{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T09:06:09Z","timestamp":1784279169090,"version":"3.55.0"},"reference-count":40,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100005408","name":"University of Electronic Science and Technology of China","doi-asserted-by":"publisher","award":["Y030232064008"],"award-info":[{"award-number":["Y030232064008"]}],"id":[{"id":"10.13039\/501100005408","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Pattern Recognition"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.patcog.2026.113726","type":"journal-article","created":{"date-parts":[[2026,4,22]],"date-time":"2026-04-22T15:22:35Z","timestamp":1776871355000},"page":"113726","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"PC","title":["Provably Noise-to-Noise robust learning: Mitigating data poisoning attacks against classifier-guided diffusion models"],"prefix":"10.1016","volume":"179","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-3492-3790","authenticated-orcid":false,"given":"Yu","family":"Yang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jianping","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rui","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hitesh","family":"Tewari","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.patcog.2026.113726_b1","series-title":"IEEE International Conference on Multimedia and Expo","first-page":"1","article-title":"One-shot federated learning with classifier-guided diffusion models","author":"Zaland","year":"2025"},{"key":"10.1016\/j.patcog.2026.113726_b2","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2024.110474","article-title":"Depth-aware guidance with self-estimated depth representations of diffusion models","volume":"153","author":"Kim","year":"2024","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113726_b3","series-title":"Advances in Neural Information Processing Systems","first-page":"1229","article-title":"Leveraging early-stage robustness in diffusion models for efficient and high-quality image synthesis","author":"Kim","year":"2023"},{"key":"10.1016\/j.patcog.2026.113726_b4","series-title":"Advances in Neural Information Processing Systems","first-page":"76839","article-title":"Constructing non-isotropic Gaussian diffusion model using isotropic Gaussian diffusion model for image editing","author":"Yu","year":"2023"},{"key":"10.1016\/j.patcog.2026.113726_b5","unstructured":"G. Zhang, J. Ji, Y. Zhang, M. Yu, T.S. Jaakkola, S. Chang, Towards coherent image inpainting using denoising diffusion implicit models, in: International Conference on Machine Learning, 2023."},{"key":"10.1016\/j.patcog.2026.113726_b6","doi-asserted-by":"crossref","unstructured":"S. Huang, H. Zhang, X. Li, Enhance vision-language alignment with noise, in: Proceedings of the AAAI Conference on Artificial Intelligence, 2025, pp. 17449\u201317457.","DOI":"10.1609\/aaai.v39i16.33918"},{"issue":"1","key":"10.1016\/j.patcog.2026.113726_b7","doi-asserted-by":"crossref","first-page":"338","DOI":"10.1109\/TPAMI.2024.3462996","article-title":"Noise-robust vision-language pre-training with positive-negative learning","volume":"47","author":"Huang","year":"2024","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.patcog.2026.113726_b8","article-title":"Zero-shot image denoising with hollow pair sampling and noise-aware attention","author":"Wang","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113726_b9","doi-asserted-by":"crossref","DOI":"10.1016\/j.patcog.2024.110799","article-title":"Denoising diffusion post-processing for low-light image enhancement","volume":"156","author":"Panagiotou","year":"2024","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113726_b10","article-title":"Multi resolution based local adaptive guided filter for fast large scale image denoising","author":"Wang","year":"2025","journal-title":"Pattern Recognit."},{"key":"10.1016\/j.patcog.2026.113726_b11","first-page":"3018","article-title":"Semantic-guided generative image augmentation method with diffusion models for image classification","volume":"vol. 38","author":"Li","year":"2024"},{"key":"10.1016\/j.patcog.2026.113726_b12","unstructured":"Y. Mo, H. Huang, M. Li, A. Li, Y. Wang, TERD: A unified framework for safeguarding diffusion models against backdoors, in: The 41th International Conference on Machine Learning, 2024."},{"key":"10.1016\/j.patcog.2026.113726_b13","doi-asserted-by":"crossref","unstructured":"J. Wang, H. Zhang, Y. Yuan, Adv-cpg: A customized portrait generation framework with facial adversarial attacks, in: Proceedings of the Computer Vision and Pattern Recognition Conference, 2025, pp. 21001\u201321010.","DOI":"10.1109\/CVPR52734.2025.01956"},{"key":"10.1016\/j.patcog.2026.113726_b14","first-page":"6791","article-title":"Step vulnerability guided mean fluctuation adversarial attack against conditional diffusion models","volume":"vol. 38","author":"Yu","year":"2024"},{"key":"10.1016\/j.patcog.2026.113726_b15","series-title":"Advances in Neural Information Processing Systems","first-page":"33912","article-title":"Villandiffusion: A unified backdoor attack framework for diffusion models","author":"Chou","year":"2024"},{"key":"10.1016\/j.patcog.2026.113726_b16","doi-asserted-by":"crossref","unstructured":"W. Chen, D. Song, B. Li, Trojdiff: Trojan attacks on diffusion models with diverse targets, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 4035\u20134044.","DOI":"10.1109\/CVPR52729.2023.00393"},{"key":"10.1016\/j.patcog.2026.113726_b17","doi-asserted-by":"crossref","unstructured":"J. Zhou, P. Lv, Y. Lan, G. Meng, K. Chen, H. Ma, DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models, in: Proceedings of the AAAI Conference on Artificial Intelligence, 2024, pp. 21850\u201321858.","DOI":"10.1609\/aaai.v38i19.30186"},{"key":"10.1016\/j.patcog.2026.113726_b18","series-title":"Generating potent poisons and backdoors from scratch with guided diffusion","author":"Souri","year":"2024"},{"key":"10.1016\/j.patcog.2026.113726_b19","doi-asserted-by":"crossref","unstructured":"S.-Y. Chou, P.-Y. Chen, T.-Y. Ho, How to backdoor diffusion models?, in: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 4015\u20134024.","DOI":"10.1109\/CVPR52729.2023.00391"},{"key":"10.1016\/j.patcog.2026.113726_b20","article-title":"Differentially private diffusion models","author":"Dockhorn","year":"2023","journal-title":"Trans. Mach. Learn. Res."},{"key":"10.1016\/j.patcog.2026.113726_b21","unstructured":"N. Carlini, F. Tramer, K.D. Dvijotham, L. Rice, M. Sun, J.Z. Kolter, (Certified!!) Adversarial Robustness for Free!, in: 8th International Conference on Learning Representations, 2022."},{"key":"10.1016\/j.patcog.2026.113726_b22","unstructured":"J. Zhang, Z. Chen, H. Zhang, C. Xiao, B. Li, {DiffSmooth}: Certifiably robust learning via diffusion models and local smoothing, in: 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 4787\u20134804."},{"key":"10.1016\/j.patcog.2026.113726_b23","series-title":"Advances in Neural Information Processing Systems","first-page":"21945","article-title":"Denoised smoothing: A provable defense for pretrained classifiers","author":"Salman","year":"2020"},{"issue":"9","key":"10.1016\/j.patcog.2026.113726_b24","doi-asserted-by":"crossref","first-page":"8313","DOI":"10.1109\/TPAMI.2025.3575295","article-title":"Variational positive-incentive noise: How noise benefits models","volume":"47","author":"Zhang","year":"2025","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"10.1016\/j.patcog.2026.113726_b25","doi-asserted-by":"crossref","unstructured":"A. Salem, M. Backes, Y. Zhang, Get a Model! Model Hijacking Attack Against Machine Learning Models, in: 29th Annual Network and Distributed System Security Symposium, NDSS 22, 2022.","DOI":"10.14722\/ndss.2022.23064"},{"key":"10.1016\/j.patcog.2026.113726_b26","doi-asserted-by":"crossref","unstructured":"T. Wang, Y. Yao, F. Xu, S. An, H. Tong, T. Wang, An invisible black-box backdoor attack through frequency domain, in: European Conference on Computer Vision, 2022, pp. 396\u2013413.","DOI":"10.1007\/978-3-031-19778-9_23"},{"key":"10.1016\/j.patcog.2026.113726_b27","doi-asserted-by":"crossref","unstructured":"Y. Li, Y. Li, B. Wu, L. Li, R. He, S. Lyu, Invisible backdoor attack with sample-specific triggers, in: Proceedings of the IEEE\/CVF International Conference on Computer Vision, 2021, pp. 16463\u201316472.","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"10.1016\/j.patcog.2026.113726_b28","series-title":"Advances in Neural Information Processing Systems","first-page":"16070","article-title":"Attack of the tails: Yes, you really can backdoor federated learning","author":"Wang","year":"2020"},{"key":"10.1016\/j.patcog.2026.113726_b29","unstructured":"N. Carlini, J. Hayes, M. Nasr, M. Jagielski, V. Sehwag, F. Tramer, B. Balle, D. Ippolito, E. Wallace, Extracting training data from diffusion models, in: 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 5253\u20135270."},{"key":"10.1016\/j.patcog.2026.113726_b30","doi-asserted-by":"crossref","unstructured":"Y. Sun, N.S. Chong, H. Ochiai, Information stealing in federated learning systems based on generative adversarial networks, in: 2021 IEEE International Conference on Systems, Man, and Cybernetics, SMC, 2021, pp. 2749\u20132754.","DOI":"10.1109\/SMC52423.2021.9658652"},{"key":"10.1016\/j.patcog.2026.113726_b31","doi-asserted-by":"crossref","unstructured":"J. Zhou, Y. Chen, C. Shen, Y. Zhang, Property inference attacks against GANs, in: 29th Annual Network and Distributed System Security Symposium, NDSS 22, 2022.","DOI":"10.14722\/ndss.2022.23019"},{"key":"10.1016\/j.patcog.2026.113726_b32","unstructured":"S. Shan, A.N. Bhagoji, H. Zheng, B.Y. Zhao, Poison forensics: Traceback of data poisoning attacks in neural networks, in: 31st USENIX Security Symposium (USENIX Security 22), 2022, pp. 3575\u20133592."},{"key":"10.1016\/j.patcog.2026.113726_b33","doi-asserted-by":"crossref","unstructured":"S. Zhai, Y. Dong, Q. Shen, S. Pu, Y. Fang, H. Su, Text-to-image diffusion models can be easily backdoored through multimodal data poisoning, in: Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 1577\u20131587.","DOI":"10.1145\/3581783.3612108"},{"key":"10.1016\/j.patcog.2026.113726_b34","series-title":"Diffusion models for adversarial purification","author":"Nie","year":"2022"},{"key":"10.1016\/j.patcog.2026.113726_b35","doi-asserted-by":"crossref","unstructured":"M. Weber, X. Xu, B. Karla\u0161, C. Zhang, B. Li, Rab: Provable robustness against backdoor attacks, in: 2023 IEEE Symposium on Security and Privacy, SP, 2023, pp. 1311\u20131328.","DOI":"10.1109\/SP46215.2023.10179451"},{"key":"10.1016\/j.patcog.2026.113726_b36","unstructured":"J. Cohen, E. Rosenfeld, Z. Kolter, Certified adversarial robustness via randomized smoothing, in: International Conference on Machine Learning, 2019, pp. 1310\u20131320."},{"key":"10.1016\/j.patcog.2026.113726_b37","article-title":"Tight certificates of adversarial robustness for randomly smoothed classifiers","volume":"vol. 32","author":"Lee","year":"2019"},{"key":"10.1016\/j.patcog.2026.113726_b38","unstructured":"T. Karras, T. Aila, S. Laine, J. Lehtinen, Progressive growing of gans for improved quality, stability, and variation, in: 6th International Conference on Learning Representations, ICLR 18, 2018."},{"key":"10.1016\/j.patcog.2026.113726_b39","series-title":"Learning Multiple Layers of Features from Tiny Images","author":"Krizhevsky","year":"2009"},{"issue":"2","key":"10.1016\/j.patcog.2026.113726_b40","doi-asserted-by":"crossref","first-page":"108","DOI":"10.3390\/info11020108","article-title":"Fastai: a layered API for deep learning","volume":"11","author":"Howard","year":"2020","journal-title":"Information"}],"container-title":["Pattern Recognition"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320326006916?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0031320326006916?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,7,17]],"date-time":"2026-07-17T08:26:51Z","timestamp":1784276811000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0031320326006916"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":40,"alternative-id":["S0031320326006916"],"URL":"https:\/\/doi.org\/10.1016\/j.patcog.2026.113726","relation":{},"ISSN":["0031-3203"],"issn-type":[{"value":"0031-3203","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Provably Noise-to-Noise robust learning: Mitigating data poisoning attacks against classifier-guided diffusion models","name":"articletitle","label":"Article Title"},{"value":"Pattern Recognition","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.patcog.2026.113726","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Ltd. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"113726"}}