Adaptive Diffusion Denoised Smoothing

• The paper introduces ADDS, a certified defense that integrates guided reverse diffusion denoising with adaptive GDP privacy filtering for vision classification.
• It employs a multi-step denoising process that adaptively steers each reverse diffusion step toward the original input while maintaining formal GDP guarantees.
• Empirical results on ImageNet show improved certified and clean accuracies, especially with majority voting at increased noise levels.

Searching arXiv for the primary paper and closely related DDS work to ground the article in current literature. Adaptive Diffusion Denoised Smoothing (ADDS) is a certified defense for vision classification that combines randomized smoothing, diffusion-model denoising, and adaptive per-step guidance in a single robustness analysis framework. Rather than adding Gaussian noise once to the input and classifying the result directly, ADDS starts from pure Gaussian noise and runs a reverse DDPM-style denoising chain that progressively reconstructs an image, while optionally steering each denoising step toward the original input. Its central technical claim is that this guided, data-dependent denoising process remains certifiable against $\ell_2$-bounded adversarial perturbations when each denoising step is interpreted as a Gaussian Differentially Private (GDP) mechanism and the resulting adaptive composition is controlled by a GDP privacy filter (Shpilevskiy et al., 10 Jul 2025).

1. Conceptual position within diffusion-denoised smoothing

ADDS belongs to the family of diffusion-denoised smoothing methods, but it differs structurally from one-shot preprocessing defenses. In the one-shot setting, a pretrained diffusion denoiser is inserted before a base classifier, and the smoothed classifier averages predictions over noisy inputs after denoising. ADDS instead treats the entire guided reverse diffusion trajectory as the randomized mechanism to be certified, and the final defended prediction is obtained from the output of this many-step stochastic process (Shpilevskiy et al., 10 Jul 2025).

The method is formulated for vision classification under an $\ell_2$ threat model. Let $x \in \mathbb R^d$ be an image and $g$ a base classifier. The adversary perturbs the input as

$$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$

The certification target is the smoothed classifier

$$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$

where $M$ denotes the full randomized defense pipeline. A certificate requires that

$M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$

A common misconception is to equate ADDS with ordinary denoising followed by classification. That characterization is incomplete. In ADDS, robustness is tied not merely to denoising quality, but to a formal composition analysis over the entire adaptive diffusion chain. The term “adaptive” refers to the fact that the denoising process can depend on the input and on previous steps, while still remaining within a certifiable GDP budget (Shpilevskiy et al., 10 Jul 2025).

2. Guided reverse diffusion as an adaptive randomized mechanism

The ADDS pipeline begins from a pure noise image,

$x_T \sim \mathcal N(0,I),$

and runs a reverse diffusion process from $t=T$ down to $\ell_2$0. At each step, the diffusion model predicts a cleaner image $\ell_2$1. Guidance is then applied by shifting this prediction toward the original input: $\ell_2$2 where $\ell_2$3 is the guidance scale (Shpilevskiy et al., 10 Jul 2025).

This guidance rule is the defining adaptive component. It makes each reverse transition data dependent, because the transition at step $\ell_2$4 no longer depends only on the latent state $\ell_2$5, but also explicitly on the clean input $\ell_2$6. The paper rewrites the guided denoising step as an adaptive stochastic map

$\ell_2$7

with diagonal covariance $\ell_2$8. Because the covariance is diagonal, the analysis is conducted pixel-wise. For pixel $\ell_2$9,

$x \in \mathbb R^d$0

The per-pixel sensitivity bound is

$x \in \mathbb R^d$1

which yields the stepwise GDP parameter

$x \in \mathbb R^d$2

The importance of this formulation is that the adaptivity introduced by guidance is not ignored; it is translated into a sensitivity term that can be budgeted and composed formally (Shpilevskiy et al., 10 Jul 2025).

3. GDP privacy filtering and the certification theorem

The theoretical core of ADDS is the connection between GDP and randomized smoothing. A Gaussian mechanism with sensitivity $x \in \mathbb R^d$3 and noise standard deviation $x \in \mathbb R^d$4 is $x \in \mathbb R^d$5-GDP with $x \in \mathbb R^d$6, and adaptive randomized smoothing can therefore be analyzed through GDP composition. ADDS uses a privacy filter to decide, step by step, whether guidance may still be applied without exceeding the total budget (Shpilevskiy et al., 10 Jul 2025).

The privacy filter tracks a per-pixel budget $x \in \mathbb R^d$7 and subtracts the cost of each guided step: $x \in \mathbb R^d$8 If $x \in \mathbb R^d$9, guidance is stopped; otherwise it continues. This mechanism is what makes an adaptive diffusion process certifiable: the denoiser may depend on the input and on previous outputs, but only while the cumulative GDP budget remains below the prescribed threshold.

The paper states three key results. First, the one-step denoising budget is given by the per-pixel $g$0 expression above. Second, under the neighboring relation that differs only in pixel $g$1, the full sampling algorithm is $g$2-GDP provided the filter ensures

$g$3

Third, these pixel-wise guarantees are lifted to the full image and to classification. If $g$4 and the smoothed class probabilities satisfy

$g$5

then for all $g$6,

$g$7

with certified radius

$g$8

An important point is that the certified-radius formula has the same functional form as standard randomized smoothing, but here it is justified for an adaptive diffusion-based preprocessor through GDP composition and privacy filtering rather than through a single fixed Gaussian perturbation (Shpilevskiy et al., 10 Jul 2025).

4. Sampling procedure, voting, and reported ImageNet behavior

The inference procedure is explicit. ADDS samples $g$9, initializes a per-pixel privacy budget with

$$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$0

and then iterates from $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$1 to $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$2. At each step it computes the diffusion model’s prediction $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$3, runs the privacy filter, applies guidance if permitted, and samples the next state from the reverse diffusion kernel. Certification then proceeds in standard smoothed-classifier fashion: many samples are drawn from the full stochastic pipeline, the top-class lower bound $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$4 and runner-up upper bound $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$5 are estimated, and the certified radius is obtained by the formula above (Shpilevskiy et al., 10 Jul 2025).

The experiments reported for ADDS are on ImageNet. The setup uses the unconditional $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$6 diffusion model from Dhariwal and Nichol, a pretrained BEiT-Large classifier with $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$7 top-1 validation accuracy, $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$8, 250 validation images, 20 denoising steps, and both 1-vote and 5-vote variants. At certified accuracy evaluated at $$x' = x + e,\qquad e \in B_2(r) = \{e : \|e\|_2 \le r\}.$$9, the reported values are as follows: Carlini et al. (2023) achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$0 at $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$1; DensePure achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$2; DensePure with 5 votes achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$3; ADDS achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$4; ADDS with 5 votes achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$5; and ADDS without unguided denoising achieves $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$6 (Shpilevskiy et al., 10 Jul 2025).

The clean-accuracy results show a related pattern. Carlini et al. reports $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$7, DensePure $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$8, DensePure with 5 votes $$M_S(x) \triangleq \arg\max_{y\in\mathcal Y} \Pr\big(M(x)=y\big),$$9, ADDS $M$0, ADDS with 5 votes $M$1, and ADDS without unguided denoising $M$2 across $M$3. The paper’s stated empirical conclusions are that ADDS with 5 votes is best at the larger noise levels $M$4, Carlini et al. is best at $M$5, ADDS without unguided denoising has the best clean accuracy across all noise levels, and majority voting tends to increase certified accuracy while sometimes reducing clean accuracy because it concentrates votes on frequent classes and can bias predictions on harder images (Shpilevskiy et al., 10 Jul 2025).

5. Relation to neighboring DDS lines of work

ADDS should be distinguished from other “adaptive” or improved variants of diffusion-denoised smoothing. In “Robustifying Diffusion-Denoised Smoothing Against Covariate Shift,” the denoiser is a single-shot denoiser derived from a pretrained diffusion model, and the main diagnosis is that DDS suffers from covariate shift caused by noise misestimation in the denoiser rather than from uncertifiable adaptivity in the denoising trajectory (Hedayatnia et al., 13 Sep 2025). In that formulation,

$M$6

and after denoising,

$M$7

The mismatch

$M$8

is identified as the source of the shift. That work keeps the DDS certificate intact and instead changes how the base classifier is trained, replacing random noise augmentation with an adversarial min–max objective over forward noise, approximated by PGD-style ascent on $M$9. It reports new state-of-the-art certified robustness results for diffusion-denoised smoothing under $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$0 perturbations on MNIST, CIFAR-10, and ImageNet, including $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$1 certified accuracy at radius $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$2 on MNIST versus $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$3 for DDS finetuned, $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$4 and $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$5 on CIFAR-10 at radii $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$6 and $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$7 versus $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$8 and $M_S(x+e)=M_S(x)\quad \forall e\in B_2(r_x).$9, and ImageNet gains such as $x_T \sim \mathcal N(0,I),$0 versus $x_T \sim \mathcal N(0,I),$1 at radius $x_T \sim \mathcal N(0,I),$2 and $x_T \sim \mathcal N(0,I),$3 versus $x_T \sim \mathcal N(0,I),$4 at radius $x_T \sim \mathcal N(0,I),$5 for $x_T \sim \mathcal N(0,I),$6 (Hedayatnia et al., 13 Sep 2025).

This distinction matters conceptually. ADDS certifies an adaptive many-step diffusion process via GDP composition, whereas the covariate-shift work adapts base-classifier training to the failure mode of a single-shot denoiser. A plausible implication is that these methods address different bottlenecks in the broader DDS landscape: ADDS targets certifiable adaptive guidance during purification, while covariate-shift robustification targets the mismatch between denoised samples and the clean-data distribution.

The term “adaptive diffusion” also has an older meaning in classical denoising theory. In “Locally adaptive image denoising by a statistical multiresolution criterion,” adaptivity refers to choosing a local smoothing parameter $x_T \sim \mathcal N(0,I),$7 from the data so that diffusivity is lowered near edges and remains large in smooth regions, with residual structure detected by a multiresolution criterion (Hotz et al., 2010). That use of “adaptive” concerns spatially varying regularization in reconstruction; it is distinct from ADDS, where adaptivity refers to privacy-filtered guidance decisions inside a certifiable randomized smoothing mechanism.

6. Limitations, trade-offs, and broader assessment

The ADDS analysis rests on several explicit assumptions: diagonal covariance and pixel-wise independence in $x_T \sim \mathcal N(0,I),$8, access to the original image $x_T \sim \mathcal N(0,I),$9 during denoising for guidance, a fixed privacy budget enforced by the filter, and a pretrained diffusion model that supplies meaningful $t=T$0 predictions. The limitations noted in the paper include the possibility that guidance can increase variance if not carefully budgeted, the fact that continuing unguided denoising after budget exhaustion may hurt clean accuracy, the observation that majority voting can reduce pure accuracy on difficult images even when it improves certification, and the restriction of the reported guarantees to ImageNet and the $t=T$1 threat model (Shpilevskiy et al., 10 Jul 2025).

Broader evaluations of DDS highlight a more general controversy: the unresolved trade-off between robustness and utility. “Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off” studies DDS as a preprocessing defense for vision foundation models across Pascal VOC, NYU Depth, and Revisited Oxford Buildings, covering classification, semantic segmentation, monocular depth estimation, and image retrieval under PGD, MI-FGSM, and SIA with $t=T$2 and 50 iterations (Belousov et al., 21 May 2025). Its reported findings are that high-noise diffusion can improve security but causes substantial degradation on clean inputs, with a $t=T$3 performance drop on classification, segmentation, and retrieval and up to $t=T$4 on depth estimation, while low-noise diffusion preserves clean performance but fails to provide adequate protection across all attack types and can be bypassed by an adaptive attack that explicitly targets the diffusion process. The paper’s conclusion is that DDS is not a complete adaptive defense for vision foundation models because no single noise level provides both strong robustness and strong utility (Belousov et al., 21 May 2025).

For ADDS, this context is significant but not directly refutational. ADDS demonstrates that adaptive guidance in a multi-step diffusion chain can be certified and can improve both certified accuracy and standard accuracy on ImageNet under a specific guiding strategy. At the same time, the wider DDS literature indicates that diffusion-denoised smoothing remains sensitive to denoiser design, task setting, attack adaptivity, and the way denoising interacts with downstream semantics. The resulting picture is technically specific rather than universal: ADDS establishes one route by which adaptivity and certification can coexist, but it does not eliminate the broader robustness–utility tensions that continue to shape diffusion-based defenses (Shpilevskiy et al., 10 Jul 2025).