Robust Classification via a Single Diffusion Model
Huanran Chen Yinpeng Dong Zhengyi Wang Xiao Yang Chengqi Duan Hang Su Jun Zhu
Recently, diffusion models have been successfully applied to improving
adversarial robustness of image classifiers by purifying the adversarial noises
or generating realistic data for adversarial training. However, the
diffusion-based purification can be evaded by stronger adaptive attacks while
adversarial training does not perform well under unseen threats, exhibiting
inevitable limitations of these methods. To better harness the expressive power
of diffusion models, in this paper we propose Robust Diffusion Classifier
(RDC), a generative classifier that is constructed from a pre-trained diffusion
model to be adversarially robust. Our method first maximizes the data
likelihood of a given input and then predicts the class probabilities of the
optimized input using the conditional likelihood of the diffusion model through
Bayes' theorem. Since our method does not require training on particular
adversarial attacks, we demonstrate that it is more generalizable to defend
against multiple unseen threats. In particular, RDC achieves $73.24\%$ robust
accuracy against $\ell_\infty$ norm-bounded perturbations with
$\epsilon_\infty=8/255$ on CIFAR-10, surpassing the previous state-of-the-art
adversarial training models by $+2.34\%$. The findings highlight the potential
of generative classifiers by employing diffusion models for adversarial
robustness compared with the commonly studied discriminative classifiers.