Diffusion models are recently employed as generative classifiers for robust
classification. However, a comprehensive theoretical understanding of the
robustness of diffusion classifiers is still lacking, leading us to question
whether they will be vulnerable to future stronger attacks. In this study, we
propose a new family of diffusion classifiers, named Noised Diffusion
Classifiers~(NDCs), that possess state-of-the-art certified robustness.
Specifically, we generalize the diffusion classifiers to classify
Gaussian-corrupted data by deriving the evidence lower bounds (ELBOs) for these
distributions, approximating the likelihood using the ELBO, and calculating
classification probabilities via Bayes' theorem. We integrate these generalized
diffusion classifiers with randomized smoothing to construct smoothed
classifiers possessing non-constant Lipschitzness. Experimental results
demonstrate the superior certified robustness of our proposed NDCs. Notably, we
are the first to achieve 80\%+ and 70\%+ certified robustness on CIFAR-10 under
adversarial perturbations with $\ell_2$ norm less than 0.25 and 0.5,
respectively, using a single off-the-shelf diffusion model without any
additional data.

通过推导证据下界（ELBO）来对高斯污染数据的扩散分类器进行泛化，将其与随机光滑化相结合，构建具有非常数 Lipschitz 性质的平滑分类器，实现了 80％+ 和 70％+ 的在 CIFAR-10 上扰动小于 0.25 和 0.5 的认证稳健性。