---
title: Diffusion Denoised Smoothing (DDS) Overview
url: https://www.emergentmind.com/topics/diffusion-denoised-smoothing-dds
type: topic
---

# Diffusion Denoised Smoothing (DDS) Overview

Searching arXiv for recent and foundational papers on Diffusion Denoised Smoothing (DDS) and closely related terminology.
Diffusion Denoised Smoothing (DDS) denotes a set of diffusion-based constructions that couple denoising with either inverse-problem optimization or randomized smoothing. In the inverse-problem literature, the phrase is often aligned with the decomposed diffusion sampler: use denoised estimates via Tweedie’s formula at each reverse diffusion step, do optimization or solve the inverse problem in the space of these denoised samples rather than directly on noisy latents, and exploit linear Krylov subspaces so that optimization steps remain on the appropriate diffusion manifold without explicit manifold projections [2409.02574]. In the robustness and interpretability literature, DDS denotes randomized smoothing plus diffusion-based denoising, in which Gaussian-noised inputs are denoised before classification or explanation, yielding certified robustness or Faithful Vision Transformers (FViTs) [2311.17983].

## 1. Terminology and scope

The acronym is overloaded, and precise usage is essential. In "Solving Video Inverse Problems Using Image Diffusion Models" [2409.02574], **DDS** refers explicitly to **decomposed diffusion sampling** as introduced by Chung et al.; the same source states that, in the broader literature, this line of work is often called **Diffusion Denoised Smoothing** or **denoised smoothing with diffusion priors**. In "Improving Interpretation Faithfulness for Vision Transformers" [2311.17983], DDS refers to **Denoised Diffusion Smoothing**, a randomized-smoothing construction for robust attention and prediction. Other papers use the same acronym for distinct concepts.

| Use of “DDS” | Core mechanism | Representative papers |
|---|---|---|
| Diffusion Denoised Smoothing / decomposed diffusion sampler | Tweedie denoising, denoised-space optimization, Krylov-subspace updates, re-noising | [2303.05754], [2409.02574] |
| Denoised Diffusion Smoothing for robustness or interpretability | Gaussian randomized smoothing plus diffusion denoising before classification or explanation | [2311.17983], [2509.14846] |
| Adaptive Diffusion Denoised Smoothing | Guided denoising diffusion analyzed as adaptive Gaussian Differentially Private mechanisms | [2507.08163] |
| Distinct acronym expansions | Denoising Diffusion Samplers; Delta Denoising Score; Density-Dependent Smoothing | [2302.13834], [2304.07090], [2602.10422] |

A common misconception is that DDS names a single algorithm. The literature instead contains at least two major DDS lineages that share a diffusion-denoising motif but differ in objective, theory, and evaluation protocol. A second misconception is terminological: "Denoising Diffusion Samplers" [2302.13834], "Delta Denoising Score" [2304.07090], and "Density-Dependent Smoothing" [2602.10422] are not the same method.

## 2. Denoised-space optimization for inverse problems

In the inverse-problem formulation, a generic problem is posed as
$$
y = A(x) + \epsilon,
$$
with measurement \(y\), unknown clean data \(x\), forward operator \(A\), and noise \(\epsilon\). Diffusion-model inverse solvers seek solutions on a clean data manifold induced by an unconditional diffusion prior [2409.02574]. Earlier approaches such as Diffusion Posterior Sampling use a manifold-constrained gradient on noisy latents, but this requires backpropagating through the diffusion network to compute and project gradients, which is computationally heavy and sometimes unstable [2409.02574].

DDS replaces that update with a denoised-space procedure. The denoised estimate is obtained by Tweedie’s formula,
$$
\hat{x}_t = \frac{1}{\sqrt{\bar\alpha_t}}
\left( x_t - \sqrt{1-\bar\alpha_t}\,\epsilon_{\theta^*}^{(t)}(x_t) \right),
$$
then the inverse problem is optimized in the denoised space, and the result is re-noised to continue the diffusion trajectory [2409.02574]. In the decomposed diffusion sampler, the single gradient step is replaced by a multi-step Krylov subspace optimization:
$$
\bar{x}_t = \arg\min_{x \in \hat{x}_t + \mathcal{K}_l} \|y - A(x)\|^2.
$$
Because the linear manifold assumption implies the diffusion manifold is locally linear, the Krylov iterations stay in a subspace consistent with the manifold. The cited consequences are direct: no need for explicit manifold projections or backprop through diffusion, better convergence than single-step gradient, and stable and efficient behavior for large-scale inverse problems [2409.02574].

"Decomposed Diffusion Sampler for Accelerating Large-Scale Inverse Problems" states the geometric core more sharply: if the tangent space at a denoised sample by Tweedie’s formula forms a Krylov subspace, then CG initialized with the denoised data ensures the data consistency update to remain in the tangent space; this negates the need to compute the manifold-constrained gradient [2303.05754]. The method is applicable regardless of the parametrization and setting, i.e. VE and VP, and the reported applications include multi-coil MRI reconstruction and 3D CT reconstruction, with more than 80 times faster inference time than the previous state-of-the-art method [2303.05754].

This inverse-problem branch therefore treats DDS as a decomposition of each reverse diffusion step into three phases: **denoise**, **optimize in denoised space**, and **re-noise**. A plausible implication is that the term "smoothing" here refers less to randomized smoothing than to denoised manifold tracking under a diffusion prior.

## 3. Randomized smoothing, diffusion denoising, and Faithful ViTs

In the ViT literature, DDS is a smoothing-based robustness mechanism. The construction defines a denoised smoothed attention module
$$
\tilde{w}(x) = Z(T(x + z)), \quad z \sim \mathcal{N}(0,\sigma^2 I_{q \times n}),
$$
where \(x \in \mathbb{R}^{q \times n}\) is the input, \(T\) is the diffusion-based denoising model, and \(Z\) is the ViT’s self-attention module or an explanation function built on it [2311.17983]. The resulting ViT is called a Faithful Vision Transformer if its attention module satisfies two conditions within a radius \(R\): **top-\(k\) robustness**, measured by the overlap ratio
$$
V_k(u, v) = \frac{1}{k} \big| T_k(u) \cap T_k(v) \big|,
$$
and **prediction robustness**, expressed through a divergence bound on the prediction distributions [2311.17983].

The theory is phrased in terms of Rènyi divergence. The paper states that, for nearby inputs \(x\) and \(x'\),
$$
D_\alpha(\tilde{w}(x), \tilde{w}(x')) \le \frac{\alpha \|x-x'\|^2}{2 \sigma^2},
$$
with analogous \(\ell_\infty\) bounds after dimension-dependent conversion [2311.17983]. The same work proves that processing ViTs directly with DDS can turn them into FViTs, and further states that Gaussian noise is nearly optimal for both \(\ell_2\)- and \(\ell_\infty\)-norm cases [2311.17983].

Algorithmically, the paper aligns randomized smoothing noise with the diffusion model by finding \(t^*\) such that
$$
\frac{1-\alpha_t}{\alpha_t} = \sigma^2,
$$
then mapping the noisy input to the diffusion time \(t^*\), denoising, and computing self-attention on the denoised sample [2311.17983]. This construction differs from plain randomized smoothing in two ways recorded in the source: it operates directly on the attention vector rather than only on classifier outputs, and it uses a denoising diffusion probabilistic model to move noisy samples back toward the data manifold before prediction or explanation.

The conceptual shift is important. The paper’s definition of faithfulness is robustness-centric: stable top-\(k\) attention and stable prediction distributions under perturbation. That framing later became an explicit point of discussion in reproduction work and follow-on robustness papers.

## 4. Certified-robustness variants and empirical extensions

The reproducibility study "Improving Interpretation Faithfulness for Vision Transformers" treats DDS both as the key ingredient that makes ViTs robustly interpretable and as a generic plug-in post-processing step that can be applied to many attribution methods [2509.14846]. The reproduced implementation uses a pre-trained ImageNet diffusion model at \(256\times256\), \(N=10\) samples for qualitative visualisations, and \(N=2\) samples for quantitative experiments. Under PGD attack on ImageNet segmentation, the reported ViT results are: TA with PixAcc \(= 0.73\), mIoU \(= 0.52\), mAP \(= 0.82\), versus TA+DDS with PixAcc \(= 0.77\), mIoU \(= 0.58\), mAP \(= 0.85\); and AR with PixAcc \(= 0.74\), mIoU \(= 0.53\), mAP \(= 0.82\), versus AR+DDS with PixAcc \(= 0.78\), mIoU \(= 0.60\), mAP \(= 0.86\). The same source states that DDS consistently boosts TA, AR, and LRP in segmentation, and that AR+DDS achieves best overall segmentation performance among all methods in the reproduction [2509.14846].

The randomized-smoothing branch then diversified. "Multi-scale Diffusion Denoised Smoothing" proposes to selectively apply smoothing among multiple noise scales, coined multi-scale smoothing, and implements this with a single diffusion model through cascaded randomized smoothing [2310.16779]. The paper reports that the proposed multi-scale smoothing scheme combined with diffusion fine-tuning enables strong certified robustness available with high noise level while maintaining its accuracy close to non-smoothed classifiers [2310.16779].

"Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusion" generalizes classical DDS by treating a guided denoising diffusion model as a long sequence of adaptive Gaussian Differentially Private mechanisms [2507.08163]. The main certification theorem preserves the familiar randomized smoothing radius,
$$
r_x = \frac{\sigma}{2}\big( \Phi^{-1}(\underline{p_+}) - \Phi^{-1}(\overline{p_-}) \big),
$$
but now the mechanism includes a long, adaptive guided diffusion chain whose GDP analysis guarantees that the randomized smoothing assumptions still hold in an \(\ell_2\) sense [2507.08163]. The paper states that, on an ImageNet validation subset with a BEiT-large classifier, ADDS with voting improves both certified accuracy and standard accuracy at larger noise levels.

A separate line of work examines failure modes in classical DDS. "Robustifying Diffusion-Denoised Smoothing Against Covariate Shift" argues that using a pretrained denoising diffusion model introduces a covariate shift via misestimation of the added noise, and proposes an adversarial objective focused on the added noise of the denoising diffusion model [2509.10913]. The paper reports significantly improved certified accuracy across MNIST, CIFAR-10, and ImageNet, including new state-of-the-art performance in \(\ell_2\)-adversarial perturbations [2509.10913].

DDS has also been extended beyond closed-set classification. "Diffusion Denoised Smoothing for Certified and Adversarial Robust Out-Of-Distribution Detection" builds DISTRO on DDS and states that the average of all OOD detection metrics on CIFAR10/100 shows an increase of \(\sim 13 \% / 5\%\) relative to previous approaches [2303.14961]. In that formulation, diffusion denoising is combined with randomized smoothing and a binary discriminator, so that OOD confidence can be bounded within an \(\ell_2\)-ball.

## 5. Spatio-temporal and large-scale inverse problems

The inverse-problem interpretation of DDS has been extended from images to videos. "Solving Video Inverse Problems Using Image Diffusion Models" states that the original DDS of Chung is a 2D image inverse solver that operates per diffusion step on denoised images, and then generalizes the DDS idea to videos by treating time as a batch dimension and doing spatio-temporal optimization over batches of denoised frames [2409.02574].

The video forward model is
$$
y = A(x) + \epsilon,
$$
with \(x\) a spatio-temporal tensor and \(A\) possibly representing temporal PSF convolution plus spatial degradation. The method avoids training a video diffusion model by treating the time dimension as a batch dimension in an image diffusion model. It defines a batch diffusion denoiser
$$
\tilde{\mathcal{E}}_\theta^{(t)}(x_t) :=
\begin{bmatrix}
\epsilon_{\theta^*}^{(t)}(x_t[1]) & \cdots & \epsilon_{\theta^*}^{(t)}(x_t[N])
\end{bmatrix},
$$
computes a batch-wise Tweedie estimate, optimizes a denoised spatio-temporal batch in a Krylov subspace, and then re-noises with a batch-consistent noise term [2409.02574].

A second addition is **batch-consistent diffusion sampling**. The paper contrasts batch-independent sampling, in which each frame has independent initialization and re-noising noise and frames drift independently, with batch-consistent sampling, in which each frame is initialized with the same noise and re-noised with the same additive noise, so frames remain highly correlated [2409.02574]. In the conditional inverse setting, frame-dependent perturbations enter through CG optimization on the full video, balancing coherence and frame-specific differences.

The reported degradations include temporal PSFs such as frame averaging over 7 or 13 frames and Gaussian motion blur along time, combined with Gaussian blur, 4× average-pooling super-resolution, or random masking with ratio \(r = 0.5\) [2409.02574]. On DAVIS, the proposed method with 20 NFEs for temporal tasks and 100 NFEs for spatio-temporal tasks significantly outperforms DiffusionMBIR, DPS, and ADMM-TV in PSNR, SSIM, LPIPS, and particularly FVD. The same source reports a **10×–50× speedup** versus diffusion baselines using 100–1000 NFEs, and states that for temporal tasks with 20 NFEs the method reaches **>1 FPS reconstruction rates** [2409.02574].

This video extension preserves the canonical DDS pattern—denoise, optimize in denoised space, re-noise—but introduces a video-level prior through synchronized noise across frames. A plausible implication is that, in this branch of the literature, DDS functions as a modular bridge between 2D image priors and spatio-temporal inverse operators.

## 6. Limitations, costs, and contested interpretations

Several papers emphasize that DDS improves robustness only under substantial trade-offs. The reproduction of FViTs reports that DDS requires, for each input sample and each DDS sample, one diffusion reverse process with \(T \approx 45\) denoising steps plus one ViT forward pass and one interpretability computation, giving complexity roughly \(\mathcal{O}(N \cdot T \cdot C)\) [2509.14846]. On an NVIDIA A100 (half GPU), a baseline segmentation run per method took ~ 0.8–1 hour, whereas the same experiment with DDS took ~ 9–10 hours per method. Using 2024 Dutch grid carbon intensity, the paper estimates, for a ViT Raw Attention segmentation run, ~37.5 g CO\(_2\) without DDS and ~616.9 g CO\(_2\) with DDS, and concludes that FViT’s environmental impact is significantly higher than that of all other methods [2509.14846].

The security–utility trade-off is explicit in "Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off" [2505.15594]. That study evaluates DDS as a practical defense for DINOv2-based downstream models on classification, semantic segmentation, monocular depth estimation, and image retrieval. The main conclusion is sharp: applying high-noise diffusion denoising to clean images without any distortions significantly degrades performance by as high as **57%**, while low-noise diffusion settings preserve performance but fail to provide adequate protection across all attack types. The same paper introduces an attack strategy specifically targeting the diffusion process itself, capable of circumventing defenses in the low-noise regime [2505.15594].

Interpretational disputes are also recorded. The reproduction study states that DDS indeed yields robust attention modules, but argues that the original notion of faithfulness is largely robustness-based and that “robust ViT” might be a more precise term [2509.14846]. A common misconception is therefore to treat DDS-based faithfulness as settling broader questions of explanation validity; the cited literature supports a narrower claim centered on stability under perturbation.

Finally, the acronym itself continues to create confusion. In 2023, "Denoising Diffusion Samplers" used DDS for diffusion-based Monte Carlo sampling and normalizing-constant estimation [2302.13834]. The same year, "Delta Denoising Score" introduced DDS as a scoring function for text-based image editing built on Score Distillation Sampling [2304.07090]. In 2026, "Navigating heterogeneous protein landscapes through geometry-aware smoothing" introduced DDS as **Density-Dependent Smoothing**, a geometry-aware generative framework for biological sequences [2602.10422]. For encyclopedia purposes, the most stable practice is to reserve **Diffusion Denoised Smoothing** for the denoise-and-smooth lines centered on inverse problems, randomized smoothing, certified robustness, and robust interpretability, while explicitly disambiguating other expansions of the acronym.

Source: https://www.emergentmind.com/topics/diffusion-denoised-smoothing-dds