DiffClean: Diffusion Cleaning Methods

• DiffClean is a term for multiple diffusion-based frameworks that remove makeup, restore clean images, or purge backdoor effects.
• Its approaches integrate text-guided diffusion, conditional normalizing flows, and gradient-based pruning to address different corruption types.
• These methods yield measurable improvements in age estimation, face verification, and image clarity across diverse datasets.

Searching arXiv for the named systems and related papers to ground the article and disambiguate the term “DiffClean.” DiffClean is an overloaded term in recent diffusion-model literature rather than a single standardized method. It most directly denotes a text-guided diffusion system for makeup removal in support of age estimation and face verification, but it is also used in parts of the FlowDiff literature for learning clean-image distributions from corrupted observations, and as a shortened label for Diff-Cleanse, a two-stage defense against backdoored diffusion models (Gavas et al., 17 Jul 2025, Wang et al., 2024, Hao et al., 2024). The shared theme across these usages is the use of diffusion-based priors or samplers to “clean” a corrupted object, but the object being cleaned differs substantially: facial appearance, posterior uncertainty under measurement corruption, or model parameters and activations.

1. Terminological scope

In the cited literature, “DiffClean” refers to at least three technically distinct systems.

Usage	Paper	Core problem
DiffClean	"DiffClean: Diffusion-based Makeup Removal for Accurate Age Estimation" (Gavas et al., 17 Jul 2025)	Makeup removal for age estimation and face verification
DiffClean in parts of the text	"Integrating Amortized Inference with Diffusion Models for Learning Clean Distribution from Corrupted Images" (Wang et al., 2024)	Learning clean distributions from corrupted images
Diff-Cleanse (“DiffClean”)	"Diff-Cleanse: Identifying and Mitigating Backdoor Attacks in Diffusion Models" (Hao et al., 2024)	Backdoor detection and model repair

The most literal use is the 2025 paper titled "DiffClean: Diffusion-based Makeup Removal for Accurate Age Estimation," which defines DiffClean as a method that erases makeup traces using a text-guided diffusion model to defend against makeup attacks (Gavas et al., 17 Jul 2025). A second use appears in the 2024 FlowDiff paper, whose detailed description explicitly states that FlowDiff is “also called DiffClean in parts of the text,” and frames the method as a joint training paradigm coupling a conditional normalizing flow with a score-based diffusion prior (Wang et al., 2024). A third use occurs in Diff-Cleanse, whose detailed description labels the framework “Diff-Cleanse (‘DiffClean’)” while addressing backdoor identification and mitigation in diffusion models (Hao et al., 2024).

A common misconception is that DiffClean names a single canonical diffusion architecture. The literature instead uses the label for three different problem settings: semantic removal of makeup traces, amortized inference from corrupted data, and purification of compromised generative models. This suggests that the term functions more as a problem-oriented naming convention than as a stable architectural family.

2. DiffClean as diffusion-based makeup removal

DiffClean in the narrow sense targets the case where facial makeup confounds age estimation and face verification. The stated goal is: given a face image with makeup $I_m$, recover a “clean” (no-makeup) image $I_g \approx I_o$ so that downstream age estimation and face verification operate on a makeup-invariant input (Gavas et al., 17 Jul 2025).

The pipeline comprises four components. First, Synthetic Makeup Pair Generation uses EleGANt to transfer a small set of reference makeup styles onto clean faces $I_o$ from UTKFace to produce paired $(I_o, I_m)$. Second, an Auxiliary Age Estimator fine-tunes SSRNet on UTKFace (ages 10–29) with a weighted self-adjusting smooth-$\mathcal{L}_1$ loss. Third, the DiffClean model itself is a Text-Guided Diffusion Model based on ADM with an improved U-Net, where the prompts “face with makeup” and “face without makeup” are embedded via CLIP, and reverse diffusion using DDIM is steered by a composite loss consisting of CLIP directional loss, identity loss, perceptual losses, and age loss. Fourth, at inference, any input $I_{test}$ is run through the finetuned diffusion network to yield $I_g$; age is estimated via MiVOLO and identity via FaceNet or MobileFace (Gavas et al., 17 Jul 2025).

The diffusion formulation follows DDPM notation with a cosine noise schedule. The forward process is

$$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$

with $\alpha_t = 1-\beta_t$ and $\bar\alpha_t = \prod_{s=1}^t \alpha_s$, giving

$I_g \approx I_o$0

The reverse process is parameterized by a U-Net $I_g \approx I_o$1 conditioned on text or CLIP features $I_g \approx I_o$2, and DiffClean employs the deterministic DDIM sampler with 40 inversion steps and 6 sampling steps over $I_g \approx I_o$3 (Gavas et al., 17 Jul 2025).

Architecturally, the ADM backbone is adapted with BigGAN residual stacks in up/down-sampling, increased multi-head attention at 16×16, 32×32, and 64×64 scales, and deeper residual blocks. The model uses 256×256 inputs. Optimization uses Adam with learning rate $I_g \approx I_o$4, fine-tuned for 5 epochs on 600 training pairs on a single NVIDIA A100. The auxiliary SSRNet is fine-tuned with batch size 50, Adam with $I_g \approx I_o$5, learning rate $I_g \approx I_o$6, cosine annealing, 200 epochs, and input size 64×64 (Gavas et al., 17 Jul 2025).

3. Guidance, losses, and empirical behavior in makeup removal

DiffClean does not use classical classifier guidance. Its text-conditioning mechanism is a CLIP-based directional loss. With CLIP image and text encoders $I_g \approx I_o$7 and $I_g \approx I_o$8, it defines

$I_g \approx I_o$9

and the CLIP loss is

$I_o$0

During denoising, the U-Net features are cross-attended to $I_o$1. An optional CLIP-age loss probes $I_o$2 with “face of $I_o$3-year old” and matches the CLIP embedding to that prompt (Gavas et al., 17 Jul 2025).

Training is end-to-end on paired $I_o$4 with a five-term objective:

$I_o$5

The identity term uses ArcFace features:

$I_o$6

with $I_o$7 and $I_o$8. Recommended loss weights are $I_o$9, $(I_o, I_m)$0, $(I_o, I_m)$1, $(I_o, I_m)$2, and $(I_o, I_m)$3 for SSRNet or $(I_o, I_m)$4 for CLIP-age (Gavas et al., 17 Jul 2025).

The reported results on EleGANt-makeup FFHQ show that makeup images without removal obtain minor/adult accuracy 82.8, age-group accuracy 34.4, and MAE 6.56. DiffClean with SSRNet-age loss reaches 87.8, 36.8, and 5.76, while DiffClean with CLIP-age loss reaches 88.6, 37.0, and 5.71. The paper summarizes this as a +4.8 percentage-point gain in minor/adult classification and an MAE reduction of approximately 0.8 years relative to makeup input (Gavas et al., 17 Jul 2025).

For face verification at $(I_o, I_m)$5, the reported TMR values are 74.5 and 79.1 for original no-makeup images using FaceNet and MobileFace, 67.8 and 75.3 for CLIP2Protect, 69.1 and 78.2 for DiffAM, 75.8 and 84.2 for DiffClean with SSRNet, and 75.5 and 82.4 for DiffClean with CLIP-age. On this benchmark, DiffClean is reported to improve face verification by 8.9% over competing baselines (Gavas et al., 17 Jul 2025).

Qualitative observations state that DiffClean removes eye- and lip-makeup cleanly while preserving hair and skin tone, whereas CLIP2Protect sometimes alters hair color and DiffAM retains residual makeup. Reported failure modes are rare but include slight over-smoothing under extremely heavy, occlusive foundation. On BeautyFace, the paper states that makeup-induced underestimation or overestimation is reduced to approximately $(I_o, I_m)$6 years; on LADN, errors are approximately 1.6 years underestimation and 3 years overestimation post-removal. Ablations further report validation MAE of 9.28 for $(I_o, I_m)$7 only, 7.43 after adding $(I_o, I_m)$8, 4.70 after adding $(I_o, I_m)$9, and 4.42 after adding $\mathcal{L}_1$0, as well as inference speed of 2 seconds per image versus 30 seconds for CLIP2Protect (Gavas et al., 17 Jul 2025).

4. FlowDiff, also called DiffClean in parts of the text

In a different line of work, FlowDiff addresses the problem of learning clean distributions from corrupted images without relying on large-scale clean signals. The detailed description explicitly notes that FlowDiff is “also called DiffClean in parts of the text.” Its architecture couples a conditional normalizing flow $\mathcal{L}_1$1, which takes Gaussian latent $\mathcal{L}_1$2 and corrupted observation $\mathcal{L}_1$3 and outputs a reconstructed clean image $\mathcal{L}_1$4, with a score-based diffusion model $\mathcal{L}_1$5, which learns an estimate of $\mathcal{L}_1$6 and acts as a data-driven prior on $\mathcal{L}_1$7 (Wang et al., 2024).

The method is derived from variational inference. It approximates the true posterior $\mathcal{L}_1$8 by $\mathcal{L}_1$9, and minimizing $I_{test}$0 yields a loss with entropy, data-fidelity, and prior terms. Because $I_{test}$1 is not available in closed form, the prior is replaced by an upper bound given by the score-matching objective of the diffusion model. The resulting joint objective is

$I_{test}$2

The two networks are coupled in both directions: $I_{test}$3 proposes candidate clean images for training $I_{test}$4, and $I_{test}$5 provides a learned prior term that regularizes $I_{test}$6’s outputs (Wang et al., 2024).

Training alternates between updating the flow using log-determinant, data-fidelity, and diffusion-prior terms, and updating the diffusion model with score matching on forward-SDE perturbations of the flow outputs. The hyperparameters listed are flow learning rate $I_{test}$7 for MNIST and CIFAR or $I_{test}$8 for microscopy, diffusion learning rate $I_{test}$9 for MNIST and CIFAR or $I_g$0 for microscopy, and a reset interval of approximately 9k steps for the flow on denoising and deblurring (Wang et al., 2024).

Quantitatively, the paper compares AmbientFlow and FlowDiff on learned clean priors using FID. On CIFAR-10 deblurring, FID improves from 272 to 209; on tubulin microscopy, from 295 to 210; on MNIST denoising with $I_g$1, AmbientFlow reports 147 and FlowDiff 149. For amortized-inference outputs, the reported PSNR/SSIM/LPIPS values are 20.73/0.399/0.160 on MNIST denoising, 21.97/0.787/0.135 on CIFAR-10 deblurring, and 18.87/0.263/0.397 on microscopy imaging, exceeding the corresponding AmbientFlow results on CIFAR-10 and microscopy (Wang et al., 2024).

For downstream inverse-problem sampling on CIFAR-10 dogs with 128 posterior samples, FlowDiff reports 21.70/0.782/0.040 for denoising, 23.91/0.880/0.031 for deblurring, 22.55/0.816/0.037 for deblurring+denoising, and 22.46/0.836/0.034 for inpainting, outperforming AmbientDiff, SURE-Score, and AmbientFlow on the listed metrics. On MNIST and microscopy denoising posterior sampling, BM3D, AmbientFlow, and FlowDiff are reported as 13.57/0.427/0.088, 17.67/0.476/0.047, and 20.97/0.618/0.053 for MNIST, and 21.28/0.542/0.073, 15.35/0.120/0.537, and 23.33/0.687/0.111 for microscopy (Wang et al., 2024).

The paper also reports a clean-prior comparison in which training the same flow model with a true clean diffusion prior yields 24.61 PSNR versus 20.73 for FlowDiff on MNIST and 22.37 versus 21.97 on CIFAR-10. This suggests that the method recovers nearly the same posterior quality without ever seeing clean images, but not complete parity with training on true clean data.

5. Diff-Cleanse (“DiffClean”) as a backdoor defense

A third usage appears in Diff-Cleanse, a backdoor defense for unconditional noise-to-image diffusion models such as DDPM and advanced ODE samplers. The detailed description names the framework “Diff-Cleanse (‘DiffClean’)” and defines a two-stage defense: trigger inversion to reconstruct an effective trigger and detect the backdoor, followed by structural pruning to eliminate backdoor neurons (Hao et al., 2024).

The threat model assumes a white-box attacker who can define an arbitrary forward backdoor diffusion process, poison a fraction of the training data with poison rates in $I_g$2, and modify training loss, sampling procedure, and hyperparameters. The defender is assumed to have white-box access to the full model, no knowledge of the trigger or target, a small set of clean images of approximately 10% of the original dataset, and the ability to run the model’s sampling procedure under arbitrary noise inputs (Hao et al., 2024).

Stage 1 optimizes a candidate trigger $I_g$3 by minimizing

$I_g$4

where

$I_g$5

and

$I_g$6

The specificity term encourages collapse of trojaned outputs onto a single target, while the entropy term discourages trivial natural trigger-target pairs by clamping image entropy to $I_g$7, with $I_g$8 and $I_g$9 in practice. Optimization uses Adam with learning rate 0.1 for up to 100 steps. Detection then uses the Trigger Effectiveness metric

$$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$0

with $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$1, so that large $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$2 indicates collapse onto one point and strong evidence of a backdoor (Hao et al., 2024).

Stage 2 computes Taylor-based importance scores for model sub-structures $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$3. Using clean and trojaned diffusion losses, it defines

$$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$4

and

$$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$5

The framework then prunes the top $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$6 of sub-structures with largest $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$7, where $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$8 is small, typically 1–3%, and fine-tunes the pruned model on the clean subset using a combined loss $$q(x_t\mid x_{t-1})=\mathcal{N}\!\bigl(x_t;\sqrt{1-\beta_t}\,x_{t-1},\beta_t\mathbf{I}\bigr),$$9, where the second term distills from the original model’s clean-diffusion outputs (Hao et al., 2024).

The reported experiments use CIFAR-10 and CelebA-HQ, DDPM plus samplers including DDIM, PNDM, DEIS, DPM-Solver O1/O2/O3, DPM++ O1/O2/O3, UNIPC, and HEUN, and attacks BadDiff, TrojDiff, and VillanDiff. Trigger inversion is evaluated with batch size $\alpha_t = 1-\beta_t$0, Adam learning rate 0.1, and maximum 100 iterations; pruning uses threshold $\alpha_t = 1-\beta_t$1, prune rate $\alpha_t = 1-\beta_t$2–$\alpha_t = 1-\beta_t$3 per layer until $\alpha_t = 1-\beta_t$4; fine-tuning uses 40 epochs on CIFAR-10 and 100 epochs on CelebA-HQ with learning rate $\alpha_t = 1-\beta_t$5 (Hao et al., 2024).

The headline result is that Diff-Cleanse achieves 100% detection accuracy and reconstructs triggers with near-perfect ASR and SSIM in the reported trigger-inversion table. For backdoor removal, compared with a fixed 7–13% “Diff-Pruning” baseline, Diff-Cleanse uses adaptive 1–3% pruning and reports lower $\alpha_t = 1-\beta_t$6 while still achieving $\alpha_t = 1-\beta_t$7 across the listed attack-model pairs. For example, on BadDiff-C with DDPM-C, the reported values are $\alpha_t = 1-\beta_t$8, $\alpha_t = 1-\beta_t$9, $\bar\alpha_t = \prod_{s=1}^t \alpha_s$0 for Diff-Pruning versus 4.50, $\bar\alpha_t = \prod_{s=1}^t \alpha_s$1, and $\bar\alpha_t = \prod_{s=1}^t \alpha_s$2 for Diff-Cleanse (Hao et al., 2024).

The paper explicitly notes limitations. Extremely tiny patch triggers, such as 3×3 TrojDiff, can cause inversion to latch onto a different “natural” backdoor, and attacks that perfectly align activations of clean versus backdoor noise can make $\bar\alpha_t = \prod_{s=1}^t \alpha_s$3 small. These statements are important because they delimit the claimed robustness of the framework rather than presenting it as attack-agnostic.

6. Broader restoration context and interpretive synthesis

A related but differently named development is Uni-DocDiff, a unified document restoration model based on diffusion. Uni-DocDiff is described as a unified, diffusion-based framework for restoring damaged documents across six fundamentally different tasks: deblurring, deshadowing, illumination rectification, binarization, handwriting removal, and dewarping. Its core is a dual-stream architecture composed of a Pixel Prediction Branch, which is a conditional diffusion UNet that iteratively reconstructs clean pixels, and a Coordinate Prediction Branch, which is a lightweight decoder that predicts a backward warp field for dewarping. To support task scalability, it introduces a learnable task prompt, a Prior Pool of high-/low-frequency cues, and a Prior Fusion Module that adaptively selects and injects priors into the UNet at each scale (Zhao et al., 6 Aug 2025).

The paper reports that Uni-DocDiff matches or outperforms all expert, task-specific models on five representative benchmarks and is second-best on the sixth. The listed highlights are deblurring on TDD with PSNR 28.77 versus 28.77 and SSIM 0.9824 versus 0.9723, deshadowing on Jung’s with PSNR 23.93 versus 23.02 and SSIM 0.9156 versus 0.9089, illumination rectification on DocUNet* with PSNR 18.22 versus 17.60 and SSIM 0.7682 versus 0.7658, dewarping on DIR300 with MS-SSIM 0.6573 versus 0.6380, LD 5.30 versus 6.40, and AD 0.203 versus 0.218, binarization on DIBCO’18 with FM 90.32% versus 91.09%, pFM 93.84% versus 94.57%, and PSNR 19.76 versus 19.92, and handwriting removal on EnsExam with PSNR 36.23 versus 36.05 and MS-SSIM 0.9685 versus 0.9671 (Zhao et al., 6 Aug 2025).

This broader context clarifies what “cleaning” means in diffusion-model research. In DiffClean for makeup removal, the cleaned object is a face image whose cosmetics are suppressed while identity and age cues are preserved. In FlowDiff, also called DiffClean in parts of the text, the cleaned object is the latent clean-image distribution inferred from corrupted observations. In Diff-Cleanse, the cleaned object is the generative model itself, purified of hidden backdoor associations. In Uni-DocDiff, the cleaned object is a damaged document reconstructed across heterogeneous degradation types (Gavas et al., 17 Jul 2025, Wang et al., 2024, Hao et al., 2024, Zhao et al., 6 Aug 2025).

A second common misconception is that diffusion is performing the entire task in isolation. The cited systems instead combine diffusion with auxiliary mechanisms: CLIP text guidance and age supervision in makeup removal, conditional normalizing flows and amortized inference in FlowDiff, gradient-based trigger inversion and structural pruning in Diff-Cleanse, and learnable task prompts plus adaptive frequency priors in Uni-DocDiff. A plausible implication is that diffusion serves as a flexible prior or iterative reconstruction engine, while task-specific conditioning and control mechanisms determine the actual notion of “cleanliness.”