jin n.2 Jiongxiao Wang +
Weili Nie Mingyan Liu Anima Anandkumar
Bo Li Dawn Song
ASU, University of Michigan, Ann Arbor, 3 NVIDIA, Caltech, 5 UIUC, 6 UC Berkeley
ABSTRACT
Diffusion models have been recently employed to improve certified robustness through the process of denoising. However, the theoretical understanding of why diffusion models are able to improve the certified robustness is still lacking, pre- venting from further improvement. In this study, we close this gap by analyzing the fundamental properties of diffusion models and establishing the conditions under which they can enhance certified robustness. This deeper understanding al- lows us to propose a new method DensePure, designed to improve the certified robustness of pretrained model (i.e. classifier). Given an (adversarial) input, DensePure consists multiple runs of denoising via the reverse process of the diffusion model (with different random seeds) to get multiple reversed samples, which are then passed through the classifier, followed by majority voting of in- ferred labels make the final prediction. This design of using multiple runs of denoising is informed by our theoretical analysis of the conditional distribution of the reversed sample. Specifically, when the data density of clean sample is high, its conditional density under the reverse process in a diffusion model is also high; thus sampling from the latter conditional distribution can purify the adversarial example and return the corresponding clean sample with a high prob- ability. By using the highest density point in the conditional distribution as the reversed sample, we identify the robust region of a given instance under the dif- fusion model's reverse process. We show that this robust region a union multiple convex sets, and is potentially much larger than the robust regions iden- tified in previous works. In practice, DensePure can approximate the label the high density region in the conditional distribution so that it enhance cer- tified robustness. We conduct extensive experiments to demonstrate the effee- tiveness of DensePure by evaluating its certified robustness given a standard model via randomized smoothing. We show that DensePure is consistently bet- ter than existing methods on ImageNet, with 7% improvement on average. Project wwt..gitthuuii..
INTRODUCTION
Diffusion models have been shown be powerful image generation tool (Ho al. 2020 Song et al. (2021b) owing to their iterative diffusion and denoising processes. These models have achieved sample quality (Dhariwal & Nichol 2021 Vahdat et al. 2021 as well as effective mode coverage (Song et al. 2021a). A diffusion model usually consists of two processes: a forward diffusion process that converts data to noise by gradually adding noise to the input, and (ii) a reverse generative process that starts from noise and generates data by denoising one step at a time (Song al. 2021b).
state-of-the-art performance
Given the natural denoising property of diffusion models, empirical studies have leveraged them for adversarial purification (Nie et al. [002]] Wu et al. 2002)] Carlini et al., (0022). For instance, NNe et al.) (2022) employed diffusion models for model purification, DiffPure. They empirically show that by carefully choosing the amount of Gaussian noises added during the diffusion process, adversarial
'the first four authors contributed equally

---

Published as a conference paper at ICLR 2023
perturbations can be removed while preserving the true label semantics, Despite the significant em- pirical result, there no provable guarantee of the achieved robustness. A concurrent work (Carlini et al. 2022) instantiated the randomized smoothing approach with the diffusion model to offer provable guarantee of model robustness against L--norm bounded adversarial example. However, they do not provide theoretical understanding of why and how diffusion models contribute such nontrivial certified robustness.
Our Approach. We are the first theoretically analyze the fundamental properties of diffu- sion models to understand why and how diffusion models enhance certified robustness. This deeper understanding allows us to propose a new method DensePure to improve the certified robustness of any given classifier more effectively using diffusion models. An illustration of the DensePure framework provided Figure [ where consists of a pretrained diffusion model and a pretrained classifier. DensePure incorporates two steps: (i) using the reverse process of the diffusion model to obtain a sample of the posterior data distribution conditioned on the adversarial input; and (ii) repeating the reverse process multiple times with different random seeds to approx- imate the label of the high-density region in the conditional distribution via a simple majority vote strategy. In particular, given adversarial input, repeatedly feed it into the reverse process of the diffusion model to get multiple reversed examples and feed them into the classifier to calculate their labels. We then apply the majority vote on the set of labels get the final predicted label.
DensePure is inspired by our theoretical analysis, where we show that the reverse process of the diffusion model provides conditional distribution of the reversed sample given adversarial in- put. Sampling from this conditional distribution can enhance the certified robustness. Specifically, we prove that when the data density of clean samples is high, it sufficient condition for the con- ditional density of the reversed samples to be also high. Therefore, in DensePure, samples from the conditional distribution can recover the ground-truue labels with a high probability.
For understanding and rigorous analysis conveniently, we use the highest density point in the con- ditional distribution as the deterministic reversed sample for the classifier prediction. We show that the robust region for given sample under the diffusion model's reverse process is the union of multiple convex sets, each surrounding a region around the ground-truth label. Compared with the robust region of previous work (Cohen et al. 2019), which only focuses only one region with the ground-truth label, such the union of multiple convex sets has the potential to provide much larger robust region, resulting in higher certified robustness. Moreover, the characterization implies that the size of robust regions is affected by the relative density and the distance between data regions with the ground-truth label and those with other labels.
We conduct extensive experiments on ImageNet and CIFAR-10 datasets under different settings to evaluate the certifiable robustness of DensePure. In particular, we follow the setting from Carlini let al. 2022) and rely on randomized smoothing to certify the robustness of the adversarial perturba- tions bounded in the C2-norm. We show that DensePure achieves a new state-of-the-art certified robustness on the standard pretrained model without further tuning any model parameters (e.g.. smooth augmentation Cohen al. (2019)) On ImageNet, it achieves a consistently higher certified accuracy, 7% improvement on average, than the existing methods among every a at every radius e.
DensePure Purification Pipolino
Off-the-shelf Classifier
Input
Reverse Process
Conditional distribution
Sample
Robust Prediction
& Majority Vole
Off-the-sheif Diffusion Model
Figure 1: Pipeline of DensePure.
Technical Contributions, In this paper, we take the first step to understand why and how diffusion models contribute to certified robustness. We make contributions on both theoretical and empirical fronts: (I in) theory, we prove that adversarial example can be recovered back to the original clean sample with a high probability via the reverse process of a diffusion model. (2) In theory, we charac- terized the robust region for each point by further taking the highest density point in the conditional
2

---

Published as a conference paper at ICLR 2023
distribution generated by the reverse process the reversed sample. We show that the robust gion for a given sample under the diffusion model's reverse process has the potential to provide a larger robust region. To the best of our knowledge, this is the first work that characterizes the robust region of using the reverse process of the diffusion model for adversarial purification (3) In prac- tice, we proposed DensePurebasee consistently better than existing methods on ImageNet, with 7% improvement on average.
theoretical analysis. We demonstrated DensePureis
2 PRELIMINARIES AND BACKGROUNDS
Continuous- Time Diffusion Model. The diffusion model has two components: the diffusion pro- cess followed by the reverse process. Given input random variable X p, the diffusion pro- cess adds isotropic Gaussian noises to the data so that the diffused random variable at time is X, var((x Xo Ex), s.t., 6, (0, I) and of (1 / and we denote X ~ Pr. The forward diffusion process can also be defined by the stochastic differential equation
dæ hlx,,t()e t)dt + g())dw,
(SDE)
where P. h : RR x R H Rd is the drift coefficient, R + R is the diffusion coefficient, and (t) E IR" is the standard Wiener process.
Under mild conditions B.I. the reverse process exists and removes the added noise by solving the reverse-time SDE (Anderson 1982)
dē (1 t) 9(t)²va= p. g(t)
(reverse-SDD)
where di is an infinitesimal reverse time step, and (() is reverse-time standard Wiener process.
In our context, we use the conventions of VP-SDE (Song et al. 2021b) where l((;;; L) = - (
and gt) = (t( with >() positive and continuous over [0, 1]. such that s=(t) varz(0) +
VI-a,e a,6 where Oi2 e Jo (s)ds and ~ No I). We use (x, 1e and {x (e).1)) to denote the diffusion process and the reverse process generated by SDE and reverse- SDE respectively, which follow the same distribution.
Discrete- Time Diffusion Model (or DDPM (Ho et al., 2020)) DDPM constructs a discrete XN) as the forward process for the training data Xy ~ p, such
Markov chain {Xo,X), X1, ; _.....
that |P(x, = (xx;;; -, B,T), where 0 < 81 < 3/ < ... < 3N < are predefined
noise scales such that x approximates the Gaussian white noise. Denote T. - (1 - 3t). we
have xxx = N(x;; v Va,xo. (1 a,) ( i.e., (x Vo,X, + (1 0; 0,) (),
The reverse process of DDPM learns reverse direction variational Markov chain p xx, Ni(x; (x,, i), Ex( i)). Ho et al. (2020) defines eg a function approximator to predict from I; such that p i)
X;
vI- Ex(x Then the reverse time samples
B.
are generated by x;-1 vI- &
vi- 60- i)) + VBic, ~ NOO, 7), and the optimal
parameters 0 are obtained by solving 0 := arg ming Exo.e [||e eel- + (1 (1-z,), 11]
Randomized Smoothing. Randomized smoothing is used to certify the robustness of a given classifier against T22normm based perturbation. transfers the classifier f to smooth version g(x) = arg max, (e==N + <) = c). where is the smooth classifier and a is a hyper- parameter of the smooth classifier g. which controls the trade-off between robustness and accuracy. Cohen et al. (2019) shows that g(z) induces the certifiable robustness for & under the Lg-norm with
radius R. where R = ( (PA) )- $ Φ-1(pp) (pn)); PA and Pa are probability of the most probable class and "runner-up" class respectively: & is the inverse of the standard Gaussian CDF. The P.a and pn can be estimated with arbitrarily high confidence via Monte Carlo method (Cohen et al. 2019).
3 THEORETICAL ANALYSIS
In this section, we theoretically analyze why and how the diffusion model can enhance the robustness of given classifier. We will analyze directly on SDE and reverse-SDD as they generate the same
3

---

Published as a conference paper at ICLR 2023
stochastic processes (x, Ti and the literature works establish an approximation reverse- SDE (Song et al., 2021b Ho et al. 2020).
will generate a conditional distribu- tion based on the scaled adversarial sample, which will have high density on data region with high data density and near to the adversarial sample in Theorem 3.1 See detailed conditions in [B.I
We first show that given diffusion model,
Theorem 3.1. Under conditions
B.I solving equation reverse- starting from time and sample Fa,t = V Varifa will generate reversed random variable Xo with density P PXx0= = x Xx; = Ba,t) x
(-llæ==allã where p is the data distribution, of 1-as is the variance of
p(x)) V12x03y" exp 2nt
Gaussian noise added at time in the diffusion process.
Proof. (sketch) Under conditions B.1 we know (xt)eejo and (&t hejo.1) follow the same distri- bution, and then the rest proof follows Bayes' Rule.
Please see the full proof' of this and the following theorems in Appendix B.2
Remark 1. Note that IP (Ro- x|X;- Fa,z) > 0 if and only p(x) > 0, thus the generated reverse sample will be on the data region where we train classifiers.
In Theorem 3.1 the conditional density TP (&gg = =||; x), is high if both p(æ:) and the Gaus- sian term have high values, i.e., x has high data density and is close to the adversarial sam- ple Va. The latter condition is reasonable since adversarial perturbations are typically bounded due to budget constraints. So the above argument implies that a reversed sample will more likely have the ground-truth label if data region with the ground-truth label has high data density. For the sake of theoretical analysis and understanding, we take the point with high- est conditional density IP (xxo = a/ |/ = F.,e)) as the reversed sample, defined as P( () == arg max, P (Xo- x|X;/ Zt,t). P(x,;t) t) is a representative of the high density data region in the conditional distribution and ((::t) t) is a deterministic purification model. In the following, we characterize the robust region for data region with ground-truth label under P' (:;t). The robust re- gion and robust radius for a general deterministic purification model given a classifier are defined below.
Definition 3.2 (Robust Region and Robust Radius). Given classifier f and point Tu, let (xx) == fx= : f(x) f(2o)} be the data region where samples have the same label as xo- Then given deterministic purification model P(:;)) with parameter th, we define the robust re- gion of ((ro) under 'P and f as Dí (G(#z);; v)) == {x ()) = [[x)), i.e., the set of such that purified sample p(æ;; ()) has the same label as Do under f. Further, we define the robust radius of zo as r& (xo: ; v) : max {r: xo +ru E D' (zo: V//ull2 S 1). i.e. the radius of maximum inclined ball of D/C (Itu; 1) centered around zu- We will omit P and when it is clear from the context and write D (g(zv); v) and r(zu; v instead.
Remark 2. In Definition 3.2 the robust region (resp. radius) is defined for each class (resp. point). When using the point with highest P P(xo- = x/xx ra,s) as the reversed sample, th t
Now given a sample To with ground-truth label, we are ready to characterize the robust region D (G(x)): b) under purification model t(::t) and classifier f. Intuitively, if the adversarial sample To is near to Ty (in Euclidean distance), Xa keeps the same label semantics of ay and so as the purified sample P(x,:t), which implies that f (P(x., (xa; +)) = f(x,). However, the condition that aa is near to Do is sufficient but not necessary since we can still achieve I (b) = (xx) if n. is near any sample To with f (P( v)) f(x))) In the following, we will show that the robust region D (xo); v is the union of the convex robust sub-regions surrounding every wo
with the same label as Vo. The following theorem characterizes the convex robust sub-region and robust region respectively.
Theorem 3.3. Under conditions B. land classifier f, let Do be the sample with ground-truth label and D. be the adversarial sample, then (i) the purified sample P P( 1) will have the ground-truth label if va falls into the following convex set,
{
Da : (xa 2o) T xo) < of log p((0o) ) p(z()) +
1|=66 =xol13
Dand (xo:: =
N
2
(mb:((
4

---

Published as a conference paper at ICLR 2023
and further, (ii) the purified sample : will have the ground-truth label if and only if xa falls into the following set, D (g(z))) := Uno: (20)(()))=((aa)) Duu (To: t). In other words. 'D (G(x))) is the robust region for data region (zv) under P!):t) and f.
Proof. (sketch) (i). Each convex half-space defined by the inequality corresponds to a 2 such that f(a)) * f(20)) where Fa within satisfies P (Xo- zo Fa,t) > P (Xtn #6 R2 f.,t)- This implies that P( 1) * x and f (P(a.; +5) fxr) The convexity is due to that the intersection of convex sets is convex. (ii). The "if" follows directly from (i). The "only if" holds because if La $ D (g(o): f). then exists 3 such that f(i1) * f(zo) and IP (&o- = T1 La,z) >
(Ko EooXx Fa.t) Vāo s.t. f(zo)= = fxx), and thus f (P((aa: +)) + f(zo).
Remark 3. Theorem 3.3 implies that when data region (mra) has higher data density and larger distances to data regions with other labels, it tends to have larger robust region and points in data re- gion tends to have larger radius. Since adversarial attack typically has small magnitude, with large robust region, the adversarial sample can be recovered to the clean sample with a high probability.
In the literature, people focus more on the robust radius (lower bound) r (g(zz);; t) (Cohen et al,, 2019 Carlini et al. 2022), which can be obtained by finding the maximum inclined ball inside ((G(z))) centering Zy. Note that although Duu (zu; t) is convex, D (g(z)); t) is generally not. Therefore, finding (G)))); t) is a non-convex optimization problem. In particular, it can be formulated into a disjunctive optimization problem with integer indicator variables, which is typi- cally NP-hard solve. One alternative could be finding the maximum inclined ball in Dan (ano: t), which can be formulated into a convex optimization problem whose optimal value provides lower bound for r (G(x));; t). However, D (G(z)); t) has the potential to provide much larger robustness radius because it might connect different convex robust sub-regions into one, as shown in Figure
D (2un(
x2
Foulh
D Dena (zoi
(
Xa
27
E 1
An illustration of the robust region D(æo; () samples with ground-truth label and æy is sample with another label. x, = Bg t6, is an adversarial sample such that P(x t) Ti # zo and thus the classification is correct but va is not reversed back to Zg. (xp) < r(zo) shows our claim that the union leads to a larger robust radius.
Figure 2:
U._, Dann(as; where æo, 31 22 are
In practice, we cannot guarantee to establish exact reverse process like reverse- SDE but instead try to establish an approximate reverse process to mimic the exact one. As long as the approximate reverse process is close enough the exact reverse process, they will generate close enough con- ditional distributions based on the adversarial sample. Then the density and locations of the data regions in two conditional distributions will not differ much and so is the robust region for each data region. We take the score-based diffusion model in [Song et al. (2021b) for an example and demonstrate Theorem 3.4 to bound the Kl-diieegeece between conditional distributions generated by freverse-SDD and score-based diffusion model. Ho et al. (2020) showed that using variational inference to fit DDPM is equivalent to optimizing an objective resembling score-based diffusion model with specific weighting scheme, so the results can be extended to DDPM.
Theorem 3.4. Under score-based diffusion model Song et al. 202 (02 and conditions B. we have (IP x X =x=xx, xa,)) =Px x x = x.,e)) JsM (0, t; X(-). where {ă and (m])re(o.e) are stochastic processes generated by reverse-SDD and score-based disflssion model
respectively. JeM(0, t; A(-) == 1/ Ep (X(T) || V log p. (x) - se(x, 1) dr, se(x, T) is the score function to approximate Vx loggp(( (x)), and À IR + R is any weighting scheme used in the training score-based diffusion models.
5

---

Published as a conference paper at ICLR 2023
Proof. (sketch) Let μ4 and Vi be the path measure for reverse processes (& hrejo.) and {xe! re respectively based on the aa,t. Under conditions B.1 H4 and V, are uniquely defined and the KL-
divergence can be computed via the Girsanov theorem Oksendal (2013).
Remark 4. Theorem 3.4 shows that if the training loss is smaller, the conditional distributions gen- erated by Trevers-SDD) and score-based diffusion model are closer, and are the same if the training loss is zero. Furthermore, by the Pinsker's inequality, the total variation (a distance metric) is upper
bounded by (xx
Xt (1P x x² =0,,)) S /V (0,
4 DENSEPURE
Inspired by the theoretical analysis, we introduce DensePure and show how to calculate its certified robustness radius via the randomized smoothing algorithm.
F Framework. Our framework. DensePure, consists of two components: (1) an off-the-shelff diffu- sion model with reverse process rev and (2) an off-the-shelf base classifier f.
The pipeline of DensePure is shown in Figure I Given input æ, we feed it into the reverse pro- cess rev of the diffusion model to get the reversed sample rev(x) and then repeat the above process K' times to get K reversed samples (rev(æ)1, samples into the classifier to get the corresponding prediction (f))) ... (rev(x)) (x))) and then apply the majority vote, termed MV, on these predictions get the final predicted la- bel I = (((((())()))))
.rev(œ) We feed the above K reversed
((rev(2))) k)}) arg max, Σ ((fer((() c]
Certified Robustness of DensePure with Randomized Smoothing.
In this paragraph, we will illustrate the algorithm to calculate certified robustness of DensePure via RS, which offers robustness guarantees for a model under a L2-norm ball.
In partieular, we follow the similar setting of Carlini et al. (2022) which uses a DDPM-based diffu- sion model. The overall algorithm contains three steps:
(1) Our framework estimates n, the number of steps used for the reverse process DDPM-based diffusion model. Since Randomized Smoothing (Cohen et al. 2019) adds Gaussian noise where E (0, o² I), to data input a to get the randomized data input, Tys x + e, we map between the noise required by the randomized example Iys and the noise required by the diffused data Dn (i.e., En N (ax: v Va, (1 a.) I)) with n step diffusion processing so that an = I467. In this [N]].
way, we can compute the corresponding timestep n, where = arg min, {(o, I+o=
(2). Given the above calculated timestep n., scale T.s with va, to obtain the scaled randomized smoothing sample Vo,, Then we feed Vanntrs into the reverse process of the diffusion model by K- K-times get the reversed sample set (#), 26. .0.. ...
(3). We feed the obtained reversed sample set into standard off-the-shelf classifier f to get the corresponding predicted labels {f(+t), (..,, ( ...))..., f }}, and apply majority vote, denoted MV(...) on these predicted labels to get the final label for Zr.--
Fast Sampling. To calculate the reversed sample, the standard reverse process of DDPM-based models require repeatedly applying "single-step" operation n times to get the reversed sample to (i.e.. E0 Reverse(.... -everse(.-RReeerseee Reverse (Revere( van n);n 1):... ..):... -.)). Here a; (overse(a;;1)) is equivalent to sample -; from N( po (f., i), Eo i)), where ne ( 1)
E0(;,, and Eg == exp(c log 3 + (1 v) log 3.). Here is a parameter learned by DDPM and 3, T-a; 1-8,-1
3.
VI-A
To reduce the time complexity, we the uniform sub-sampling strategy from Nichol & Dhari- wal 2021). We uniformly sample a subsequence with size b from the original N-step the re- verse process. Note that Carlini et al. (2022) set b 1 for the "one-shot" sampling, in this way, Lo - (I,, - /1 Ee Vr, n)) IS deterministic value so that the reverse process does the input. Instead, ber of the sub-sampled DDPM steps to be larger than one (b > 1) to sample from a posterior data distribution conditioned the input. The details about the fast sampling are shown in appendix C
Vo,,
not obtain posterior data distribution conditioned
tune the num-

---

Published as a conference paper at ICLR 2023
Cettifidd Accuracy o.)3))
CIFAR-10
ImngeNet
Method
Off-the-heeff
0.25
0.5
0.75
1.0
0.5
1.0
1.5
2.0
3,0
Pix Lecivee
2019
(21/1/22.0
(44020
Rah 20p
(11.6610
m3.0
(6.-919.00
Mimane et al
2019
02.00
Consustency
Join & Som
M120
(77-4668.8
110000000
(8101170
MACER
1
05-11570
(00 14.0
Boceting
Tonith c.
(5144200.
524
122-1570
(400gg 8
SmootMMX
Jeong et 2021
0774667.9
057.9
1743447.7
155-000000
17.0
Denoised
Siiman
2020
(2.0
1..
Loz 11
Carlim
Canint al. 2022
c0020000 0
22
Ours
(67-07666
(976
187/430044
190-07660
6250062.0
37,0
22.0
Table I: Certified accuracy compared with existing works. The certified accuracy at 0 for each
model is in the parentheses. The certified accuracy for each cell is from the respective papers except Carlini et al. (2022). Our diffusion model and classifier are the same as Carlini et al. (2022), where the off-the-shelf classifier uses ViT-based architectures trained on a large dataset (ImageNet-22k).
1.0
Ours o
0.500
Certified Accuracy
0.8
Cariin at al. 0.25.5
Certified Accuracy
0.8
Carioa u-00.5
Carini et 0
Cantni et d.50.50
0.6
0.6
Cantni et 0=0000
0.4
0.2
0.0
0.0
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
4.0
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
4.0
CIFAR-10
ImageNet
Figure 3: Comparing our method vs Carlini et al. (2022) on CIFAR-10 and ImageNet. The lines
represent the certified accuracy with different L2 perturbation bound with different Gaussian noise a E (0.25, 0.50, 1.00).
EXPERIMENTS
In this section, we use DensePure to evaluate certified robustness on two standard datasets, CIFAR- 10 (Krizhevsky al. 2009) and ImageNet (Deng et al. 2009).
Experimental settings We follow the experimental setting from Carlini et al. for CIFAR-10,
(022) Specifically,
the 50-M unconditional improved diffusion model from Nichol & Dhariwal
2021 as the diffuuion model. We select ViT-B/16 model Dosovitskiy et al. (020)) pretrained on
Ima and finetuned on CIFAR-I0 as the classifier, which could achieve 97.9% accuracy
on CIFAR-10. For ImageNet, we use the unconditional 256x256 guided diffusion model from Dhariwal & Nichol (222)) as the diffusion model and pretrained BEiT large model (Bao al. (021) trained on ImageNet-21k 2 as the classifier, which could achieve 88.6% top-1 accuracy on validation set of ImageNet- k.. We select three different noise levels a [0.25, 0.5, 1.0) for certification. For the parameters of DensePure, we set K 40 and b 10 except the results in ablation study. The details about the baselines are in the appendix.
5.1 MAIN RESULTS
We perform DensePure on the subset of CIFAR-10 or ImageNet. We choose the same subset as in Cohen et al. (2019), 500 samples for CIFAR-10 and 100 samples for ImageNet (the results with 500 samples are shown in the appendix DD.0). The results are shown in Table For CIFAR- 10, comparing with the models which are carefully trained with randomized smoothing techniques in end-to-end manner (i.e., w/o off-the-shelf classifier), we observe that our method with the standard fff-th classifier outperforms them at smaller e = {0.25, 0.5) on both CIFAR-10 10 and 10.75.1.03 Comparing
ImageNet datasets while achieves comparable performance at larger with the non-diffusion model based methods with off-the-shelf classifier (i.e., Denoised (Salman et al. 2020) and Lee (Lee 2021)), both method and Carlini et al. (2022) significantly better
7

---

Published as a conference paper at ICLR 2023
0.85
0.85
0.80
Certified Accuracy
Certified Accuracy
0.75
0.70
Carkin My
0.65
0.05
steps
radius 0.0
0.60
stens MV
0.60
rdlus 0.25
0.55
2 itens without NV
sings without NV
without
20
0.6
0.8
Majority Numbers
Figure 4: Ablation study ImageNet. The left image shows the certified accuracy among different vote numbers with different radius e E {0.0, 0.25, 0.5, 0.753. The right image shows the certified accuracy with different fast sampling steps b.
than them. These results verify the non-trivial adversarial robustness improvements introduced from the diffusion model. For ImageNet, our method is consistently better than all priors with a large margin.
Since both Carlini al. 2022) and DensePure use the diffusion model, to better understand the importance of our design, that approximates the label of the high density region in the conditional distribution, we compare DensePure with Carlini al. 2022) in a more fine-grand tnne-graindd manner.
We show detailed certified robustness of the model among different a at different radius for CIFAR- 10 in Figure left and for ImageNet in Figure righh. We also present our results of certified accu- racy at different in Appendix D.3 From these results, we find that our method is still consistently better at most e (except e = 0) among different a. The performance margin between ours and Carlini er al. (2022) will become even larger with a large e. These results further indicate that although the diffusion model improves model robustness, leveraging the posterior data distribution conditioned on the input instance (like DensePure ) via reverse process instead of using single sample ( (CCarlini ict al. 2022)) is the key for better robustness. Additionally, we use the off-the-shelf classifiers, which the ViT-based architectures trained larger dataset. In the later ablation study section, select the CNN- based architecture wide-ResN trained on standard dataset from scratch. Our method still achieves non-trivial robustness. Further, our experiments in Appendix D.7 shows that removing the diffusion model from DensePure deteriorates the performance. It further verifies that our design is -ri-iai
5.2 ABLATION STUDY
Voting samples (K) We first show how K affects the certified accuracy. For efficiency, we select
b = 10. We conduct experiments for both datasets. We show the certified accuracy among different r at 0.25 in Figure The results for 0.5. 1.0 and CIFAR-10 10 are shown in the Appendix D.4 Comparing with the bascline (Carlini et al. 2022). we find that a larger majority vote number leads better certified accuracy. It verifies that DensePure indeed benefits the adversarial robustness and making a good approximation of the label with high density region requires a large number of voting samples. We find that our certified accuracy will almost converge r = 40 for our experiments. The results with other show the similar tendency. To further improve the time efficiency, we can use K-Consensus (Horváth et al. 2021). It accelerates the majority vote process by 45% ~ 60% with negligible performance drop. The experimental details and results are in Appendix D.8
40. Thus, we set
Fast sampling steps (6) To investigate the role of b, we conduct additional experiments with b e (2,5) at a 0.25. The results on ImageNet are shown in Figure fand results for a = 0.5, 1.0 and CIFAR-10 are shown in the Appendix D.5 By observing results with majority vote, we find that larger can lead to better certified accuracy since a larger generates images with higher quality. By observing results without majority vote, the results show opposite conclusions where a larger b leads to a lower certified accuracy, which contradicts to our intuition. We guess the potential reason is that though more sampling steps can normally lead to better image recovery quality, it also brings more randomness, increasing the probability that the reversed image locates into a data region with the wrong label. These results further verify that majority vote is necessary for better performance.
8

---

Published as a conference paper at ICLR 2023
Certified Accuracy at e(%)
Datasets
Methods
Model
0.0
0.25
0.5
0.75
Model
0.0
0:25
0,5
0.75
CIFAR-10 Carlini (arlini et al.
2022
VII-B/16
93,0
76.0
57.0
47.0
WRN28-10
86.0
66.0
55.0
37.0
Ours
ViT-
92.0
82.0
69.0
56.9
WRN28- 10
90.0
77.0
63.0
50.0
ImageNet
Carlini
Cadinni ot al.
2022
BETT
77.0
76.0
71.0
60.0
WRNS0-2
73.0
67.0
57.0
48.0
Ours
BEIT
80.0
78.0
76.0
71.0
WRNS0-2
81.0
72.0
66.0
61.0
Table 2: Certified accuracy of our method among different classifier. BeiT and ViT are pre-trained on a larger dataset ImageNet-22k and fine-tuned at ImageNet- Ik and CIFAR-10 respectively. WideRes- Net is trained on ImageNet-Ik Ik for ImageNet and trained on CIFAR-I0 10 from scratch for CIFAR-10.
Different architectures One advantage of DensePure is to use the off-the-shelf classifier so that it can plug in any classifier. We choose Convolutional neural network (CNN)-based architectures: Side-ResNNe228100 (Zagoruyko & Komodakis 2016) for CIFAR-10 10 with 95.1% accuracy and Wide- ResNet50-2 for ImageNet with 81.5% top-1 accuracy.
0.25. The results are shown in Table 2 and Figure E in Appendix D.6 Results for more model architectures and a of ImageNet are also shown in Appendix (.6 We show that our method can enhance the certified robustness of any given classifier trained on the original data distribution. Noticeably, although the performance of CNN- based classifier is lower than Transformer-basee classifier, DensePure with CNN-based model as the classifier can outperform Carlini el al. (2022) with ViT-based model as the classifier (except c 0 for CIFAR-10).
RELATED WORK
Using an off-the- generative model to purify adversarial perturbations has become an important direction in adversarial defense. Previous works have developed various purification methods based on different generative models, such as GANs (Samangouei et al. 2018), autoregressive generative models (Song et al.) 2018), and energy energy-based models (Du & Mordatch, 2019; Grathwohl et al.) 2020 Hill et al. 2021). More recently, as diffusion models (or score- based models) achieve better generation quality than other generative models (Ho et al., 2020 Dhariwal & Nichol, 2021). > many
works consider using diffusion models for adversarial purification (Nie et 2022] Wu et al. [002] Sun et al. 2022) Although they have found good empirical results in defending against existing adversarial attacks (Nie et al. 2022), there is no provable guarantee about the robustness about such methods. On the other hand, certified defenses provide guarantees of robustness (Mirman et al. Cohen et |ll] 2219 Lecuyer et al. 2019 Salman et al. |
2018
Horváth et al. [021 Zhang et al.,
2018 Raghunathan et al. [2018a bj Salman et al. [0199b Wang al.) 2021). They provide lower bounder of model accuracy under constrained perturbations. Among them, approaches Lecuyer et al.
: et (2019): [Salman al. | (2019a); Jeong Shin (2020); /Zhai et al. al. (2020); Horváth eet al. (2021); Jeong et al. (202)); Salmmn et al.) (2020); Lee| (2021); Carlini et al. (2022) based on randomized smoothing (Cohen et al. 2019) show the great scalability and achieve promising
performance on large network and dataset. The most similar work to is Carlini et al. (2022), which
uses diffusion models combined with standard classifiers for certified defense. They view diffusion model as blackbox without having theoretical under- standing of why and how the diffusion models contribute to such nontrivial certified robustness.
7 CONCLUSION
In this work, we theoretically prove that the diffusion model could purify adversarial examples back to the corresponding clean sample with high probability, long as the data density of the cor- responding clean samples is high enough. Our theoretical analysis characterizes the conditional distribution of the reversed samples given the adversarial input, generated by the diffusion model reverse process. Using the highest density point in the conditional distribution as the deterministic reversed sample, we identify the robust region of given instance under the diffusion model re- verse process, which is potentially much larger than previous methods. Our analysis inspires us to propose an effective pipeline PensePure, for adversarial robustness. We conduct comprehensive experiments to show the effectiveness of DensePure by evaluating the certified robustness via the randomized smoothing algorithm. Note that DensePure is an off-the-shelf pipeline that does not require training a smooth classifier. Our results show that DensePure Pure achieves the new SOTA cer- tified robustness for perturbation with norm. We hope that our work sheds light on an in-depth understanding of the diffusion model for adversarial robustness.

---

Published as a conference paper at ICLR 2023
Limitations. The time complexity of DensePure is high since it requires repeating the reverse process multiple times. In this paper, we use fast sampling to reduce the time complexity and show that the setting (b 2 and K 10) achieve nontrivial certified accuracy. We leave the more advanced fast sampling strategy as the future direction.
ETHICS STATEMENT
Our work can positively impact the society by improving the robustness and security of Al systems. We have not involved human subjects or data set releases; instead, we carefully follow the provided licenses of existing data and models for developing and evaluating our method.
ACKNOWLEDGMENT
We thank the support of NSF grant 19.1000100, NSF CNS 2046726, C3 Al and DHS under grant No. 17STQAC00001-00 -06-00, DARPA under grant N66001-15-C-4066 the Center for Long-Term Cybersecurity, and Berkeley Deep Drive. Any opinions, findings, conclusions, recommendations expressed in this material are those of the authors, and do not necessarily reflect the views of the sponsors.
REPRODUCIBILITY STATEMENT
For theoretical analysis, all necessary assumptions are listed in B.1 and the complete proofs are included in B.2] The experimental setting and datasets are provided section The podudo-code for DensePure ure is in C.1 and the fast sampling procedures are provided in C.2
REFERENCES
Brian DO Anderson. Reverse-time diffusion equation models. Stochastic Processes and their Ap- plications, 12(3):3133326, 1982.
Hangho Bao, Li Dong, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.0888 08254, 2021.
Nicholas Carlini, Florian Tramer, Zico Kolter, et al. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206. 10550, 2022.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pp. 1310-1320. PMLR, 09-15 Jun 2019. URL htttps://proceeed/eea
ppress/v91 www.cchhhc.cccc 9ttps//1////chhe1...b.mmm
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-24482 255. leee, 2009.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in Neural Information Processing Systems, 34:8780-8794, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint 0rXiv:2010.11922, 2020.
Yilun Du and Igor Mordatch. Implicit generation and modeling with energy based models. Advances in Neural Information Processing Systems, 2019.
Will Grathwohl, Kuan-Chiel Wang, foem--Herte Jacobsen, David Duvenaud, Mohammad Norouzi, and Kevin Swersky. Your classifier is secretly an energy based model and you should treat it like one. In International Conference Learning Representations, 2020.
10

---

Published as a conference paper at ICLR 2023
Mitch Hill, Jonathan Craig Mitchell, and Song- Song-Chun Zhu. Stochastic security: Adversarial defense using long-run mung-run dynamics of energy-based models. In International Conference on Learning Rep- resentations, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models, 2020. URL
https://arxiis www.ooggg///ooooooooooo//eeoe wwwp///....... 11239
Miklós Z. Horváth, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. arXiv preprint arXiv:2 (0t:::2006009466, 2021.
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. Advances in Neural Information Processing Systems, 33:10558-10570, 2020.
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chang Lee, Do-Guk Kim, and Jinwoo Shin. smoothed classifiers for certified robustness. Ad- vances in Neural Information Processing Systems, 34:30153-30168, 2021.
Smoothmix: Training
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP). pp. 656-672. IEEE, 2019.
Kyungmin Lee. Provable defense by denoised smoothing with learned score function. In ICLR Workshop on Security and Safety in Machine Learning Systems, 2021.
Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for prov- ably robust neural networks. In International Conference on Machine Learning, pp. 3578-3586. PMLR, 2018.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffuuson probabilistic models. In International Conference on Machine Learning, pp. 8162-8171. PMLR, 2021.
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
Bernt Oksendal. Stochastic differential equations: an introduction with applications. Springer Science & Business Media, 2013.
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial exam- ples. In International Conference on Learning Representations, 201 Sa.
Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying robustness to adversarial examples. In NeurlPS, 2018b.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers, Ad- vances Neural Information Processing Systems, 32, 2019a.
Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A convex relax- ation barrier to tight robustness verification of neural networks. Advances in Neural Information Processing Systems, 32:9835-9846, 2019b.
Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems, 33:21945 21957, 2020.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gai gan: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Represen- fations, 2018.
11

---

Published as a conference paper at ICLR 2023
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Leveraging generative models to understand and defend against adversarial examples. In Inter- national Conference Learning Representations, 2018.
Yang Song, Conor Durkan, lain Murray, and Stefano Ermon. Maximum likelihood training of score- based diffusion models. Advances in Neural Information Processing Systems, 34:1415-1428, 2021a.
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In Interna- tional Conference on Learning Representations, 202 lb.
Jiachen Sun, Weili Nie, Zhiding Yu, Z. Morley Mao, and Chaowei Xiao. Pointdp: Diffusion- driven purification against adversarial attacks on 3d point cloud recognition. arXiv preprint wrXiv:2208.0980) 2022.
Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based generative modeling in latent space. Advances in Neural Information Processing Systems, 34: 1287-11333,,, 2021.
Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and Zico Kolter. Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification. Advances in Neural Information Processing Systems, 34:29909-29921, 2021.
Quanlin Wu, Hang Ye, and Yuntian Gu. Guided diffusion model for adversarial purification from random noise. arXiv preprint arXiv:2206. 2022.
Sergey Zagoruyko and Nikos Komodakis. 165.v:1605.071466, 2016.
Wide residual networks.
arXiv preprint
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-fres free and scalable robust training via maximizing certified radius. arXiv preprint arXiv:2001.02378 2020.
Huan Zhang, Tsui- Weng, Pin- Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. In NeurIPS, 2018.
12

---

Published as a conference paper at ICLR 2023
APPENDIX
Here is the appendix.
A NOTATIONS
p
data distribution
P(A)
probability event A set of functions with continuous k-th derivatives standard Wiener Process
c
(t)
(t)
reverse-time standard Wiener Process
t(x,t)
drift coefficient in SDE
g(t)
diffusion coefficient in SDE
a
scaling coefficient time
of
variance of added Gaussian noise at time f diffusion process generated by SDE reverse process generated by reverse-SDE distribution of x, and & diffusion process generated by DDPM pre-defined noise scales in DDPM adversarial attack
(x1hej0,1)
(x1, X2: , xN)
{8.))
ca
adversarial sample
Ca.
scaled adversarial sample
f(-)
classifier
g())
smoothed classifier
(Stn x/ sra.t)
density of conditional distribution generated by reverse- SDE based on a,,t
P(Eait)
purification model with highest density point
((xv)
data region with the same label Zo
()(((z)):
robust region for G(x)) associated with base classifier f and purification model P
r t)
robust radius for the point associated with base classifier f and purification model P
(2u t)
convex robust sub-region score function
so(x,t) 1)
{x] (x]]ee0011
reverse process generated by score-based diffusion model density of conditional distribution generated by score- based diffusion model based on Ca.
(xH = x|x] Io.1)
X(7)
weighting scheme of training loss for score-based diffusion model
(0
truncated training loss for score-based diffusion model
Pr, Vt
path measure for {*r)re(o.d] and [x)rr()))) respectively
13

---

Published as a conference paper at ICLR 2023
B MORE DETAILS ABOUT THEORETICAL ANALYSIS
B.1 ASSUMPTIONS
(i The data distribution E C² and Ee-p [ [2] < cc.
iii Vt E [0. h(.tt) e C² 3C 0, Va E R,,t [0. T] [[h(a, < C [
(ii) 30 0, Vz, y E R" ||((z,t) h(y t)Ile & C| - vll..
(iv) C and VŁ = [0, [t) 0.
(v) Vt E [0, sa(.tt e C² 30 > 0, to E p2 t E [0, || t)ll2 & C1 + |
(vi) 3C 0, Vx, y E R= ||,0( t) so t)]l2 C| yll..
B.2 THEORRES AND PROOFS
Theorem 3.1. Under conditions B.7 solving equation reverse- SDE starting from time and point
Fa, Vaiia will generate reversed random variable Xo with conditional distribution
P (Ro x/x; = wa.t) xx p(æ)
20
(2To²)"
where of l-as is the variance of the Gaussian noise added at timestamp in the diffusion
process SDE
Proof. Under the assumption, we know fx, (xeeeeoo11 and {xetreto.11 follow the same distribution, which means
P(X0 2, Fo,t)
PP (So- x 8c xa.e)
P((: (a,,))
P(xo x. Faa1.)
PP(x, aa,st)
P(x; Da.t XU x))
= =P (xo xx)
P(x: Fa,t)
x 1PP(x x))
(2TT??)
p(x))
20
(2To?))
where the third equation is due to the chain rule of probability and the last equation is result of the diffusion process.
Theorem 3.3. Under conditions B.1 and classifier f. let Do be the sample with ground-trun truth label and D. be the adversarial sample, then (i) the purified sample P(x.;; t)) will have the ground-truth label if aa falls into the following convex set,
p(2o) p(x1)
||a66 mo 2
Danb (woit) t) =
xa (Ea T xx) < of log
(al:
and further, (ii) the purified sample P(xa: will have the ground-truth label if and only xa falls into the following set, 'D (G(m)); t) = ( f(ro)) Danr (To; t). In other words, 'D (G(z)):t) is the robust region for data region ((xv) under P(-:t) and f.
Proof. We start with part (i).
14

---

Published as a conference paper at ICLR 2023
The main idea is to prove that point z such that f(x() f(xu) should have lower density than zy the conditional distribution in Theorem 3.1 so that a t) cannot be z/6. In other words, we should have
IP (Ko- Fol8; = Fa,t) > P (Xo a' X2 Ia,t).
By Theorem
3.1 this equivalent to
11au-mu113 207
-11 20?
p(xo)
> >p(20))
(2ma²²)
v V(zTO?)"
p(
1
+> log
(||00 Fall2
||/66 xo xal12)
(((r())
207
p(w()
1
<> log
(||æ0 vall2 1| 200 + 20
Vna (2l1))
(((r6))
2
p(x2o)
1
+ log
(2(xa xo) 72'6 xo) ||/6 xo xo11))
p(xx())
20
Re-organizing the above inequality, we obtain
p(zn) p(2%))
(aa ( Ta'b xo) < of log
|/%6
xo.12
Note that the order of za is at most one in every term of the above incquality, so the inequality actually defines a half-space IR" for every (Io, x/)) pair. Further, we have to satisfy the inequality for every o such that f(ar)) # (2=0), therefore, by intersecting over all such half-spaces, obtain a convex Duub (Doit) t).
Then prove part (ii).
On the one hand, Ha E D t)) then there exists one Tp such that f(ăn) = f(x) and Ta Dun (æo; l). By part (i), Bo has higher probability than all other points with different la- bels from 26 in the conditional distribution PP P - = Fa,() characterized by Theorem 3.1 Therefore, P(xa:t t) should have the same label as He. On the other hand, va & (Zoz)):
then there is point I1 with different label from vo such that for any To with the same label as æo. P (Xg- 2 xx Fa,t) P (Xo o = Ta,t)- other words, P(x.; would have different label from Co.
Theorem 3.4. Under score-based diffasiio model (Snn el al. (2021b) and conditions B. bound
we can
(TP(O0 = x X2 = TP,)) = x x² xa,))) = JSM (0,
where (Ør brrrue and (xf bre(o.0] are stochastic processes generuted by reverse-SDD and score- based diffusion model respectively,
1 (0, = Ep.(x) ((()) V lx) - so(x, T) dr,
so(x,7 T) is the score function approximate Vx log py (x), and A IR + any weighting scheme used in the training score-based diffusion models.
Proof. Similar to proof of (Song et al. 202 Theorem 1), let μ4; and v; be the path measure for
reverse processes (x, re(o.r) and [ re(o.t] respectively based on the scaled adversarial sample
Catt- Under conditions B.I the KL-ddivergence can be computed via the Girsanov theorem Oksendal
15

---

Published as a conference paper at ICLR 2023
2013):
DRL. (P(80- x
8: [P.:) - x1 x voot))
dv:
=- Eu
log
du:
g(T) (Vx (x) s0(x,,)) dw, 1
2 ( [(2)=1(2))))p s0(x, r)ll dr
Esg.
1
Egg
2 VV2) - 50(x,T)]
2 / Epr(x) (9())² |V (x) s0(x, r)1 dr
1
= JsM (6, t: (;))
where (i) is due to Girsanov Theorem and (ii) is due to the martingale property of Itô integrals.
C MORE DETAILS ABOUT DENSEPURE
C.I PSEUDO-CODE
We provide the pseudo code of DensePure in Algo. and Alg.
Algorithm DensePure pseudo-code with the highest density point
1: Initialization: choose off-the-shelf diffusion model and classifier f. choose a/ = t,
2: Input sample 2a 36 Ea
3: Compute io- = P P(xai
4: (
Algorithm 2 DensePure pseudo-code with majority vote
1: Initialization: choose off-the- thelf diffusion model and classifier f. choose
2: Compute 0 I n1 = arg min, { { I+o7
8 E {1, 2, ... .N., NN3
3: Generate input sample 2ss 2o + 6, N(0
4: Choose schedule Sh get #1 +- rev T i 1,2,, 2,......A K with Fast Sampling
5: 0 MV(I f(a)) }} = arg max, ΣK 1(f(t)) = c}
C.2 DETAILS ABOUT FAST SAMPLING
Applying single-step operation n times is a time-consuming process. In order to reduce the time complexity, we follow the method used in (Nichol & Dhariwal 2021 and sample subsequence
Sh with values (i.c., 5hh {n. In
n
where 5/ is the j-th element in Shh and ST. ,111 1.....,)...
In - in Vj < and St. = 1) from the original schedule S (i.e., S = {n, 1, 1.... 1}. where
S, = j is the j-th element in S).
Within this context, we adapt the original a schedule 5 = {a1, ai, ....... ann used for single-
step to the new schedule s ". " [ (i.., a.Sh a
is the
i-th element in S We calculate the corresponding 35t {3s" 1385
8
B and
3s* = (3 35*
3s*
35* schedules, where Agb 85
3 S4
Bsg. With these new schedules, we can use times reverse steps calculate
1-
16

---

Published as a conference paper at ICLR 2023
Certified Accuracy e(%)
Methods
Noise
0.0
0.25
0.5
0.75
1.0
0.25
88.0
73.8
56.2
41.6
0.0
Carlini (Carlini al. 2022
0.5
74.2
62.0
50.4
40.2
31.0
1.0
49.4
41.4
34.2
27.8
21.8
0.25
87.6(-0.4)
76.6(+2.8)
64.6(+8.4)
50.4(+8.8)
0.0(+0.0)
Ours
0.5
73.6(-0.6)
65.4(43.4)
55.6(45.2)
46.0(+5.8)
37.4(+6.4)
1.0
55.0(+5.6)
47.8(+6.4)
40.8(46.6)
33.0(+5.2)
28.2(46.4)
Table A: Certified accuracy compared with Carlini et al. (2022) for CIFAR-10 at all a. The numbers the bracket are the difference certified accuracy hetween two methods. Our diffusion model and classifier are the same as Carlini et al. (2022).
æo Reverse(... R....Reeeeeeeeeee Reverse((Reverse(en) Sh); St .)...... Since Ea(#s; St) is parameterized
6 range between 3 and 8 it will automatically rescaled. Thus, &s Reverse( St) equivalent to sample st from s( st S!), st St)).
D MORE EXPERIMENTAL DETAILS AND RESULTS
D.1 IMPLEMENTATION DETAILS
We select three different noise levels E (0.25, 0.5, 1.0} for certification. For the parameters of DensePure, The sampling numbers when computing the certified radius are 100,000 000 for
evaluate the certified robustness on 500 samples subset of CIFAR-10 testset and 100 samples subset of ImageNet validation set. we set K 40 and b = 10 except the results ablation study.
CIFAR-10 and n 10, 000 for ImageNet.
D.2 BASELINES.
We select randomized smoothing based methods including PixeIDP (Lecuyer et al.) 2019). RS (Co-
hen et al. 2019), SmoothAdv (Salman et al.) 2019a). 9a), Consistency (Jeong & Shin 2020). MACER
(Zhai et al. 2020), Boosting (Horváth et al. 2021 SmoothMix (Jeong et al. 2021). Denoised Salman et al. 2020), Lee (Lee (021). Carlini (Carlini et al. 2022) our baselines. Among them, PixeIDP, RS, SmoothAdv. Consistency, MACER, and SmoothMix require training a smooth clas- sifier for better certification performance while the others do not. Salmmn et al. and Lee use the off-the-shelf classifier but without using the diffusion model. The most similar one compared with us is Carlini et al.) which also uses both the off-the-shelf diffusion model and classifier. The above two settings mainly refer to Carlini et al. (2022), which makes us easier to compared with their results.
D.3 MAIN RESULTS FOR CERTIFIED ACCURACY
We compare with Carlini al. 2022 in more fine- fine-grained version. We provide results of certified
accuracy at different e in Table A for CIFAR- 10 and Table|Boo for ImageNet. We include the accuracy difference between tables that the certified accuracy of our method outperforms Carlini et al. (2022 except = 0 at 0.25, 0.5 for CIFAR-10.
and Carlini al. (2022) in the bracket in Tables. We observe from the
D.4 EXPERIMENTS FOR VOTING SAMPLES
Here provide experiments with {0.5. 1.0) and b 10 for different voting samples K in
Figure [A] and Figure B The results for CIFAR- 10 is in Figure G We can draw the same conclusion mentioned in the main context.
17

---

Published as a conference paper at ICLR 2023
Certified Accuracy at c(%)
Methods
Noise
0.0
0.5
1.0
1.5
2.0
3.0
a 0.25
77.0
71.0
0.0
0.0
0.0
0.0
Carlini Carlinii et al. 2022
a 0.5
67.0
54.0
46.0
0.0
1.0
59.0
53.0
49.0
38.0
29.0
80.0(+3.0)
76.0(+5.0)
0.0(+0.0)
0.0X+0.0)
0.0(+0.0)
0.0(+0.0)
Ours
0.5
75.0(+1.0)
72.0(+5.0)
62.0(+8.0)
49.0(+3.0)
0.0X+0.0)
0.0(+0.0)
1.0
61.0(+2.0)
57.0(+4.0)
53.0(+4.0)
49.0(+11.0)
37.0K8..0)
26.0(+4.0)
Table B: Certified accuracy compared with Carlini (2022) for ImageNet at all σ. The numbers in the bracket are the difference of certified accuracy between two methods. Our diffusion model and classifier are the same as Carlini al. (2022).
0.8
Certifre Accuracy
0.7
Certified Accuracy
0.5
radius 0.0
redlus 0.25
redias
0.4
0.5
redius 0.5
redius 100
radius=1.0
redius
0.3
5
15
25
40
20
Majority Vote Numbers
Majority Vote Numbers
CIFAR=10
ImageNet
Figure A: Certified accuracy among different vote numbers with different radius. Each line in the figure represents the certified accuracy among different vote numbers with Gaussian noise a = 0.50.
D.5 EXPERIMENTS FOR FAST SAMPLING STEPS
We also implement additional experiments with b E {1,2, 1.0. The results shown in Figure C and Figure D The results for CIFAR-10 are in Figure G We draw the same conclusion mentioned in the main context.
D.6 EXPERIMENTS FOR DIFFERENT ARCHITECTURES
We try different model architectures of ImageNet including Wide ResNet-50-2 and ResNet 152 with b = 2 and K 10. The results are shown in Figure F. We find that our method outperforms (Carlini
ct al. 2022) for all a among different classifiers.
D.7 EXPERIMENTS FOR RANDOMIZED SMOOTHING WITHOUT DIFFUSION MODEL
To show the effectiveness of our diffusion model design, we remove the diffusion model from our pipeline and conduct experiments. Specifically, first, remove the diffusion model and perform randomized smoothing only on the pretrained classifier that we used in Dense (i.e., ViT-B/16 for CIFAR- 10 and BEiT for ImageNet). The results are shown in Table and Table D The number in the bracket is the robust accuracy of pretrained classifier the robust accuracy of DensePure. From the result, we conclude that without the help of diffusion models, neither ViT nor BEiT could reach high certified accuracy.
Second, we conduct additional experiments to fairly compare with randomized smoothing without diffusion models under majority vote settings. Specifically, activate droppath in BETT at the inference stage to support majority votes. The other settings are the same as DensePure. The results shown in Table The number in the bracket is calculated by the robust accuracy of BeiT with majority votes the robust accuracy of DensePure. We find that simply performing majority votes on the BeiT classifier will not result in higher certified robustness.
18

---

Published as a conference paper at ICLR 2023
Certifie Accuracy
0.3
Certified Accuracy
0.5
0.4
0.3
redius 0.0
redius 0.5
redius 110
0.2
radius 0.5
0.2
radlus 0.75
radias
1.0
redias 3.0
15
0
10
15
20
25
30
35
40
Majority Vote Numbers
Majority Vote Numbers
CIFAR=10
ImageNet
Figure B: Certified accuracy among different vote numbers with different radius. Each line in the figure represents the certified accuracy among different vote numbers with Gaussian noise
1.00.
0.8
Carliil dt.
Corlin et steps with MV
MV
Certifed Accuracy
0.6
steps without MV
Certified Accuracy
stops
MV
10 steps without MV
0.5
0.4
0.3
0.5
0.4
0.1
0.0
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2.00
Radius
Radius
CIFAR=10
ImageNet
Figure C: Certified accuracy with different fast sampling steps Each line in the figure shows the certified accuracy among different L2 adversarial perturbation bound with Gaussian noise 0.50.
Third, to compare with randomized smoothing without diffusion model, we also evaluate certified accuracy with Gaussian augmentation-traanee VIT models on CIFAR-10. The results shown in the table that DensePure still achieve higher certified accuracy than randomized smoothing on even Gaussian augmented models without diffusion models. The numbers in the bracket are the difference between the robust accuracy of Gaussian augmentation randomized smoothing and DensePure.
D.8 EXPERIMENTS FOR K-CONSENSUS AGGREGATION
To improve the efficient our algorithm, we try the K-consensus Aggregation, where an early stop will be triggered if the classification results of the K consecutive reversed samples are the same. Here we calculate the certified robustness for 100 subsamples of CIFAR- 10 and ImageNet with sampling steps, maximum 10 majority votes and consensus threshold k=3. Results are shown in Table G and Table H The column of Avg MV" in the tables means the average of the actual number of majority votes required for algorithm. For instance, if the predicted labels of the first 3 reversed samples are the same, the actual majority vote numbers will be 3. The numbers in the bracket are the difference between certified accuracy w/o K-Consensus Aggregation.
D.9 EXPERIMENTS FOR CERTIFIED ACCURACY WITH LESS SAMPLING STEPS AND VOTE NUMBERS
We also conduct additional experiments with 2 sampling steps and majority votes. The results are shown in Table T] We find that our method still achieves better results than the existing method.
19

---

Published as a conference paper at ICLR 2023
styps
5hops with
0.5
10 steps with NV
10 stops with
Certified Accuracy
without
Certified Accuracy
0.5
0.4
steps
steps MV
0.2
0.1
0.2
0.1
1.5
2.0
4.0
0.0
0.5
1.0
1.5
2.0
2.5
3.0
3.5
Radius
Radius
CIFAR=10
ImageNet
Figure D: Certified accuracy with different fast sampling steps 6. Each line in the figure shows the certified accuracy among different L2 adversarial perturbation bound with Gaussian noise 1.00.
BET
Ours Kide Restiet
0.8
Cartin et al. WI
0.8
Certifed Accuracy
Carini of al. Wide RosNet
Certified Accuracy
Cantii at al, Wide ResNet
0.6
0.6
0.4
0.2
0.0
0.2
0.4
0.6
0.8
1.0
Radius
Radius
CIFAR=10
ImageNet
Figure E: Certified accuracy with different architectures. Each line in the figure shows the certified accuracy among different L2 adversarial perturbation bound with Gaussian noise 0.25.
D.10 EXPERIMENTS FOR DENSEPURE 500 TEST SAMPLING NUMBER RESULTS ON IMAGENET
We increase the ImageNet test sampling number from 100 to 500 and update the experiment results in aad Table K
We can draw the similar conclusion.
20

---

Published as a conference paper at ICLR 2023
1.0
1.0
Ours a m0.55
Our o 0:25
0.50
Dura p0.50
0.8
0.8
0.000
Certified Accuracy
0-0.25
Certified Accuracy
etal
Carini et 0m00.0
Cantni et 0.50
0.6
Canin at at. om 1.00
Carini at om 1.00
0.4
0.2
0.0
0.0
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.5
4.0
0.0
0.5
1.0
2.0 Radius
2.5
3.0
3.5
4.0
Wide ResNet-50-2
ResNet152
Figure F: Certified accuracy of ImageNet for different architectures. The lines represent the certified accuracy with different L2 perturbation bound with different Gaussian noise a {0.25, 0.50, 1.00).
0.85
0.85
0.80
Certified Accuracy
Certified Accuracy
0.75
0.70
0.65
steps with NY
with
aduus 0.0
0.60
0.60
eddux 0.25
raduus
0.55
steps without WV
without
addus
steps
0.55
0.50
10
40
0.0
0.2
0.6
0.8
Majoriky Vote Numbers
Radius
ImageNet
ImageNet
Figure Ablation study. The left image shows the certified accuracy among different vote num- bers with different radius E {0.0, 0.25, 0.5, 0.75J. Each line in the figure represents the certified accuracy of our method among different vote numbers K with Gaussian noise a 0.25. The right image shows the certified accuracy with different fast sampling steps b. Each line in the figure shows the certified accuracy among different Le adversarial perturbation bound.
Certified Accuracy c(%)
Noise
0.0
0.25
0.5
0.75
1.0
0.25
20.8(-66.8)
7.4(-69.2)
1.8(-62.8)
0.2(-50.2)
0.0(+0.0)
0.5
11.6(-62.0)
6.6(-58.8)
3.8(-51.8)
1.2(-44.8)
0.2(-37.2)
= 1.0
10.6(-44.4)
10.6(-37.4)
9.4(-31.4)
9.4(-23.6)
9.4(-18.8)
Table C: Certified accuracy of randomized smoothing on pretrained classifier VTT-B/16 all for CIFAR-10
Certified Accuracy c(%)
Noise
1.0
1.5
3.0
= 0.25
73.2(-10.8)
55.8(-22.0)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
0.5
7.8(-22.4)
4.6(-71.0)
3.2(-63.8)
1.0(53.6)
0,0(+0.0)
0.0(+0.0)
1,0
0.0(667.8)
0.0(661.)
0.0(-55.6)
0.0(-50.0)
0.0(-22.2)
0.0(25.88)
Table D: Certified accuracy of randomized smoothing pretrained classifier BEÎT all for ImageNet
21

---

Published as a conference paper at ICLR 2023
Certified Accuracy e(%)
Noise
0.0
0.5
1.0
1.5
2.0
3.0
o 0.25
73.8(-10.2)
58.0(-19.8)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
0 0.5
9.0(-71.2)
7.0(-68.6)
4.0(-63.0)
2.0(-52.6)
0.0(+0.0)
0.0(+0.0)
0 1.0
0.0(-67.8)
0.0(-61.4)
0.0(-55.6)
0.0(-50.0)
0.0(-42.2)
0.0(-25.8)
Table E: Certified accuracy of randomized smoothing on droppatch activated BEiT with 10 majority votes at all a for ImageNet
Certified Accuracy at e(%)
Noise
0.0
0.25
0.5
0.75
1.0
0.25
88.2(+0.6)
71.4(-5.2)
53.2(-11.4)
35.2(-15.2)
0.0(+0.0)
0.5
69.8(-3.8)
60.0(-5.4)
48.4(-7.2)
37.2(-8.8)
27.2(-10.2)
1.0
49.0(-6.0)
41.8(-6.0)
34.0(-6.8)
27.0(-6.0)
22.0(-6.2)
Table F: Certified accuracy of randomized smoothing on Gaussian augmentation-trainnt ViT at all CIFAR-10
Certified Accuracy at <(%)
Noise
0.0
0.25
0.5
0.75
1.0
Avg MV
0.25
92(+0.0)
77(+0.0)
60(+0.0)
48(-1.0)
0(+0.0)
3.84
0.5
74(+0.0)
65(+0.0)
53(-1.0)
45(+0.0)
40(+0.0)
4.43
σ 1.0
53(+0.0)
46(+0.0)
42(+0.0)
31(+0.0)
25(+0.0)
5.49
Table G: Certified accuracy and average majority votes with 2 sample steps and k consensus threshold at all a for CIFAR-10.
Certified Accuracy at <(%)
Noise
0.0
0.5
1.0
1.5
2.0
3.0
Avg MV
0.25
78(+0.0)
74(+0.0)
0(+0.0)
0(+0.0)
0(40.0)
0(+0.0)
3.34
0.5
75(+0.0)
69(+0.0)
61(+0.0)
47(+0.0)
0(+0.0)
0(+0.0)
3.89
1.0
60(+0.0)
54(+0.0)
50(+0.0)
41(+0.0)
32(40.0)
23(+0.0)
5.23
Table H: Certified accuracy and average majority votes with 2 sample steps and k consensus threshold at all a for ImageNet.
Certified Accuracy at c(%)
CIFAR-10
ImageNet
Noise
0.0
0.25
0.5
0.75
1.0
0.0
0.5
1.0
1.5
2.0
3.0
0.25
87.6
74.8
59.2
44.6
0.0
78
74
0
0
0
0
0.50
73.2
62.6
52.6
41.8
34.0
75
69
58
0
0 1.00
53.4
44.0
35.8
30.2
24.4
60
54
49
39
30
22
Table Certified accuracy with 2 sampling steps and vote numbers at all a for both CIFAR-10 and ImageNet
22

---

Published as a conference paper at ICLR 2023
Centiied o(%)
CIPAR-10
ImageNet 1.5
OfT-he-shelf
0.25
PixeDD et
2019
(7.6:22.0
(44.02.0
16.0
RS (f HBM
63.00
00.0
1960110
SmoothAdy
Salman
201
63.
0
(4.01180
(o R1081
(a 61.1170
MACER
2hirg M1:1
919.00
6/25.0
Boosting
Hervalbett d: X01
2206
22122
SmorthMr
Boong
(77667
(TT
(74204777
(15/110.0
(a10/260
(02
Lae
600
410
240
Carlmn
Crrlin et al
2022
956.2
17.0
10.0
06 9766
(97 64.6
(90395446
424
(47
0 for each model is in the parentheses. The certified accuracy for each cell is from the respective papers except Carlini al. (2022). Our diffusion model and classifier are the same as Carlini al. (2022), where the off-the- shetthh-shelf classifier uses ViT-based architectures trained on a large dataset (ImageNet-22k).
Table Certified accuracy compared with existing works. The certified accuracy
Certified Accuracy <(%)
Methods
Noise
0.0
0.5
1.0
1.5
2.0
3.0
0.25
82.0
74.0
0.0
0.0
0.0
0.0
Carlini Carliini ct al. 2022
a 0.5
77.2
71.8
59.8
47.0
0.0
0.0
8 1.0
64.6
57.8
49.2
40.6
31.0
19.0
a 0:25
84.0(+2.0)
77.8(+3.8)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
0.0(+0.0)
Ours
0.5
80.2(+3.0)
75.6(+3.8)
67.0(+7.2)
54.6(+7.6)
0.0(+0.0)
0.0(+0.0)
L.0
67.8(43.2)
61.4(+3.6
55.6(+6.4)
50.0(+9.4)
42.2(+11.2)
25.8(+6.8)
Table K: Certified accuracy compared with Carlini et al. 2022) for ImageNet at all a. The numbers in the bracket the difference of certified accuracy between two methods. Our diffusion model and classifier are the same as Carlini et al. (2022).
23


Reviews:
[{"review_id": "vyxTGeFBVVD", "reviewer": "Reviewer_HvUT", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper studies the conditions under which diffusion model can work well for purification of adversarially perturbed samples. A simple diffusion-based purification method named DensePure is proposed by using majority vote  and achieves higher certified accuracy in comparison with other method on CIFAR-10 and ImageNet. ", "summary_of_the_review": "In general, this paper provides novel theoretical results and an effective algorithm.  I suggest \"marginally above the acceptance threshold\" mainly due to \"Weakness (W2) Claimed but seemingly not well-supported contributions\". See Weakness (W2) for more details. ", "strength_and_weaknesses": "Strengths:\n\nS1) Theoretical strength: This paper theoretically analyzes why and how diffusion-based purification model can enhance the adversarial robustness of a given classifier for the first time. The robust region of a sample (under a deterministic inverse purification process and a base classifier)  is characterized as the union of several convex sub-robust regions (indexed by samples with the same ground truth label). The newly characterized robust region may provide with a larger robust radius than other methods, which indicates better robustness. \n\nS2) Modelling/algorithmic strength:  The proposed DensePure performs consistently better than existing methods on ImageNet, with 7% improvement on average. \n\nWeaknesses:\n\nW1) Time complexity of DensePure: As it requires repeating the reverse process multiple times, DensePure is really time-consuming and this drawback may prevent it from further applications to large datasets.\n\nW2) Claimed but seemingly not well-supported contributions:  The authors claimed their first contributions as \"We prove that under constrained data density property, an adversarial example can be recovered back to the original clean sample with high probability via the reverse process of a diffusion model\". However, it seems not well-supported. The reason is as follows:\n\nLet $x_0$ be the clean sample and $x_a$ be its adversarially perturbed sample. \nTheorem 3.1 characterizes the distribution of inversed variable $\\hat{x}_0$ from a scaled adversary $x\\_{a,t}=\\sqrt{\\alpha}\\_t x\\_a$ as \n$$ \\mathbb{P}(\\hat{x}_0=x|\\hat{x}\\_t=x\\_{a,t}) \\propto p(x)\\cdot\\frac{1}{\\sqrt{(2\\pi\\sigma^2_t)^n}}\\textnormal{exp}\\big(\\frac{-\\|\\|x-x_a\\|\\|_2^2}{2\\sigma^2_t}\\big)$$ Letting $x=x_0$, we obtain\n$$ \\mathbb{P}(\\hat{x}_0=x_0|\\hat{x}\\_t=x\\_{a,t}) \\propto p(x_0)\\cdot\\frac{1}{\\sqrt{(2\\pi\\sigma^2_t)^n}}\\textnormal{exp}\\big(\\frac{-\\|\\|x_0-x_a\\|\\|_2^2}{2\\sigma^2_t}\\big)$$\n\nwhich seems unable to directly imply \"$\\mathbb{P}(\\hat{x}_0=x_0|\\hat{x}\\_t=x\\_{a,t})$ is high\" or \"$\\mathbb{P}(\\|\\|\\hat{x}_0-x_0\\|\\|\\le \\delta |\\hat{x}\\_t=x\\_{a,t})$ is high with a small $\\delta$\". \n\nSo, I failed to understand why \"under constrained data density property, an adversarial example can be recovered back to the original clean sample with high probability\". What is the \"constrained data density property\"? Can the authors provide upper bounds on $\\|\\|\\hat{x}_0-x_0\\|\\|$ to verify \"an adversarial example can be recovered back to the original clean sample with high probability\"? Did I miss something?\n\n----------------After rebuttal------------\nIn the rebuttal, both of my main concerns about \"Weakness 1: Time complexity of DensePure\" and \"Weakness 2: Claimed but seemingly not well-supported contributions\" have been well explained. Therefore, I decided to change my score from 6 to 8.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works."}, "extra_text": {}}, {"review_id": "oE-ezvgNm7j", "reviewer": "Reviewer_ChYc", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to solve the potential classification problem of the adversarial samples with the help of diffusion models. Specifically, the authors firstly give some analysis of the regions of the conditional generation. They claim that the conditionally generated samples will concentrate on the regions around the original adversarial sample. Then through majority voting, the proposed method can help find the correct labels. Experiments show that the proposed method does help improve the performance.", "summary_of_the_review": "For one thing, the paper help clarify the conditional distribution of the diffusion models, which may help the community; for another, the theoretical contribution seems limited and the proposed method overkills the adversarial classification problem in terms of resource and time.", "strength_and_weaknesses": "Strength:\n- The paper gives some theoretical analysis about the conditional generation, which can help clarify the understanding of the problem.\n- The experiments show that the proposed method can improve the robust of the classification of adversarial inputs.\n\nWeakness:\n- In general, it seems that the classification of the adversarial samples is overkilled. To improve the robustness, the authors need to run the time-consuming diffusion models more than 10 times to get the conditional generation and then run the classifiers. It is unreasonable.\n- The theory part just includes some clarifications of common sense, it hard to get some novel ideas through the definitions or theorems. \n    - It is also unclear if it is proper to bound the complex data support  with hyper-balls. For example, in the data manifold, if the data labeled by 1 is supported in a 2-dimensional rectangular like region with large length and width ratio, can we use definition 3.2 or theorem 3.3 to measure the results?\n    - In theorem 3.4, KL divergence may not be a good method to measure the similarity of two distributions since it is not a distance. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "D5-twjVksr", "reviewer": "Reviewer_pQBA", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposed to increased robustness to adversarial attacks of an off the shelf classifier by using a (of the shelf) diffusion model as a data augmentation preprocessing step.\n\n", "summary_of_the_review": "The framework is simple and clever.\nI could not verify the theoretical analysis part as it is out of my skills.", "strength_and_weaknesses": "Strength:\n- simplicity of the framework\n- use of off the shelves diffusion model and classifiers", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "7Jxse1yNeB", "reviewer": "Reviewer_MqVZ", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a new method, DensePure, designed to improve the certified robustness of a pretrained model (i.e. classifier). Specifically, DensePure uses the diffusion model to denoise the adversarial input to get multiple reversed samples, which are then passed through the off-the-shelf classifier, followed by majority voting of inferred labels to make the final prediction. The extensive experiments demonstrate the effectiveness of DensePure by evaluating its certified robustness given a standard model and show it is consistently better than existing methods on ImageNet.", "summary_of_the_review": "DensePure with the diffusion step can improve the robustness of prediction in the late stage. Overall, it is a good paper, I am ok if it is accepted.", "strength_and_weaknesses": "Quality/Clarity: the paper is well written and the techniques presented are easy to follow. Its motivation is clear to use diffusion model to denoise input to improve classification accuracy. On a technical level, I do not see much new contribution, where most equations are from diffusion model. For the BEiT in Table 2, do we use the same BEiT model for evaluation while comparing to Carlini 2022? We do not know its gain from the model itself or from the label voting. Also it is better to add experimental comparision w/o diffusion model.\n\nOriginality/significance: the idea is interesting, which uses diffusion model to improve data quality to improve classification performance. Another contribution is the label voting from multiple samples. However, both diffusion model and pretrained classifier are known, which makes DensePure an incremental approach. In addition, the diffusion model is only for Gaussian noise, which limit the application of this approach. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Accept: poster