Robust Representation Consistency Model via Contrastive Denoising
Authors: Jiachen Lei
Julius Berner
Jiongxiao Wang
Zhongzhu Chen
Chaowei Xiao
Zhongjie Ba
Kui Ren
Jun Zhu
Anima Anandkumar
Venue: ICLR 2025 Poster (2025)
Keywords: Certified Robustness
Diffusion-based randomized smoothing
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Robustness is essential for deep neural networks, especially in security-sensitive applications. To this end, randomized smoothing provides theoretical guarantees for certifying robustness against adversarial perturbations. Recently, diffusion models have been successfully employed for randomized smoothing to purify noise-perturbed samples before making predictions with a standard classifier. While these methods excel at small perturbation radii, they struggle with larger perturbations and incur a significant computational overhead during inference compared to classical methods. To address this, we reformulate the generative modeling task along the diffusion trajectories in pixel space as a discriminative task in the latent space. Specifically, we use instance discrimination to achieve consistent representations along the trajectories by aligning temporally adjacent points. After fine-tuning based on the learned representations, our model enables implicit denoising-then-classification via a single prediction, substantially reducing inference costs. We conduct extensive experiments on various datasets and achieve state-of-the-art performance with minimal computation budget during inference. For example, our method outperforms the certified accuracy of diffusion-based methods on ImageNet across all perturbation radii by 5.3\% on average, with up to 11.6\% at larger radii, while reducing inference costs by 85x on average.

Published as a conference paper at ICLR 2025
ROBUST REPRESENTATION CONSISTENCY MODEL VIA CONTRASTIVE DENOISING
Jiachen Lei Julius Berner Jiongxiao Wang², Zhongzhu Chen Zhongjia Ba', Kui Ren' Jun 2,6 Anima Anandkumar' 'Zhejiang University, ?NVIDIA, "UW-Madison *Amazon, "Shengshu, Tsinghua University, 'Caltech
ABSTRACT
Robustness essential for deep neural networks, especially in security-sensitiv applications. To this end, randomized smoothing provides theoretical guaran- tees for certifying robustness against adversarial perturbations. Recently, diffu- sion models have been successfully employed for randomized smoothing to pu- rify noise-perturbed samples before making predictions with standard classifier. While these methods excel small perturbation radii, they struggle with larger perturbations and incur a significant computational overhead during inference compared to classical methods. To address this, reformulate the generative modeling task along the diffusion trajectories in pixel space as discriminative task the latent space. Specifically, we use instance discrimination achieve consistent representations along the trajectories by aligning temporally adjacent points. After fine-tumie tine-tuning based on the learned representations, our model enables implicit wwwpiiinnggteeenllssiiiiiii ing inference costs. We conduct extensive experiments on various datasets and achieve state-of-the-art performance with minimal computation budget during in- ference. For example, our method outperforms the certified accuracy of diffusion- based methods on ImageNet across all perturbation radii by 5.3% average, with up to 1 11.6% at larger radii, while reducing inference costs by 85x on average. Codes available https:/ /tt///gii wwg.ttu..h..ogggggggggg com www.////aacclle/eeccc.ocooeeeeee /RCM.
via single prediction, substantially reduc-
INTRODUCTION
Deep neural networks (DNNs) have achieved unprecedented success in various visual appli- cations. Yet, they are still vulnerable to small adversarial perturbations. This imposes threat to the deployment of DNNs in real-world sys- tems, in particular for security-critical scenar- ios, such as human face identification and au- tonomous driving. To counteract this issue, numerous efforts in terms of both empirical and certified defenses have been made to im-
Certified Radius= 1.0
Durs
Classification Accuracy (%))
60
DensePune
32PM
50
642M
40
DON
642M
DensePure
6AZM
642M
prove the robustness of DNNs against adver-
30-
DiffSmooth
sarial perturbations. While empirical defenses train DNNs to be robust to known adversarial examples (Madry et al., 2017), they can be eas- ily compromised by employing stronger un- known perturbations. In contrast, to end the mouse-and-cat game of iterative improvements of attacks and defenses, certified defenses focus on developing strategies that provide certifiable and formal robustness guarantees. However, this also makes the design of such certified defenses much more challenging. Among certified defenses, randomized smoothing with Gaussian noise (Cohen
10a
10a
102
10a
104
Logiscale Inference Latency (Seconds)
Figure I: Performance vs. Inference Latency.
Marker sizes correspond to relative model sizes.
WWrk partially done Caltech.

---

Published as a conference paper at ICLR 2025
Projecur
Contrastive Less
Contrastive
grad
Consistency Loss
Prijectx
Projecsx
Unncoder
Consistency Loes
Patch-Position
Embedding
leamable embelding
Lince Prijakia Hattane Pacchex
Fncoder
Ficodder
step
Narac Injetion
Noisy input Kr,
Noisy input
Figure 2: Illustration of our pre-training method and model forward pass. (a) Pre-training method. After pre-training, the projector discarded, and the encoder fine-tuned alongside linear head using class labels. (b) Model forward pass. Noticeably, during certification, model serves as the base classifier (as described Section 2) and predicts the class label each perturbed sample in single forward pass.
et al., 2019) is currently considered the "gold standard", providing scalable way of certifying model robustness against adversarial perturbations with bounded f--norm. To date, various ran- domized smoothing-
methods have been proposed (Jeong & Shin, 2020; Carlini et al., 2022). Among these works, diffusion model-based methods (Carlini et al., 2022) stand out with superior performance by integrating trained diffusion models into randomized smoothing. They first apply the denoising process a diffusion model to remove Gaussian noise added to images. Then, using the purified samples, they predict the class label using a separate classifier. For brevity, we refer to these approaches as diffusion-bart based methods in the following discussions.
Despite the success, there exists a gap between achieving low latency and strong performance for diffusion-basee methods. To maintain a competitive performance, they either increase the number of sampling steps (Xiao al., 2022) and/or implement majority voting during class prediction (Xiao et al., 2022; Zhang et al., 2023), suffering from even higher computational demands during infer- ence (e.g., as high as 52 minutes!), ). Furthermore, while leveraging the basic denoising property of diffusion models, previous approaches achieve consistent prediction across perturbed and clean sam- ples through two independent models, resulting in a cumbersome prediction process and increased model maintenance overhead. We show that the framework of diffusion models itself already offers an effective solution in this regard: it establishes a unique connection between perturbed and clean samples along the trajectories of the probability flow (PF) of the denoising process. In this text, perturbed samples can be seen as points on the same trajectory of the denoising process but at different time steps, with the clean sample being the initial point". This motivates our approach of directly optimizing for consistent semantics across noise- perturbed and clean samples on the same trajectory of the diffusion process. leading to a unified model that supports consistent one-step pre- diction. In contrast, classical methods (Cohen et al., 2019; Jeong & Shin, 2020; Salman et al., 201920 19a) train models directly on noisy samples, primarily relying on heuristic strategies. These approaches fail to thoroughly exploit the intrinsic relationships between noisy and clean images, limiting their potential to achieve higher levels of certified robustness.
We close the gap of diffusion-based methods in terms of the tradeoff between performance and efficiency. In particular, we achieve performance that better than classical ran- domized smoothing methods at fraction of the cost of existing diffusion iiffusion-bbsed methods. This is made possible by directly optimizing model robustness based on structured connections between
Our approach:
'On single A800 GPU, we report the time by certifying DensePure (Xiao al., 2022) single image from ImageNet with N=10k smoothing noises.
As is common practice, we call the clean image the reverse sampling trajectory the "initial point", as opposed to the sampled from the Gaussian prior the heginning of the reverse sampling process.
2

---

Published as a conference paper at ICLR 2025
clean and perturbed samples. With the above analysis. reformulate model robustness against noise perturbations as consistency between predictions of clean and perturbed samples. Specifically, framework decomposes the training into two stages: pre-training and fine-tuning. During pre- training, the model learns to align representations across points along the deterministic trajectory from the Gaussian prior to the data distribution. To accomplish this, reformulate the original generative image denoising task into a discriminative task in latent space and propose to align the representations of temporally adjacent points on the same trajectory via pair-wise instance discrimi- nation. Based on the learned consistent representations, the model is then fine-tuned in a supervised manner to predict class labels given perturbed samples as input. This integrates denoising and clas- sification into a single model and enables one-shot image classification, which is key to lowering the computation cost during inference. We term our model Robust Representation Consistency Model (rRCM).
In our experiments, we demonstrate that our method improves the certified accuracy of Carlini et al. (2022) at all perturbation radii by 5.3% on average, with up to 11.6% at larger radius, while at the same time reducing the computation cost by 85x on average during inference. In comparison with classical methods (Cohen et al., 2019; Jeong & Shin, 2020; Salman al., 2019a; Zhai et al., 2020; Jeong et al., 2021), 1), our rRCM model either matches or surpasses their performance, achieving an average improvement of 8.48% across all perturbation radii, and maintains similar inference cost. Besides, we demonstrate that our method exhibits strong scalability w.r.t the training budget, including model parameters and training batch size, on ImageNet (Deng et al., 2009). In particular, we empirically observe that the performance of our rRCM model has not yet plateaued, indicating that a larger training budget could lead to even higher certified robustness. These results underscore the advantages of leveraging established noise schedules from diffusion models to enhance model robustness and streamline the certification process, making our method more effective than previous approaches. Figure illustrates the trade-off between performance and efficiency across different methods, including rRCM. In conclusion, our contributions are as follows:
1. Structured noise schedule for robustness. To the best of knowledge, we are the first ex- ploit the advantages of the structured noise schedule of diffusion models in training robust classifica- tion models and provide a general direction for enhancing model robustness by drawing connections between noisy and clean samples.
2. One-step denoising- cennosing-then-claaee classffiassifiiaaiinn Our method reformulates the denoising objective, generative modeling task, in discriminative manner. It supports one-step denoising-then classification, lowering computational demands and maintenance overhead. Besides, it offers re- markable representation consistency in the sense that our model is capable of generating meaningful representations by mapping random noise to the manifold of the clean data in latent space.
3. Bridging
trade-ofls. Our method bridges the gap in achieving low latency and superior performance for diffusion- based randomized smoothing methods. We perform extensive experiments across various datasets, demonstrating that rRCM achieves state-of-the-an performance compared existing methods.
4. Strong scalability. Our training framework also exhibits strong scalability w.r.t. enhancing model robustness on large-scale datasets like ImageNet.
2 PRELIMINARIES
Diffusion Models (Ho et al., 2020; Song et al., 2020) aim to approximate the underlying data distri- bution p(zo). given training data æo ~ (. They are composed of a forward and reverse process. Following the definition of Karras et al. (2022), the forward process of a diffusion model is given by the stochastic differential equation (SDE) dx; = v /2tdw,, where w, is the standard Wiener process and é E [0, I'] (we use T = 80). Let pr (x) (a( denotes the data distribution of the solution e; to the forward SDE at time I, where Pr (x) & (0, I"). Correspondingly, the reverse process is given by the reverse-time teerse-timeeee SDE dx, = - 2t log 1tgpt((2 (x) + Vtddw, starting at = T. Here, w. is a standard Wiener process that runs backward in time and 2T (r))). For the given reverse-time SDE, there exists a corresponding deterministic reverse-time process that shares the same marginal probability densities (pr(x) (p:(o)) as the SDE:
dx. -VV log Pe (2:)
3

---

Published as a conference paper at ICLR 2025
The ordinary differential equation (ODE) given above is referred to Probability Flow ODE (PF ODE) (Song et al., 2020). Given the score function Va log Pt (a:). one can generate "clean" samples from p(zn)) by sampling from the prior (0, II) and following the deterministic trajectories given by the above PF ODE.
As is common practice, we consider the discretized versions of the above equations. Using time steps (fn, o we divide the time horizon into N non-overlapping intervals. The endpoints, to and iv. chosen such that 2t, can be seen as approximate sample from p(æ)) and IN T. We denote points along the PF ODE sampling trajectory as {æt,, Jizo Subsequently, the PF ODE in (1) can be discretized
- Lt, to ( tn) ve Po, (a) (a))==
(2)
Given a clean sample Vo. one can also directly sample at,, using
Ft 2o + In with NO,,
(3)
Randomized Smoothing (Cohen et al., 2019) is a technique to certify the robustness of arbitrary classifiers against adversarial perturbations under the f2-norm. It leverages base classifier's s robust- ness against random noise and builds a new classifier robust to adversarial perturbations, providing theoretical guarantees for the robustness of this new classifier. Given input sample æ and the base classifier ff with classes V, randomized smoothing considers a smoothed version of f defined as
F(x) arg max P Pe-N((,.) [f( e) cc cE)
where the noise level a is hyper-parameter of the smoothed classifier. In our following discussion, we term F as the hard model and f as the soft model. Suppose I classifies samples from M(x, o² I), the predicted probability of the most probable class is Pe.. and the runner up probability is Pen- Then, the robustness radius lower bound r of the hard model F around is given by
2 Φ (Pea) - (Pez).
(5)
where Φ-1 is the inverse cumulative distribution function (CDF) of a standard Gaussian distribution. To achieve strong robustness under noise perturbations, one should maintain consistent predictions across clean and noisy samples. In practice, we adopt the common setting of classification models and parameterize the soft model as function that outputs logits, which then pass through softmax operation to obtain discrete probabilities of æ belonging to each of the classes. Moreover, to approx- imate the probability in (4), we use a large number (typically 10k or 100k in practice) samples of e, so-called smoothing noises.
3 METHOD
3.1 OVERVIEW
A robust model shall give consistent predictions across clean and perturbed samples. To achieve this, first draw connections between clean and perturbed samples leveraging the PF ODE used in diffusion models. For a given initial condition, the PF ODE ensures that trajectories remain distinct and do not cross each other. This indicates that any point uniquely belongs to a single sampling trajectory. In this context, points on the same trajectory can be interpreted as data of the same latent representation, defined by the initial clean data point Fg. By formulating the training objective as grouping points on the same trajectory (in latent space), we can align points at higher noise levels with those from earlier time steps with lower noise levels, ultimately reaching the consistency goal.
We achieve this goal in a two-step process: pre-training and fine-tuning. During pre-training, we treat both clean and perturbed samples as points along the same deterministic PF ODE sampling trajectory of the diffusion model defined in Section 2. We align representations between tempo- rally adjacent points that are sampled along the trajectory via pair-wise instance discrimination. Specifically, we attract temporally adjacent points the same trajectory, while repelling those from different trajectories, leading to consistent representations among perturbed and clean samples. Af- fine-tune the model via super-
terwards, drawing upon the acquired consistent representations, vised training with class labels and additionally enforce consistent predictions on perturbed samples of the same noise magnitude. This transforms the alignment task from sample-to-sample alignment
4

---

Published as a conference paper at ICLR 2025
during pre-training to sample-to-class-lbell alignment and further partitions the trajectories based on their respective classes.
Our approach reframes the image denoising task discriminative task in the latent space, effec- tively learning denoising by discrimination. This unifies the two independent modules into a single model and enables robust one-shot image classification. Next, we formalize the aforementioned idea and provide a detailed description of our training methodology.
3.2 PROBLEM FORMULATION
Given points along the PF ODE sampling trajectory of the diffusion model, our goal is to align the logits produced by the soft model fe. with & as model parameters. This can be formulated as
with fo fo I1.oll
arg
ffoo))ff(eeee (o(
Vn [I,
(6)
Her {at,, In are obtained as in (2). The alignment objective in (6) maximizes the cosine similarity between paired samples (I+,,, It.-,). ). similar to the goal of contrastive learning methods (Chen al., 2020; He et al., 2020; Chen & He, 2021; Chen et al., 2021), which attracts semantically similar views (positive puirs)
sample latent space while repelling dissimilar ones (negative pairs). In our case, the positive pairs temporally adjacent points along the same PF ODE sampling trajectory, while points from different trajectories serve as negative pairs.
Considering the similar underlying rationale, decompose the training into two stages (pre- training and fine-tuning), and we parameterize the soft model fo as (w.8) = lww o ga. where ge is neural network and h. is a linear layer. During pre-training, the same PF ODE sampling trajectory in latent space. Then, we fine-tune go together with the linear head Ao using class labels, ultimately achieving consistent class prediction perturbed images. We will discuss details of our pre-training and fine-tuning method next.
train ge align points along
3.3 PRE-TRAINING
{= drawn from p(æ0). we aim to reformulate the alignment objective using loss functions similar to the infoNCE loss (Oord et al., 2018), i...
Given a sequence of i.i.d. samples' X'
Golat, ahi p0, Σ Galaf a3:g0,11)
L(A, go p)) EA Σ
log
where
go(2) ğo- (v)
go(uu)
(us 0i go. = exp
with Go(u) = [
(8)
In the above, f is exponential moving average (EMA) of 0 with EMA update rate n1, and hyper-parameter (that we set to 0.2 in our experiments). Moreover, sequence of samples, where of and al are considered positive sample pair defining two related yet different views of the i-th sample z) while ( treated as negative samples to the i-th sample. Overall, our alignment objective is then given by
{(a), ) mm is
arg min L(X, go, v1) + L(Z, Pe o ga, ga, U2).
The differences between the two terms lie in three aspects: the construction of positive and negative pairs, model for computing the loss, and EMA update rate μ. We call the first term in (9) the consistency loss and the second one the contrastive loss. Next, we will discuss how to construct the positive and negative samples for each loss.
In the contrastive loss, i.e., the second term in (9), 2 denotes a sequence of augmented samples created following the convention in contrastive learning literature (Chen et al., 2020; 2021). Specif- ically, we construct each positive pair by applying different data augmentations to the clean data w)
We subscripts to distinguish clean samples from noisy samples St,, and superscripts denote different clean samples x..
5

---

Published as a conference paper at ICLR 2025
and consider other augmented samples within the same batch negative samples to the i-th sample. For the consistency loss, i.c., the first term in (9), we define X' = { :;,- )) where we uniformly sample unique n in {I,.... N } for each batch of samples. We consider æe,, and æi,_. as positive sample pair, representing temporally adjacent points from the same PF ODE trajectory that share the same clean image znj- Moreover, (=: D are treated as negative samples to the i-th sample wt,. They are constructed with other samples within the same batch and are temporally adjacent to æi,, yet from different PF ODE trajectories.
To construct a positive pair (zt).. 2;,,-1) with clean data zy.- we first sample zi., following the discrete forward process in (3). Then, we could compute wi._, by (2), However, the score
A log Pt, (x) is unknown. To address this, one could employ a pre-trained score model and per- form a single-step denoising given iy,,. Alternatively, the score can also be expressed via Tweedie's formula (Efron, 2011), i.e.,
Lt
20 t2
Va lo, (x) -E
Lt
(10)
Following (Song et al., 2023), we can then use Monte Carlo estimate of the expectation and ap- proximate -i__, as
_ = xi + (tn-11 t,
(11)
Notably, each positive pair (at x shares the same Gaussian noise e. We adopt this method in our work, leaving further exploration of pre-trained score models to future research.
The contrastive loss in (9) (second term) is incorporated to enhance the model's semantic discrim- ination capabilities, enabling it to better distinguish points on different trajectories, particularly at early time steps, and ultimately improving certified robustness. Otherwise, the model tends to rely on trivial representations, which leads to training difficulties. To this end, we additionally in- clude an extra projector head pv. 3-layer MLP, alongside the encoder go during pre-training. The projector head acts as an information bottleneck that focuses on learning augmentation-invarian representations (Chen et al., 2020), and is removed later during fine-tuning. In early experi- ments, we observe that computing both losses on the output of the projector head leads to train- ing instabilities. Therefore, we do not employ the projector when computing consistency loss. We refer to Figure 2a for an overview of our pre-training method. We illustrate details of our model forward pass in Figure 2b. In particu- lar, the input to the model includes a time em- bedding, a learnable class token, and noisy im- age tokens. The time embedding is included to provide the model with awareness of the noise magnitude added to the input samples, follow- ing the practice established in diffusion mod- els (Song et al., 2020). When computing the loss, we select the output token corresponding to the learnable class token. As mentioned ear- lier, the consistency loss is calculated using the token from the model's output, while the con- trastive loss is computed using the token from the projector's 'ss output.
Algorithm rRCM Pre-training Pseudocode
g: online model g_ema: target model proj: the projector head
z1 and 22: two augmented views of x0
tl and t2: two adjacens time steps
epsilon: Gassian noise sampled from (O, I)
for zl, z2, x0, tn in doader
eps Pandn_liken (x3)
xt1 = x0 + ttlepsilon
xt x0 + tt2-epsilon
f1 proj (g1,1, t0))
f2 [g_ema (z2, t0))
p1 - gxtt1, t1)
p2 g [xt2,, =2) detachh)
loss consistency__oas// Loas p2)
loss +- contrastive_ ofs (f1, (2)
loss. .ss.bbckkarrd
For brevity, we name go as online model and 9e as target model. For the two loss terms, we use two separate target models, each parameter- ized by distinct 0- and updated with different EMA rates. Specifically, we set μ사 and μlz in (9) to 0 and 0.99 respectively. To avoid maintaining two sets of frozen parameters, we simplify the process for the consistency loss by using the online model directly and stopping gradient back prop- agation from the resulting model output. The pseudocode for the pre-training procedure is provided in Algorithm 1. While conceptually similar contrastive learning, the pretraining of rRCM sig- nificantly differs from previous methods. To demonstrate this, we conduct further experiments and compare the effectiveness of our method with MoCo-v3 (Chen et al., 2021), additionally equipped
update (g_ema)

---

Published as a conference paper at ICLR 2025
with Gaussian noise augmentation, in Appendix F. We also present detailed comparisons with con- trastive learning methods and consistency model Song et al. (2023) in Section 5.
3.4 FINE-TUNING
As described in Section 3.1, during fine-tuning, we map each perturbed sample to its ground-truth label while enforcing consistent predictions among among samples generated via the forward SDE, given the same clean image the same time step t. In our work, we adopt the diffusion model proposed in EDM (Karras et al., 2022) and the time step t is interchangeable with the noise level o in (4), as can be seen in (3). For randomized smoothing, a typically takes values {0.25, 0.5, 1.0). In our experiments, starting with the same pre-trained weights 0, we fine-tune the model (w. independently for each noise level. Specifically, for a given noise level o, we fine-tune the model using the following training objective (Jeong & Shin, 2020)
arg min Ex ae p(cc) p(c) log(ps(()) - ( log''(x'') - 1/2 (x( log Po (20)) (12)
Here, po( = softmax(fs and Ta x + ac and x'j = ae' are two noisy versions of p(zg), where c, (0, I). The variable c denotes the class label of the sample æ and 7/1 are hyper-parameters, In the above, the first two terms represent the cross-entropy loss, which aligns the model's predictions with the ground-truth label and enforces consistency between predictions for the two perturbed versions of the same input. The third term computes the entropy of the model's 's predictions, acting as a regularization mechanism. This regularization encourages the model make confident class predictions, contributing to achieving larger robustness radius.
In early experiments, we observed that training a ViT model from scratch with this objective proved challenging. Upon further analysis, we speculate that the model struggles to simultaneously learn meaningful representations for class predictions while ensuring consistent predictions for noisy sam- ples derived from the same clean image. However, after pre-training with our objective in (9), the model converges smoothly. We attribute this improvement to the similar representations among perturbed samples acquired during pre-training. We defer detailed explanation of the underlying rationale of our fine-tune annettnnig method to Appendix E.
4 EXPERIMENTS
4.1 EXPERIMENT SETTINGS
In this section, we evaluate our IRCM model on two datasets: ImageNet (Deng et al., 2009) and CIFAR1O (Krizhevsky et al., 2009). First, we demonstrate the efficiency and effectiveness of rRCM in comparison with existing baseline methods. Second, we study the scalability of our method in the aspects of model size and training batch size. We defer training details and the ablation studies on hyper-parameters of our method to the Appendix.
Model. We employ three different models in our experiments, namely, rRCM-S, rRCM-B and B-CeBB with an increasing number of parameters. All models follow the Vision Transformer (ViT) architecture (Dosovitskiy al., 2020). Unless otherwise specified, conduct experiments on ImageNet with rRCM-B and rRCM-B- B---eep model, and conduct experiments on CIFAR LO with rRCM-B model. Further details our model architectures be found in the Appendix.
Certification. We follow the settings of Carlini et al. (2022). Specifically, on both ImageNet and CIFAR10, we certify subset that contains 500 images from their test set with confidence 99.9%. We certify each sample at three different noise levels E (0.25, 0.5, 1.0), and report the certified accuracy under different perturbation radii r. We report certified accuracies of rRCM models uti- lizing both 10, 000 and 100, 000 smoothing noises on ImageNet, and 100, 000 smoothing noises on CIFAR1O. We compare our models with a series of baseline methods. Both on ImageNet and CIFAR1O, the certified accuracy of classical methods (Salman et al., 2020; Jeong & Shin, 2020; Salman et al., 2019a; Horváth et al., 2021: Zhai et al., 2020; Jeong et al., 2021) is reported utilizing 100, 000 smoothing noises. We measure the inference latency of all methods on single A800 GPU.
We attribute the reduced time expense compared to classical methods the use of advanced deep learning code toolkits, such as xFormers (nt (tttps://ggg http:/twwww..cccecccceoo.eboeeee rch/ xformers)

---

Published as a conference paper at ICLR 2025
Table I: Results on ImageNet. 1 We report the latency of classical randomized smoothing methods based the number obtained on Gaussian (Carlini et al., 2022). We report the number from DiftSmooth (Zhang et al., 2023). EEvaluated with 10,000 smoothing noises. Following the notations in (Xiao et al., 2022; Zhang et al., 2023), we denote the total number of model predictions utilized in majority voting with and m respectively.
Certified Accuracy at r (%)
Method
Lateney'
0.0
0.5
1.0
1.5
2.0
2.5
Gaussian (Salman et al., 2019a)
Imin 20s
67.0
49.0
37.0
29.0
19.0
15,0
Consistency (Jcong & Shin, 2020)
Imin 20s
55.0
50.0
44.0
34.0
24.0
21.0
SmoothAdv (Salman et al., 2019a)
Imin 20s
67.0
56.0
43.0
37.0
27.0
25.0
Boosting (Horváth al., 2021)
4min
65.6
57.0
44.6
38.4
28.6
24.6
MACER (Zhai al., 2020)
Imin 20s
57.0
43.0
31.0
25.0
18.0
SmoothMix (Jeong et al., 2021)²
Imin 20s
55.0
50.0
43.0
38.0
26.0
24.0
Denoised (Salman al., 2020)
60.0
33.0
14.0
6.0
DDS (Carlini et al., 2022)
3min 52s
76.2
61.0
41.4
28.0
21.2
17.2
DensePure (Xiao et al., 2022)
K=1
17min 8s
76.6
57.0
38.0
22.2
17.0
13.2
K=5
52min 20s
77.8
64.6
38.4
23.0
18.4
14.0
DiftSmooth (Zhang et al., 2023) m
4min 41s
70.1
59.7
34.7
24.8
18.0
13.8
m 10
5min 10s
70.0
61.4
36.0
26.4
20.8
18.0
15
5min 35s
69.8
62.2
36.4
28.2
21.6
19.2
rRCM-B
6s
76.6
62.6
45.2
33.8
27.0
22.0
rRCM-B
53s*
76.8
63.0
45.6
34.8
28.0
22.6
rRCM-B-Deep
Imin 41s
77.4
64.0
51,2
40.0
32.6
25.0
4.2
MAIN RESULTS
On both datasets, we report both the time cost (latency) of certifying one sample and the classi- fication accuracy under various perturbation radii. The results of our rRCM models on ImageNet and CIFARIO are shown in Table and Table 2, respectively. As demonstrated, we achieve superior performance over current diffusion-based randomized smoothing methods (Carlini et al., 2022; Xiao al., 2022; Zhang et al., 2023) especially at large perturbation radii, while significantly reducing the computational cost, which is par with other classical methods (Salman al., 201 9a; Jeong & Shin, 2020; Salman et al., 2020; Horváth et al., 2021; Zhai et al., 2020; Jeong et al., 2021).
Performance ImageNet. As shown in Table 1, in comparison with both classical and diffusion- based methods, our rRCM-B model yields superior performance while maintaining an inference cost (53 seconds) slightly lower than that of classical methods (1 minutes and 20 seconds). Perfor- mance can be further improved by using a deeper model, rRCM-B-Deep. which ultimately reaches state-of-the-art results. This demonstrates the promising scalability of approach, detailed in Section 4.3.
Subsequently, we also conduct fine-grained experiments demonstrate the unwilling computation trade-off of DensePure (Xiao et al., 2022) and DiffSmooth (Zhang et al., 2023) in order to achieve competitive results to classical methods, in particular at large perturbation radii. In specific, we re- implement DDS (Carlini et al., 2022), DensePure, and DiffSmooth under the recommended settings in respective works. For DDS and DensePure, we use ViT-based classifier that has the same amount of parameters as our rRCM-B model and achieves 81 81.35% accuracy on the ImageNet validation set. For DiftSmooth, we follow the settings in Zhang al. (2023) and use the same base classifier as DDS and DensePure but instead fine-tuned respectively with samples augmented with Gaussian noise at various noise levels a E (0.25, 0.5, 1.0]. We report their certified accuracies utilizing 10, 000 smoothing noises under different Eg radii.
As anticipated, when the computation budget is limited and only a small number of majority vot- ing is adopted during class prediction, both DensePure and DiffSmooth exhibit poorer performance than that of DDS. Noticeably, while adopting more denoising steps (b=5) during purification pro- cess, DensePure yields worse performance than DDS when no majority voting is applied during
8

---

Published as a conference paper at ICLR 2025
class prediction. As increase the majority voting number, the performance of both methods gradually increase different pace. Though finally surpassing DDS, their computation overhead increases tremendously, phenomenon especially observed on results of DensePure, which requires 52 minutes and 20s for certifying a single sample.
Performance CIFAR10. As shown in Table 2, reach superior certified classification accuracy, pushing the certified accuracy of DDS (Carlini et al., 2022) up at most by 6.4% (r 0.5). Besides, rRCM-B model either surpasses or is highly competitive to other high-performing methods, including SmoothAdy (Salman et al., 2019a), Boosting (Horváth et al., 2021), and MACER (Zhai al., 2020). Our rRCM-B model outperformed at 0.75 by Boosting (Horváth al., 2021), method that ensembles 10 different classifiers. Yet, we still surpass diffusion- methods at all perturbation radii.
Table 2: Results CIFAR1O. We report the lateney of standard randomized smoothing methods based on the results we obtained on Gaussian (Carlini et al., 2022).
Certified Accuracy at r (%)
Method
Latency
0.0
0.25
0.5
0.75
1.0
Gaussian (Cohen al., 2019)
83.0
61.0
43.0
32.0
22.0
Consistency (Jeong & Shin, 2020)
4s
77.8
68.8
58.1
48.5
37.8
SmoothAdv (Salman et al., 2019a)
4s
82.0
68.0
54.0
41.0
32.0
Boosting (Horváth et al., 2021)
40s
83.4
70.6
60.4
52.4
38.8
MACER (Zhai et al., 2020)
4s
81.0
71.0
59.0
46.0
38.0
SmoothMix (Jeong al., 2021)
4s
77.1
67.9
57.9
47.7
37.2
DDS Carlini al. (2022)
52s
79.8
69.9
55.0
47.6
37.4
DiftSmooth Zhang et al. (2023)
3min 34s
78.2
67.2
59.2
47.0
37.4
rRCM-B
16s
83.6
73.4
61.4
48.0
39.2
80
rRCM-S
128
Certrlled Accuracy (96
70
rRCM-B
Certilied Accuracy (%)
50
512
RCCM---Deep
1024
40
50
40
30
20
20
10
10
0.0
0.5
1.0
1.5
2.0
2.5
3.0
0.0
0.5
1.0
1.5
2.0
2.5
3.0
Radius
Radius
Figure 3: Scaling up model size on ImageNet im- proves performance.
Figure 4: Increasing training batch sizes on Ima- geNet improves performance.
4.3 SCALABILITY
We now explore the scalability of our method by pre-training models with varying model param- eters and batch sizes on the ImageNet dataset. Following our experiment settings Section 4.2, we additionally train rRCM-S model and compare the certified accuracy of rRCM-S, rRCM-B, and RRCM-B-Deep. Additionally, utilizing IRCM-B, we investigate the impact of training batch size on model performance. The results, presented in Figures 3 and 4, highlight the excellent scal- ability of our method. With increased computational resources, we anticipate further performance improvements, which we leave for future work.
5 RELATED WORK
Certified Robustness. Deep neural networks (DNNs) are susceptible to adversarial exam- ples (Goodfellow et al., 2014), prompting the development of various defense techniques, includ-

---

Published as a conference paper at ICLR 2025
Contrastive Learning
Consistency Model
Ours
x²b
repel
%
X
altract
(xx)
attract
Nt.
Fra-1
XC,
X
(ug((x)
p(Kg)
p(Ka]
uitirust
>
Xg
Ag
(X)
Figure 5: Comparisons of contrastive learning and consistency model training with our method. The gray lines denote the PF ODE trajectories. zy and ao are two different clean samples that act as the initial point on respective PF ODE trajectory.
ing empirical defense and certified robustness. While empirical defense methods (Mądry al., 2017: Samangouei, 2018; 8; Zhang et al., 2019) can be easily compromised utilizing stronger adap- tive attacks, certified robustness aims at providing theoretical guarantee for the lower bound of model prediction accuracy under constrained perturbations. In certified robustness, a series of ef- forts (Raghunathan al., 201 8a;b; Salman al., 2019b; Zhang al., 2018) been devoted to provide robustness certification of DNNs. However, randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019) attract most attention due its superior scalability. It supports non-trivial cer- tification on large-scale dataset such as ImageNet and is applicable to any model architectures. On top of this, numerous works (Jeong Shin, 2020; Salman et al., 2019a; Horváth et al., 2021; Zhai et al., 2020; Jeong et al., 2021; Li al., 2024; Jeong & Shin, 2024) have been proposed further enhance model's robustness. To the best of our knowledge, we are the first to utilize a structured noise schedule to train randomized smoothing based model for enhanced adversarial robustness.
Teacher-Student training paradigm widely adopted in various domains, including representa- tion learning and generative modeling. Contrastive Learning(Chen et al., 2020; Chen & He, 2021; He et al., 2020) aims at capturing meaningful visual representation by encouraging the model to out- put similar representations for samples of similar semanties. Meanwhile, generative models (Ho et al., 2020; Song et al., 2020; Karras et al., 2022), consistency model (Song al., 2023), variant of diffusion models, employs a two-branch network to approximate the an- alytical solution of the PF ODE at initial point, resulting in consistent image predictions given any points on the same PF ODE sampling trajectory. Here, the clean image serves as a static boundary condition, preventing the model from learning trivial solutions. In comparison, rather than learning superior visual representations or achieving consistent image prediction, we aim at strong model robustness against adversarial perturbations. We learn consistent representations across points on the PF ODE trajectory by discriminating whether given point pairs are from the same PF ODE sam- pling trajectory. Besides, The initial point utilize is diw-dimensional representation dynamically learned during the training process. Noticeably, our rRCM model operates directly on image inputs, differing significantly from two-stage generative methods like LCM (Luo et al., 2023) which trains consistency model in the latent space a pre-trained VAE (Kingma, 2013). We present comparisons of contrastive learning, consistency model with rRCM in Figure
member of score-based
CONCLUSION
In this work, we introduce the Robust Representation Consistency Model (rRCM), novel approach to enhancing model robustness against adversarial perturbations through contrastive denoising in latent space. By reformulating the generative modeling process as discriminative task, rRCM leverages a structured noise schedule to align representations of noisy and clean samples. allowing for one-step denoising and classification. This integration enables substantial reductions in infer- ence costs, outperforming existing diffusion-based smoothing methods by notable margin, partic- ularly at higher perturbation radii. Our evaluations on ImageNet and CIFAR-10 confirm that rRCM achieves wate-of-the-art performance with significantly improved efficiency, bridging the gap in the trade-off between robustness and latency. The proposed framework not only offers promising approach to certified robustness but also establishes a foundation for future applications in repre- sentation learning and image generation. We leave further exploration of these applications for our future work.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
J.B. acknowledges support from the Wally Baer and Jeri Weiss Postdoctoral Fellowship. A.A. is supported in part by Bren endowed chair, ONR (MURI grant N00014-2311-2644)) and the A12050 senior fellow program at Schmidt Sciences.
REFERENCES
Fan Bao, Shen Nie, Kaiwen Xue, Yue Cao, Chongxuan Li, Hang Su, and Jun Zhu. All are worth words: A VIT backbone for diffusion models. In Proceedings of the IEEE/CVE conference on computer vision and pattern recognition, pp. 22669-22679, 2023.
Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and Zico Kolter. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206. 10550, 2022.
Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning of visual representations. In International conference on machine learning, pp. 1597-1607. PMLR, 2020.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEF/CVF conference computer vision and pattern recognition, pp. 15750-15758, 2021.
Xinlei Chen, Saining Xie, and Kaiming He. An empirical study of training self- supervieee vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 9640-9649, 2021.
Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. international conference on machine learning, pp. 1310-1320. PMLR, 2019.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference computer vision and pattern recognition, pp. 248-255. Icee, 2009.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 2020.
Bradley Efron. Tweedie's 's formula and selection bias. Journal of the American Statistical Associa- tion, 1024449) 2011.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv: arXiv:141..6572. 2014.
Kaiming He. Haoqi Fan, Yuxin Wu, Saining Xic, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9729 9738, 2020.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter.
Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851, 2020.
Miklós Z Horváth, Mark Niklas Müller, Marc Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. arXiv preprint 1xXiv:216600644 2021.
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. Advances in Neural Information Processing Systems, 33:10558- 10570, 2020.
Jongheon Jeong and Jinwoo Shin. Multi-scale diffusion denoised smoothing. Advances in Neural Information Processing Systems, 36, 2024.

---

Published as a conference paper at ICLR 2025
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chand Lee, Do-Guk Kim, and Jinwoo Shin. Smoothmix: Training manfienncecalibrac smoothed classifiers for certified robustness. Ad- vances in Neural Information Processing Systems, 34:30153-30166 2021.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in Neural Information Processing Systems, 01226655-267777 2022.
Diederik Kingma, Auto-encoding variational bayes. arXiv preprint
2013,
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Toronto, ON, Canada, 2009.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE symposium on security and privacy (SP), pp. 656-672. IEEE, 2019.
Tianhong Li, Dina Katabi, and Kaiming He. Self-conditioned image generation via generating representations. arXiv preprint arXiv:2312.03701, 2023.
Yiquan Li, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Bo Li, and Chaowei Xiao. Consistency purifi- cation: Effective and efficient diffusion purification towards certified robustness. arXiv preprint arXiv:2407.00623, 2024.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu, Dpm-solver: fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems, 35:5775-5787, 2022.
Simian Luo, Yiqin Tan, Longbo Huang, Jian Li, and Hang Zhao. Latent consistency models: Synthe- sizing high-resolution images with few-step inference. arXiv preprint arXiv:2310.04378. 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant to adversarial attacks. stat, 1050(9), 2017.
Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predic- tive coding. arXiv preprint arXiv:1807.0377 2018
Aditi Raghunathan, Jacob Steinhardt, and Percy Liang. Certified defenses against adversarial exam- ples. arXiv preprint arXiv:/801.000 /80::0944000444 2018a.
Aditi Raghunathan, Jacob Steinhardt, and Percy S Liang. Semidefinite relaxations for certifying ro- bustness to adversarial examples. Advances in neurul information processing systems, 31, 2018b.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. Ad- vances in neural information processing systems, 32, 2019a.
Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang, convex relax- ation barrier to tight robustness verification of neural networks. Advances in Neural Information Processing Systems, 32, 2019b.
Hadi Salman, Mingjie Sun, Greg Yang. Ashish Kapoor, and J Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems, 01221955-119577 2020.
P Samangouei. Defense-gan: protecting classifiers against adversarial attacks using generative mod- els. arXiv preprint 1805 06605, 2018.
Yang Song, Jascha Sohl-Dickstein, Diederik Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456, 2020.
Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. arXiv preprint arXiv:2303.01440 2023.
12

---

Published as a conference paper at ICLR 2025
Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anand- kumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models towards adversarial robustness. arXiv preprint wwXiv:2211.0033: 2022.
Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. Macer: Attack-free and scalable robust training via maximizing certified radius. arXiv preprint arXiv:2001.02371 2020.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent EI Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp. 7472-7482. PMLR, 2019.
Huan Zhang, Tsui- Wei Weng. Pin- Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in neural information processing systems, 31, 2018.
Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, and Bo Li. DiffSmooth: Certifiably robust learning via diffusion models and local smoothing. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 7787-4804, 2023.
13

---

Published as a conference paper at ICLR 2025
A COMPATIBILITY WITH DIFFERENT SELF-SUPERVISED REPRESENTATION LEARNING METHODS
Our framework, as formalized in Eq. (6), enhances model robustness by maximizing the cosine simi- larity between temporally adjacent points along deterministic probability flow trajectory. While implement this objective using the infoNCE loss a standard choice in contrastive learning (Chen al., 2021)-01 approach is broadly compatible with other self-supervised paradigms, including Joint Embedding Predictive Architectures (JEPA).
Unlike contrastive methods that rely explicit comparisons between positive and negative pairs, JEPA learns representations by predicting missing information in an abstract latent space, eliminat- ing the need for handcrafted data augmentation heuristics. To integrate JEPA into our framework, we adapt two key components: (1) replacing cosine similarity with Euclidean distance to align with JEPA's emphasis on prediction consistency representation space, and (2) substituting the con- trastive loss with JEPA's predictive loss while reformulating the consistency objective an MSE loss between positive pairs (constructed as in Section 3). Critically, our framework retains JEPA's core architecture and training designs, requiring only consistency regularization term. This adap- tation preserves JEPA's ability to learn invariant features through latent prediction while inheriting method's trajectory-awart robustness, demonstrating the flexibility of our approach in unifying contrastive and predictive self-supervised paradigms.
B MODEL. ARCHITECTURE
We display details of our models in Table 3.
Table 3: Details of rRCM-S, IRCM-B and rRCM-B-Deep.
Model
#Param
Depth
Dim
MLP Hidden Dim
Output Dim
#Heads
rRCM-S
25M
6
512
2048
256
rRCM-B
90M
12
768
2048
256
12
rRCM-B B-Deep
177M
24
768
4096
256
24
C EXPERIMENTAL DETAILS
Table 4: Hlyer-parametter used during pre-training.
Model
Lr
#Iter
Bs
EMA1
EMA2
Optim
Time steps
ImageNer
rRCM-B lc-4 600k
4096
0.99
0.0
0.2
AdamW
20 80
rRCM-B-Deep le-4 600k
4096
0.99
0.0
0.2 AdamW
20 to 80
CIFARIO
rRCM-B
lc-4 300k
2048
0.99
0.0
0.2 AdamW 20 to 80
Table Data augmentations utilized when pre-training on ImageNet and CIFAR10.
Augmentation
Probability p
RandomRResizedCrop. scale=(0.08, I.)
1.0
ColorJitter(0.4, 0.4, 0.2, 0.1)
0.8
RandomGrayscale
0.2
GaussianBlur((O.. 2.0])
0.1
Solarize
0.2
RundomHorizoonalFlip
0.5
14

---

Published as a conference paper at ICLR 2025
Pre-training During pre-training, adopt the definition of diffusion models proposed in EDM (Karras et al., 2022) and refer to the implementation consistency models (Song et al,, 2023), including noise schedule, imput scaling, time embedding strategy, and time discretization strategy. As for data augmentation strategies, we adopt those utilized in MoCo-v3 (Chen et al,, 2021). The temperature value in (9) is set to 0.2 for all experiments. By default, pre-train rRCM-B and rRCM-B-Deep for 600k steps with a batch size of 4096 on the ImageNet dataset. We pre-train rRCM-B for 300k steps on the CIFARIU 10 dataset, with batch size of 2048. Subsequently, we fine-tune our rRCM models separately at various noise levels E {0.25, 0.5, 1.0). In specific, for both ImageNet and CIFAR-10, 10, we set 771 (12) to 10 at the noise level of 0.25 and 20 for noise levels 0.5 and 1.0. In all experiments, 1/2 in (12) is fixed as 0.5.
To enhance training stability, we apply dynamic EMA schedule for the target model utilized when computing the contrastive loss. Specifically, we gradually increase the EMA rate from 0.99 to 0.9999 following a pre-defined sigmoid schedule, as shown in Figure 6. This schedule is defined by the following equations:
k E - 82) + K
1
(13)
2
(14)
1+1 FMA E. + a1 a). S
(15)
Here, it denotes current training iteration, K is total number of training iteration, S and represent the start and end EMA rate, is an empirical parameter, which is set to 10 in our experiments. We present hyper-parameter used in our pre-training experiments in Table 4 and the data augmentation strategies in Table 5.
1.000
0.998
EMA Value
0.996
0.992
A-5
0.990
A-15
12
Training Step (50k)
Figure 6: Illustration of the dynamic EMA schedule when changing parameter m from to 15. A larger m corresponds to faster increasing EMA rate.
Fine-tuning We fine-tune pre-trained model following the implementation in (Jeong Shin, 2020) at three different noise levels E [0.25, 0.5, 1.0], and report the best results at each per- turbation radius. We tune the pre-traines model for 150 epochs on ImageNet and 100 epochs on CIFAR10.
Certification We measure the inference time of all methods on a single A800 GPU. For classical methods, evaluate with batch size of 4000 ImageNet and batch size equals 1000 CI- FAR10. For diffusion- based methods and our rRCM models, we evaluate with batch size of 100 on ImageNet and 500 CIFAR10.
Scalability After pre-training, we merely tine-tunigg the model at noise level a = 1.0, and we report the certified accuracy at different perturbation radii.
15

---

Published as a conference paper at ICLR 2025
Figure Images generated by conditioning on the output of our rRCM-B model.
D QUANTITATIVE ANALYSIS ON THE DEGREE OF REPRESENTATION ALIGNMENT
To further demonstrate the model's ability to align representations by generating meaningful outputs from pure noise inputs, we reuse the rRCM-B model from our CIFARIO experiment to conduct image generation experiments. In detail, we train diffusion model conditioned on the output of our rRCM-B model, which takes clean images as input. When generating images, we first generate representations using 1RCM-B by feeding in pure noises sampled from the Gaussian prior, defined in Section 2. We then use these representations as conditions to the diffusion model to generate images. As result, achieve FID (Heusel et al., 2017) score of 5.31 measured with 50k generated images. Uncurated image generation results are displayed in Figure 7. We train the diffusion model based on U-ViT-Small (Bao et al., 2023) for 500k steps batch size of 128. During sampling, we use DPM-Solver (Lu et al., 2022) to generate images with 50 reverse sampling steps. As conditioning imput to the diffusion model, we use features from the MLP head of our rRCM-B model, normalized by their mean and standard deviation.
E QUANTITATIVE ANALYSIS OF THE SEMANTIC SIMILARITY BETWEEN POINTS ON DIFFERENT PF ODE TRAJECTORIES
During pre-training, each positive pair is generated from the same clean image perturbed by identi- cal Gaussian noise but at different noise levels. Points in the sample space are treated solutions of the PF ODE and aligned with their corresponding unique initial point. However, achieving strong certified robustness requires consistent class predictions among points the stochastic forward tra- jectory. Specifically, the certification process involves predicting class labels for perturbed samples constructed via the forward SDE, where points are not necessarily confined on the same PF ODE trajectory. Consequently, theses points share similar, rather than identical, semantics to the initial point. As the noise level increases, the semantic similarity between the perturbed and clean images on the stochastic forward trajectory diminishes, which ultimately sets an upper bound on the robust- ness of our model. This phenomenon, representing fundamental limitation of all diffusion-based methods, has also been studied in Zhang et al. (2023).
To assess the semantic similarity between points on different PF ODE trajectories, we first train linear head on clean images using frozen features from the pre-trained rRCM-B model. We then evaluate classification accuracy on noisy samples created by adding varying levels of noise clean images following the forward SDE of diffusion models. Additionally, we reuse the model in Sec- tion D and visualizes images generated by conditioning on representations extracted from points along the stochastic forward trajectory. As shown in Table 6 and Figure 8, increasing noise level leads to a monotonic drop in classification accuracy, with the image content gradually diverging from the original clean image. Furthermore, report the Fréchet Distance (FD) (Li et al., 2023; Heusel et al., 2017) between representations extracted from Iin and Tie in Table 6. A lower RFD value, akin to reduced FID score (Heusel et al., 2017), indicates greater similarity. This suggests that, despite the differences from their corresponding initial points, the model's 's predictions on noisy samples still capture meaningful semanties.
16

---

Published as a conference paper at ICLR 2025
Table 6: Quantitative results of the semantic similarity between points on different PF ODE trajec- tories. Utilizing features from the pre-trained rRCM model, we train a linear head on clean samples while evaluating on noisy sample of various noise levels.
Linear Probing Ace at a
Dataset
RFD
0
0.25
0.5
1.0
ImageNet CIFAR1O
9.79
72.71
65.47
55.62
44.86
3.73
87.92
72.09
65.87
50.84
Figure 8: Images generated by conditioning on representations from rRCM-B. The representations extracted from noisy samples, constructed following forward SDE of diffusion models. From left to right, the time step progressively increases, indicating an increase in the magnitude of noise.
F COMPARISON WITH NOISE AUGMENTED CONTRASTIVE LEARNING
In this section, we compare rRCM-B with MoCo-v3 on CIFARIO dataset with performance mea- sured by certified accuracy various perturbation radii. Specifically, pre-train a ViT-B model, which has the same amount of model parameters as our rRCM-B model, with MoCo-v3 (Chen al., 2021) that is additionally equipped with Gaussian noise augmentation. We follow the settings of MoCo-v3 and pre-train the ViT-B model for 300k iterations with a batch size of 256, same as our rRCM-B model. Subsequently, we fine-tune the VIT-B model at noise level o 1.0. In early experiments, we ablate the fine-tuming settings of the ViT-B model and observe similar certified robustness across various configure configurations. Therefore, we adopt the same fine-tuning settings as our rRCM-B model, including learning rate, data augmentation strategies, training batch size, and total training epochs. As illustrated in Figure 9, the certified accuracy of the ViT-B model is significantly lower than that of our rRCM-B model all perturbation radi. This highlights that method, which leverages a structured noise schedule and consistency loss, is fundamentally different from MoCo-v3 which is additionally equipped with Gaussian noise augmentations.
G ABLATION STUDIES ON
In this section, we ablate our key designs on CIFARIO dataset. We compare the performance of various settings and report the classification accuracy under different perturbation radii using N 100k smoothing noises. By default, we pre-train rRCM-B model for 300k iterations with a batch size of 256. For efficiency, merely fine-tune the pre-trained model at the noise level of o 1.0.
Ablation on EMA A rate and temperature value r. We ablate the EM rate value utilized when computing consistency loss, and ablate the temperature value for both consistency and constrastive loss. We illustrate the results in Figure 10.
Training on Restricted Noise Levels. Following (Carlini al., 2022), we compare five different models pre- pre-trdined under restricted noise levels in two distinct settings. (1) Aligning sample points on partial reverse sampling trajectory: In this experiment, we set T (T 80 in our default
17

---

Published as a conference paper at ICLR 2025
70
Default
Certified Accuracy (%)
MoCo-v3 Noise aug)
60
50
40
30
20
0.0
0.25
0.5
0.75
1.0 1.25 1.5 1.75 2.0 2.25
Radius r
Figure 9: Our method remarkably different from MoCo-v3 that is additionally equipped with Gaussian noise augmentation. The experiment is conducted CIFARIO.
70
Default
Certified Accuracy (%)
EMA-0.99
60
tau 0.1
50
20
0.25
0.5
0.75
1.25 1.5 1.75 2.0 2.25 Radius
Figure 10:
Ablation study on the hyper-parameter settings. By default, we use EMA2=0.0 and 0.2 for computing consistency loss.
setting) the endpoint, resulting in iy 1, where n E 1...., N. (2) Aligning sample points directly with the initial point: Specifically, we select points at three different noise levels along the trajectory: fn = 0.5, t, 1.0, and f, 2.0. We present results for the model trained by aligning points at these noise levels with the initial point.
The results are displayed Figure It is observed that the model, trained by directly aligning points with initial point, yields worse performance as the semantic gap between the two points getting larger.
70
70
0.5
50
to
1.0
50
40-
30
30
30
30
10
30
0.25
0.75
1.25 1.5
2.2.
0.25 0.5
1.0
1.5
2.0
0.0
0.25
0.5
1.0125 1.5
2.0
Figure 11: Training on restricted noise levels, including setting the rightmost endpoint at T 1.0 and aligning points with the initial point: t, E 0.5, 1.0, 2.0 f,, [0.5, 1.0, 2.0].
18

---

Published as a conference paper at ICLR 2025
Table Certified accuracy of rRCM-B on ImageNet under different perturbation radii.
Certified Accuracy at r
eval
0.0
0.5
1.0
1.5
2.0
2.5
0.25
0.768
0.63
0.0
0.0
0.0
0.0
0.25
0.5
0.616
0.476
0.382
0.23
0.0
0.0
1.0
0.376
0.294
0.222
0.168
0.12
0.078
0.25
0.694
0.586
0.0
0.0
0.0
0.0
0.5
0.5
0.672
0.566
0.456
0.346
0.0
0,0
1.0
0.494
0.392
0.322
0.266
0.218
0.156
0.25
0.674
0.554
0.0
0.0
0.0
0.0
1.0
0.5
0.632
0.54
0.442
0.346
0.0
0.0
1.0
0.532
0.462
0.396
0.348
0.28
0.226
Table 8: Certified accuracy of rRCM-B-Deep on ImageNet under different perturbation radii.
Certified Accuracy at
eval at a
0.0
0.5
1.0
1.5
2.0
2.5
0.25
0.774
0.64
0.0
0.0
0.0
0.0
0.25
0.5
0.692
0.552
0.43
0.32
0.0
0.0
1.0
0.502
0.412
0.338
0.258
0.202
0.138
0.25
0.718
0.612
0.0
0.0
0.0
0.0
0.5
0.5
0.682
0.592
0.512
0.4
0.0
1.0
0.562
0.498
0.412
0.34
0.266
0.214
0.25
0.678
0.604
0.0
0.0
0.0
0.0
1.0
0.5
0.668
0.594
0.486
0.4
0.0
0.0
1.0
0.572
0.51
0.434
0.372
0.326
0.25
H BASELINE METHODS
We compare our method with nine different baseline methods, including: (1) Gaussian (Cohen et al., 2019) trains model with Gaussian noise augmented samples; (2) Consistency (Jeong & Shin, 2020) trains model by additionally regularizing the model output on two Gaussian noise augmented views of the same clean sample; (3) SmoothAdy (Salman al., 2019a) trains model adversarial
samples crafted during training; (4) Boosting (Horváth et al., 2021) ensembles up to 10 different smoothed classifiers; (5) MACER (Zhai et al., 2020) trains models by directly optimizing for larger certified radius; (6) SmoothMix (Jeong et al., 1) trains model by on samples created by mixing up adversarial samples and Gaussian perturbed samples; (7) DDS (Carlini al., 2022) uses diffusion model to purify perturbed samples, followed by classification with an off-the-shelf classifier; (8) DensePure (Xiao et al., 2022) also incorporates diffusion model with multi-step purification and applies majority voting on class predictions; (9) DiffSmooth (Zhang et al., 2023) uses a diffusion model to purify perturbed samples and employs a smoothed classifier on noisy samples created by adding local smoothing noise the purified samples, with majority voting for class prediction. We ve-implement DensePure by setting the reverse sampling step to as suggested in their work. For DensePure and DiffSmooth, apply various majority voting numbers, as detailed in Table 1.
I FURTHER EXPERIMENTAL RESULTS
We show detailed certified accuracy of our models in Table Table 7 and Table 8.
19

---

Published as a conference paper at ICLR 2025
Table 9: Certified accuracy on CIFAR-10 under different perturbation radii.
eval at σ
Certified Accuracy at r
0.0
0.25
0.5
0.75
1.0
0.25
0.836
0.734
0.614
0,458
0.0
0.25
0.5
0.728
0.638
0.54
0,438
0.336
1.0
0.518
0.46
0.378
0.312
0.246
0.25
0.798
0.712
0.614
0.48
0.0
0.5
0.5
0.686
0.622
0.52
0.444
0.364
1.0
0.492
0.436
0.378
0.34
0.278
0.25
0.722
0.652
0.576
0.476
0.0
1.0
0.5
0.618
0.556
0.5
0.444
0.392
1.0
0.5
0.446
0.408
0.356
0.296
20


Reviews:
[{"review_id": "HLFtidvfUi", "reviewer": "Reviewer_iF9T", "summary": "The paper presents the Robust Representation Consistency Model (rRCM), an approach to improve robustness in deep neural networks by leveraging contrastive denoising within diffusion models. Instead of standard generative denoising, the authors reframe denoising as a discriminative task in latent space, enabling implicit one-step classification with reduced computational overhead. The authors perform experiments on datasets like ImageNet and CIFAR10 and investigate the method’s certified accuracy and scalability across perturbation radii, claiming a notable reduction in inference costs.", "questions": "My questions are mainly related towards addressing the weaknesses mentioned before:\n- Can the authors clearly motivate the methodology, why this particular approach and not something else? Why e.g. not just train a ViT on a lot of noisy samples?\n- Can the presentation be improved so that readers can easily see the overall motivation, and follow along with the details?\n- Despite the complexity overhead, does the approach generalize on other e.g. models or datasets, and how easily?", "limitations": "", "rating": 5, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The paper introduces a structured noise schedule for diffusion-based Randomized Smoothing, reformulating de-noising from a generative to a discriminative task. This is an interesting idea, especially in adversarial robustness, where noise schedules and latent consistency are less commonly used.\n- The authors perform a thorough evaluation of their approach, comparing it against multiple state-of-the-art methodologies, in terms of certified accuracy and inference time.", "weaknesses": "- Motivation: the main idea of Carlini et al. (2022) is to utilize an existing diffusion model for de-noising, thus getting randomized smoothing \"for free\", without needing to fine-tune the base classifier. This work reformulates the diffusion process to be more aligned in the latent space, but in the end, we get a classifier that's trained from scratch, with a diffusion-like objective. Why do all that and not just train a classifier on noisy images (since we're going to train in any case)? What is the benefit? The motivation of the approach is not very clear to me. In particular, I cannot follow the diffusion formulation and motivation precisely. \n- Presentation: related to the above, the methodology section of the paper is not easy to follow, e.g. there are various details where I don't fully understand how it all comes together (normalization, consistency loss, etc.). It would help if the authors (1) state the high-level motivation of their approach, (2) add clean pseudo-codes showing how the overall process works. Also, figure 2 would benefit from further elaborations.   \n- Complexity: the approach is technically complex (structured noise schedule, alignment with PF ODE trajectories) which could hinder it's extension in other setups. \n- Some things, like e.g. the 46x speed improvement are over-claimed, for instance this holds only for a particular case. On average, the approach is faster than e.g. the Gaussian baseline or Carlini et al. (2022), but not by that much.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cvV36IrhkS", "reviewer": "Reviewer_VAKb", "summary": "This paper proposes a new method to improve the robustness of deep neural networks against adversarial perturbations. By reformulating the generative task in consistency models as a discriminative task in latent space, the authors use instance discrimination to ensure consistency of noisy samples along PF-ODE trajectories. This approach enables one-step denoising and classification, reducing computational overhead while achieving a balance between robustness and efficiency across different perturbation radii. Experiments show that the method performs well on large-scale datasets like ImageNet and significantly reduces computational costs compared to traditional methods.", "questions": "- What are z_0 and z_1 in Algorithm 1? More explanation and a detailed description of the proposed method are needed.\n- It is still unclear what the upper limit of this method is. I hope the authors can explain this and clarify why the method has or has not reached this limit if applicable.\n- It appears that this method relies on the consistency model to denoise perturbed data. My question is why the consistency model can recover perturbed data to the corresponding original data. Although this is not the main contribution claimed by the paper, I still hope the authors can provide a reasonable explanation for this.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 3, "strengths": "+ The overall structure and writing approach of the paper are well-organized and clear.\n+ Combining consistency model with robust representation learning is interesting and novel to me. The use of PF-ODE to build a consistent relationship between clean data and perturbed data has a theoretical basis.\n+ The proposed method is significantly more time-efficient than previous diffusion-based methods, both theoretically and practically..", "weaknesses": "- Some details of the method are unclear; it would be helpful to provide the complete loss function formula used in the approach, along with a detailed explanation.\n- The improvements in Certified Accuracy shown in Table 1 are marginal, suggesting limited gains in robustness compared to prior methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cJjJ1ZnyGk", "reviewer": "Reviewer_wTyH", "summary": "This paper proposes to incorporate a new diffusion trajectory based consistency loss to the self-supervised pretraining of vision transformers for robust representation learning. The resulting model can be utilized directly in the randomized smoothing framework for certified adversarial robustness, removing the need of pretrained diffusion models employed by prior works. The proposed method, rRCM, is competitive with prior art at low perturbation radii with lower latency, while outright exceeding previous state of art performance at larger perturbation radii.\n\n+++++++++++++++++++++++++++++++++++++++++++++++++++++\n\nPost rebuttal edit:\n\nMost of my concerns regarding clarity and presentation have been addressed in the revision. I think the paper is in solid shape and hence would recommend accepting for publication.", "questions": "1. Please address my concerns in the weaknesses section. I think the technical content of the paper is great but the presentation of the paper requires significant work.\n2. On what hardware configuration and at what batch size are the latency number obtained?\n3. What are the “raw” classification accuracies of rRCM-B-Deep on Imagenet at various perturbation radii? (the numbers in bracket in Carlini2022’s table 1 and 2)", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed method makes sense intuitively and seems like a novel way to bake adversarial robustness into representation learning pipelines\n2. Experimental evaluations are fairly thorough and the performance improvements over prior methods are quite large.", "weaknesses": "1. I can’t quite understand what is the message behind the image generation experiment in section 4.5. Is the diffusion model trained on actual images in CIFAR10? If so, then regardless of whether the conditioning encoder extracts meaningful semantic representations, the diffusion model will produce images that resemble CIFAR10 images.\n\n2. Overall, writing could use some polish. Some examples:\n  * Line 42 “While empirical defenses train DNNs to be robust to known adversarial examples (Madry et al., 2017) during training”\n  * Line 305 “... . And we…”\n * Line 315 “During pre-training, we adopt the settings of the diffusion model in EDM”. Which settings are you adopting?\n* Table 1. Table caption should appear on top of table. Ties should be highlighted (SmoothAdv at r=2.5)\n*There is a lot of empty space around figures and some sections in the text that could be removed (such as that on image generation) to make space for a method figure in the main text (but leave out the patch illustration as I think most audiences are familiar with how ViTs work).\n* Figures 1,3,4,5 have “classification accuracy” on y-axis, should this be “certified accuracy”?\n* Figure 3 is never mentioned in text. Captions or legends in figures 3,4, and 5 should indicate which dataset the evaluation is from.\n3. Writing in the method section in particular lack clarity in several places:\n* a. While I understand the idea the authors are attempting to convey with equation 6 and 7, their presentation diminishes the rigor of the paper as the equality constraint between $f(x_*)$ in 6 and the dot product being equal to 1 are strong statements. It would be more appropriate to instead state, for instance, that you intend to minimize the differences between two $f(x_*)$ , i.e. $\\min_\\theta ( f_\\theta (x_*) - f_\\theta (x_**) )$. As a side note, one clearly does not intend to have equation 6 hold all the way to $t_N$, as the marginal of the PF-ODE at $t_N$ attains a standard Gaussian distribution, such that all trajectories are indistinguishable in distribution at this time step, thereby forcing f to loose all discriminative power.\n* b. How is teacher-student training actually related to your proposed method? Is it just the use of the ema weights in the contrastive loss? This seems like a weird point of emphasis as even the SimCLR paper doesn’t consider itself an example of knowledge distillation. The paragraph on teacher-student learning in related works feels similarly ill-named.\n* c. In Algorithm 1, it is not clear whether mlp(g( , )) corresponds to the linear head or the non-linear projector head. It is also not clear what ct_loss and cnsis_loss meant (also, there’s a typo “cnsis_loss” becomes “cnsis” on the next line)\n* d. Line 247-line 253 cites SimCLR but there doesn’t seem to be any statement in SimCLR that supports the statement of line 247-line 253\n* e. Line 255-line 272 was very confusing until I read line 273 stating that you use contrastive loss in addition to the PF-based consistency loss. It would have been much more clear to state that these two losses were used before going into details such as which samples are augmented and the bottleneck layer. Furthermore, an expression of the consistency loss should be included in the methods section for completeness.\n* f. There is no subsection on finetuning?\n* g. Why the obsession with comparisons to MoCo-V3 but not have it in the main results tables?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "E8YOxF16Yy", "reviewer": "Reviewer_Svp1", "summary": "The authors propose a novel defense method for image classifiers utilizing contrastive denoising. Experimental results indicate that their approach significantly enhances the model's robustness while reducing inference latency.", "questions": "Please see the weaknesses section.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The authors present strong empirical results, claiming that their method outperforms existing methods in the literature by as much as 5.8% while reducing inference costs by 46 times on ImageNet. The concept of training a robust model using the contrastive denoising method has the potential to benefit adversarial defense society and inspire future research.", "weaknesses": "Honestly, I’m not familiar with the denoising-based adversarial defense literature, so my concerns mainly focus on the experimental settings and results.\n\n1. In Figure 1. The authors compare their method with others from the literature. While their method achieves competitive accuracy, the model structure (number of parameters) differs from those used in other studies. It is unclear whether the reduction in inference latency is due to a smaller model size, a high-performance deep learning toolkit (Footnote 5), or advancements in the proposed method. What is the adversarial accuracy of the methods from the literature when using the same models as those employed by the authors in this paper?\n\n2. Line 228-229. Could author further clearify what is role of the teacher model, in the teacher-student training paradigm they used in the paper?\n\n3. What is $Z_1$ and $Z_2$ in the pseudocode of algorithm 1?\n\n4. Line 255-264. Why can a trainable MLP be considered a data augmentation method? Setting data augmentation aside, I still cannot agree with the claim that adding a trainable MLP can \"ensure\" the model captures meaningful representations. It would be helpful if the authors could provide more evidence to support this statement.\n\n5. In Figure 3, the authors compare their results with those of MoCo V3. However, the accuracy of MoCo V3 is significantly lower than what is reported in the original paper when the radius is set to zero, raising concerns about the correctness of the implementation and the fairness of the comparison.\n\n6. Line 466. Minor: It seems it should be Figure 3 rather than Figure 4.\n\n7. NOT A WEAKNESS (CONCERN). I’m just curious—since the paper is focusing on the defense method, could the authors provide further explanation of the motivation behind Section 4.5, \"Image Generation\"?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)