Diffusion Denoised Smoothing (DDS) Overview

• Diffusion Denoised Smoothing (DDS) is a framework that combines diffusion-based denoising with optimization methods or randomized smoothing for enhanced inverse-problem solutions and robustness.
• It leverages Tweedie’s formula and Krylov subspace optimization to efficiently solve inverse problems, achieving significant speedups in applications like MRI and CT reconstruction.
• In vision transformers, DDS integrates diffusion denoising with randomized smoothing to create robust attention modules that improve certified robustness and interpretability under perturbations.

Searching arXiv for recent and foundational papers on Diffusion Denoised Smoothing (DDS) and closely related terminology. Diffusion Denoised Smoothing (DDS) denotes a set of diffusion-based constructions that couple denoising with either inverse-problem optimization or randomized smoothing. In the inverse-problem literature, the phrase is often aligned with the decomposed diffusion sampler: use denoised estimates via Tweedie’s formula at each reverse diffusion step, do optimization or solve the inverse problem in the space of these denoised samples rather than directly on noisy latents, and exploit linear Krylov subspaces so that optimization steps remain on the appropriate diffusion manifold without explicit manifold projections (Kwon et al., 2024). In the robustness and interpretability literature, DDS denotes randomized smoothing plus diffusion-based denoising, in which Gaussian-noised inputs are denoised before classification or explanation, yielding certified robustness or Faithful Vision Transformers (FViTs) (Hu et al., 2023).

1. Terminology and scope

The acronym is overloaded, and precise usage is essential. In "Solving Video Inverse Problems Using Image Diffusion Models" (Kwon et al., 2024), DDS refers explicitly to decomposed diffusion sampling as introduced by Chung et al.; the same source states that, in the broader literature, this line of work is often called Diffusion Denoised Smoothing or denoised smoothing with diffusion priors. In "Improving Interpretation Faithfulness for Vision Transformers" (Hu et al., 2023), DDS refers to Denoised Diffusion Smoothing, a randomized-smoothing construction for robust attention and prediction. Other papers use the same acronym for distinct concepts.

Use of “DDS”	Core mechanism	Representative papers
Diffusion Denoised Smoothing / decomposed diffusion sampler	Tweedie denoising, denoised-space optimization, Krylov-subspace updates, re-noising	(Chung et al., 2023, Kwon et al., 2024)
Denoised Diffusion Smoothing for robustness or interpretability	Gaussian randomized smoothing plus diffusion denoising before classification or explanation	(Hu et al., 2023, Kurek et al., 18 Sep 2025)
Adaptive Diffusion Denoised Smoothing	Guided denoising diffusion analyzed as adaptive Gaussian Differentially Private mechanisms	(Shpilevskiy et al., 10 Jul 2025)
Distinct acronym expansions	Denoising Diffusion Samplers; Delta Denoising Score; Density-Dependent Smoothing	(Vargas et al., 2023, Hertz et al., 2023, Anumasa et al., 11 Feb 2026)

A common misconception is that DDS names a single algorithm. The literature instead contains at least two major DDS lineages that share a diffusion-denoising motif but differ in objective, theory, and evaluation protocol. A second misconception is terminological: "Denoising Diffusion Samplers" (Vargas et al., 2023), "Delta Denoising Score" (Hertz et al., 2023), and "Density-Dependent Smoothing" (Anumasa et al., 11 Feb 2026) are not the same method.

2. Denoised-space optimization for inverse problems

In the inverse-problem formulation, a generic problem is posed as

$y = A(x) + \epsilon,$

with measurement $y$, unknown clean data $x$, forward operator $A$, and noise $\epsilon$. Diffusion-model inverse solvers seek solutions on a clean data manifold induced by an unconditional diffusion prior (Kwon et al., 2024). Earlier approaches such as Diffusion Posterior Sampling use a manifold-constrained gradient on noisy latents, but this requires backpropagating through the diffusion network to compute and project gradients, which is computationally heavy and sometimes unstable (Kwon et al., 2024).

DDS replaces that update with a denoised-space procedure. The denoised estimate is obtained by Tweedie’s formula,

$$\hat{x}_t = \frac{1}{\sqrt{\bar\alpha_t}} \left( x_t - \sqrt{1-\bar\alpha_t}\,\epsilon_{\theta^*}^{(t)}(x_t) \right),$$

then the inverse problem is optimized in the denoised space, and the result is re-noised to continue the diffusion trajectory (Kwon et al., 2024). In the decomposed diffusion sampler, the single gradient step is replaced by a multi-step Krylov subspace optimization:

$$\bar{x}_t = \arg\min_{x \in \hat{x}_t + \mathcal{K}_l} \|y - A(x)\|^2.$$

Because the linear manifold assumption implies the diffusion manifold is locally linear, the Krylov iterations stay in a subspace consistent with the manifold. The cited consequences are direct: no need for explicit manifold projections or backprop through diffusion, better convergence than single-step gradient, and stable and efficient behavior for large-scale inverse problems (Kwon et al., 2024).

"Decomposed Diffusion Sampler for Accelerating Large-Scale Inverse Problems" states the geometric core more sharply: if the tangent space at a denoised sample by Tweedie’s formula forms a Krylov subspace, then CG initialized with the denoised data ensures the data consistency update to remain in the tangent space; this negates the need to compute the manifold-constrained gradient (Chung et al., 2023). The method is applicable regardless of the parametrization and setting, i.e. VE and VP, and the reported applications include multi-coil MRI reconstruction and 3D CT reconstruction, with more than 80 times faster inference time than the previous state-of-the-art method (Chung et al., 2023).

This inverse-problem branch therefore treats DDS as a decomposition of each reverse diffusion step into three phases: denoise, optimize in denoised space, and re-noise. A plausible implication is that the term "smoothing" here refers less to randomized smoothing than to denoised manifold tracking under a diffusion prior.

3. Randomized smoothing, diffusion denoising, and Faithful ViTs

In the ViT literature, DDS is a smoothing-based robustness mechanism. The construction defines a denoised smoothed attention module

$$\tilde{w}(x) = Z(T(x + z)), \quad z \sim \mathcal{N}(0,\sigma^2 I_{q \times n}),$$

where $x \in \mathbb{R}^{q \times n}$ is the input, $T$ is the diffusion-based denoising model, and $y$0 is the ViT’s self-attention module or an explanation function built on it (Hu et al., 2023). The resulting ViT is called a Faithful Vision Transformer if its attention module satisfies two conditions within a radius $y$1: top-$y$2 robustness, measured by the overlap ratio

$y$3

and prediction robustness, expressed through a divergence bound on the prediction distributions (Hu et al., 2023).

The theory is phrased in terms of Rènyi divergence. The paper states that, for nearby inputs $y$4 and $y$5,

$y$6

with analogous $y$7 bounds after dimension-dependent conversion (Hu et al., 2023). The same work proves that processing ViTs directly with DDS can turn them into FViTs, and further states that Gaussian noise is nearly optimal for both $y$8- and $y$9-norm cases (Hu et al., 2023).

Algorithmically, the paper aligns randomized smoothing noise with the diffusion model by finding $x$0 such that

$x$1

then mapping the noisy input to the diffusion time $x$2, denoising, and computing self-attention on the denoised sample (Hu et al., 2023). This construction differs from plain randomized smoothing in two ways recorded in the source: it operates directly on the attention vector rather than only on classifier outputs, and it uses a denoising diffusion probabilistic model to move noisy samples back toward the data manifold before prediction or explanation.

The conceptual shift is important. The paper’s definition of faithfulness is robustness-centric: stable top-$x$3 attention and stable prediction distributions under perturbation. That framing later became an explicit point of discussion in reproduction work and follow-on robustness papers.

4. Certified-robustness variants and empirical extensions

The reproducibility study "Improving Interpretation Faithfulness for Vision Transformers" treats DDS both as the key ingredient that makes ViTs robustly interpretable and as a generic plug-in post-processing step that can be applied to many attribution methods (Kurek et al., 18 Sep 2025). The reproduced implementation uses a pre-trained ImageNet diffusion model at $x$4, $x$5 samples for qualitative visualisations, and $x$6 samples for quantitative experiments. Under PGD attack on ImageNet segmentation, the reported ViT results are: TA with PixAcc $x$7, mIoU $x$8, mAP $x$9, versus TA+DDS with PixAcc $A$0, mIoU $A$1, mAP $A$2; and AR with PixAcc $A$3, mIoU $A$4, mAP $A$5, versus AR+DDS with PixAcc $A$6, mIoU $A$7, mAP $A$8. The same source states that DDS consistently boosts TA, AR, and LRP in segmentation, and that AR+DDS achieves best overall segmentation performance among all methods in the reproduction (Kurek et al., 18 Sep 2025).

The randomized-smoothing branch then diversified. "Multi-scale Diffusion Denoised Smoothing" proposes to selectively apply smoothing among multiple noise scales, coined multi-scale smoothing, and implements this with a single diffusion model through cascaded randomized smoothing (Jeong et al., 2023). The paper reports that the proposed multi-scale smoothing scheme combined with diffusion fine-tuning enables strong certified robustness available with high noise level while maintaining its accuracy close to non-smoothed classifiers (Jeong et al., 2023).

"Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion" generalizes classical DDS by treating a guided denoising diffusion model as a long sequence of adaptive Gaussian Differentially Private mechanisms (Shpilevskiy et al., 10 Jul 2025). The main certification theorem preserves the familiar randomized smoothing radius,

$A$9

but now the mechanism includes a long, adaptive guided diffusion chain whose GDP analysis guarantees that the randomized smoothing assumptions still hold in an $\epsilon$0 sense (Shpilevskiy et al., 10 Jul 2025). The paper states that, on an ImageNet validation subset with a BEiT-large classifier, ADDS with voting improves both certified accuracy and standard accuracy at larger noise levels.

A separate line of work examines failure modes in classical DDS. "Robustifying Diffusion-Denoised Smoothing Against Covariate Shift" argues that using a pretrained denoising diffusion model introduces a covariate shift via misestimation of the added noise, and proposes an adversarial objective focused on the added noise of the denoising diffusion model (Hedayatnia et al., 13 Sep 2025). The paper reports significantly improved certified accuracy across MNIST, CIFAR-10, and ImageNet, including new state-of-the-art performance in $\epsilon$1-adversarial perturbations (Hedayatnia et al., 13 Sep 2025).

DDS has also been extended beyond closed-set classification. "Diffusion Denoised Smoothing for Certified and Adversarial Robust Out-Of-Distribution Detection" builds DISTRO on DDS and states that the average of all OOD detection metrics on CIFAR10/100 shows an increase of $\epsilon$2 relative to previous approaches (Franco et al., 2023). In that formulation, diffusion denoising is combined with randomized smoothing and a binary discriminator, so that OOD confidence can be bounded within an $\epsilon$3-ball.

5. Spatio-temporal and large-scale inverse problems

The inverse-problem interpretation of DDS has been extended from images to videos. "Solving Video Inverse Problems Using Image Diffusion Models" states that the original DDS of Chung is a 2D image inverse solver that operates per diffusion step on denoised images, and then generalizes the DDS idea to videos by treating time as a batch dimension and doing spatio-temporal optimization over batches of denoised frames (Kwon et al., 2024).

The video forward model is

$\epsilon$4

with $\epsilon$5 a spatio-temporal tensor and $\epsilon$6 possibly representing temporal PSF convolution plus spatial degradation. The method avoids training a video diffusion model by treating the time dimension as a batch dimension in an image diffusion model. It defines a batch diffusion denoiser

$\epsilon$7

computes a batch-wise Tweedie estimate, optimizes a denoised spatio-temporal batch in a Krylov subspace, and then re-noises with a batch-consistent noise term (Kwon et al., 2024).

A second addition is batch-consistent diffusion sampling. The paper contrasts batch-independent sampling, in which each frame has independent initialization and re-noising noise and frames drift independently, with batch-consistent sampling, in which each frame is initialized with the same noise and re-noised with the same additive noise, so frames remain highly correlated (Kwon et al., 2024). In the conditional inverse setting, frame-dependent perturbations enter through CG optimization on the full video, balancing coherence and frame-specific differences.

The reported degradations include temporal PSFs such as frame averaging over 7 or 13 frames and Gaussian motion blur along time, combined with Gaussian blur, 4× average-pooling super-resolution, or random masking with ratio $\epsilon$8 (Kwon et al., 2024). On DAVIS, the proposed method with 20 NFEs for temporal tasks and 100 NFEs for spatio-temporal tasks significantly outperforms DiffusionMBIR, DPS, and ADMM-TV in PSNR, SSIM, LPIPS, and particularly FVD. The same source reports a 10×–50× speedup versus diffusion baselines using 100–1000 NFEs, and states that for temporal tasks with 20 NFEs the method reaches >1 FPS reconstruction rates (Kwon et al., 2024).

This video extension preserves the canonical DDS pattern—denoise, optimize in denoised space, re-noise—but introduces a video-level prior through synchronized noise across frames. A plausible implication is that, in this branch of the literature, DDS functions as a modular bridge between 2D image priors and spatio-temporal inverse operators.

6. Limitations, costs, and contested interpretations

Several papers emphasize that DDS improves robustness only under substantial trade-offs. The reproduction of FViTs reports that DDS requires, for each input sample and each DDS sample, one diffusion reverse process with $\epsilon$9 denoising steps plus one ViT forward pass and one interpretability computation, giving complexity roughly $$\hat{x}_t = \frac{1}{\sqrt{\bar\alpha_t}} \left( x_t - \sqrt{1-\bar\alpha_t}\,\epsilon_{\theta^*}^{(t)}(x_t) \right),$$0 (Kurek et al., 18 Sep 2025). On an NVIDIA A100 (half GPU), a baseline segmentation run per method took ~ 0.8–1 hour, whereas the same experiment with DDS took ~ 9–10 hours per method. Using 2024 Dutch grid carbon intensity, the paper estimates, for a ViT Raw Attention segmentation run, ~37.5 g CO$$\hat{x}_t = \frac{1}{\sqrt{\bar\alpha_t}} \left( x_t - \sqrt{1-\bar\alpha_t}\,\epsilon_{\theta^*}^{(t)}(x_t) \right),$$1 without DDS and ~616.9 g CO$$\hat{x}_t = \frac{1}{\sqrt{\bar\alpha_t}} \left( x_t - \sqrt{1-\bar\alpha_t}\,\epsilon_{\theta^*}^{(t)}(x_t) \right),$$2 with DDS, and concludes that FViT’s environmental impact is significantly higher than that of all other methods (Kurek et al., 18 Sep 2025).

The security–utility trade-off is explicit in "Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off" (Belousov et al., 21 May 2025). That study evaluates DDS as a practical defense for DINOv2-based downstream models on classification, semantic segmentation, monocular depth estimation, and image retrieval. The main conclusion is sharp: applying high-noise diffusion denoising to clean images without any distortions significantly degrades performance by as high as 57%, while low-noise diffusion settings preserve performance but fail to provide adequate protection across all attack types. The same paper introduces an attack strategy specifically targeting the diffusion process itself, capable of circumventing defenses in the low-noise regime (Belousov et al., 21 May 2025).

Interpretational disputes are also recorded. The reproduction study states that DDS indeed yields robust attention modules, but argues that the original notion of faithfulness is largely robustness-based and that “robust ViT” might be a more precise term (Kurek et al., 18 Sep 2025). A common misconception is therefore to treat DDS-based faithfulness as settling broader questions of explanation validity; the cited literature supports a narrower claim centered on stability under perturbation.

Finally, the acronym itself continues to create confusion. In 2023, "Denoising Diffusion Samplers" used DDS for diffusion-based Monte Carlo sampling and normalizing-constant estimation (Vargas et al., 2023). The same year, "Delta Denoising Score" introduced DDS as a scoring function for text-based image editing built on Score Distillation Sampling (Hertz et al., 2023). In 2026, "Navigating heterogeneous protein landscapes through geometry-aware smoothing" introduced DDS as Density-Dependent Smoothing, a geometry-aware generative framework for biological sequences (Anumasa et al., 11 Feb 2026). For encyclopedia purposes, the most stable practice is to reserve Diffusion Denoised Smoothing for the denoise-and-smooth lines centered on inverse problems, randomized smoothing, certified robustness, and robust interpretability, while explicitly disambiguating other expansions of the acronym.