Title: DiffAug: A Diffuse-and-Denoise Augmentation for Training Robust Classifiers
Venue: NeurIPS 2024
Accepted: yes
Keywords: Synthetic Augmentations; Robust Classifiers; Classifier-guided Diffusion; Perceptually Aligned Gradients
Abstract: We introduce DiffAug, a simple and efficient diffusion-based augmentation technique to train image classifiers for the crucial yet challenging goal of improved classifier robustness. Applying DiffAug to a given example consists of one forward-diffusion step followed by one reverse-diffusion step. Using both ResNet-50 and Vision Transformer architectures, we comprehensively evaluate classifiers trained with DiffAug and demonstrate the surprising effectiveness of single-step reverse diffusion in improving robustness to covariate shifts, certified adversarial accuracy and out of distribution detection. When we combine DiffAug with other augmentations such as AugMix and DeepAugment we demonstrate further improved robustness. Finally, building on this approach, we also improve classifier-guided diffusion wherein we observe improvements in: (i) classifier-generalization, (ii) gradient quality (i.e., improved perceptual alignment) and (iii) image generation performance. We thus introduce a computationally efficient technique for training with improved robustness that does not require any additional data, and effectively complements existing augmentation approaches.

DiffAug: A Diffuse-and-Denoise Augmentation for Training Robust Classifiers

Abstract

We introduce DiffAug, a simple and efficient diffusion-based augmentation technique to train image classifiers for the crucial yet challenging goal of improved classifier robustness. Applying DiffAug to a given example consists of one forwarddiffusion step followed by one reverse-diffusion step. Using both ResNet-50 and Vision Transformer architectures, we comprehensively evaluate classifiers trained with DiffAug and demonstrate the surprising effectiveness of single-step reverse diffusion in improving robustness to covariate shifts, certified adversarial accuracy and out of distribution detection. When we combine DiffAug with other augmentations such as AugMix and DeepAugment we demonstrate further improved robustness. Finally, building on this approach, we also improve classifier-guided diffusion wherein we observe improvements in: (i) classifier-generalization, (ii) gradient quality (i.e., improved perceptual alignment) and (iii) image generation performance. We thus introduce a computationally efficient technique for training with improved robustness that does not require any additional data, and effectively complements existing augmentation approaches.

1 Introduction

Motivated by the success of diffusion models in high-fidelity and photorealistic image generation, generative data augmentation is an emerging application of diffusion models. While attempts to train improved classifiers with synthetic data have proved challenging, Azizi et al. [2] impressively demonstrated that extending the training dataset with synthetic images generated using Imagen [42] with appropriate sampling parameters (e.g. prompt and guidance strength) - could indeed improve Imagenet classification. In a similar experiment with Stable Diffusion (SD) [41], Sariyildiz et al. [45] studied classifiers trained exclusively on synthetic images (i.e. no real images) and discovered improvements when training on a subset of 100 Imagenet classes. The success of generative data augmentation depends crucially on sample quality [40], so these findings irrefutably highlight the superior generative abilities of diffusion models.

Despite these impressive findings, widespread adoption of diffusion models for synthetic data augmentation is constrained by high computational cost of diffusion sampling, which requires multiple steps of reverse diffusion to ensure sufficient sample quality. Furthermore, both SD and Imagen are trained on upstream datasets much larger than Imagenet and some of these improvements could also be attributed to the quality and scale of the upstream dataset [19]. For example, Bansal and Grover [4] find limited advantages in synthetic examples generated from a diffusion model trained solely on Imagenet.

Together, these limitations motivate us to explore a diffusion-based augmentation technique that is not only computationally efficient but can also enhance classifier training without relying on extra data. To that end, we consider the following questions:

Can we leverage a diffusion model trained with no extra data?

2. Can we train improved classifiers with a single step of reverse diffusion?

In the context of reverse diffusion sampling, the intermediate output obtained after one reverse diffusion (i.e., denoising) step is commonly interpreted as an approximation of the final image by previous works and has been utilised to define the guidance function at each step of guided reversediffusion (e.g., [3, 10, 11]). Similarly, Diffusion Denoised Smoothing (DDS) [5] applies denoised smoothing [43], a certified adversarial defense for pretrained classifiers, using one reverse diffusion step. In contrast to previous work, we use the output from a single reverse diffusion step as an augmentation to train classifiers (i.e., not just at inference time) as we describe next.

Diffuse-and-Denoise Augmentation Considering a diffusion model defined such that time t = 0 refers to the data distribution and time t = T refers to isotropic Gaussian noise, we propose to generate augmentations of train examples by first applying a Gaussian perturbation (i.e., forwarddiffusion to a random time t ∈ [0 , T ] ) and then crucially, applying a single diffusion denoising step (i.e., one-step reverse diffusion). That is, we treat these diffused-and-denoised examples as augmentations of the original train image and refer to this technique as DiffAug. A one-step diffusion denoised example derived from a Gaussian perturbed train example can also be interpreted as an intermediate sample in some reverse diffusion sequence that starts with pure noise and ends at the train example. Interpreted this way, our classifier can be viewed as having been trained on partiallysynthesized images whose ostensible quality varies from unrecognizable (DiffAug using t ≈ T ) to excellent (DiffAug using t ≈ 0 ). This is surprising because, while Ravuri and Vinyals [40] find that expanding the train dataset even with a small fraction of (lower quality) synthetic examples can lead to noticeable drops in classification accuracy, we find that classifier accuracy over test examples does not degrade despite being explicitly trained with partially synthesized train images. Instead, we show that diffusion-denoised examples offer a regularization effect when training classifiers that leads to improved classifier robustness without sacrificing clean test accuracy and without requiring additional data .

Our contributions in this work are as follows 1 :

(a) DiffAug We propose DiffAug, a simple, efficient and effective diffusion-based augmentation technique. We provide a qualitative and analytical discussion on the unique regularization effect -complementary to other leading and classic augmentation methods - introduced by DiffAug.

(b) Robust Classification . Using both ResNet-50 and ViT architectures, we evaluate the models in terms of their robustness to covariate shifts, adversarial examples (i.e., certified accuracy under Diffusion Denoised Smoothing (DDS)[5]) and out-of-distribution detection.

(c) DiffAug-Ensemble (DE) We extend DiffAug to test-time and introduce DE, a simple test-time image augmentation/adaptation technique to improve robustness to covariate shift that is not only competitive with DDA [18], the state-of-the-art image adaptation method but also 10x faster.

(d) Perceptual Gradient Alignment. Motivated by the success of DDS and evidence of perceptually aligned gradients (PAGs) in robust classifiers, we qualitatively analyse the classifier gradients and discover the perceptual alignment described in previous works. We then theoretically analyse the gradients through the score function to explain this perceptual alignment.

(e) Improved Classifier-Guided Diffusion . Finally, we build on (d) to improve gradient quality in guidance classifiers and demonstrate improvements in terms of: (i) generalization, (ii) perceptual gradient alignment and (iii) image generation performance.

2 Background

The stochastic diffusion framework [47] consists of two key components: 1) the forward-diffusion (i.e., data to noise) stochastic process, and 2) a learnable score-function that can then be used for the reverse-diffusion (i.e., noise to data) stochastic process.

The forward diffusion stochastic process { x t } t ∈ [0 ,T ] starts at data, x 0 , and ends at noise, x T . We let p t ( x ) denote the probability density of x at time t such that p 0 ( x ) is the data distribution, and p T ( x ) denotes the noise distribution. The diffusion is defined with a stochastic-differential-equation (SDE): d x = f ( x , t ) dt + g ( t ) d w , (1)

where w denotes a standard Wiener process, f ( x , t ) is a drift coefficient, and g ( t ) is a diffusion coefficient. The drift and diffusion coefficients are usually specified manually such that the solution to

the SDE with initial value x 0 is a time-varying Gaussian distribution p t ( x | x 0 ) whose mean µ ( x 0 , t ) and standard deviation σ ( t ) can be exactly computed.

To sample from p 0 ( x ) starting with samples from p T ( x ) , we solve the reverse diffusion SDE [1]:

where d ¯ w is a standard Wiener process when time flows from T to 0, and dt is an infinitesimal negative timestep. In practice, the score function ∇ x log p t ( x ) is estimated by a neural network s θ ( x , t ) , parameterized by θ , trained using a score-matching loss [47].

Denoised Examples. Given ( x 0 , y ) ∼ p 0 and x ∼ p t ( x | x 0 ) = N ( x | µ ( x 0 , t ) , σ 2 ( t ) I ) , we can compute the denoised image ˆ x t using the pretrained score network s θ as:

Intuitively, ˆ x t is an expectation over all possible images m t = µ ( x 0 , t ) that are likely to have been perturbed with N ( 0 , σ 2 ( t ) I ) to generate x and the denoised example ˆ x t can be written as

We note that the mean does not change with diffusion time t in variance-exploding SDEs while the mean decays to zero with diffusion time for variance-preserving SDEs (DDPMs).

3 DiffAug: Diffuse-and-Denoise Augmentation

In this section, we describe Diffuse-and-Denoise Augmentation (DiffAug, in short) and then provide an analytical and qualitative discussion on the role of denoised examples in training classifiers. While we are not aware of any previous study on training classifiers using partially denoised examples, Diffusion-denoised smoothing (DDS) [5], DiffPure [36] and Diffusion Driven Adaptation (DDA) [18] are test-time applications of - single-step (DDS) and multi-step (DiffPure/DDA) - denoised examples to promote robustness in pretrained classifiers.

As implied by its name, DiffAug consists of two key steps: (i) Diffuse: first, we diffuse a train example x 0 to a uniformly sampled time t ∼ U (0 , T ) and generate x ∼ p t ( x | x 0 ) ; (ii) Denoise: then, we denoise x using a single application of trained score network s θ as shown in Eq. 3 to generate ˆ x t . We assume that the class label does not change upon augmentation (see discussion below) and train the classifier to minimize the following cross-entropy loss:

𝐱

!

𝐱 "

!

𝐱 "

"

where, t ∼ U (0 , T ) , ( x 0 , y ) ∼ p 0 ( x ) , and p ϕ denotes the classifier parameterized by ϕ . In this work, we show the effectiveness of DiffAug as a standalone augmentation technique, as well as the further compounding effect of combining it with robustness-enhancing techniques such as Augmix and DeepAugment, showing that DiffAug is achieving a robustness not captured by the other approaches. When combining DiffAug with such novel augmentation techniques, we simply include Eq. 5 as an additional optimization objective instead of stacking augmentations (for example, we can alternatively apply DiffAug to images augmented with Augmix/DeepAugment or vice-versa). Also, our preliminary analysis on stacking augmentations showed limited gains over simply training the network to classify independently augmented samples likely because training on independent augmentations implicitly generalizes to stacked augmentations.

Qualitative Analysis and Manifold Theory. When generating augmentations, it is important to ensure that the resulting augmentations lie on the image manifold. Recent studies [10, 38] on theoretical properties of denoised examples suggest that denoised examples can be considered to

be on the data manifold under certain assumptions lending theoretical support to the idea of using denoised examples as augmentations. We can interpret training on denoised examples as a type of Vicinal Risk Minimization (VRM) since the denoised examples can be considered to lie in the vicinal distribution of training samples. Previous works have shown that VRM improves generalization: for example, Chapelle et al. [8] use Gaussian perturbed examples ( x ) as the vicinal distribution while MixUp [57] uses a convex sum of two random inputs (and their labels) as the vicinal distribution. From Eq. 4, we can observe that a denoised example is a convex sum over m t and we can interpret ˆ x t as being vicinal to examples m t that have a non-trivial likelihood, p t ( m t | x ) , of generating x . The distribution p t ( m t | x ) is concentrated around examples perceptually similar to µ ( x 0 , t ) when x is closer to x 0 (i.e., smaller σ ( t ) ) and becomes more entropic as the noise scale increases: we can qualitatively observe this in Fig. 1.

Diffusion denoised augmentations generated from larger σ ( t ) can introduce label-noise into the training since the class-labels may not be preserved upon augmentation - for example, some of the diffusion denoised augmentations of the dog in Fig. 1 resemble architectural buildings. Augmentations that alter the true class-label are said to cause manifold intrusion [21] leading to underfitting and lower classification accuracies. In particular, accurate predictions on class-altered augmented examples would be incorrectly penalised causing the classifier to output less confident predictions on all inputs (i.e., underfitting). Interestingly, however, diffusion denoised augmentations that alter the true-class label are also of lower sample quality. The correlation between label noise and sample quality allows the model to selectively lower its prediction confidence when classifying denoised samples generated from larger perturbations applied to x 0 (we empirically confirm this in Section 4). In other words, the classifier learns to observe important details in ˆ x t to determine the optimal prediction estimating the class-membership probabilities of x 0 . On the other hand, any augmentation that alters class-label by preserving the sample quality can impede the classifier training since the classifier cannot rely on visual cues to selectively lower its confidence (for an example, see Fig. 7 in appendix). Therefore, we do not consider multi-step denoising techniques to generate augmentations - despite their potential to improve sample quality - since this would effectively decorrelate label-noise and sample-quality necessitating additional safeguards - e.g., we would then need to determine the maximum diffusion time we could use for augmentation without altering the class-label or scale down the loss terms corresponding to samples generated from larger σ ( t ) . We leave this exploration to future work and include a preliminary analysis in Appendix B.2.2.

Test-time Augmentation with DiffAug. Test-time Augmentation (TTA) [30] is a technique to improve classifier prediction using several augmented copies of a single test example. A simple yet successful TTA technique is to just average the model predictions for each augmentation of a test sample. We extend DiffAug to generate test-time augmentations of a test-example wherein we apply DiffAug using different values of diffusion times t and utilize the average predictions across all the augmentations to classify the test example x 0 :

where, S denotes the set of diffusion times considered. We refer to this as DiffAug Ensemble (DE). A forward diffusion step followed by diffusion denoising can be interpreted as projecting a test-example with unknown distribution shift into the source distribution and forms the basis of DDA, a diffusion-based image adaptation technique. Different from DE, DDA uses a novel multi-step denoising technique to transform the diffused test example into the source distribution. Since DE uses single-step denoised examples of forward diffused samples, we observe significant improvement in terms of running time while either improving over or remaining on par with DDA.

4 Experiments I: Classifier Robustness

In this section, we evaluate classifiers trained with DiffAug in terms of their standard classification accuracy as well as their robustness to distribution shifts and adversarial examples. We primarily conduct our experiments on Imagenet-1k and use the unconditional 256 × 256 Improved-DDPM [14, 35] diffusion model to generate the augmentations. We apply DiffAug to train the popular ResNet-50 (RN-50) backbone as well as the recent Vision-Transformer (ViT) model (ViT-B-16, in particular). In addition to extending the default augmentations used to train RN-50/ViT with DiffAug, we also combine our method with the following effective robustness-enhancing augmentations: (i) AugMix (AM), (ii) DeepAugment (DA) and (iii) DeepAugment+AugMix (DAM). While we train

the RN-50 from scratch, we follow DeIT-III recipe[50] for training ViTs and apply DiffAug in the second training stage; when combining with AM/DA/DAM, we finetune the official checkpoint for 10 epochs. More details are included in Appendix B.1. In the following, we will evaluate the classifier robustness to (i) covariate shifts, (ii) adversarial examples and (iii) out-of-distribution examples.

Covariate Shifts To evaluate the classifiers trained with/without DiffAug in terms of their robustness to covariate-shifts, we consider the following evaluation modes:

(a) DDA : A diffusion-based test-time image-adaptation technique to transform the test image into the source distribution.

(b) DDA-SE : We consider the original test example as well as the DDA-adapted test-example by averaging the classifier predictions following the self-ensemble (SE) strategy proposed in [18].

(c) DiffAug-Ensemble (DE) : We use a set of test-time DiffAug augmentations to classify a test example as described in Eq. (6). Following DDA, we determine the following range of diffusion times S = { 0 , 50 , . . . , 450 } . In other words, we generate 9 DiffAug augmentations for each test example.

(d) Default : In the default mode, we directly evaluate the model on the test examples.

We evaluate the classifiers on Imagenet-C, a dataset of 15 synthetic corruptions applied to Imagenettest and summarize the results across all evaluation modes in Table 9. We summarize our observations as follows:

(i) DiffAug introduces consistent improvements Classifiers trained with DiffAug consistently improve over their counterparts trained without these augmentations across all evaluation modes. The average relative improvements across all corruptions range from 5.3% to 28.7% in the default evaluation mode (see Table 6 in Appendix). On clean examples, we observe that DiffAug helps minimize the gap between default evaluation mode and other evaluation modes while effectively preserving the default accuracy.

(ii) DE improves over DDA On average, DiffAug Ensemble (DE) yields improved detection rate as compared to direct evaluation on DDA images. Furthermore, DiffAug-trained classifiers evaluated using DE improve on average over their counterparts (trained without DiffAug) evaluated using DDA-SE. This experiment interestingly reveals that a set of one-step diffusion denoised images (DE) can achieve improvements comparable to multi-step diffusion denoised images (DDA) at a substantially faster ( ∼ 10 x) wallclock time (see Table 10 in Appendix).

DiffAug vs Extra Synthetic Data : Bansal and Grover [4] demonstrate that foundation models such as Stable-Diffusion can be used to generate additional synthetic data to improve classifier robustness to covariate shifts. We note that extra synthetic data with diffusion models trained exclusively on ImageNet do not help in enhancing classifier robustness (see Appendix B.2.1). In particular, Bansal and Grover [4] utilise diverse prompts to generate a synthetic clone of Imagenet consisting of 1.3M

images. We utilize their open-sourced synthetic dataset and fine-tune the torchvision resnet-50 model for 10 epochs using both real and synthetic images and call this RN50+Synth. Next, we repeat this finetuning process with DiffAug and call this RN50+Synth+DiffAug. In Table 2, we summarize the results across many datasets and interestingly observe that DiffAug - using an ImageNet-only diffusion model - offers improvements over and beyond additional synthetic data using StableDiffusion. This is surprising due to the following reasons: (i) SD is trained on LAION-5B, a much larger dataset that also subsumes ImageNet. (ii) Additional synthetic data requires more compute per each sample (e.g., 50 reverse-diffusion steps) whereas DiffAug just uses one reverse-diffusion step.

While the improvements offered by the extra synthetic data can be largely attributed to the upstream training dataset, DiffAug augmentations offer complementary regularization benefits. To understand this, we first note that DiffAug augmentations are qualitatively distinct from high-quality synthetic images and can be interpreted as lying on the image manifold in regions between high-quality samples: depending on the diffusion time, the DiffAug augmentation can vary greatly in quality (as shown in Fig. 1). As a result, classifying some of these augmented images is more challenging as compared to the original examples producing a regularizing effect that leads to empirical robustness improvements.

We include a detailed evaluation across different datasets including ImageNet-R/S in the Appendix (Table 7). Overall, we observe that DiffAug training and DE inference help significantly enhance robustness to covariate-shifts in several cases.

Out-of-Distribution (OOD) Detection. Test examples whose labels do not overlap with the labels of the train distribution are referred to as out-of-distribution examples. To evaluate the classifiers in terms of their OOD-detection rates, we use the Imagenet near-OOD detection task defined in the OpenOOD benchmark, which also includes an implementation of recent OOD detection algorithms such as ASH[15], ReAct[49], Scale[54] and MSP[23]. For context, while the torchvision ResNet-50 checkpoint is most commonly used to evaluate new OOD detection algorithms, AugMix provides the best OOD detection amongst the existing robustnessenhancing augmentation techniques and AugMix/ASH is placed 3rd amongst 73 methods on the OpenOOD leaderboard (ordered by nearOOD performance). Yet in Table 3 we observe that DiffAug introduces further improvement on the challenging near-OOD detection task across all considered OOD algorithms.

Comparing our results to the leaderboard, we observe AugMix+DiffAug/Scale achieves an AUROC of 84.81 outperforming the second best method (84.01 AUROC) and comparable to the top AUROC of 84.87.

0

200

400

600

800

0

2

4

6

Entropy (nats)

Maximum Entropy

DA

+DiffAug

AM

+DiffAug

DAM

+DiffAug

t

DiffAug training teaches the network to selectively lower its prediction confidence (higher prediction entropy) based on the image content (Fig. 2) and we hypothesize that this leads to improved OOD detection rates. We include the detailed OOD detection results in Appendix B.4. Interestingly, the combination of augmentations that improve robustness on covariate shifts may not necessarily lead to improved OOD detection rates: for example, AugMix+DeepAugment improves over both AugMix and DeepAugment on covariate shift but achieves lower OOD detection rates than either. On the other hand, we observe that combining with DiffAug enhances both OOD detection as well as robustness to covariate shift.

Certified Adversarial Accuracy. Denoised smoothing [43] is a certified defense for pretrained classifiers inspired from Randomized smoothing [12] wherein noisy copies of a test image are first denoised and then used as classifier input to estimate both the class-label and robust radius for each example. Using the same diffusion model as ours, DDS[5] already achieves state-of-the-art certified Imagenet accuracies with a pretrained 305M-parameter BeIT-L. Here, we evaluate the improvement in certified accuracy when applying DDS to a model trained with DiffAug and include the results in Appendix B.3. We speculate that finetuning the BeIT-L model with DiffAug should lead to similar improvements but skip this experiment since it is computationally expensive.

Perceptually Aligned Gradients and Robustness. Classifier gradients ( ∇ z log p ϕ ( y | z ) where z is an image) which are semantically aligned with human perception are said to be perceptually aligned gradients (PAG) [17]. While input-gradients of a typical image classifier are usually unintelligible, gradients obtained from adversarially robust classifiers trained using randomized smoothing [28] or adversarial training [16, 44, 52] are perceptually-aligned. Motivated by the state-of-the-art certified adversarial accuracy achieved by DDS, we analyse the classifier gradients of one-step diffusion denoised examples - i.e., we analyse ∇ x log p ϕ ( y | ˆ x t ) where x = p t ( x | x 0 ) and ˆ x t = x + σ 2 ( t ) s θ ( x , t ) . We visualise the gradients in Fig. 3 and interestingly discover the same perceptual alignment of gradients discussed in previous works (we compare with gradients of

classifiers trained with randomized smoothing later). To theoretically analyse this effect, we first decompose the input-gradient using chain rule as:

Empirically, we find that the perceptual alignment is introduced due to transformation by d ˆ x t d x and analyse it further:

Theorem 4.1. Consider a forward-diffusion SDE defined as in Eq. 1 such that p t ( x | x 0 ) = N ( x | m t , σ 2 ( t ) I ) where m t = µ ( x 0 , t ) . If x ∼ p t ( x ) and ˆ x t = x + σ 2 ( t ) s θ ( x , t ) , for optimal parameters θ , the derivative of ˆ x t w.r.t. x is proportional to the covariance matrix of the conditional distribution p ( m t | x ) . See proof in Appendix B.6.

This theorem shows us that the multiplication by ∂ ˆ x t ∂ x in Eq (7) is in fact a transformation by the covariance matrix Cov [ m t | x ] . Multiplying a vector by Cov [ m t | x ] stretches the vector along the principal directions of the conditional distribution p ( m t | x ) . Intuitively, since the conditional distribution p ( m t | x ) corresponds to the distribution of candidate denoised images, the principal directions of variation are perceptually aligned (to demonstrate, we apply SVD to J and visualise the principal components in Appendix B.7) and hence stretching the gradient along these directions will yield perceptually aligned gradients. We note that our derivation complements Proposition 1 in Chung et al. [10] which proves certain properties (e.g., J = J ⊤ ) of this derivative. In practice, however, the score-function is parameterized by unconstrained, flexible neural architectures that do not have exactly symmetric jacobian matrices J . For more details on techniques to enforce conservative properties of score-functions, we refer the reader to Chao et al. [7]. Ganz et al. [17] demonstrate that training a classifier to have perceptually aligned gradients also improves its robustness exposing the bidirectional relationship between robustness and PAGs. This works offers additional evidence supporting the co-occurrence of robustness and PAGs since we observe that classification of diffused-and-denoised images (e.g., DDS, DE, DDA) not only improve robustness but also produce PAGs.

Ablation Analysis. Appendix B.5 includes an ablation study on the following:

(a) Extra Training . The pretrained DA, AM, and DAM classifiers are sufficiently trained for 180 epochs and hence, we compare the DiffAug finetuned model directly with the pretrained checkpoint. For completeness, we train AugMix for another 10 epochs and confirm that there is no notable change in performance as compared to results in Tables 3, 7 and 9.

(b) DiffAug Hyperparameters . In our experiments, we considered the complete range of diffusion time. We investigate a simple variation where we either use t ∈ [0 , 500] or t ∈ [500 , 999] to generate the DiffAug augmentations.

(c) DiffAug-Ensemble Hyperparameters . We analyse how the choice of diffusion times considered in the set S (Eq. (6)) affects DE performance.

(d) Conditional DiffAug . While our DiffAug experiments mainly utilize unconditional diffusion models, we can also utilize conditional diffusion models and explore an extension of AugMix with conditional DiffAug for various guidance strengths.

(e) Latent-Space Diffusion Models . Wealso tried the DiffAug augmentation method with DiffusionTransformer (DiT): while we observed that the test-accuracy is preserved even in this case, we only observe slight robustness improvements as compared with pixel-space diffusion models. This may be explained by noting that the VAE-decoder is trained to output perceptually highquality image and hence, does not accurately capture the expectation in Eq. (4).

5 Experiments II: Classifier-Guided Diffusion

Classifier guided (CG) diffusion is a conditional generation technique to generate class-conditional samples with an unconditional diffusion model. To achieve this, a time-conditional classifier is separately trained to classify noisy samples from the forward diffusion and we refer to this as a guidance classifier

where, t ∼ U (0 , T ) , x ∼ p t ( x | x 0 ) and ( x 0 , y ) ∼ p 0 ( x ) . At each step of the classifier-guided reverse diffusion (Eq. (2)), the guidance classifier is used to compute the class-conditional score ∇ x log p t ( x | y ) = ∇ x log p ϕ ( y | x , t ) + λ s ∇ x log p t ( x ) ( λ s is classifier scale[14]), which is used in place of unconditional score ∇ x log p t ( x ) .

Denoising-Augmented (DA) Classifier . The guidance classifiers participate in the sampling through their gradients, which indicate the pixel-wise perturbations that maximizes log-likelihood of the target class. Perceptually aligned gradients that resemble images from data distribution lead to meaningful pixel-wise perturbations that could potentially improve classifier-guidance and forms the motivation of Kawar et al. [29], where they propose an adversarial training recipe for guidance classifiers. With the same motivation, we instead build on Theorem 4.1 in order to improve perceptual alignment and propose to train guidance classifiers with denoised examples ˆ x t derived from x . While the obvious choice is to simply train the guidance-classifier on ˆ x t instead of x , we choose to provide both x as well as ˆ x t as simultaneous inputs to the classifier and instead optimize L CE = E t, x [ -log p ϕ ( y | x , ˆ x t , t )] (compare with Eq. (8)). We preserve the noisy input since the primary goal of guidance classifiers is to classify noisy examples and this approach enables the model to flexibly utilize information from both inputs. We refer to guidance-classifiers trained using both x and ˆ x t as denoising-augmented (DA) classifier and use noisy classifiers to refer to guidance-classifiers trained exclusively on x .

Experiment setup. We conduct our experiments on CIFAR10 and Imagenet and evaluate the advantages of DA-Classifiers over noisy classifiers. While we use the same Imagenet diffusion model described in Section 4, we use the deep NCSN++ (continuous) model released by Song et al. [47] as the score-network for CIFAR10 (VE-Diffusion). As compared to the noisy classifier, the DA-classifier has an additional input-convolution layer to process the denoised input and is identical from the second layer onwards. We describe our classifier architectures and the training details in Appendix C.1.

Classification Accuracy. We first compare guidance classifiers in terms of test accuracies as a measure of their generalization (Table 4) and find that DA-classifiers generalize better to the test data. Training classifiers with Gaussian perturbed examples often leads to underfitting [59] explaining the lower test accuracy observed with noisy classifiers. Interestingly, the additional denoised example helps address the underfitting - for example, see Fig. 19 (in appendix). One explanation of this finding could be found in Chung et al. [10],

Table 4: Summary of Test Accuracies for CIFAR10 and Imagenet: each test example is diffused to a random uniformly sampled diffusion time. Both classifiers are shown the same diffused example.

where they distinguish between noisy examples and their corresponding denoised examples as being in the ambient space and on the image manifold respectively, under certain assumptions. To determine the relative importance of noisy and denoised examples in DA-classifiers, we zeroed out one of the input images to the CIFAR10 classifier and measured classification accuracies: while zeroing the noisy input caused the average accuracy across all time-scales to drop to 50.1%, zeroing the denoised input breaks the classifier completely yielding random predictions.

Classifier Gradients . In Fig. 4a, we qualitatively compare between the noisy classifier gradients ( ∇ x log p ϕ ( y | x , t ) ) and the DA-classifier gradients( ∇ x log p ϕ ( y | x , ˆ x , t ) ). We find that the gradients obtained from the DA-classifier are more structured and semantically aligned with the clean image as compared to the ones obtained with the noisy classifier (see Figs. 20 and 22 in Appendix for more examples). Gradients backpropagated through the denoising score network have been previously utilized (e.g., [3, 10, 11, 18, 26, 36]), but our work is the first to observe and analyze the qualitative properties of gradients obtained by backpropagating through the denoising module (also see Fig. 21 in appendix).

Image Generation. To evaluate the guidance classifiers in terms of their image generation, we generate 50k images each - see Appendix C.2 for details on the sampling parameters. We compare the classifiers in terms of standard generative modeling metrics such as FID, IS, and P/R/D/C (Precision/Recall/Density/Coverage). The P/R/D/C metrics compare between the manifold of generated distribution and manifold of the source distribution in terms of nearest-neighbours and can be computed conditionally (i.e., classwise) or unconditionally. Following standard practice, we additionally evaluate CIFAR10 classifiers on class-conditional P/R/D/C. Our results (Table 5) show that our proposed Denoising-Augmented (DA) Classifier improves upon the Noisy Classifier in terms of FID and IS for both CIFAR10 and Imagenet at roughly same Precision and Recall levels (see Appendix C.3 for comparison with baselines). Our evaluation of average class-conditional precision, recall, density and coverage for each CIFAR10 class also shows that DA-classifiers outperform

Noisy classifiers: for example, DA-classifiers yield classwise density and coverage of about 0.92 and 0.77 respectively on average as compared to 0.78 and 0.71 obtained with Noisy-Classifiers. We can attribute our improvements in the class-conditional precision, recall, density and coverage to the improved generalization of DA-classifier. To qualitatively analyse benefits of the DA-classifier, we generated Imagenet samples using DDIM-100 sampler with identical random seeds and λ s = 2 . 5 . In our resulting analysis, we consistently observed that the DA-classifier maintains more coherent foreground and background as compared to the Noisy Classifier. We show examples in Fig. 4b. Overall, we attribute improved image generation to the improved generalization and classifier gradients.

6 Related Works

Synthetic Augmentation with Diffusion Models have also been explored to train semi-supervised classifiers [55] and few-shot learning [51]. Other studies on training classifiers with synthetic datasets generated with a text2image diffusion model include [4, 22, 56]. Apart from being computationally expensive, such text2image diffusion models are trained on large-scale upstream datasets and some of the reported improvements could also be attributed to the quality of the upstream dataset. Instead, we propose a efficient diffusion-based augmentation method and report improvements using a diffusion model trained with no extra data. Further, we also find that DiffAug is complementary to synthetic training data generated with large text2image diffusion models and leave further exploration of DiffAug with larger diffusion models as future work.

Synthetic examples have also been shown to be useful for enhancing training adversarially robust classifiers (e.g., [27, 53]) and extension of DiffAug for compute-efficient adversarial training is apt for exploration in future work.

Diffusion Models for Robust Classification. Diffusion-classifier [31] is a method for zero-shot classification but also improves robustness to covariate shifts. Diff-TTA[39] is a test-time adaptation technique to update the classifier parameters at test time and is complementary to classifier training techniques such as DiffAug. In terms of OOD detection, previous works have proposed reconstructionbased metrics for ood detection [20, 32]. To the best of our knowledge, this work is the first to demonstrate improved OOD detection on ImageNet-1k using diffusion models.

7 Conclusion

In this work, we introduce DiffAug to train robust classifiers with one-step diffusion denoised examples. The simplicity and computational efficiency of DiffAug enables us to also extend other data augmentation techniques, where we find that DiffAug confers additional robustness without affecting accuracy on clean examples. We qualitatively analyse DiffAug samples in an attempt to explain improved robustness. Furthermore, we extend DiffAug to test time and introduce an efficient test-time image adaptation technique to further improve robustness to covariate shifts. Finally, we theoretically analyse perceptually aligned gradients in denoised examples and use this to improve classifier-guided diffusion. Overall, we present effective augmentation technique using diffusion models trained with no external datasets.

References

Brian DO Anderson. Reverse-time diffusion equation models. Stochastic Processes and their Applications , 12(3):313-326, 1982.

Shekoofeh Azizi, Simon Kornblith, Chitwan Saharia, Mohammad Norouzi, and David J. Fleet. Synthetic data from diffusion models improves imagenet classification. Transactions on Machine Learning Research , 2023.

Arpit Bansal, Hong-Min Chu, Avi Schwarzschild, Soumyadip Sengupta, Micah Goldblum, Jonas Geiping, and Tom Goldstein. Universal guidance for diffusion models, 2023.

Hritik Bansal and Aditya Grover. Leaving reality to imagination: Robust classification via generated datasets, 2023.

Nicholas Carlini, Florian Tram` er, Krishnamurthy Dvijotham, Leslie Rice, Mingjie Sun, and Zico Kolter. (certified!!) adversarial robustness for free! International Conference on Learning Representations (ICLR) , 2023.

Chen-Hao Chao, Wei-Fang Sun, Bo-Wun Cheng, Yi-Chen Lo, Chia-Che Chang, Yu-Lun Liu, Yu-Lin Chang, Chia-Ping Chen, and Chun-Yi Lee. Denoising likelihood score matching for conditional score-based data generation. In International Conference on Learning Representations , 2022.

Chen-Hao Chao, Wei-Fang Sun, Bo-Wun Cheng, and Chun-Yi Lee. On investigating the conservative property of score-based generative models, 2023.

Olivier Chapelle, Jason Weston, L´ eon Bottou, and Vladimir Vapnik. Vicinal risk minimization. Advances in neural information processing systems , 13, 2000.

Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence , pages 1-17, 2024.

Hyungjin Chung, Byeongsu Sim, Dohoon Ryu, and Jong Chul Ye. Improving diffusion models for inverse problems using manifold constraints. In Advances in Neural Information Processing Systems , 2022.

Hyungjin Chung, Jeongsol Kim, Michael Thompson Mccann, Marc Louis Klasky, and Jong Chul Ye. Diffusion posterior sampling for general noisy inverse problems. In The Eleventh International Conference on Learning Representations , 2023.

Jeremy Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing. CoRR , abs/1902.02918, 2019.

Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. In Advances in Neural Information Processing Systems , pages 8780-8794. Curran Associates, Inc., 2021.

Prafulla Dhariwal and Alex Nichol. Diffusion models beat gans on image synthesis. CoRR , abs/2105.05233, 2021.

Andrija Djurisic, Nebojsa Bozanic, Arjun Ashok, and Rosanne Liu. Extremely simple activation shaping for out-of-distribution detection. In The Eleventh International Conference on Learning Representations , 2023.

Andrew Elliott, Stephen Law, and Chris Russell. Explaining classifiers using adversarial perturbations on the perceptual ball. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021 , pages 10693-10702. Computer Vision Foundation / IEEE, 2021.

Roy Ganz, Bahjat Kawar, and Michael Elad. Do perceptually aligned gradients imply adversarial robustness?, 2023.

Jin Gao, Jialing Zhang, Xihui Liu, Trevor Darrell, Evan Shelhamer, and Dequan Wang. Back to the source: Diffusion-driven test-time adaptation. arXiv preprint arXiv:2207.03442 , 2022.

Scott Geng, Ranjay Krishna, and Pang Wei Koh. Training with real instead of synthetic generated images still performs better. In Synthetic Data for Computer Vision Workshop @ CVPR 2024 , 2024.

Mark S. Graham, Walter H. L. Pinaya, Petru-Daniel Tudosiu, Parashkev Nachev, Sebastien Ourselin, and M. Jorge Cardoso. Denoising diffusion models for out-of-distribution detection, 2023.

Hongyu Guo, Yongyi Mao, and Richong Zhang. Mixup as locally linear out-of-manifold regularization, 2018.

Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wenqing Zhang, Philip Torr, Song Bai, and Xiaojuan Qi. Is synthetic data from generative models ready for image recognition?, 2023.

Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In International Conference on Learning Representations , 2017.

Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshminarayanan. Augmix: A simple data processing method to improve robustness and uncertainty. arXiv preprint arXiv:1912.02781 , 2019.

Jonathan Ho and Tim Salimans. Classifier-free diffusion guidance, 2022.

Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi, and David J. Fleet. Video diffusion models, 2022.

Kai Hu, Klas Leino, Zifan Wang, and Matt Fredrikson. A recipe for improved certifiable robustness. In The Twelfth International Conference on Learning Representations , 2024.

Simran Kaur, Jeremy M. Cohen, and Zachary C. Lipton. Are perceptually-aligned gradients a general property of robust classifiers? CoRR , abs/1910.08640, 2019.

Bahjat Kawar, Roy Ganz, and Michael Elad. Enhancing diffusion-based image synthesis with robust classifier guidance. Transactions on Machine Learning Research , 2023.

Masanari Kimura. Understanding test-time augmentation, 2024.

Alexander C Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your diffusion model is secretly a zero-shot classifier. arXiv preprint arXiv:2303.16203 , 2023.

Zhenzhen Liu, Jin Peng Zhou, Yufan Wang, and Kilian Q. Weinberger. Unsupervised out-of-distribution detection with diffusion inpainting, 2023.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: a fast ode solver for diffusion probabilistic model sampling in around 10 steps. In Proceedings of the 36th International Conference on Neural Information Processing Systems , Red Hook, NY, USA, 2024. Curran Associates Inc.

Eric Luhman and Troy Luhman. Knowledge distillation in iterative generative models for improved sampling speed. CoRR , abs/2101.02388, 2021.

Alex Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. CoRR , abs/2102.09672, 2021.

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML) , 2022.

William Peebles and Saining Xie. Scalable diffusion models with transformers. arXiv preprint arXiv:2212.09748 , 2022.

Frank Permenter and Chenyang Yuan. Interpreting and improving diffusion models using the euclidean distance function. arXiv preprint arXiv:2306.04848 , 2023.

Mihir Prabhudesai, Tsung-Wei Ke, Alexander C. Li, Deepak Pathak, and Katerina Fragkiadaki. Testtime adaptation of discriminative models via diffusion generative feedback. In Conference on Neural Information Processing Systems , 2023.

Suman Ravuri and Oriol Vinyals. Classification accuracy score for conditional generative models. Advances in neural information processing systems , 32, 2019.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨ orn Ommer. High-resolution image synthesis with latent diffusion models. CoRR , abs/2112.10752, 2021.

Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-toimage diffusion models with deep language understanding. Advances in Neural Information Processing Systems , 35:36479-36494, 2022.

Hadi Salman, Mingjie Sun, Greg Yang, Ashish Kapoor, and J. Zico Kolter. Black-box smoothing: A provable defense for pretrained classifiers. CoRR , abs/2003.01908, 2020.

Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Image synthesis with a single (robust) classifier. In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada , pages 1260-1271, 2019.

Mert Bulent Sariyildiz, Karteek Alahari, Diane Larlus, and Yannis Kalantidis. Fake it till you make it: Learning transferable representations from synthetic imagenet clones, 2023.

Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv:2010.02502 , 2020.

Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations , 2021.

Yang Song, Prafulla Dhariwal, Mark Chen, and Ilya Sutskever. Consistency models. 2023.

Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of-distribution detection with rectified activations. In Advances in Neural Information Processing Systems , pages 144-157. Curran Associates, Inc., 2021.

Hugo Touvron, Matthieu Cord, and Herve Jegou. Deit iii: Revenge of the vit. arXiv preprint arXiv:2204.07118 , 2022.

Brandon Trabucco, Kyle Doherty, Max A Gurinas, and Ruslan Salakhutdinov. Effective data augmentation with diffusion models. In The Twelfth International Conference on Learning Representations , 2024.

Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be at odds with accuracy. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019 . OpenReview.net, 2019.

Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. In Proceedings of the 40th International Conference on Machine Learning , pages 36246-36263. PMLR, 2023.

Kai Xu, Rongyu Chen, Gianni Franchi, and Angela Yao. Scaling for training time and post-hoc out-ofdistribution detection enhancement. In The Twelfth International Conference on Learning Representations , 2024.

Zebin You, Yong Zhong, Fan Bao, Jiacheng Sun, Chongxuan Li, and Jun Zhu. Diffusion models and semisupervised learners benefit mutually with few labels. In Thirty-seventh Conference on Neural Information Processing Systems , 2023.

Jianhao Yuan, Francesco Pinto, Adam Davies, and Philip Torr. Not just pretty pictures: Toward interventional data augmentation using text-to-image generators, 2023.

Hongyi Zhang, Moustapha Cisse, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization, 2018.

Guangcong Zheng, Shengming Li, Hui Wang, Taiping Yao, Yang Chen, Shouhong Ding, and Xi Li. Entropydriven sampling and training scheme for conditional diffusion generation. In European Conference on Computer Vision , pages 754-769. Springer, 2022.

Stephan Zheng, Yang Song, Thomas Leung, and Ian J. Goodfellow. Improving the robustness of deep neural networks via stability training. CoRR , abs/1604.04326, 2016.

Part I

Appendix

Table of Contents

Contribution Statement

CSS and SHD are student contributors of this project and their contributions are as follows: CSS proposed the key research idea, designed and carried out all the experiments in this paper, worked on the theoretical derivations and wrote the first draft of this paper. SHD provided advice and constructive criticisms throughout the research and development phase.

Limitations and Future Work

In this work, we introduced DiffAug, a simple diffusion-based augmentation technique to improve classifier robustness. While we presented a unified training scheme, we follow previous works and evaluate robustness to covariate shifts, adversarial examples and out-of-distribution detection using separate evaluation pipelines (for e.g., we do not apply DDA on OOD examples). A unified evaluation pipeline for classifier robustness is an open problem and out of scope for this paper. The key advantage of our method is its computational efficiency since it requires just one reverse diffusion step to generate the augmentations; however, this is computationally more expensive than handcrafted augmentation techniques such as AugMix. Nevertheless, it is fast enough that we can generate the augmentations online during each training step. With recent advances in distilling diffusion models for fast sampling [34] such as Consistency-Models [48], it may be possible to generate better quality synthetic examples within the training loop. Since the improved robustness introduced by DiffAug can be attributed to the augmentations of varying image quality (Fig. 1), we believe that this complementary regularization effect can still be valuable with efficient high-quality sampling and leave further exploration to future work. Likewise, DiffAug is complementary to the use of additional synthetic data generated offline with text2image diffusion models and the extension of DiffAug to text2image diffusion models is suitable for future investigation. We also extend DiffAug to test time and propose DE, wherein we demonstrate improvements comparable to DDA at 10x wallclock time on all classifiers except ViT on Imagenet-C; while this demonstrates a limitation of single-step denoising (i.e., DE) vs. multi-step denoising(i.e., DDA), we also note that DE improves over DDA for all classifiers when considering Imagenet-R and Imagenet-S. While we demonstrate improvements over existing baselines of classifier-guidance (e.g., [6, 29, 58]), we do not compare with classifier-free guidance [25], the popular guidance method, since our primary focus is on the training of robust classifiers with DiffAug and demonstrating the potential of DiffAug. Training classifier-guided diffusion models for careful comparison requires additional computational resources and we leave this analysis to future work. Nevertheless, classifier-guidance is a computationally

attractive alternative to perform conditional generation since this allows flexible reuse of a pretrained diffusion model for different class-definitions by separately training a small classifier model. We also note that computing classifier-gradients is slower for DA-classifiers as compared to noisy classifiers since it requires backpropagating through the score-network and shares this limitation with other recent works that utilize intermediate denoised examples for guidance (e.g., Bansal et al. [3], Chung et al. [10, 11], Ho et al. [26]) - the recent advances in efficient diffusion sampling could be extended to class-conditional sampling to reduce the gap.

Compute Resources

For this paper, we had access to 8 40GB A40 GPUs to conduct our training and evaluation. We used a maximum of 4 GPUs for each job and the longest training job was the 90-epoch RN-50 training followed by the 20-epoch ViT training. The evaluation of classifiers on Imagenet-C, Imagenet-R and Imagenet-S using DE and Default evaluation modes are fairly fast. However, generating DDA examples for the entire Imagenet-C dataset and Imagenet-test dataset is computationally expensive and takes up to a week (even while using 8 GPUs in parallel) and also requires sufficient storage capacity to save the DDA-transformed images. Likewise, evaluation of certified accuracy with DDS is also computationally expensive since it uses 10k noise samples per example to estimate the certified radius and prediction. Training CIFAR10 guidance classifiers are fairly efficient while finetuning the Imagenet guidance classifier can take up to 3 days depending on the gradient accumulation parameter (i.e., number of GPUs available) - when available, we used a maximum of 4 GPUs. On average, the 50k CIFAR10 and Imagenet images that we sample for evaluation of guidance classifiers can be done within a maximum of 36 hours depending on how we parallelize the generation.

Broader Impact

The main contribution of this paper is to introduce a new augmentation method using diffusion models to improve classifier robustness. With increasing deployment of deep learning models in real-world settings, improved robustness is crucial to enable safe and trustworthy deployment. Since we demonstrate potential of diffusion models trained with no extra data as compared to the classifier, we anticipate that this will be useful in applications where such extra data is not easily available (e.g., medical imaging). We also extend this method to improve classifier-guided diffusion. Improvements in classifier-guided diffusion can be used in developing a myriad downstream applications, each with their own potential balance of positive and negative impacts. Leveraging and re-using a pre-trained model amplifies the importance of giving proper consideration to copyright issues associated with the data on which that model was trained. While our proposed model has the potential for generating deep-fakes or disinformation, these technologies also hold promise for positive applications, including creativity-support tools and design aids in engineering.

A Appendix for Section 3

0.6

batch of noised examples x

batch of diffAug examples xt

0.4

clusters of original examples xo

0.2

0.0

0.2

-0.4

-0.6

-0.4

-0.2

0.0

0.2

0.4

0.6

0.8

1.0

1.2

0.1

diffusionprocess

reverse diffusionstep

individual trainingpoint

0.0

diffusedtrainingpoint

diffAug trainingpoints

-0.1

0.2

-0.3

0.4

0.05

0.10

0.15

0.20

0.25

0.30

0.35

0.40

0.45

Original

Color Augmented

Manifold Intrusion from Color Augmentation

B Appendix for Section 4

B.1 Training Details

In the following, we describe the training details for the classifiers we evaluated in Section 4. In general, we optimize a sum of two losses: L Total = L Orig + L where, L Orig is the classification objective on the original augmentation policy that we aim to improve using DiffAug examples and L denotes the classification objective measured on DiffAug examples (Eq. (5)). Before applying DiffAug, we first resized the raw image such that at least one of the edges is of size 256 and then use a 224 × 224 center-crop as the test image since the diffusion model was not trained on random resized crops.

RN-50: We trained the model from scratch for 90 epochs using the same optimization hyperparameters used to train the official PyTorch RN-50 checkpoint.

ViT: We used the two-stage training recipe proposed in DeIT-III. In particular, the training recipe consists of an 800-epoch supervised pretraining at a lower resolution (e.g., 192 × 192) followed by a 20-epoch finetuning at the target resolution (e.g., 224 × 224). Starting with the pretrained checkpoint (i.e., after 800 epochs), we finetune the classifier exactly following the prescribed optimization and augmentation hyperparameters (e.g., AutoAugment (AA) parameters and MixUp/CutMix parameters) except that we also consider DiffAug examples. We also included DiffAug examples when applying MixUp/CutMix since we observed significant drops in standard test accuracies when training directly on DiffAug examples without label-smoothing or MixUp. We briefly explored stacking DiffAug with AA and identified that this did not introduce any noticeable change as compared to independent application of DiffAug and AA to train examples.

AugMix/DeepAugment/DeepAugment+AugMix: To evaluate the combination of DiffAug with these augmentations, we finetune the RN-50 checkpoint opensourced by the respective papers for 10 epochs with a batch-size of 256. We resume the training with the optimizer state made available along with the model weights and use a constant learning rate of 1e-6.

B.2 More Results on Covariate Shift Robustness

0

100

200

300

400

40

45

50

55

60

65

DA

DA+DiffAug

AM

AM+DiffAug

DAM

RN50

RN50+DiffAug

ViT-B/16

ViT-B/16+DiffAug

t

B.2.1 Extra Synthetic Data with ImageNet-only Diffusion models

In this section, we conduct a preliminary analysis of extending training data with fully-synthesized examples generated with a diffusion model trained only on ImageNet data. In particular, we generate 50k new examples using 4 different techniques as shown in Table 11. From these experiments, we find that fully synthesized examples from ImageNet-only diffusion models do not enhance the robustness as compared to the synthetic examples from stable-diffusion. Overall, we find that DiffAug uses an ImageNet-only diffusion-model to achieve robustness improvements although the fully-synthesized examples from the same diffusion models do not enhance robustness.

B.2.2 DiffAug with Other Samplers

The single reverse-diffusion step used in DiffAug can be understood as a single reverse-diffusion step of the DDIM [46] sampler. Alternatively, we can consider improved diffusion samplers and in this section, we explore DPM-Solver[33]. We illustrate the augmentations in Fig. 9.

a) Original Images

x

0

b) DiffAug - DDIM

We evaluate a single-step of reverse-diffusion of DPM-solver-2, both at train-time as well as at test-time. In particular, we first diffused the train example to a random diffusion-time t and used a single reverse-diffusion step of the order-2 DPM solver to integrate the diffusion ODE backwards from diffusion time t to t = ϵ with ϵ = 0 . 01 instead of ϵ = 0 for numerical stability. Based on the results shown in Table 12, DDIM appears to be the better sampling strategy for DiffAug although the resulting augmented images are somewhat of high visual quality when using DPM-Solver. While DiffAug using DPM-Solver may not be beneficial for classification, there may be other applications of such augmentations and leave further exploration to future work.

B.3 Certified Accuracy Experiments

We follow DDS[5] and previous works on denoised smoothing and evaluate the certified accuracy on a randomly selected subset of 1k Imagenet samples. The classifiers are generally evaluated with 3 noise scales: σ t ∈ { 0 . 25 , 0 . 5 , 1 . 0 } and for each l 2 radius and model pair, the noise that yields the best certified accuracy at that radius is selected and summarized in Table 13, following previous works. We also show the certified accuracy plots for each Gaussian perturbation separately in Fig. 10.

0.0

0.5

1.0

1.5

2.0

2.5

3.0

l

2

Radius

0.0

0.2

0.4

0.6

0.8

1.0

Certified Accuracy

ViT

+DiffAug

(a)

σ

t

= 0

.

25

.

0.0

0.5

1.0

1.5

2.0

2.5

3.0

l

2

Radius

0.0

0.2

0.4

0.6

0.8

1.0

Certified Accuracy

ViT

+DiffAug

(b)

σ

t

= 0

.

5

.

0.0

0.5

1.0

1.5

2.0

2.5

3.0

l

2

Radius

0.0

0.2

0.4

0.6

0.8

1.0

Certified Accuracy

ViT

+DiffAug

(c)

σ

t

= 1

.

0

.

B.3.1 DiffAttack Adversarial Examples

We also explored robustness to DiffAttack[9] adversarial examples: these are unrestricted adversarial examples generated with a stable-diffusion model. Here, we generate adversarial examples using their official code: in particular, we use the inception-v3 to generate the adversarial examples and evaluate the other classifiers. We tabulate the results in Table 14.

B.4 Detailed OOD Detection Results

OOD Detection results are mainly evaluated with with two metrics: AUROC and FPR@TPR95. The AUROC is a threshold-free evaluation of OOD detection while FPR@TPR95 measures the false positive rate at which OOD samples are incorrectly identified as in-distribution samples given that the true positive rate of detecting in-distribution samples correctly is 95%. The Near-OOD Imagenet task as defined by OpenOOD consists of SSB-Hard and NINCO datasets and we also include the performance for each dataset in the following tables.

0

200

400

600

800

t

0

2

4

6

Entropy (nats)

Maximum Entropy

ViT

ViT+DiffAug

RN50

RN50+DiffAug

B.5 Ablation Experiments

We describe ablation experiments related to DiffAug and DiffAug Ensemble in the following.

B.5.1 Extra Training

We train the pretrained AugMix checkpoint for extra 10 epochs to isolate the improvement obtained by DiffAug finetuning. In Table 19, we analyse the OOD detection performance as well as the robustness to covariate shift (Imagenet-C, Imagenet-R and Imagenet-S) finding no notable difference as compared to the results in Tables 3, 7 and 9.

B.5.2 DiffAug Hyperparameters

The time range used to generate the DiffAug train augmentations constitutes the key hyperparameter and we analyse and compare between weaker DiffAug augmentations ( t ∈ [0 , 500] ) and stronger DiffAug augmentations ( t ∈ [500 , 999] ). From Table 19, we find that both weak and strong DiffAug augmentations complement each other and contribute to different aspects of robustness. Overall, using the entire diffusion time range to generate DiffAug yields consistent improvements.

Table 19: Ablation Analysis .

B.5.3 DiffAug Ensemble (DE) Hyperparameters

We use set S = { 0 , 50 , · · · , 450 } to compute the DE accuracy in Table 9. Here, we study the effect of step-size (the difference between consecutive times) and the maximum diffusion time used. First, we analyse the performance when using maximum diffusion time = 999 instead of t = 450 in Fig. 13. Then, using maximum diffusion time = 450 , we study the effect of using alternative step-sizes of 25 (more augmentations) and 75 (fewer augmentations) in Fig. 12.

0

200

400

0.32

0.34

0.36

DA

25

75

50

0

200

400

0.275

0.300

0.325

AM

25

75

50

0

200

400

0.40

0.42

DAM

25

75

50

0

200

400

0.48

0.50

ViT-B/16

25

75

50

0

200

400

0.20

0.25

RN50

25

75

50

0

200

400

0.35

0.40

DA+DiffAug

25

75

50

0

200

400

0.30

0.35

AM+DiffAug

25

75

50

0

200

400

0.42

0.44

25

75

50

0

200

400

0.515

0.520

0.525

ViT-B/16+DiffAug

25

75

50

0

200

400

0.20

0.25

0.30

RN50+DiffAug

25

75

50

0

200

400

600

800

1000

0.20

0.25

0.30

0.35

0.40

0.45

0.50

a) DiffAug-Ensemble Accuracy vs

t

DA

DA+DiffAug

AM

AM+DiffAug

DAM

ViT-B/16

ViT-B/16+DiffAug

RN50

RN50+DiffAug

0

200

400

600

800

1000

0.0

0.1

0.2

0.3

0.4

0.5

t

B.5.4 Conditional DiffAug

In this section, we study the application of DiffAug with conditioning. For these experiments, we utilize two - one class-conditional and one unconditional - ImageNet256 diffusion models to apply the DiffAug augmentation. If s θ 1 ( x | y ) and s θ 2 ( x ) refer to the conditional and unconditional scores, we can combine these using an hyperparameter λ (similar to classifier-free guidance) and use the following formulation of s θ to apply the DiffAug augmentation (Eq. (3)):

where, λ = 0 denotes unconditional DiffAug, as explored in the main paper. In the following, we illustrate conditional DiffAug both qualitatively and quantitatively.

a) Original Images

x

0

b) DiffAug[

λ

=0]

c) DiffAug[

λ

=0

.

25]

d) DiffAug[

λ

=0

.

5]

e) DiffAug[

λ

=0

.

75]

f) DiffAug[

λ

=1

.

0]

g) DiffAug[

λ

=2

.

0]

h) DiffAug[

λ

=3

.

0]

i) DiffAug[

λ

=4

.

0]

0.0

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

λ

28

30

32

34

36

38

40

Default

DE

AM/Default

AM/DE

B.5.5 DiffAug with DiT

In this section, we explore the application of DiffAug with latent-space diffusion models such as the Diffusion-Transformer (DiT). Diffusion-Transformer models the distribution of a variational autoencoder (VAE) latent-space. To apply DiffAug with DiT, we (i) first apply the VAE encoder to encode the train image into the latent-space, (ii) apply DiffAug within the latent-space, and (iii) finally, decode the image using the V AE decoder. We refer to this as DiT-DiffAug. We finetune the torchvision ResNet-50 model for 10 epochs using class-conditional and unconditional DiT-DiffAug augmentation and summarize the results in Table 20.

B.6 Derivation of Theorem 4.1

For the forward-diffusion SDEs considered in this paper, the marginal distribution p t ( x ) can be expressed in terms of the data distribution p ( x 0 ) :

If we denote µ ( x 0 , t ) by m t , we can rewrite p t ( x ) as

since µ is linear and invertible. The optimal score-function s θ ∗ ( x , t ) = ∇ x log p t ( x ) can be simplified as:

Using Eq (11), we can rewrite the denoised example, ˆ x t = x + σ 2 ( t ) s θ ( x , t ) , as:

That is, the denoised example ˆ x t is in fact the expected value of the mean m t given input x . (See also Eq (4) in the main text ).

where

To compute

B.7 Analysis with SVD Decomposition

Considering the CIFAR10 images in Fig. 16, we compute the 3072 × 3072 jacobian matrix J and then apply SVD decomposition J = USV using default settings in PyTorch. Then, we visualise - after min-max normalization - the columns of U and rows of V along with the (batch-averaged) value in the diagonal matrix S of the corresponding row/column. We find that the principal components of the jacobian matrix are perceptually aligned and provides additional intuition for Theorem 4.1. See Figs. 17 and 18.

C Appendix for Section 5

C.1 Guidance Classifier Training: Experiment Details

We use the pretrained noisy Imagenet classifier released by Dhariwal and Nichol [14] while we trained the noisy CIFAR10 classifier ourselves; the Imagenet classifier is the downsampling half of the UNET with attention pooling classifier-head while we use WideResNet-28-2 as the architecture for CIFAR10. For the DA-classifier, we simply add an extra convolution that can process the

10

2

10

1

10 0

10 1

Noise Level

0.2

0.4

0.6

0.8

Noisy Classifier vs Denoising Augmented Classifier

Denoising Augmented Classifier

Clean Classifier

denoised input: for Imagenet, we finetune the pretrained noisy classifier by adding an additional input-convolution module while we train the denoising-augmented CIFAR10 classifier from scratch. The details of the optimization are as follows: (1) for Imagenet, we fine-tune the entire network along with the new convolution-module (initialized with very small weights) using AdamW optimizer with a learning-rate of 1e-5 and a weight-decay of 0.05 for 50k steps with a batch size of 128. (2) For CIFAR10, we train both noisy and DA-classifiers for 150k steps with a batch size of 512 using AdamW optimizer with a learning-rate of 3e-4 and weight decay of 0.05. For CIFAR10 classifiers, we use the Exponential Moving Average of the parameters with decay-rate equal to 0.999.

C.2 Classifier-Guided Diffusion: Sampling

We use a PC sampler as described in Song et al. [47] with 1000 discretization steps for CIFAR10 samples while we use a DDIM [46] sampler with 25 discretization steps for Imagenet samples. We use the 256x256 class-conditional diffusion model open-sourced by Dhariwal and Nichol [13] for our Imagenet experiments and set the classifier scale λ s = 2 . 5 following their experimental setup for DDIM-25 samples. The classifier-scale is set to 1.0 for CIFAR10 experiments.

C.3 Comparisons with DLSM, ECT and Robust Guidance

Table 21: DLSM vs DA-Classifier: In this table, we compare between using DLSM - i.e., DLSM-Loss in addition to cross-entropy loss in training classifiers on noisy images as input - and DA-Classifiers wherein we use both noisy and denoised images as input but only used cross-entropy loss for training. Since Chao et al. [6] use ResNet18 backbones for their CIFAR10 experiments, we train a separate DAClassifier for these comparisons. We compare between FID, IS and also compare the unconditional precision and recall (P/R) and the average class-conditional ˜ Precision/ ˜ Recall/ ˜ Density/ ˜ Coverage.We obtain our results for Noisy Classifier (CE) and Noisy Classifier (DLSM) from Table 2 of Chao et al. [6]. While the FID and IS scores are comparable, we note that our class-wise Precision, Recall, Density and Coverage metrics are either comparable or demonstrate a significant improvement.

d log PΦ

0 log PΦ

xe Φdbol e Φdbol e

dx

dx

x

dx

a) Airplanes

b) Cars

c) Birds

d) Cats

e) Deer

f) Dogs

g) Frogs

h) Horses

i) Ships

j) T rucks

D Uncurated Samples

a) Airplanes

b) Cars

c) Birds

d) Cats

e) Deer

f) Dogs

g) Frogs

h) Horses

i) Ships

j) T rucks

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: Please find the contributions listed in Section 1.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: Please find the discussion of limitations in Part I.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate 'Limitations' section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: We state Theorem 4.1 in the main paper and include a proof in Appendix B.6. Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We have provided a preliminary version of the code as part of this submission. We will open-source the trained checkpoints to enable easy adoption of our method and classifiers in future research.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We use popular open-source datasets for all experiments in this work.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We use the standard data splits and demonstrate the robustness to hyperparameter choice in our ablation study (Appendix B.5).

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: It is computationally expensive and we do not compute error bars. However, we highlight the significance of our improvement by providing appropriate context, where necessary, to interpret our improvements.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer 'Yes' if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We discuss compute resources and approximate execution time in Part I.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We ensured conformance to the NeurIPS code of ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We include a short description in Part I.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: We only release the classifier weights but it can be used for generation in conjunction with the diffusion model, open-sourced by OpenAI.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: Yes, we have ensured that we give the due credit to code and models of other researchers that we use in this work.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We will provide appropriate documentation for use of our code and ensure reproducibility.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: Does not include research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: Does not include research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes DiffAug, a new method for training image classifiers that are more robust. DiffAug is based on diffusion models and effective at improving classifier robustness in several ways, such as resistance to variations in the data. It also can improve the performance of classifier-guided diffusion models. Furthermore, DiffAug is computationally efficient and can be combined with other augmentation techniques.\n\nSTRENGTHS:\n1. The writing and the presentation of the work is good and easy to follow.\n2. The finding, that training with degraded images from the diffusion process won’t harm the classifier’s performance but even improve it, is interesting.\n3. The experiments are comprehensive and diverse, showing the effectiveness of the proposed method.\n\nWEAKNESSES:\nWhile I currently find the paper favorable and have no major weaknesses to point out, I do have some questions that the authors' responses could help clarify (see the part below). I am open to raising the score based on their explanations.\n\nQUESTIONS:\n1.\tThe authors state on Line 106 that they are unaware of prior studies training classifiers with denoised examples. However, Line 20 mentions previous work using \"synthetic images generated using Imagen [38]\". Does reference [38] not qualify as a \"previous study on training classifiers with denoised examples\"? Perhaps the authors meant there's no prior work on training with diffused-and-denoised data?\n2.\tThe authors mention \"include Eq. 5 as an additional optimization objective\" (Line 128-129). Could they elaborate on why it's considered \"additional\"? How does Eq. 5 differ from the standard classification loss typically used during classifier training?\n3.\tIn Section 4, the experiments explore \"unconditional improved-DDPM.\" Have the authors investigated using DiffAug with \"conditional\" diffusion models? Can such text guidance improve DiffAug's performance, or would the \"conditional\" process limit augmentation diversity and hinder performance?\n4.\tIn Table 1, which model structure is trained on when evaluating “AM, DA, and DAM”? It seems the first column didn’t present enough information on that.\n5.\tTable 1 results (columns 3, 4 & 8, 9) consistently show DE underperforming compared to DDA(SE). What explains this difference? Could it be due to DDA's \"self-ensemble\" strategy (although DE also uses ensembles)? Does this suggest that using even multiple-step-denoised examples can enhance classifier robustness?\n6.\tWhile the paper focuses on improving classifier’s robustness based on diffusion models, there's a complementary area of research: diffusion-based attacks (DiffAttack [1], Diff-PGD [2]). How effective is DiffAug against these attacks? Given Diff-PGD's constraints with perturbation norms, the results in the paper on certified adversarial accuracy might generalize. However, DiffAttack is unrestricted. Can DiffAug still be applied in such cases? The authors should supplement these discussions in the paper for better evidence of DiffAug’s robustness.\n7.\tAbout the related work, the idea of leveraging a diffusion model for augmentation and incorporating denoised examples to improve classifier robustness was also mentioned in the discussion section of DiffAttack [1]. Citing this related work would be appropriate. \n8.\tBoth DE and DDS employ a single reverse diffusion step during testing. What are the key distinctions between these methods? There seem no comparisons between them or descriptions about their differences.\n\n[1] Chen, Jianqi, et al. \"Diffusion models for imperceptible and transferable adversarial attack.\" arXiv preprint arXiv:2305.08192 (2023).\n\n[2] Xue, Haotian, et al. \"Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability.\" arXiv preprint arXiv:2305.16494 (2023).\n\nLIMITATIONS:\nYes. Limitations and social impacts have been involved in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-25"}

comments: SUMMARY:
This paper applies a diffusion-based data augmentation method to enhance the robustness of classifier. First, a gaussian perturbation is applied to train examples and then a single diffusion denoising step is applied to generate the augmentations. Besides, DiffAug can also be combined with other augmentations to further improve robustness. Empirically, DiffAug can achieve improvements in classifier generalization, gradient quality and image generation performance.

STRENGTHS:
1. DiffAug can be combined with other augmentations to improve robustness. Besides, DiffAug can be also used to improve many other performance, such as classifier generalization, gradient quality and image generation performance
2. DiffAug is simple, computational and easy to follow to improove robustness.

WEAKNESSES:
1. Absence of ablation study of sampling methods and sampling processes. Did the use of better sampling methods and more steps achieve better results?
2. Absence of ablation study of diffusion model. Can other diffusion model such as DiT also be used to apply DiffAug

QUESTIONS:
As shown in Weakness 1, why adopt a single diffusion denoising step when the current sampling method, such as DPM-Solver, can generate good results within 10 steps? In theory, better sample generation can achieve better results

LIMITATIONS:
yes
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 2
DATE: 2024-07-12

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper explores the use of diffusion as a data augmentation technique to train robust classifiers. Specifically, it investigates whether a diffusion model trained without additional data can be leveraged to enhance classifier performance. The study shows utilizing a diffusion model trained without extra data to improve classifier robustness on Imagenet-C by 2 points, while train improved classifiers with just a single step of reverse diffusion.\nThe proposed method is evaluated on challenging benchmarks such as Imagenet-C and Imagine, utilizing Vision Transformer (ViT) and ResNet models.\n\nSTRENGTHS:\n1. Originality: The paper proposes an effective method of one-step diffusion augmentation for training robust image classifiers. While similar augmentation techniques using generative models have been explored previously, the utilization of a single-step diffusion process in this context is interesting. The idea is straightforward yet innovative, offering a novel approach to enhancing classifier robustness with minimal computational overhead.\n\n2. Clarity: the paper is clearly written.\n\n3. Quality: the paper includes ablation study and visualization. Say on diffusion time.\n\nWEAKNESSES:\n1. Soundness of results: the robustness is only evaluated on Imagenet-C (severity 5 only), which is only local corruption. Does the proposed method work when viewpoint, background, scale, style, texture change? What about the other severity?  Say can test on Imagenet-A [1], ImageNet-D [2], Imagenet-S [3], ImageNet-R [4]. Since it is diffusion-based augmentation, the reviewer wondered if it will help ImageNet-D the most since this one is diffusion-based testing. Evaluation on those will help understand the strengths and weakness of the proposed approach.\n\n2. Not clear how useful is test-time augmentation, can add the ablation study.\n\n3. Unclear why the proposed method can handle covariate shifts. Can the author explain intuitively?\n\nThe score will be updated based on whether evaluation concerns are addressed.\n\n[1] https://openaccess.thecvf.com/content/CVPR2021/html/Hendrycks_Natural_Adversarial_Examples_CVPR_2021_paper.html\n[2] https://openaccess.thecvf.com/content/CVPR2024/html/Zhang_ImageNet-D_Benchmarking_Neural_Network_Robustness_on_Diffusion_Synthetic_Object_CVPR_2024_paper.html\n[3] https://arxiv.org/abs/1905.13549\n[4] https://openaccess.thecvf.com/content/ICCV2021/html/Hendrycks_The_Many_Faces_of_Robustness_A_Critical_Analysis_of_Out-of-Distribution_ICCV_2021_paper.html\n\nQUESTIONS:\nHow do the hyper parameters of the one-step diffusion set? If you add more noise, you may change globally, if only local noise, you can only handle local noise corruption.\n\nCan the author show an ablation study on this tradeoff if there is any?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a data augmentation method DiffAug for training robust classifiers. The method is very simple: first, add Gaussian noise to one training image, and then denoise the noisy images with a pre-trained diffusion model. They also propose methods for test-time augmentation using DiffAug. Experiments show that DiffAug is able to improve robust accuracy on a wide range of datasets such as ImageNet-C, R,S, OOD detection, and certification accuracy. This paper also shows that the proposed method can improve the generation quality of classifier-guided diffusion generation.\n\nSTRENGTHS:\n1. To the best of my knowledge, this method is new. Most of the existing methods use diffusion models to generate new training examples instead of augmenting existing ones. The proposed method is simple and easy to follow and implement. \n\n2. This paper provides extensive ablation experiments to demonstrate the effectiveness of the proposed method. The proposed method is able to achieve significant improvements even combined with SoTA augmentation for robustness, say AugMix and DeepAugment, which indicates the proposed method provides new information for the model to learn. DiffAug can also be used to improve the performance of guidance classifiers in diffusion generation, thus lead to better results.\n\n3. Models trained with this method have perceptually aligned gradients and this paper provides nice figures to demonstrate this.\n\nWEAKNESSES:\n1. **Missing related work and comparison**\n\nComparison with existing work that uses large synthetic data datasets with diffusion models to improve training is lacking. For example [1] uses diffusion models to generate extra training examples to improve empirical adversarial robustness and [2] for certificated robustness. Both two works show significant improvements for robustness.\n\nSpecifically, suppose DiffAug train the model with E epochs on a dataset of N images. SoTA diffusion models can generate new images with K steps (K can be small (K<= 10) using DDIM, even 1 step using some flow based methods). If we use the diffusion model to generate EN/K new images, and train the model on the original dataset with the generated images. The extra computational cost is the same as DiffAug, if I understand it correctly. Will DiffAug achieve better results over this method? If yes, what could be the motivation/theory?\n\n\n2. **Concerns regarding some numbers reported**\n\nIn the DeepAugment paper, they report results for ResNet50 on ImageNet-C ([3], Figure 5). The accuracy of DeepAugment+AugMix (DAM in this paper) is close to 60%, which is much higher than the numbers in this paper (around 40%). Similarly, the results of AugMix reported in the original paper are also much higher than the numbers in this paper. (I do not work in the corruption robustness field, so there may be errors in citing these numbers)\n\nCan the authors explain why the gap is so large? If it is due to different settings. I suggest following the original settings for a fair comparison.\n\nSimilarly, the results on Table 8 are also significantly higher than numbers in [4], and far from SoTA.\n\n\n\n\n\n[1] Better Diffusion Models Further Improve Adversarial Training. ICML23\n\n[2] A Recipe for Improved Certifiable Robustness. ICLR 2024\n\n[3] The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalization\n\n[4] (CERTIFIED!!) ADVERSARIAL ROBUSTNESS FOR FREE!\n\nQUESTIONS:\n1. I do not pretty understand the sentence in line 128: what does \"additional optimization objective\" refer to?\n\n```\nWhen combining DiffAug with such novel augmentation techniques, we simply include Eq. 5 as an additional optimization objective instead of stacking augmentations\n```\n\nand line 131: why stacking augmentations are not good and what is the difference between stacking augmentations the the proposed method?\n```\nour preliminary analysis on stacking augmentations showed limited gains over simply training  the network to classify independently augmented samples likely because training on independent  augmentations implicitly generalizes to stacked augmentations.\n```\n\n2. Why use unconditional diffusion models? Will using conditional diffusion models raise to some problem?\n\n3. Can authors provide some insights why the proposed method can improve both corruption robustness  and certificated adversarial robustness? Will this method also improve empirical adversarial robustness?\n\nLIMITATIONS:\nYes, authors adequately addressed the limitations.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-15"}