Source-linked AI summary
Content-based Unrestricted Adversarial Attack
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, Wenqiang Zhang
TL;DR
Existing unrestricted attacks often limit content changes to preserve photorealism, constraining flexibility and potential transferability. The paper maps images to a low-dimensional manifold and optimizes their latent representations to create unrestricted adversarial examples. ACA reports 13.3∼50.4% improvement over state-of-the-art attacks in adversarial transferability.
Problem
Existing unrestricted attacks subjectively select or constrain image content to preserve photorealism, limiting the flexibility and potential transferability of their modifications.
Source: §1 · pp. 1–2Method
The framework maps images onto a low-dimensional natural-image manifold and optimizes latent representations along the adversarial direction using diffusion-based ACA.
Source: §1 · p. 2Results
13.3∼50.4% improvement over state-of-the-art attacks in adversarial transferability is reported.
Source: §1 · p. 2Takeaways & Limitations
The authors report that existing defense methods are not very effective against unrestricted content-based attacks.
Source: §5 · p. 10Diffusion sampling makes inference relatively slow, at about 2.5 minutes on a single A100 GPU, and current adaptive generation does not allow fine-grained image editing.
Source: §5 · p. 10
Abstract
from arXiv · showhide
Unrestricted adversarial attacks typically manipulate the semantic content of an image (e.g., color or texture) to create adversarial examples that are both effective and photorealistic, demonstrating their ability to deceive human perception and deep neural networks with stealth and success. However, current works usually sacrifice unrestricted degrees and subjectively select some image content to guarantee the photorealism of unrestricted adversarial examples, which limits its attack performance. To ensure the photorealism of adversarial examples and boost attack performance, we propose a novel unrestricted attack framework called Content-based Unrestricted Adversarial Attack. By leveraging a low-dimensional manifold that represents natural images, we map the images onto the manifold and optimize them along its adversarial direction. Therefore, within this framework, we implement Adversarial Content Attack based on Stable Diffusion and can generate high transferable unrestricted adversarial examples with various adversarial contents. Extensive experimentation and visualization demonstrate the efficacy of ACA, particularly in surpassing state-of-the-art attacks by an average of 13.3-50.4% and 16.8-48.0% in normally trained models and defense methods, respectively.
1 Introduction
Existing unrestricted attacks trade flexibility and transferability against photorealism, despite the need for natural, diverse adversarial content. The paper proposes a manifold-based framework and reports improved transferability for its attack.
1 Introduction
- Existing unrestricted attacks often constrain content changes to preserve photorealism, limiting flexibility and potential transferability.Shape-, texture-, and color-based approaches manipulate different image attributes, while color-based methods may rely on subjective choices or minor modifications.Source: §1 · p. 2
- An ideal unrestricted attack should preserve photorealism and semantic consistency while allowing diverse content changes and high transferability.Source: §1 · p. 2
- The proposed framework maps images onto a low-dimensional natural-image manifold and optimizes along its adversarial direction to generate diverse content.The generative model is trained on millions of natural images and is described as having capacity for photorealism and alignment between image content and latent space.Source: §1 · p. 2
- ACA uses Image Latent Mapping and Adversarial Latent Optimization in a diffusion model to generate high-transferability unrestricted examples.The framework is presented as producing examples with more diverse and natural content.Source: §1 · p. 2
- 13.3∼50.4% improvement over state-of-the-art attacks in adversarial transferability is reported.The result is validated through experimentation and visualization.Source: §1 · p. 2
2 Background and Preliminary
Unrestricted attacks seek imperceptible image changes that mislead classifiers, and this paper frames evaluation in a black-box setting. It motivates adaptive content modification on a low-dimensional manifold and selects Stable Diffusion as that manifold.
2 Background and Preliminary
- Unrestricted attacks seek imperceptible image distortions or texture and color changes that mislead a classifier.The stated evaluation setting is black-box: attackers use a substitute model without access to the target model's architecture, weights, or gradients.Source: §2 · p. 2
- Prior content-based attacks subjectively select image regions or rely on a selected dataset, constraining flexibility and adaptive semantic-consistent modification.The section raises adaptive content modification as a question for unrestricted attacks.Source: §2 · p. 3
- The illustrated manifold walk combines multiple adversarial contents, including shape, texture, and color.Source: Figure 1 · p. 3
- Stable Diffusion is selected as the low-dimensional manifold to balance computational cost with high-fidelity image generation.The passage describes it as generating realistic natural images conforming to prompt semantics.Source: §2 · p. 3
3 Adversarial Content Attack
Adversarial Content Attack (ACA) maps images onto a diffusion-model low-dimensional manifold, then optimizes their latent representations along an adversarial direction to generate natural, highly transferable examples.
3 Adversarial Content Attack
- ACA maps images onto a diffusion-model low-dimensional manifold, then applies Adversarial Latent Optimization (ALO) along the adversarial direction to generate natural, highly transferable examples.The pipeline first maps images into latent space and then optimizes them to fool the target classifier.Source: §3 · p. 3, Figure 2 · p. 4
3.1 Image Latent Mapping
- Image Latent Mapping (ILM) uses inverse DDIM sampling with a prompt embedding to map an image into the latent space, assuming the ODE can be reversed in the small-step limit.The resulting latent comprises noise, a null text embedding, and a text embedding; image prompts can be generated automatically with image-captioning models such as BLIP v2.Source: §3.1 · p. 4
- Classifier-free guidance during DDIM inversion amplifies per-step noise-prediction errors, disrupting the noise distribution and producing visual artifacts; optimizing a null text embedding is used to mitigate cumulative errors.Stable Diffusion's default guidance scale is 7.5.Source: §3.1 · p. 4
3.2 Adversarial Latent Optimization
- ALO optimizes the latent noise rather than the null or text embeddings, which preserve reconstruction quality and image semantics, respectively.The paper says the latent noise largely represents the image information, while optimizing it remains challenging because of gradient computation and value-range overflow.Source: §3.2 · p. 5
- ALO estimates a latent perturbation with gradient-based updates, assuming a sufficiently small perturbation preserves consistency, and uses momentum with projection onto a κ-ball.The perturbation is applied to the latent noise, and ACA iteratively optimizes the adversarial latent.Source: §3.2 · pp. 5–6
- Skip gradients approximate denoising-process gradients while reducing computation and memory use, avoiding the memory overflow caused by accumulating T backpropagation graphs.The classifier gradient with respect to the reconstructed image provides the adversarial direction, but the full denoising gradient cannot be directly calculated.Source: §3.2 · p. 5
- Differentiable boundary processing constrains generated values to [0, 1], while the objective maximizes cross-entropy loss and minimizes the adversarial image's l2 distance from the clean image.The loss combines cross-entropy with a mean-square-error term weighted by β = 0.1.Source: §3.2 · pp. 5–6
4 Experiments
Experiments assess ACA’s transferability on normally trained models and defenses, image quality, visual examples, and generation time. ACA reports strong transfer results but incurs notable time costs.
4.1 Experimental Setup
- On the 1,000-image ImageNet-compatible dataset, experiments compare ACA with eight attacks using ASR across CNN and ViT models.Attacks are evaluated with default settings; experiments use Stable Diffusion v1.4 and automatically generated BLIP v2 prompts.Source: §4.1 · pp. 6–7
4.2 Attacks on Normally Trained Models
- ACA outperforms state-of-the-art methods by 13.3%∼50.4% on average on normally trained models.With RN-50 as surrogate, it surpasses NCF by 10.0%, 16.1%, 32.1%, and 32.5% on MobViT-s, ViT-B, Swin-B, and PVT-v2, respectively.Source: Table 1 · p. 7, §4.2 · p. 8
4.3 Attacks on Adversarial Defense Methods
- Against defense methods, ACA exceeds NCF, SAE, and ColorFool by 27.13%, 27.63%, and 37.27% on average ASR, respectively.For input-preprocessing defenses, ViT-B is the surrogate and Inc-v3ens3 the target; lp-trained and shape-texture-debiased models also remain vulnerable to unrestricted examples.Source: Table 2 · p. 8, §4.3 · p. 8
4.4 Visualization
- ACA is judged most natural in Figure 3 and achieves the best image-quality assessment results while combining shape, texture, and color changes.In some cases, the semantic subject changes, which the authors suggest may reflect BLIP v2 prompts that inadequately describe image content.Source: §4.4 · pp. 8–9, Figure 3 · p. 9, Table 3 · p. 9
4.5 Time Analysis
- ACA has significant per-image time cost, with ILM and ALO each accounting for 50%, largely in diffusion-model sampling.The authors estimate that applying diffusion acceleration could theoretically bring attack speed close to 6 seconds.Source: §4.5 · pp. 9–10, Table 4 · p. 10
5 Conclusions
The paper introduces a manifold-based unrestricted attack that generates diverse, photorealistic adversarial examples, and reports that existing defenses are not very effective against these attacks.
5 Conclusions
- The framework maps images onto a natural-image manifold and moves them along an adversarial gradient to generate diverse, photorealistic examples.The authors implement Adversarial Content Attack based on a diffusion model.Source: §5 · p. 10
- Existing defense methods are not very effective against unrestricted content-based attacks.Source: §5 · p. 10
- The method takes about 2.5 minutes per image on a single A100 GPU and does not support fine-grained image editing.Source: §5 · p. 10
- The authors warn that the method’s photorealism and strong black-box transferability may enable malicious attacks on security-sensitive applications.Source: §5 · p. 10