PaperlayerView exact revision on arXiv

Source-linked AI summary

Diffusion Models for Imperceptible and Transferable Adversarial Attack

Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, Zhenwei Shi

arXiv:2305.08192v2cs.CV

TL;DR

Existing Lp-norm attacks can be perceptible, while prior unrestricted attacks often lack black-box transferability. DiffAttack addresses this gap by optimizing diffusion-model latents and using attention-based mechanisms to preserve content and distract the diffusion model. Across models, datasets, and defenses, the paper reports improved imperceptibility and transferability over existing attacks, while noting computational and targeted-transfer limitations.

  • Problem

    Existing RGB-space Lp attacks can be perceptible, while prior unrestricted attacks improve imperceptibility but lack transferability across black-box models.

  • Method

    DiffAttack optimizes diffusion-model latents and uses cross-attention to distract the diffusion model and self-attention to preserve image structure.

  • Results

    DiffAttack achieves superior imperceptibility and transferability across extensive black-box models, defenses, and datasets compared with existing attack methods.

  • Takeaways & Limitations

    Diffusion models provide a foundation for unrestricted adversarial examples that combine human imperceptibility with transferability.

  • Takeaways & Limitations

    DiffAttack has substantial computational cost, does not consistently reach 100% white-box success, and has low transferability for targeted attacks.

Abstract

from arXiv · show

Many existing adversarial attacks generate $L_p$-norm perturbations on image RGB space. Despite some achievements in transferability and attack success rate, the crafted adversarial examples are easily perceived by human eyes. Towards visual imperceptibility, some recent works explore unrestricted attacks without $L_p$-norm constraints, yet lacking transferability of attacking black-box models. In this work, we propose a novel imperceptible and transferable attack by leveraging both the generative and discriminative power of diffusion models. Specifically, instead of direct manipulation in pixel space, we craft perturbations in the latent space of diffusion models. Combined with well-designed content-preserving structures, we can generate human-insensitive perturbations embedded with semantic clues. For better transferability, we further "deceive" the diffusion model which can be viewed as an implicit recognition surrogate, by distracting its attention away from the target regions. To our knowledge, our proposed method, DiffAttack, is the first that introduces diffusion models into the adversarial attack field. Extensive experiments on various model structures, datasets, and defense methods have demonstrated the superiority of our attack over the existing attack methods.

1 Introduction

Existing adversarial attacks face a trade-off between imperceptibility and transferability: pixel-space Lp attacks remain visible, while unrestricted attacks improve visual naturalness but generally transfer poorly. DiffAttack addresses this gap by optimizing diffusion-model latents with attention-based content preservation and diffusion-model deception.

  • Limitations of Existing Attacks: Pixel-space Lp attacks constrain RGB perturbations but can remain visibly similar to high-frequency noise.The paper also notes that Lp-norm is not an ideal perceptual-distance measure.
  • Limitations of Existing Attacks: Unrestricted attacks improve imperceptibility without Lp constraints, but existing methods generally struggle to transfer across black-box models.Their perturbations can focus on relatively large-scale image regions while remaining visually imperceptible.
  • DiffAttack: DiffAttack optimizes perturbations in diffusion-model latent space rather than directly manipulating image pixels.The approach is framed as an unrestricted attack that leverages pretrained diffusion models.
  • DiffAttack: DiffAttack uses cross-attention to distract the diffusion model and self-attention to preserve image structure during attack generation.The method treats diffusion models as having both generative and implicit discriminative capabilities.
  • Reported Evaluation: Experiments across model architectures, datasets, and defense methods report superior imperceptibility and transferability over existing attack methods.The contribution statement presents both properties as central goals of DiffAttack.

2 Related Works

Related work spans white-box and black-box attacks, transferability techniques, unrestricted imperceptible attacks, and diffusion models. DiffAttack builds on these directions while targeting the transferability gap of prior unrestricted attacks.

  • Adversarial Attacks: White-box attacks access target-model architecture and parameters, whereas black-box attacks operate without that information.Transfer-based black-box attacks construct examples on a surrogate model and apply them to the target.
  • Transferable Attacks: Transferable attacks use model ensembles, optimization strategies, and data augmentation to reduce surrogate-model overfitting.These methods seek adversarial examples that generalize across model architectures.
  • Unrestricted Attacks: Unrestricted attacks abandon RGB-space Lp constraints and manipulate attributes, perceptual color losses, or color distributions to improve imperceptibility.Despite their visual quality, prior unrestricted methods generally cannot match pixel-based attacks in transferability.
  • Diffusion Models: Diffusion models transform images through a noise-forward process and a learned reverse denoising process, optionally guided by text prompts.Their generation and editing capabilities motivate their use for adversarial-example construction.
  • DiffAttack: DiffAttack applies diffusion-model latent optimization to pursue both imperceptibility and transferability in unrestricted attacks.The framework is introduced as the first diffusion-based exploration of unrestricted adversarial attacks in the paper.

3 Method

DiffAttack converts a clean image into diffusion latent space, optimizes the latent against a surrogate classifier, and uses diffusion attention to preserve semantics while improving transferability. Its design balances attack freedom against reconstruction quality and content retention.

  • 3.1 Problem Formulation: Black-box attacks optimize examples on a surrogate classifier because the target classifier is inaccessible.The attack seeks to change the classifier’s decision from the correct label to an incorrect one.
  • 3.1 Problem Formulation: Unlike pixel-based attacks constrained by ∥ϵ∥p < c, DiffAttack imposes perturbations in diffusion-model latent space.The design relies on diffusion properties to produce visually natural and successful attacks.
  • 3.2 Basic Framework: DDIM Inversion maps the clean image into diffusion latent space, where the latent is modified before deterministic denoising reconstructs the adversarial image.Applying inversion for selected timesteps allows reconstruction from the inverted latent.
  • 3.2 Basic Framework: Latent perturbations are optimized with classifier loss, while diffusion denoising suppresses perceptible high-frequency noise and produces semantically rich differences.The paper links these semantic perturbations to both imperceptibility and transferability.
  • 3.3 “Deceive” Diffusion Model: Cross-attention between captions and pixels is minimized to distract diffusion-model recognition and improve attack transferability.The caption can use the ground-truth category name or the surrogate model’s predicted category.
  • 3.4 Preserve Content Structure: Self-attention constraints preserve image structure because self-attention captures structural information while largely ignoring appearance.The fixed inverted latent reconstructs the clean image and supplies the structural reference.
  • 3.4 Preserve Content Structure: Inversion strength trades off imperceptibility against attack success by controlling latent distance from Gaussian noise and the number of affected denoising steps.The method controls inversion near the later denoising stages to retain high-level semantics while increasing editing space.
  • 3.5 Objective: Unconditional embedding optimization is additionally used to obtain a good initial reconstruction, and the final objective weights the component losses with α, β, and γ.The paper refers to prior work for details of unconditional optimization.

4 Experiments

Experiments evaluate DiffAttack across datasets, model architectures, attack baselines, defenses, and ablations using transferability and imperceptibility metrics. The results show strong transferability, visual imperceptibility, defense robustness, and contributions from the proposed design choices.

  • Experimental Setup: Evaluation uses 1,000 resized 224×224×3 ImageNet-Compatible images and spans CNN, Transformer, and MLP architectures.The experiments also report results on CUB-200-2011 and Stanford Cars in the appendix.
  • Normally Trained Models: DiffAttack achieves the best transferability across varied model structures, outperforming the second-best method by nearly 10 points on VGG-19 and Mob-v2.The reported comparisons are 38.2% vs. 49.0% and 40.5% vs. 49.9%.
  • Normally Trained Models: DiffAttack produces more imperceptible and natural-looking examples than the compared pixel-based attacks and NCF, while PerC-AL has the best FID but worst transferability.FID measures human imperceptibility, and the visual comparison highlights reduced high-frequency noise and more natural color space.
  • Additional Comparisons: DiffAttack consistently outperforms GAN-based attacks, with additional comparisons against stronger ensemble attacks reported in the appendices.These comparisons supplement the main evaluations of iterative and unrestricted attacks.
  • Defense Approaches: DiffAttack remains robust under defenses and shows the least change in attack success against adversarial purification defenses.The defense evaluation includes input preprocessing, adversarially trained models, NRP, and DiffPure.
  • Ablation Studies: Adding the Eq. 4 loss improves attack success, while inversion-strength and self-attention controls improve FID, structure retention, and texture.The ablations also identify prompt guidance as important for transferability.

5 Discussions and Outlooks

The discussion identifies unresolved limitations in diffusion-based attacks and outlines future directions involving diffusion-based augmentation and adversarial training.

  • 5 Discussions and Outlooks: Exploratory strategies for improving imperceptibility and transferability achieved limited success.The authors discuss these trials as potential directions for future research.
  • Future directions: Diffusion models could serve as input augmentations by mapping images into latent space, applying noise or DDIM Inversion, and denoising them.This extends prior transferability approaches based on differentiable input augmentations.
  • Future directions: Semantic clues embedded in DiffAttack examples motivate studying their use in training datasets and adversarial training.The authors propose evaluating effects on clean-image accuracy and classifier robustness.
  • Limitations: Diffusion-based attacks have high computational cost, limited white-box success, and low targeted transferability.These constraints are reported across iterative diffusion computation, white-box evaluation, and transferable targeted attacks.

6 Conclusion

The paper concludes that diffusion models support imperceptible and transferable unrestricted adversarial attacks, while highlighting reproducibility and the underlying diffusion sampling framework.

  • 6 Conclusion: DiffAttack leverages diffusion models to create adversarial examples with both imperceptibility and transferability.The conclusion reports superiority across black-box models, defenses, and datasets.
  • Ethics Statement: The authors warn that natural-looking DiffAttack images can induce wrong decisions across black-box models and defenses.This raises AI-safety concerns about malicious use in real-world applications.
  • Reproducibility Statement: The method is described in detail through architectures, algorithms, implementation specifics, source code, and documentation.These materials are distributed across the main text and appendices.
  • Diffusion Models: DDPMs generate images by gradually denoising Gaussian noise through forward and reverse processes.DDIM accelerates this framework and becomes deterministic when σ_t = 0.
  • Diffusion Models: DDIM Inversion maps real images back to latent space, enabling later image editing and latent perturbation.DiffAttack perturbs x_t rather than guided text because text perturbations transfer poorly to black-box models.

C.2 Experiments and Analysis

The experiments examine latent versus text perturbations, masking strategies, and category prompts, revealing trade-offs between realism, imperceptibility, and transferability.

  • C.2 Experiments and Analysis: Latent perturbation transfers better to black-box models than text perturbation, despite text perturbation’s slightly stronger white-box result.Text perturbation produces more realistic images but offers limited local control.
  • D Trial for Better Imperceptibility: Pseudo masks improve human imperceptibility by restricting perturbations to foreground objects, but substantially reduce transferability.The authors attribute the drop to useful recognition information in the background.
  • D.2 Experiments and Analysis: Masking lowers FID and attack success, while hard masks introduce blocky artifacts compared with soft masks.Masks can better preserve words on hot-air-balloon surfaces.
  • E Trial on Further Improving Transferability: Using five top-confidence category names as prompts fails to improve transferability and can hurt performance.The approach reduces attention to the first category while increasing attention to the others.
  • E Trial on Further Improving Transferability: The extended objective directs classification toward the most error-prone categories and modifies cross-attention intensities.It adds an averaged cross-attention loss weighted by 100.

F More Implementation Details

Implementation details describe comparison settings for baseline attacks and show that DiffAttack’s relative advantage depends on controlling distortion for fair comparison.

  • F More Implementation Details: Comparisons include transfer-based black-box attacks, unrestricted attacks, and additional surrogate models.Reported metrics include top-1 accuracy and LPIPS across surrogate and target models.
  • F More Implementation Details: I-FGSM-based baselines use 10 steps, maximum perturbation 16, and step size 1.6 under L∞ constraints.Additional settings specify method-specific decay, transformation, kernel, and amplification factors.
  • F More Implementation Details: DiffAttack does not surpass combined multi-attack methods, which improve transferability at the cost of increased distortion.After removing structural controls to align FID values, DiffAttack again shows superior performance.

H Performance on Additional Surrogate Models and LPIPS Metric

DiffAttack generalizes across Transformer and MLP surrogate models and achieves strong imperceptibility under LPIPS evaluation.

  • DiffAttack generalizes well across Transformer and MLP surrogate models, including ViT-B, DeiT-B, and Mix-B.The supplementary evaluation compares these surrogates with recent attack methods.
  • DiffAttack also performs strongly on LPIPS, complementing its FID-based imperceptibility assessment.LPIPS provides an additional full-reference image-quality measure.

I Performance on More Datasets

Additional evaluations on CUB-200-2011 and Stanford Cars support DiffAttack’s generalization across diverse datasets.

  • The evaluation adds CUB-200-2011 and Stanford Cars, sampling 1,000 images from each dataset.Normally trained evaluations use ResNet50, SENet154, and SE-ResNet101 models.
  • DiffAttack shows strong generalization across the additional datasets.PerC-AL is excluded because of its notably low transferability in the main comparison.

J Comparisons with GAN-Based Attack Methods

Against GAN-based and ensemble attacks, DiffAttack combines stronger transferability and imperceptibility, while explicit multi-structure ensembles retain an advantage in some settings.

  • GAN-based attack comparisons: DiffAttack surpasses GAN-based attacks by a large margin on transferability while maintaining better FID and LPIPS imperceptibility.The comparison uses transferability measured by AVG w/o self and imperceptibility measured by FID and LPIPS.
  • Implicit ensemble characteristic: DiffAttack’s implicit ensemble mechanism perturbs intermediate diffusion cross-attention maps without requiring an additional classifier or memory overhead.Unlike explicit ensembles, it targets intermediate attention representations rather than final similarity outputs.
  • Explicit CLIP ensemble comparisons: Original DiffAttack consistently outperforms methods using an additional zero-shot CLIP classifier in transferability and imperceptibility.Replacing the transfer loss with an explicit CLIP surrogate improves transferability but reduces imperceptibility.
  • Limitations and targeted evaluation: A single-structure DiffAttack falls short of explicit ensembles targeting two model structures, although it retains superior imperceptibility.Explicitly attacking more structures improves transferability across those surrogate structures.
  • DiffAttack for ensemble attacks: DiffAttack-based explicit ensembles achieve better or competitive transferability and imperceptibility after removing the transfer loss for fairness.Diffusion models therefore also provide a platform for constructing explicit ensemble attacks.
  • Limitations and targeted evaluation: Targeted attacks remain difficult to transfer to black models, and DiffAttack has lower targeted success than pixel-based attacks.Increasing the learning rate improves white-box success and transferability but reduces fidelity.

M Discussions about Limitation of Time and Memory Cost

DiffAttack incurs higher computational costs because diffusion models are iterative and parameter-heavy, limiting use in resource-constrained or real-time settings.

  • DiffAttack requires more time and memory than other attack methods because diffusion models are iterative and contain many parameters.The comparison measures adversarial-example generation time and maximum GPU memory.
  • On a single RTX 3090 processing 224×224 images, DiffAttack generally takes longer and consumes more memory.These costs could hinder deployment in autonomous driving, edge models, and real-time systems.
  • This computational drawback is common to diffusion-based approaches, while ongoing efficiency and memory optimization may narrow the gap.The passage cites PyTorch, Hugging Face Diffusers, and recent diffusion-acceleration work as relevant efforts.

N Further Ablation Study: Assessing the Impact of the Diffusion Model Itself on Transferability and Imperceptibility

The ablation study attributes DiffAttack’s transferability and imperceptibility gains to the diffusion model itself, including latent-space perturbation and denoising. Parameter studies further identify trade-offs among attack success, image quality, transferability, and optimization cost.

  • Diffusion Model Ablation: Removing the diffusion model produced a pixel-based attack similar to I-FGSM for comparison with DiffAttack.The ablation aligned iteration counts and constrained perturbations to reduce unnatural high-frequency noise.
  • Diffusion Model Ablation: The diffusion model improved transferability on both traditionally trained and defensive models while producing lower FID scores.These results support contributions from latent-space perturbation and defensive denoising.
  • Parameter Studies: Increasing guidance scale improved transferability but reduced imperceptibility, leading to a final setting of 2.5.The authors selected 2.5 because attack success differed substantially from 1.0 while FID changed only slightly.
  • Parameter Studies: Increasing iterations traded image quality for attack success and optimization time, so the authors selected 30 iterations.The chosen setting balances time consumption, image quality, and attack robustness.
  • Parameter Studies: DDIM sample-step choices substantially affected transferability and imperceptibility, while 10 steps produced poor quality and changed image structure completely.The authors selected 20 sample steps for perceptual quality.
  • Visual Comparisons: Additional visual comparisons show that DiffAttack’s adversarial examples are human-imperceptible and difficult to perceive.Figures 8 and 9 provide supplementary visualizations of attacks.
Loading 2305.08192v2…