Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance
Authors: Bahjat Kawar
Roy Ganz
Michael Elad
Venue: Accepted by TMLR ()

Abstract: Denoising diffusion probabilistic models (DDPMs) are a recent family of generative models that achieve state-of-the-art results. In order to obtain class-conditional generation, it was suggested to guide the diffusion process by gradients from a time-dependent classifier. While the idea is theoretically sound, deep learning-based classifiers are infamously susceptible to gradient-based adversarial attacks. Therefore, while traditional classifiers may achieve good accuracy scores, their gradients are possibly unreliable and might hinder the improvement of the generation results. Recent work discovered that adversarially robust classifiers exhibit gradients that are aligned with human perception, and these could better guide a generative process towards semantically meaningful images. We utilize this observation by defining and training a time-dependent adversarially robust classifier and use it as guidance for a generative diffusion model. In experiments on the highly challenging and diverse ImageNet dataset, our scheme introduces significantly more intelligible intermediate gradients, better alignment with theoretical findings, as well as improved generation results under several evaluation metrics. Furthermore, we conduct an opinion survey whose findings indicate that human raters prefer our method's results.

Published in Transactions on Machine Learning Research (03/2023)
Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance
Bahjat Kawar
akjjo.kkwwrrSos..eennion.c..
Computer Science Deportment Technson, Israel
Roy Ganz
Electrical Engineering Deportment Technion, Israel
Michael Elad
elad@cs. techscio.cccc....c....o
Computer Science Department
Technion, Israel
Reviewed on OpenReview: https: // wpw.reveee....eeeeeomee net/ forum? id- 22Vp>2nJWX
Abstract
Denoising diffusion probabilistic models (DDPMs) are recent family of generative models that achieve state-of-the-art results. In order to obtain class-conditional generation, it was suggested to guide the diffusion process by gradients from a time-dependent classifier. While the idea is theoretically sound, deep learning-based classifiers are infamously susceptible to madient-based adversarial attacks. Therefore, while traditional classifiers may achieve good accuracy scores, their gradients are possibly unreliable and might hinder the improvement of the generation results. Recent work discovered that adversarially robust classifiers exhibit gradients that are aligned with human perception, and these could better guide generative process towards semantically meaningful images. We utilize this observation by defining and training a time-dependent adversarially robust classifier and use as guidance for a generative diffusion model. In experiments on the highly challenging and diverse ImageNet dataset, our scheme introduces significantly more intelligible intermediate gradients, better aligument with theoretical findings, well improved generation results under several evaluation metrics. Furthermore, we conduct opinion survey whose findings indicate that human raters prefer our method's results.
1 Introduction
Image synthesis is one of the most fascinating capabilities that have been unveiled by deep learning. The ability to automatically generate new natural-looking images without any input was first enabled by revo- lutionary research on VAEs - variational auto-encoders (Kingma & Welling 2014) and GANs generative adversarial networks Goodfellow et al.} 2014). Both these techniques, as well as their many subsoquent works (Radford et al. [ojovssrrovsky et al. 22017 Gulrajani al. 2017 Karras al. 2020 Van Den Oord et al. 2017 Vahdat & Kautz 2020), involved training neural networks a large dataset of natural images, aiming to convert simple and easily accessed random vectors into images drawn from distribution close to the training set. Despite their impressive capabilities, the image distributions Icarned by these models were initially restricted to a specific class of images, ranging from low-resolution handwrilien digits (Deng 2012) to higher-resolution human faces [Karras et al.) 2019). As more research and resources were invested in this field, several works (Pu al. 2017 Brock al. 2018 Esser et al.) 2021 were able make a leap forward, and devise more complicated models capable of synthesizing diverse range of natural images. commonly agreed upon challenge in this context. is ImageNet. (Deng et al. 2009), dataset containing millions of natural

---

Published in Transactions on Machine Learning Research (03/2023)
Figure 1: Images generated with our proposed method.
images, all labeled with one of 1000 image classes. For given class label (e.g. "hen" or "baseball"), these class-conditional generative models can nowadays synthesize realistic image of that class.
Recently, a different family of generative models has emerged to the forefront of image synthesis research. Denoising diffusion probabilistic models (Sohl-Dickstein et al. 2015 Ho et al. 2020). also known as score- basod generative models (Song & Ermon 2019), have achieved new stato-of-the-art image generation perfor- mance (Dhariwal & Nichol 2021 Song et al.] 2021 Vahdat et al.
2021p, showcasing better image fidelity and mode coverage than VA and GANs. These models have also excelled at several downstream tasks (Amit 2022), and they also act the powerhouse behind the unprecedented capabilities of text-to-image models (Ramesh et al.] 2022 Saharia et al. 2022) Essentially, these models utilize a Gaussian denoising neural network in an iterative scheme starting from a pure Gaussian noise image, it is contimually and gradually denoised in a controlled fashion, while also being perturbed randomly, until it finally turns into a synthesized natural-looking image. To achieve class- conditional generation, the denoising neural network can accept the class label as input (Ho et al.) 2022a) Additionally, the diffusion process can be guided by gradients from classifier (Dhariwal & Nichol, 2021 This brings naturally to discuss the next topic, of image classifiers, and their role in image synthesis.
et al. 2021 Kawar et al.) 2021b Theis et al. 2022 Nie et al.)
In parallel to the progress in image synthesis research, substantial efforts were also made in the realm of image classification. Given an input image, neural networks trained for classification are able to assign it a class label from a predefined set of such labels, often achieving superhuman performance (He et al. 2016 Dosovilskiy et al. 2020).. Despite their incredible effectiveness, such classifiers were found to be susceptible to small malicious perturbations known as adversarial attacks (Szegedy et al., (004).. These attacks apply small change to an input image, almost impercoptible to the human eyc, causing the network to incorrectly classify the image. Subsequently, several techniques were developed for defending against such attacks Madry et al. 2018 Andriushchenko & Flammarion) 2020 Zhang et al. 2019 Wang et al. 2020). obtaining classifiers that are adversarially robust. In addition to their resistance to attacks, robust classifiers were also found to possess unexpected advantages. The gradients of a robust classifier model were found to be percepiually aligned, exhibiting salient features of a class interpretable by humans (Tsipras al. 2019)
This phenomenon was harnessed by few subsequent works, cnabling robust classifiers aid basic image generation, inpainting, and boosting existing generative models (Santurkar al., 2019; Ganz & Elad 2021
In this work, we draw inspiration from these recent discoveries in image classification and incorporate their advantages into the world of diffusion-basct image synthesis, which has largely been oblivious to the capabil- ities of robust. classifiers. Dhariwal & Nichol (2021) suggested to use gradients from a (non-robust) classifier for guiding a diffusion synthesis process. We improve upon this technique by examining the validity of these gradients and suggesting a way obtain more informative ones. We pinpoint several potential issues the training scheme of classifiers used as guidance and observe their manifestation empirically (see Figures and We then propose the training of an ad adversarially robust, time-dependent classifier (i..,, classifier
2

---

Published in Transactions on Machine Learning Research (03/2023)
Vanilla
Robust
dugong
abacus
salamander
Samoyed
chainlink fence
great gray owl
Cardigan
Figure 2: Images generated by guided diffusion using the same random seed and class label, with a vanilla (top) and robust (bottom) classifier. Our robust model provides more informative gradients, leading to better synthesis quality.
that accepts the current diffusion timestep input) suited for guiding generation process. Our proposed training method resolves the theoretical issues raised concerning previous classifier guidance techniques. Empirically, our method attains significantly enhanced generative performance on the highly challenging ImageNet dataset (Deng et al., 2009). We evaluate the synthesis results using standard metrics, where our method outperforms the previous stato-of-tho-art classifier guidance technique. Furthermore, we conduct an opinion survey, where we ask human evaluators to choose their preferred result out of pair of generated images. Each pair consists of two images generated using the same class label and the same random seed, once using the baseline classifier guidance method (Dhariwal & Nichol 2021), and once using our proposed robust classifier guidance. Our findings show that human raters exhibit a pronounced preference towards our method's synthesis results.
To summarize, we incorporate a recently discovered capability robust classifiers, perceptually aligned gradients, into the classificr-gus guided diffusion-baser image synthesis scheme (Dhariwal & Nichol 2021). We highlight several benefits of the adversarial training scheme and show how they aid in classifier guidance for diffusion models. To that end, train adversarially robust time-dependent classifier the diverse ImageNet dataset (Deng et al., 2009). We use this classifier in conjunction with a conditional diffusion model to obtain high quality image generation. The resulting technique outperforms the previous vanilla classifier guidance method on several key evaluation metrics such as FID (Heusel et al., 2017). Furthermore, we present conducted opinion survey, which found that human evaluators show a clear preference towards our method.
2 Background
2.1 Robust Classifiers
Deep learning-based classifiers parameterized by & aim model the log-likelihood a class label y E {I,..., C) given data instance x E Rdd namely log (ylx). Such architectures are trained minimize the empirical risk over a given labeled training set (xi, 1 e.g.
1 N
min
(ce(hs(xs),
(1)
where N is the number of training examples, hx(x)) = (logg((ilxs){ is the set of these log-likelihood scores predicted by the classifier for the imput X,, and Loe is the well-known cross-entropy loss, defined as
exp(zyy
LCE(2,)) = log
(2)
E exp(z;)
3

---

Published in Transactions on Machine Learning Research (03/2023)
Image
Image
Vanilia, 1=0
Vanilla, 1=300
Robust t=300
Robust. I=0
Figure 3: Gradients of images on their respective true class labels, using vanilla classifier and robust one at different timesteps. Gradients are min-max normalized.
Classifiers of this form have had astounding success and have led to state-of-the-art (SOTA) performance
in a wide range of domains (He et al.
2016 Simonyan & Zisserman 2014
Nevertheless, these networks
are known be highly sensitive minor corruptions (Hosseini et al. 2017 Dodge & Karam 2017 Geirhos
et al. 2017 Temel al.) 2017 2018 Temel & AlRegib 2018 and small malicious pertur perturbations, known
adversarial attacks (Szegedy et al. 2014 Athalye et al., 2017 Biggio et al. 2013 Carlini & Wagner 2017
Goodfellow et al. 2015 Kurakin et al. 2017 Nguyen et al. 2014). With the introduction of such models
to real-world applications, these safety issues have raised concerns and drawn substantial research attention. As a consequence, in recent years there has been an ongoing development of better attacks, followed by the development of better defensos, and so on.
While there are abundant attack and defense strategies, in this paper we focus on the Projected Gradient Descent (PGD) attack and Adversarial Training (AT) robustification method (Madry et al. 2018) that builds on it. PGD is itcrative process for obtaining adversarial examples the attacker updates the imput instance using the direction of the model's gradient w.r.t. the input, so to maximize the classification loss. AT is an algorithm for robustifying a classifier, training it to classify maliciously perturbed images correctly. Despite its simplicity, this mothod was proven to be highly effective, yiclding very robust models, and most
modern approaches rely on it (Andriushchenko Flammarion 2020; Huang et al. 2020 Pang et al. 2020
Qin et al. 2019 Xie et al. 2019 Zhang et al. 2019 Wang et al. 2020).
In addition to the clear robustness advantage of adversarial defense methods, Tsipras et al. 2019 has discovered that the features captured by such robust models are more aligned with human perception. This property implies that modifying image to maximize the probability of being assigned to target class when estimated by a robust classifier, yields semantically meaningful features aligned with the target class. In contrast, performing the same process using non-robust classifiers leads to imperceptible and meaningless modifications. This phenomenon is termed Perceptually Aligned Gradients (PAG). Since its discovery, few works (Santurkar et al. 2019 Aggarwal al., 2020) have harnessed for various generative tasks, including synthesis relinement a post- post-processing step (Ganz & Elad 2021
2.2 Diffusion Models
Denoising diffusion probabilistic models (DDPMs), also known as simply diffusion models, are family of generative models that has recently been incrcasing in popularity (Song & Ermon 2019 Ho et al., (020). These methods have demonnstrated unprecedented realism and mode coverage in hesized images, achiev- ing state-of-the-art results (Dhariwal & Nichol 2021 Song et al.) 2021 Vahdat et al. 2021 in well-known metrics such as Fréchet Inception Distance FID (Housel et al., 2017). In addition to image genera- tion, these techniques have also been successful in a multitude of downstream applications such as image
restoration (Kawar et. al. 2021a 2022). unpaired image-to-image translation (asaki et al. 2021 image
4

---

Published in Transactions on Machine Learning Research (03/2023)
segmennatiin (Amit et al. 2021), J, image editing (Liu et al., 2021 Avrahami et al 2022). text-to-image gen-
eration
[Ramesh et al.;
2022 Saharia et. al.)
2022). and more applications in image processing (Theis et al.
2022
Gao et al. 2022
Nie et al. 2022 Blau et al. 2022:
Han et al. 2022) and beyond (Jeong et al. 2021
Chen et al. 2022 Ho ct al. 2022b Zhou et al. 2021).
The core idea of diffusion-based generative models is to start from a pure Gaussian noise image, and gradually modify it using denoising network and a controlled random perturbation until it is finally crystallized into a realistic high-quality image. While different realizations of this idea exist, follow the notation established in (Dhariwal & Nichol 2021). Specifically, diffusion models aim to sample from a probability distribution (x( that approximates a data probability g(x) representing a given datasct. Sampling starts from a pure Gaussian noise vector X7, and gradually updates it into samples XT- X7- X2, Xi until the final output
image Xg- Each timestep t represents a fixed noise level in the corresponding image Xt, which is a mixture of Xg and a white Gaussian noise vector e;: specifically
X = Varxa + V1 11--a66 a,C
with prodefinod signal and noise levels a and dz, respectivcly (0 ar < ar-1 <... a1 < ag 1). A demoising model eo (x(; is trained to approximate Et, and is subsequently used at sampling time to model the distribution px( = NM,, with
1 cx-1 co 6o(xx.1))
at-1
14
Xt
(4)
04
vI
at
and of is either set to constant value representing a bound on the possible variance of the underlying distribution (Ho et al. 2020). or learned by neural network (Nichol & Dhariwal 2021). This distribution enables the iterative sampling, starting from pure noise Xr and ending with a final image Xo-
3
Motivation
3.1
Class-Conditional Diffusion Synthesis
We are interested in generating an image from a certain user-requested class of images, labeled y. Previous work in this area suggested conditioning a denoising diffusson model on an input class label, thereby obtaining (x,, f, and this way conditioning the sampling sequence on the desired class label (Ho et al.] 2022a). In addition, building on ideas from (Sohl-Dickstein et al., 2015 Song et al. 2021], ), it was suggested by [Dhariwa] & Nichol 2021) to guide the diffuuion process using gradients from classifier. Assuming access to time- dependent (actually, -oise-levelldeeeendeeet))) classification model that outputs log PogPa(e (p) Xx, (), this classifier guidance technique suggests incorporating the model's gradient Vx, log (v/xx,,) into the diffusion process. This encourages the sampling output Xo to be recognized as the target class by the classifier model utilized. These gradients can be further scaled by a factor 8, corresponding to a modified distribution proportional to Po Py/x,, 1,, t)². Increasing s results in sharper distribution, thereby trading off diversity for fidelity. A time-dependent classifier logPo xx,,) t) is trained for this purpose using the cross-entropy loss on noisy intermediate images Iı, obtained by sampling images from a datasct and randomly setting t, controlling the noise level. The classifier is then used in conjunction with a conditional diffusion model for sampling.
3.2 Vanilla Classifier Guidance Shortcomings
The use of gradients of the assumed underlying data distribution Vx, log logg(v| t) in the diffusion process is mell-motivated by Dhariwal & Nichol (2021). However, it is unclear whether the aforementioned "vanilla" training method of classifier encourages its gradients' proximity to those of the data distribution. In fact, it was proven by (Srinivas & Fleurel 2020) that these model gradients can be arbitrarily manipulated without affecting the classifier's cross-entropy loss nor its accuracy. Crucially, this means that training is oblivious to arbitrary changes in model gradients. We provide this proof Appendix B for completeness, and naturally extend it to cover time-dependent classifiers trained on noisy images. It was also previously suggested that the iterative use of such gradients is akin to black-box adversarial attack on the Inception classifier used for
5

---

Published in Transactions on Machine Learning Research (03/2023)
Vanilla Classifier Guidance
Robust Classifier Guidance
Original
hyena
squirrel
leopard
tennis ball
hyena
squirrel
leopard
tennis ball
Figure 4: Maximizing the probability of target classes with given images using classifier gradients (at = 0). Our robust classifier leads to images with less adversarial noise, and more aligned with the target class.
assessing generation quality (Ho Salimans 2021). Essentially, this may result better nominal generation performance in metrics such as FID, while not necessarily improving the visual quality of output images. Moreover, (Chao et al. 2021) prove that changing the scaling factor of classifier guidance to # does not generally correspond to valid probability density function.
To conclude, there is substantial evidence in recent literature towards the shortcomings of "vanilla" trained classifiers for obtaining accurate gradients. This, in turn, motivales the pursuit of alternative approximations of Vx, log ((ylx)))) (x,)))))) t) for use as classifier guidance in diffusion- based synthesis.
4 Obtaining Better Gradients
4.1 Robust Classifier Benefits
In traditional Bayesian modeling literature, it is assumed that given a data point x, there exists a probability of belonging to a certain class y, for each possible choice of y. diffusion models, the same assumption is made over noisy data points x,, with the probability distribution q(v)x, (). However, in practice, no concrete realization of these probabilities exists. Instead, we have access to labeled image dataset where for each image x, there is a "ground-truth" label {I....,Cy C). Using this data, a classifier model is encouraged 1 and (y (), 0 for y * y through the cross-entropy loss function. While this method achieves impressive classification accuracy scores, there is no indication that its outputs would approximately match the assumed underlying distribution, nor will it reliably provide its input-gradients.
to output ())
Instead of relying on "vanilla" cross-entropy training of classification models, we suggest leveraging a few recently discovered advantages of robust adversarially-trained classífiers, which have been largely unexplored in the context of diffusion models hitherto. [Tsipaa al. (2019) show that traditionally trained classifiers can very easily mismatch underlying synthetic data distribution by relying on non-robust weakly correlated features. In contrast, an adversarially-tranne robust classifier would be vastly more likely to rely on more robust and highly informative features.
Interestingly, by migrating to a robust classifier, we can leverage its recently discovered phenomenon of perceptually aligned gradients (Tsipras al.] 2019). These gradients have allowed robust classifiers to be used in tasks such as inpainting, basic image generation (Santurkar et al.) 2019), and boosting existing generative models (Gazz & Flad. 2021). Notably, such tasks imply the existence of decent. generative
6

---

Published in Transactions on Machine Learning Research (03/2023)
Table 1: Quality metrics for image synthesis using a class-conditional diffusion model on ImageNet (128
128). Left right: no guidance, vanilla classifier guidance, robust classifier guidance (ours).
Metric
Unguided
Vanilla
Robust
Precision (1)
0.70
0.78
0.82
Recall (t)
0.65
0.59
0.56
FID (4) 5.91
2.97
2.85
capabilities implicit in robust classifier gradients, but not "vanilla" ones. Therefore, we propose replacing the classifier used in (Dhariwal & Nichol 2021 with robust one.
4.2 Proposed Method
Note that an off-the-shelf adversarially trained robust classifier would not fit our purpose this context. This due to the fact that in the diffusion process, the classifier operates on intermediate images x2, which are linear mixture of an ideal image and Gaussian noise. Furthermore, this mixture is also function of t, which requires the classifier model to be time-dependent. Consequently, novel robust time-dependent classifier model ha(x,, () = (logro (),, For each sample x from a training set D = {x,, ) and timestep 1, we first transform into its noisy counterpart x,, and then apply a gradient-based adversarial attack on it. Since the training images are perturbed with both Gaussian and adversarial noises, we apply early stopping the atlack stops as soon as the model is fooled. Finally, the model is shown the attacked image X, = A (x,, o), and is trained using the cross-entropy loss with the ground-truth label y. The resulting loss function formulated
propose the training of
B.x.) [CEE (CCE (he (xe, f)]].
(5)
Early stopping is crucial to this training scheme, as heavily noisy images (especially for large f) with full-ftedgod attack casily overwhelm the model in the carly stages of training. Converscly, carly stopping allows the model to train on non-attacked samples initially, then proceeding to gradually more challenging cases as training progresses.
This schome resolves several previously mentioned issues with vanilla classifier guidance. First, the gradients of an adversarially trained classifier cannol be arbitrarily manipulated like those of a vanilla model. Unlike the vanilla setting, the loss for an adversarially trained classifier is directly dependent on the adversarial attack employed, which in turn depends the model gradients. Therefore, any change to the model's gradients, such as the one suggested by (Srinivas & Fleuret 2020). would necessarily affect the model's predictions and loss during training. Second, gradients from a robust classifier are shown to be aligned with human perception. Namely, they exhibit salient features that humans naturally associate with the target class, and this should be contrasted with adversarial noise unintelligible by humans. Therefore, they cannot be thought of as "adversarial" performance metrics, as their vanilla classifier counterparts (Ho Salimans, 2021). Third, while vanilla cross-nntropy-traind classificr gradients are not known to contain any intelligible features, robust. classifier gradients may be interpretable. Elliott al. (2021) have leveraged robust classifier gradients in order to highlight salient features and explain neural network decisions. These findings hint towards the superiority of these gradients.
Note that because of the need to work on intermediate images, the classifiers employed with diffusion models train on data mixed with Gaussian noise. It was discovered that this simple data augmentation can lead to gradients that are more interpretable by humans (Kaur et al.] 2019), albeit to a lesser extent than observed in adversarially trained models. Therefore, we hypothesize that utilizing model with better "perceptually aligned gradients" will yield enhanced image synthesis results.
7

---

Published in Transactions on Machine Learning Research (03/2023)
Vanilla
Robust
Vanilla
Robust
Figure 5: Approximations of the final image at uniformly spaced intermediate steps of the guided diffusion process, for the same class and the same random seed. Our robust classifier provides better guidance.
5
Experiments
5.1 Robust Time- Demee-Deeedent Classifier Training
In our experiments, we focus on the highly challenging ImageNet (Deng et al. 2009) dataset for its diversity and fidelity. We consider the 128 x 128 pixel resolution, as it provides a sufficiently high level of details, while still being computationally efficient. In order to test our hypothosis, we require the training of a robust Lime-dependent classifier. We adopt the same classifier archilecture from (Dhariwal & Nichol 2021} and train it from scratch using the proposed loss in Equation
(5) on the ImageNet training set. We use the gradient-based PGD attack to perturb the noisy images X₃- The attack is restricted to the threat model {x, + 8 |11 2 < 0.5), and performed using step size of 0.083, and maximum number of 7 iterations. We stop the PCD attack on samples as soon as it is successful in achieving misclassification. This early stopping technique allows the model to train on unattacked data points at the beginning, and progressively increase its robustness during training. We train the classifier for 240k iterations, using a batch size of 128, a weight decay 0.05, and a linearly annealed learning rale starting with 3 x 10-4 and ending with 6 x 10-5, Training performed on two NVIDIA A40 GPUs. In addition, we conduct an ablation study on CIFAR-10 (Krizhevsky al. 2009) and report the results and implementation details in Appendix E.
To qualitatively verify that the resulting model indeed produces perceptually aligned gradients, examine the gradients at different timesteps for handful of natural images from the ImageNet validation set. For comparison, we also show the same gradients as produced from the vanilla classifier trained by Dhariwal & Nichol (2021). As can be seen in Figure 3 the gradients from our robust model are more successful than their vanilla counterpart at highlighting salient features aligned with the image class, and with significantly less adversarial noise. To further demonstrate the information implicit in these gradients, we perform targetod PGD process with steps and a threat model {x + 8 ||]||| 100), maximizing certain larget class for initial image. Figure 4 shows that our model yields images that align better with the target class.
5.2 Robust Classifier Guided Image Synthesis
The main goal of our work improving condittonii image synthesis. Following (Dhariwal & Nichol, 2021), we utilize 250 diffusion steps out of the trained 1000 (by uniformly skipping steps at sampling time) of their pre- trained conditional diffusion model for this task, while guiding it using our robust classifier. For the classifier guidance scale, sweep across values E (0.25, 0.5, 1, 2) and find that = 1 produces better
8

---

Published in Transactions on Machine Learning Research (03/2023)
Table 2: Percentage of image pairs where human evaluators prefer our robust classifier's output, the vanilla one; or have no preference. An output is considered preferred if the percentage of users who selected it passes certain threshold.
Threshold
Robust
Vanilla
No Preference
50%
61.5%
31.5%
7.0%
60%
51.0%
28.5%
28.5%
70%
35.0%
13.5%
51.5%
80%
21.5%
8.5%
70.0%
results, aligning well with theoretical findings set forth by Chao et al. (002)) Dhariwal & Nichol (2021)
perform a similar sweep for their model, and find that 8 = 0.5 provides the best results. In all comparisons, we use = for our robust classifier and 5 = 0.5 for the vanilla one. We conduct an ablation study regarding the important hyperparameters and design choices in Appendix E.
Qualitatively, the resulting synthesized images using our robust classifier look visually pleasing, as evident in Figures I 2 and 5 However, our method underperforms in handful of cases, as show in Figure G In order to quantily the quality of our results, we adopt. the standard practice in class-condiitonall ImageNet image synthesis: we randomly generate 50000 images, 50 from each of the 1000 classes, and evaluate them using several well-known metrics FID (Heusel et al.) (017]) Precision, and Recall (Kynkäänniemi et al. 2019). Precision quantifies sample fidelity as the fraction of generated images that reside within the data manifold, whereas Recall quantifies the diversity samples as the fraction of real images residing within the generated image manifold. FID provides comprehensive metric for both fidelity and diversity, measuring the distance between two image distributions (real and generated) in the latent space of the Inception V3 (Szegedy et al. 2016) network. In Table 1 we compare three guidance methods for class-conditional generation: (i) using the class-conditional diffusion model without guidance; (ii) guidance using the pre- trained vanilla classifier; and (iii) guidance by our robust classifier. Our proposed model achieves better FID and Precision than both competing techniques, but it outperformed in Recall.
Sooking a more conclusive evidence that our method leads better visual quality, we conduct an opin- ion survey with human evaluators. We randomly sample 200 class labels, and then randomly generate corresponding 200 images using the conditional diffusion model guided by two classifiers: once using the pre-trained vanilla classifier, and once using our robust one. Both generation processes are performed using the same random seed. Human evaluators were shown a randomly ordered pair of images (one from each classifier), the requested textual class label, and the question: "Which image is more realistic, and more aligned to the description?". Evaluators were asked to choose an option from "Left", "Right", and "Same". The image pairs were shown in random order for cach evaluator.
The main findings of the survey are summarized in Table In each pair, we consider image to be preferred over its counterpart if it is selected by more than certain percentage (threshold) of users who selected a side. We then calculate the percentage of pairs where evaluators prefer our robust classifier's output, the vanilla one, or have no preference. We vary the threshold from 50% up to 80%, and observe that humans prefer our classifier's outputs over the vanilla ones for all threshold levels. During the survey, each pair was rated by 19 to 36 evaluators, with an average of 25.09 evaluators per pair, totaling 5018 individual answers. Out of these, 40.4% were in favor of our robust classifier and 32.4% were in favor of the vanilla one. These results provide evidence for human evaluators' considerable preference for method, for significance level of > 95%.
6 Related Work
In this work we propose to harness the perceptually aligned gradients phenomenon by utilizing robust classifiers guide a diffusion process. Since this phenomenon's discovery, several works have explored the generative capabilities of such classifiers. [aanturar et al. (2019) demonstrated that adversarially robust

---

Published in Transactions on Machine Learning Research (03/2023)
Norwegian elkhound
Siberian husky
Komodo dragon
bathtub
Vanilla
Robust
Vanilla
Robust
Vanilla
Robust
Vanilla
Robust
Figure 6: In a handful of cases, vanilla classifier guidance produces better outputs than robust classifier guidance. These results mostly consist of better lighting, saturation, and image focus.
models can be used for solving various generative tasks, including basic synthesis, inpainting, and super- resolution. Zhu et al. (2021) drew the connection between adversarial training and energy-based models and proposed joint energy-adversarin training method for improving the generative capabilities of robust classifiers. Furthermore, Ganz & Elad (2021) proposed using robust classificr for sample refinement as a post-processing step. In contrast to these works, this paper the first to combine robust classifier into the inner- moresworks of generative model's synthesis process, leading to marked improvement.
Also worth mentioning are few other improved guidance techniques for class-conditional diffusion that were proposed. Chao et al. (2021) developed a new objective for training a classifier to capture the likelihood score. More specifically, they introduced a two-stage training scheme: first train a diffusion model, and then train the classífier to better supplement the estimations of the frozen diffusion model. Despite the intriguing idea, they demonstrate it only on low-resolution datasets (32 x 32), and the two training phases are sequential, as the classifier's training requires pre-trained diffusion model. Hence, these phases are not parallelizable. In contrast, we propose independent classifier training scheme, which scales well to more diverse datasets with higher resolutions. Another fascinating work is (Ho & Salimans 2021). which proposed a class-conditional synthesis without using a classifier. Instead, they offered to combine predictions of conditional and unconditional diffusion models linearly. Interestingly, a single neural network was used for both models. However, while it shows impressive performance, the proposed combination is heuristic, and requires careful hyperparameter tuning. Their work (named classifier-free guidance) follows different research direction than ours, as we focus on enhancing classifier guidance, enabling information from outside the trained diffusion model to be incorporated into the generation process. This approach improves the generalive process' modularily and flexibility, as il allows the continued definitions of more classes, without requiring further training of the base generative diffusion model. Moreover, in the case where classes are not mutually exclusive, classificr guidance allows for the gencration of multiple classes in the same image at inference time (by taking the gradient for all requested classes). This is possible in classifier-free guidance only by defining a combinatorial number of class embeddings (to account for all possible class intersections).
7 Conclusion
In this paper we present the fusion of diffusion-based image synthesis and adversarially robust classification. Despite the success of the classifier guidance of diffusion models (Dhariwal & Nichol 2021), highlight several key weaknesses with this approach. Specifically, our analysis of the vanilla classifier gradients used for guidance exposes their limited ability to contribute to the synthesis process. As an alternative, we train a novel adversarially robust time-dependent classifier. We show that this scheme resolves the issues identified in vanilla classifier gradients, and use the resulting robust classifier as guidance for a generative diffusion process. This shown to enhance the performance of the image synthesis on the highly challenging TmageNet. datasct (Deng et al., 2009), as we verify using standard evaluation metrics such as FID (Heusel et al. 2017). as well as a generative performance evaluation survey, where human raters show a clear preference towards images generated by the robust classifier guidance technique that we propose.
Our future work may focus on several promising directions: (i) generalizing this technique for obtaining better gradients from multi-modal nelworks such as CLIP (Radford et al. 2021). which help guide lext-to-image diffusion models [Ramesh et al. 2022); (ii) implementing robust classifier guidance beyond diffusion models, e.g. for use in classifier-guidos GAN training (Sauer et al. 2022); (iii) extending our proposed technique unlabeled datasets; and (iv) secking better sources of perceptually aligned gradients (aazz al. 2022), so to better guide the generative diffusion process.
10

---

Published in Transactions on Machine Learning Research (03/2023)
References
Gunjan Aggarwal, Abhishek Sinha, Nupur Kumari, and Mayank Kumar Singh. On the benefits of models with perceptually-aligned gradients. ArXiv, abs/2005.01499 2020.
Tomer Amit, Eliya Nachmani, Tal Shaharbany, and Lior Wolf. Segdiff: Image segmentation with diffusion probabilistic models. arXiv preprint arXiv:2112.005: 003900 2021.
Maksym Andriushchenko and Nicolas Flammarion. Understanding and improving fast adversarial training. In Newral Information Processing Systems, 2020.
Martin Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein generative adversarial networks. In Pro- aeedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pp. 214 124.223..222 PMLR, 06-11 Aug 2017.
Anish Athalye, Logan Engstrom, Andrew Nyas, and Kevin Kwok. Synthesizing robust adversarial examples, 2017.
Omri Avrahami, Dani Lischinski, and Ohad Fried. Blended diffusion for text-driven editing of natural images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18208-18218, 2022.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Sindié, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. Lecture Notes in Computer Science, pp. 387 402, 2013. ISSN 1611-3349.
Tsachi Blau, Roy Ganz, Bahjat Kawar, Alex Bronstein, and Michael Elad. Threat model-agnostic adversarial defense using diffusion models. arXiv preprint arXiv:2207.08088 2022.
Andrew Brock, Jell Donahue, and Karen Simonyan. Large scale GAN training for high fidelity natural image synthesis. Xini preprint 180. 2018.
Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods, 2017.
Chen-Hao Chao, Wei-Fang Sun, Bo-Wun Chong, Yi-Chen Lo, Chia-Che Chang, Yu-Lun Liu, Yu-Lin Chang, Chia-Ping Chen, and Chun-Yi Yi Lee. Denoising likelihood score matching for conditional score-baseds data generation. In International Conference on Learning Representations, 2021.
Zehua Chen, Xu Tan, Ke Wang, Shifeng Pan, Danilo Mandic, Lei He, and Sheng Zhao. Infergrad: Improving diffusion models for vocoder by considering inference in training. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 8432-84488 8436. IEEE, 2022.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. In 2009 IEFE Conference on Computer Vision and Pottern Recognition, pp. 248 255, 2009.
Li Deng. The MNIST database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 2916)1141-142, 2012.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat GANs on image synthesis. In Thirty- Fifth Conference on Neural Information Processing Systems, 2021.
Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recognition perfor- mance under visual distortions, 2017.
Alexcy Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x 16 words: Transformers for image recognition at scale, 2020.
11

---

Published in Transactions on Machine Learning Research (03/2023)
Andrew Elliott, Stephen Law, and Chris Russell. Explaining classifiers using adversarial perturbations the perceptual ball. In Conference Compuler Vision and Paltern Recognition (CVPR), 2021.
Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high-resolution image synthesis. Tn Proceedings of the IEEE/CVF conference computer vision and pattern recognátion, pp. 12873 12883, 2021.
Roy Ganz and Michael Elad. abs/2108.03702. 2021.
Bigroc: Boosting image generation via a robust classifier.
CoRR,
Roy Ganz, Bahjat Kawar, and Michael Elad. Do perceptually aligned gradients imply adversarial robustness? arXiv preprinl arXi::2207.133 113707 2022.
Jin Gao, Jialing Zhang, Xihui Liu, Trevor Darrell, Evan Shelhamer, and Dequan Wang. Back to the source: Diflusion-driven test-time adaplation. arxie preprint 2rX1:2227.00442, 2022.
Robert Geirhos, David H. J. Janssen, Heiko H. Schäut, Jonas Rauber, Malthias Bethge, and Felix A. Wichmann. Comparing deep neural networks against humans: object recognition when the signal gets weaker, 2017.
I. Goodfellow, J. Shlens, and C. Szegody. Explaining and Harnessing Adversarial Examples. In International Conference on Leurning Representations, ICLR, 2015.
Ian Goodfellow, Jean Pouget-Abadie, Mchdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in Neural Information Processing Systems, 27, 2014.
Ishaan Guirajani, Faruk Ahmed, Martin Arjovsky, Vincent Dumoulin, and Aaron C Courville. Improved training of Wasserstein GANs. Advances in neural information processing systems, 30, 2017.
Xizewen Han, Huangjie Zheng, and Mingyuan Zhou. CARD: Classification and regression diffusion models. arXiv preprint ar ftt:2206600275, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. In Advances in Neural Information Processing Systems, volume 30, 2017.
Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance. In NewrIPS 2021 Workshop on Deep Generative Models and Downstream Applications, 2021.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffuuson probabilistic models. In Advances in Neural Information Processing Systems, volume 33, pp. 6840-6851. Curran Associates, Inc., 2020.
Jonathan Ho, Chitwan Saharia, William Chan, David J Fleet, Mohammad Norouzi, and Tim Salimans. Cascaded diffusion models for high fidelity image generation. Journal of Machine Learning Research, 23 (47):1-33, 2022a.
Jonathan Ho, Tim Salimans, Alexey A Gritsenko, William Chan, Mohammad Norouzi, and David J Fleet. Video diffusion models. In ICLR Workshop on Deep Generative Models for Highly Structured Data, 2022b.
Hossein Hosseini, Baicen Xiao, and Radha Poovendran. Google's cloud vision api is not robust noise, 2017.
Lang Huang, Chao Zhang, and Hongyang Zhang, aelf-ide training: beyond empirical risk minimization. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Tien Lin (eds.), Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrIPS 2020, December 6- 6-12, 2020, virtual, 2020.
12

---

Published in Transactions on Machine Learning Research (03/2023)
Myconghun Jeong, Hyeongju Kim, Sung Jun Cheon, Byoung Jin Choi, and Nam Soo Kim. Diff-tts: A denoising diffusion model for text-to-speech. arXiv preprint arXi::2044.014000 2021.
Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4401 4410, 2019.
Tero Karras, Samuli Laine, Mila Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. In Proceedings of the IEEE/CVF conference on compuler vision and pattern recognition, pp. 8110-8119, 8119, 2020.
Simran Kaur, Jeremy Cohen, and Zachary C Tipton. Are perceptually-aligned gradients a general property of robust classifier? arvvv preprint or 1KK0:1910..550 2019.
Bahjat Kawar, Gregory Vaksman, and Michael Elad. SNIPS: Solving noisy inverse probloms stochastically. Advances in Neural Information Processing Systems, 34, 2021a.
Bahjat Kawar, Gregory Vaksman, and Michael Elad. Stochastic image denoising by sampling from the posterior distribution. In Proceedings of the IERE/CVF International Conference on Computer Vision Workshops, pp.
2021b.
Bahjat Kawar, Michael Flad, Stefano Ermon, and Jiaming Song. Denoising diffusion restoration models. In ICLR Workshop on Deep Generative Models for Highly Structured Data, 2022.
Diederik P. Kingma and Max Welling. Auto-Encoding Variational Bayes. In 2nd International Confer- ence on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
A. Kurakin, I. Goodfellow, and S. Bengio. Adversarial examples in the physical world, 2017.
Tuomas Kynkäänniemi, Tero Karras, Samuli Laine, Jaakko Lehtinen, and Timo Aila. Improved precision and recall metric for assessing generative models. Advances in Newrol Information Processing Systems, 32, 2019.
Xihui Liu, Dong Huk Park, Samaneh Azadi, Gong Zhang, Arman Chopikyan, Yuxiao Hu, Humphrey Shi, Anna Rohrbach, and Trevor Darrell. More control for free! image synthesis with semantic diffusion guidance. ar preprint S1S:::2112005444 2021.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In 6th International Conference on Learning Repre- sentations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018.
Anh Mai Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. CoRR, abs/1412.1887, 2014.
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International Conference on Machine Learning, pp. 8162-8171. PMLR, 2021.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference Machine Learning (ICML), 2022.
Tianyu Pang, Xiao Yang, Yinpeng Dong, Taufik Xu, Jun Zhu, and Hang Su. Boosting adversarial training with hypersphere embedding. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan-Tien Lin (ods.), Advances in Newral Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrIPS 2020, December 6-12, 2020, virtual, 2020.
13

---

Published in Transactions on Machine Learning Research (03/2023)
Yuchen Pu, Weiyao Wang, Ricardo Henao, Liqun Chen, Zhe Gan, Chumyuan Li, and Lawrence Carin. Adversarial symmetric variational autoencoder. Advances in nearal information processing systems, 30, 2017.
Chongli Qin, James Martens, Sven Gowal, Dilip Krishnan, Krishnamurthy Dvijotham, Alhussein Fawzi, Soham De, Robert Stanforth, and Pushmeet Kohli. Adversarial robustness through local lincarization. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d' Alché-Buc, Emily B. Fox, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 32: Annual Conference on Newral Information Processing Systems 2019, NeurIPS 2019, December 8- 6414, 2019, Vancowver, BC, Canada, pp. 18824-13833, 2019.
Alec Radford, Luke Metz, and Soumith Chintala. Unsupervised representation learning with doep convo- lutional generative adversarial networks. In 4th International Conference on Leurning Representations, 2016.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763. PMLR, 2021.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with CLIP latents. arXiv preprint orXiv:2204.060 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Seyed Kamyar Seyed Ghasemipour, Burcu Karagol Ayan, Sara Mahdavi, Rapha Gontijo Lopes, al. Photorealistic text-lo- image diffusion models with deep language understanding. arXiv preprint arxiv:2205. 11487, 2022.
Shibani Santurkar, Dimitris Tsipras, Brandon Tran, Andrew Ilyas, Logan Engstrom, and Aleksander Madry. Image Synthesis with a Single (Robust) Classifier. Curran Associates Inc., Red Hook, NY, USA, 2019.
Hiroshi Sasaki, Chris G Willcocks, and Toby P Breckon. UNIT-DDPM: Unpaired image translation with denoising diffusion probabilistic models. arXiv preprint arXiv:2104.0535 2021.
Axel Sauer, Katja Schwarz, and Andreas Geiger. Stylegan-xl: Scaling stylegan to large diverse datasets. In Special Interest Group on Computer Graphics and Interactive Techniques Conference Proceedings, pp. 1-10, 2022.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition, 2014. URL
Jascha htttp:://arxxi..rggabb/////////s 1556
Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International Conference on Machine Learning, pp. 2256-2265. PMLR, 2015.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. In Aduances in Neural Information Processing Systems, pp. 11918-11930, 2019.
Yang Song, Jascha Sohl-Dickstein, Diederík P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference Learning Representations, 2021.
Suraj Srinivas and Francois Fleuret. Rethinking the role of gradient-based attribution methods for model interpretability. In International Conference on Learning Representations, 2020.
C. Szegedy, W. Zaremba, 1. Sutskever, J. Bruna, D. Erhan, 1. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, ICLR, 2014.
Christian Szegedy, Vincent Vanhoucke, Sergey Toffe, Jon Shlens, and Zbigniew Wojna. Rothinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pollern recognition, pp. 2818 2826, 2016.
14

---

Published in Transactions on Machine Learning Research (03/2023)
Dogancan Temel and Ghassan AlRegib. Traffic signs in the wild: Highlights from the IEEE video and image processing cup 2017 student competition (SP competitions). IEEE Signal Processing Magazine, 35(2): mar 2018.
Dogancan Temel, Gukyeong Kwon, Mohit Prabhushankar, and Ghassan AlRegib. Cure-tsr: Challenging unreal and real environments for traffic sign rocognition. 2017.
Dogancan Temel, Jinsol Lee, and Ghassan AlRegib. Cure-or: Challenging unreal and real environments for object recognition. 2018.
Lucas Theis, Tim Salimans, Matthew D Hoffman, and Fabian Mentzer. Lossy compression with gaussian diffusion. Xiv preprinl Nii:2200000888 2022.
D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry. Robustness May Be at Odds with Accuracy. In International Conference on Learning Represenlations, ICLR, 2019.
Arash Vahdat and Jan Kautz. Nvae: A deep hierarchical variational autoencoder. Advances in Neural Information Processing Systems, 33:19667- 19679, 2020.
Arash Vahdat, Karsten Kreis, and Jan Kautz. Score-based generative modeling in latent space. In Newral Information Processing Systems (NeurIPS), 2021.
Aaron Van Den Oord, Oriol Vinyals, and Koray Kavukcuoglu. Neural discrete representation learning. Advances in Newral Information Processing Systems, 30, 2017.
Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adversar- ial robustness requires revisiting misclassified examples. In 8th International Conference Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.nee net, 2020.
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In IEEE Conference on Computer Vision and Pottern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20, 2019, pp. 501-509. Computer Vision Foundation / IEEE, 2019.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference Machine Learning, TCMT. 2019, 9-15 June 2019, Long Beach, California, USA, volume 97 of Proceedings of Machine Learning Research, pp. 7472 7482. PMLR, 2019.
Shengyu Zhao, Zhijian Liu, Ji Lin, Jun-Yan Zhu, and Song Han. Differentiable augmentation for data-cfficient gan training. Advances in Neural Information Processing Systems, 01-7559-75700 2020.
Linqi Zhou, Yilun Du, and Jiajun Wu. 3d shape generation and completion through point-voxel diffusion. In Proceedings of the LEEE/CVE International Conference on Computer Vision, pp. 1826-5833 2021.
Yao Zhu, Jiacheng Ma, Jiacheng Sun, Zewei Chen, Rongxin Jiang, Yaowu Chen, and Zhenguo Li. Towards un- derstanding the generative capability of adversarially robust classifiers. In 2021 JEEE/CVE International Conference on Computer Vision (ICCV), pp. 7708 7717, 2021. doi:
15

---

Published in Transactions on Machine Learning Research (03/2023)
A Additional Samples
Top
Figure 7: Uncurated samples generated by conditional diffusion model, guided by our robust time- dependent classifier.
16

---

Published in Transactions on Machine Learning Research (03/2023)
B Proof for Arbitrarily Manipulated Gradients
Below we show theoretical observation, adapted from the original work it was presented in (Sriniaas &
Fleuret 2020
Observation. Assume neural network classifier hxx) = (x)()) where h; Rd + R, and an arbitrary function g Rd + R. Consider another neural network classifier h(x) = {h,(x)) where (x(x) = hx(x) g(x), for which we obtain Vxh;(x) (x) + Vxg(x). For this, the corresponding
cross-entropy loss values and accuracy scores remain unchanged.
Proof. For any data point x E Rd and its corresponding true label fI...., C}2 the cross-entropy loss for the neural network hxx) is given as
exp(hy(xx)
Lcr(h(x), log
2j exp(hi(x))
- log exgeeppyyyyx + log
Σ exp (h2 (x))
- + log
Σ exp (f,(x)))
(6)
For the neural network h((x), we obtain the ertss-y loss by substituting h,(x) = h;(x) + g(x) in Equation 6
(cE(h(x),,) -h (x) + log Σ exp (h)()))
->),(x) 9(x) + log
Σ exp (l5(x) + +(x)))
-x) - -g(x)= + log
exp (h)(x)) exp (o(x))
-h),(x) - -((x)= + log Σ exp (1)(x))
+ log (exp (g(x)))
-x, - -((x) + log Σ exp (h,(x))
+ g(x)
= -l,,(x)) + log
Σ exp (h2 (x))
=ccE(h(x),))
(7)
The last equality holds due Equation 6 It also holds that
arg max h,(x) arg max (h,(x) + 9(x) arg max h hx(x), ve(1....C)
(8)
(E(....,)) iE(1....C)
implying identical predictions for both networks on any input, and therefore identical accuracy scores, completing the proof.
17

---

Published in Transactions on Machine Learning Research (03/2023)
This observation shows that two neural networks with an identical loss over all inputs, can have arbitrarily different gradients, as the proof does not assume any limitations on g(x) nor on x. This also implies that the proof remains valid for noisy training data, and as a result, it remains valid for time-dependent classifiers which follow Gaussian noise schedule, such as the one trained by (Dhariwal & Nichol (021). However, when transitioning into an adversarial training scheme, the perturbed training inputs become dependent the model's gradients, and consequently, the adversarial loss presented in Equation (5) changes. This
motivates the use of an adversarially-trained classifier over a vanilla one, when the goal is to obtain better gradients.
C Opinion Survey Details
Which image more realistic, and more aligned to the description?
Doberman
Doberman
Left
Right
Same
Figure 8: A screenshot of the survey that was shown to human evaluators.
As previously mentioned, we conducted an opinion survey, asking human evaluators choose their preferred image out of pair of generated images 200 pairs, randomly shuffled, where each pair consists of two randomly ordered images generated with the same class label and seed, once guided by our robust classifier, and once guided using the pre-trained vanilla classifier. An example of the screen shown to evaluators is displayed in Figure
choose that they have no preference. Evaluators were shown
Some evaluators did not fill out the entire survey. Hence, different pairs have different numbers of answers. Nevertheless, sufficient data was collected for all pairs, as the number answers per pair ranged from 19 to 36, averaging 25.09 answers.
D Implementation Details
We base implementation on the publicly available code provided by (Dariial & Nichol 2021 J. For implementing the adversarial training scheme, adapt code from (Madry et al. 2018) to work with time- dependent models and enable carly stopping, and use it to train our robust time-dependent classifier. The sampling routine is identical to that of (Dhariwal & Nichol 2021), up to changing the model and sampling hyperparametees. Our code and trained robust timo-dependent classifier models are available at https:
E
Ablation Study
To perform a comprehensive ablation study on the different hyperparameters of our method, we consider the smaller CIFAR-10 (Krizhevsky et al. 2009) dataset, containing 32 32-pixel images. We train class-
18

---

Published in Transactions on Machine Learning Research (03/2023)
Table 3: FID different training iterations of an unguided class-con diffusion model for CIFAR-10.
Iterations
50k
100k
150k
200k
250k
300k
FID
11.65
8.41
7.81
7.67
7.68
7.91
conditional diffusion model for CIFAR-10, with an architecture adapted from Nichol & Dhariwal (2021) (changing the dropout from 0.3 to 0.1, making the model class-conditional, and using linear 1000-step noise schedule akin to Dhariwal & Nichol (2021) ) We mcasure FID with 10000 images against the validation set, and show the diffusion model's results in Table 3 The trained diffusion model achieves its best FID at 200k training dlerations As a general point of reference, StyleGAN2 (Karras et al. 2020) achieves an FID of 11.07 (Zhao et al. 2020). As a baseline, we train a vanilla time-dependent classifier with an architecture similar to Dhariwal Nichol (2021) (changing: the number of output channels to 10 and image size to to match CIFAR-10, the allention resolutions from [32, 16, 8] to [16, 8), and the classifier width from 128 to 32). At 200k iterations and 0.25, it achieves FID of 7.65 with the aforementioned diffusion model.
Table 4: FID CIFAR-10 for different threat models and numbers of attacker steps, after training robust classifier for 200k steps and using guidance scale of 0.25. Best result is highlighted in bold.
Threat Model
steps
7 steps
9 steps
{x + 0 |8112 S 0.25)
7.62
7.62
7.64
{xt + 6
[8], S 0.5]
7.62
7.60
7.63
{x, +
[81, I 1.0]
7.64
7.63
7.65
(x, + 5
181 > S 4/255]
7.61
7.61
7.62
[x 8
18 S 8/255]
7.65
7.64
7.67
Then, we adversarially train a robust classifier with the same architecture. We perform an ablation study on the different adversarial training hyperparameters and summarize our results in Table The attack step size is set 2.5 times the upper bound in the attack threat model, divided by the number of attacker steps. We choose the best, performing robust classifier, which trained on the threat model {x, + 5 ||1||| S 0.5) with 7 attacker steps and 200k training iterations.
Table 5: FID for classifier guidance scales (s) for both the vanilla and robust classifiers on CIFAR-10.
Classifier = 0 = 0.0625
0.125
==00 0.25
= 0.5
Vanilla
7.67
7.65
7.62
7.65
7.87
Robust
7.67
7.62
7.58
7.60
7.79
Moreover, we also conduct an ablation study for the classifier guidance scale hyperparameter s, for both the vanilla and robust classifiers, and present the results in Table Our robust classifier outperforms its vanilla counterpart in every classifier scale, attaining an FID of 7.58 0.125. These results show that simple traversal of the classifier scales cannot improve the vanilla classifier's performance to the level attained by the robust one.
E.1 Effect of Classifier Guidance Scale Precision and Recall
We measure the effect of the classifier guidance scale hyperparameter s on the Precision and Rocall metrics for our main ImageNet experiments for both the vanilla and robust classifiers. The results are presented in Table G
19

---

Published in Transactions on Machine Learning Research (03/2023)
Table 6: Precision and Recall for classifier guidance scales (s) for both the vanilla and robust classifiers on ImageNet.
Classifier
Metric
== 0
0.25
= 0.5
1.0
8
2.0
8 = 4.0
Vanilla
Precision
0.70
0.73
0.77
0.80
0.84
0.86
Recall
0.65
0.62
0.59
0.53
0.46
0.37
Robust
Precision
0.70
0.74
0.77
0.82
0.86
0.89
Rocall
0.65
0.62
0.60
0.56
0.47
0.39
Diffusion models are known for their great mode coverage, which gives them an edge in the Recall metric. In fact, the unguided diffusion model achieves better Recall rales than any guided version. As increases (in both vanilla and robust settings), we trade off Recall for better Precision.
Our robust model at 0.5 achieves Precision and Recall that are similar to Dhariwal & Nichol (2021 However, in FID, which computes distance between distributions (covering concepts from both Precision and Recall), our robust classifier (at = 1.0) improves upon the vanilla. one (which achieves its best FID result at - 0.5), meaning that the improvement in precision outweighs the loss in recall.
20


Reviews:
[{"review_id": "mcgJCDsOPi", "reviewer": "Reviewer_RJzT", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The motivation of the approach is well written and makes it clear why an adversarially robust classifier may be preferred over a vanilla classifier for guidance of class-conditional diffusion models.\nThe evaluation is done on ImageNet, arguably one of the most challenging class-conditional datasets for image generation and based on FID and a human user study the proposed methodology seems to improve upon the baseline.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes to replace the classifier for classifier-guided diffusion models with an adversarially trained classifier, arguing that a classifier trained with adversarial noise provides better gradients and information to a class-conditional diffusion net at sample time. For this, the paper compares results of a class-conditional diffusion net on ImageNet guided by either a vanilla or an adversarially trained classifier. Using an adversarially robust classifier for guidance improves FID and precision and a human user study indicates that humans prefer images generated with the guidance of the adversarially robust classifier.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "The approach is only evaluated on a single dataset. While ImageNet is a good benchmark the approach should be evaluated on other datasets, too. The approach is somewhat constrained in that it only works on class-conditional datasets, nevertheless, there are other datastes on which this approach can be evaluated such as CUB-200, Oxfod 102-Flower, possible CelebA, or even CIFAR.\n\nOverall, however, I believe the biggest drawback is the limitation of classifier-guided models to class-conditional image datasets in the first place. Arguably, most of the popularity of diffusion days nowadays stems from the fact that they are able to model large, diverse datasets. In these cases, classifier-guidance is not realistic since there are no available class labels for most images. Approaches such as CLIP-guidance may alleviate this to a degree but are not evaluated in this paper.\n\nThe default approach is classifier-free guidance for almost all of these cases, which has the advantage of not needing an additional classifier network and is not limited to class-conditional guidance.\n\nAs a summary, I would expect the paper to have\n- comparisons on more datasets\n- extension of the approach to CLIP-guidance or similar guidance mechanisms that are not restricted to class-conditional models\n- a comparison to classifier-free guidance: if the approach is not better than classifier-free guidance despite being more complex and expensive I don't see the benefit", "broader_impact_concerns": "n/a", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "zcfhOH6rDU", "reviewer": "Reviewer_KbY7", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n- The paper is well-written and easy to follow.\n- It is interesting to see ideas from the adversarial robustness literature being employed to improve diffusion models. \n\nWeaknesses:\n- A somewhat salient point that is not clear is whether they train the diffusion model from scratch or fine-tune the pre-trained model from Dhariwal and Nichol on ImageNet. If it is the latter, (i) the authors should explain why they made this choice and (ii) it should be clearly stated throughout the paper. It would also be valuable to see how the approaches compare on training the model from scratch.\n- It is not clear how significant the improvement in generation actually is. In particular, one concern I have is that the proposed method is trading of quality (improved precision and FID) for diversity (recall)---perhaps similar to the effect of the scaling factor s. Moreover, the human experiment is also setup to measure quality and not diversity. I wonder whether simply tuning \"s\" for the vanilla method would yield similar results. \n- Finally, given that robust training is a key component of the proposed approach, the authors could do a better job of examining how choices of hyperparameters therein affect generation quality. Currently, parameters such as eps, step size, number of steps are merely stated without explanation. The paper could be strengthened with an analysis of how image quality changes with eps and step size. Also, it seems like the step size being used for the attack might be too small---in general, the rule of thumb is 2.5*eps/steps.\n\nSome additional questions/comments:\n\n- In Table 1, does no guidance just mean using the pre-trained model from Dhariwal and Nichol (trained with vanilla classifier guidance)?\n- It seems from Table 1 that like a big part of the improvement stems from training the model longer with any guidance.\n- Even though the metrics used in the paper (FID, precision and recall) are derived from prior work, it would be nice if the authors could briefly describe them at least in the Appendix.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a methodology to improve image quality in class-conditional DDPMs. In particular, they rely on the observation from prior work that adversarially robust classifiers tend to have more perceptually-aligned gradients. They leverage this property by using gradients from a robust classifier (rather than a standard ERM-trained classifier) to guide the diffusion process (based on the setup of Dhariwal and Nichol). They validate their approach on ImageNet generation in terms of automated metrics as well as a human study.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "My main concerns are described in the three weaknesses above. I would be happy to recommend acceptance if the authors addressed those concerns.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "teQnidb6qW", "reviewer": "Reviewer_s4sm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n• The paper addresses an important short-coming of guided image-synthesis approaches and provides a solution to address these short-comings as well as a valid line of argument why / how their solution addresses the short-coming. To the best of my knowledge the proposed solution is novel wrt state-of-the-art approaches.\n\n• The paper provides some strong qualitative evidence that their proposed approach improves guided image synthesis. \n\n• Implementation of the approach and reproduction of the findings seem straight forward, however no code is provided.\n\n• The paper is well written and structured. The main contributions of the paper are introduced and presented in an easy to access manner.\n\n\nWeaknesses:\n\n• My major concern for this work is the lack of sufficient quantitative results / evaluations. Only Table 1 provides some rather limited quantitative evaluation. Specifically additional ablations studies / argumentation would be desirable addressing the low recall rate for the proposed approach. Like why/how and in which cases this doesn’t work.\n\n\nMinor Weakness:\n\n• I find the term “time-dependent” rather confusing. I understand that this refers to the iterations in the diffusion model, but is suggests a relation to video-generation, which is not the meaning here. If “time-dependent” is a commonly used term in the context of diffusion models that is fine. \n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work addresses a shortcoming of diffusion-based image synthesis which rely on an image classification model for (class) guided image generation. The authors argue that well known adversarial vulnerability of such image classification models also impairs the performance of image synthesis approaches based on a vulnerable model. The authors propose to utilize adversarial hardened (here in form of adversarial training) classification models instead. The authors provide some quantitative as well as qualitative evidence to show improvements of their method for image synthesis.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "I consider it critical that some further quantitative evidence / ablations are provided to better understand the achieved improvements for the new approach.\n\nIf addressed I would raise my \"Claims And Evidence\" rating \"No\" -> \"Yes\"\n\n", "broader_impact_concerns": "Similar to other image generation methods the proposed method can be used to also improve quality of faked images / photos and can hence be misused.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: Reasoning behind my recommendation can be found under "Claims and Evidence"
Decision: Accept (poster)