SlowGuess/NeurIPS_2023_OCR huggingface dataset:
**Physical World Attacks** The background images in the physical world attacks are collected by taking photos of the target object with different camera poses. For the physical adaptor, we set the scale factor to be around [0.8, 1.2] of the original patch size; then we set the random brightness to be [0.5, 1.5] of the original brightness. We also set a margin for the random positions of the image patch so that the patch will not be too far away from the target object. We use an iPhone 8-Plus to take images from the real world and use an HP DeskJet-2752 for color printing. For Diff-PGD we use DDIM10 and  $K_{s} = 2$  to allow larger purification.
Transferability and Anti-Purification Power We show results of two additional good properties of  $x^n$  and  $x_0^n$  generated by Diff-PGD: transferability and anti-purification power. For transferability, we use  $\epsilon = 16 / 255$ ,  $\eta = 2 / 255$ ,  $n = 10$  in the main paper, with DDIM50 with  $K_s = 2$  for Diff-PGD. Targeting our network on ResNet-50, we test the adv-samples among ResNet-101, ResNet18, and WRN-50 and WRN-101.
For the test of anti-purification power, we use an SDEdit with DDIM50 with a larger  $K_{s} = 5$  and test for both PGD and Diff-PGD with  $\epsilon = 16 / 255$ ,  $\eta = 2 / 255$ ,  $n = 10$  and DDIM50 with  $K_{s} = 2$  for Diff-PGD so that our method is not biased.
E Results on Vision Transformers
Compared with the Convolutional-based network such as ResNet we used before, Vision Transformers are another branch of strong classifiers that are worth taking into consideration. Here we try a global attack on two famous models on ImageNet, ViT-b (https://huggingface.co/google/vit-base-patch16-224) and BEiT (https://huggingface.co/microsoft/beit-large-patch16-224-pt22k-ft22k).
Figure 9 demonstrates that Diff-PGD can still work well to generate adversarial samples with higher stealthiness. Table 5 shows that Diff-PGD is still effective for vision transformers.
F Results on  $\ell_2$ -based Attacks
We also conduct experiments for  $\ell_2$ -based attacks, we set  $n = 10$  and  $\epsilon (\ell_2) = 16 / 255$ , and we can still get a high success rate as  $100\%$  and the generated adversarial samples are shown in Figure 8, which turns out to be also realistic.
Figure 7: Purification on Adv-samples Generated by PGD vs Diff-PGD: PGD attack can be easily purified using recently proposed purification strategies using diffusion model, while Diff-PGD can generate adv-samples in the realistic domain, making it harder to be purified. The changes in PGD contain a lot of noise while the changes of Diff-PGD contain more meaningful features, which means that the adversarial noise can be easily removed for traditional PGD. Also, we show the  $\ell_2$  norm of the changes, from which we can see that changes of Diff-PGD are always smaller.
Model	n	ε	SR
ViT-base	10	8/255	100
ViT-base	10	16/255	100
BEiT-large	10	8/255	99.6
BEiT-large	10	16/255	99.6
Table 5: Success rate of Diff-PGD on vision transformers.
Figure 8: Performance of Diff-PGD on  $\ell_{2}$  perturbations : all the figures attack ResNet-50 with  $\epsilon = 16 / 255$  under  $l_{2}$  norm. (Zoom-in for better observation)
Figure 9: Qualitative Results of Diff-PGD on Vision Transformers: the left-half attack ViT-b and the right-half attack BEiT-1. (Zoom-in for better observation)
Figure 10: Qualitative Results of Diff-PGD with Gradient Approximation : here we show six samples, each contains  $x$ ,  $x^n$ ,  $x_0^n$  from left to right. (Zoom-in for better observation)
Figure 11: More Results of Style-based Attacks: we show nine samples from the constructed dataset, each sample contains  $x, M, x_s, x_0^n$  from left to right.
G More Complementary Results
Global Attacks Here we present more results randomly sampled from the ImageNet validation set to show that Diff-PGD can steadily generate adv-samples with high stealthiness. In Figure 12, we show some complementary results of  $\epsilon = 16 / 255$ ,  $\eta = 2 / 255$ ,  $n = 10$  in main part of the paper. Also in Figure 13, we show results when the perturbation bound is larger:  $\epsilon = 32 / 255$ ,  $\eta = 4 / 255$ ,  $n = 10$ , where we use DDIM10 with  $K_{s} = 2$ ; from the figure we can see that Diff-PGD can still generate realistic adv-samples.
Also, we demonstrate that Diff-PGD remains effective in generating adversarial samples with a high success rate even when the attack bound is smaller. Figure 14 illustrates this point, where we set  $\epsilon = 8 / 255$  and evaluate two Diff-PGD strategies: DDIM50 and DDIM100, all with  $T_{s} = 2$ . Both strategies exhibit a notable success rate and can produce realistic adversarial samples.
Regional Attacks Diff-rPGD can be adopted in customized settings where only masked regions can be attacked. Here, we show more results of regional attacks in Figure 20, where  $\epsilon = 16 / 255$ ,  $\eta = 2 / 255$ ,  $n = 10$ . We compare Diff-rPGD with rPGD, and the results show that our Diff-rPGD can deal with the regional adversarial attack better: the masked region can be better merged into the background.
Style-based Attacks In the main paper, we show that Diff-PGD can help generate style-based adv-samples effectively. In Figure 15, we further present that the second stage in our two-stage strategy is necessary and can highly preserve the realism of the output images.
Physical World Attacks We present the result of physical world attacks using adversarial patches generated using Diff-PGD in the main paper. In order to show that the adversarial patches are robust to camera views, we show more images taken from different camera views in Figure 16. For the two cases: computer mouse (untargeted) and back bag (targeted to Yorkshire Terrier), we randomly sample ten other camera views. The results show that the adversarial patches are robust both for targeted settings and untargeted settings. For targeted settings, our adversarial patch can fool the network to predict back bag as terriers, and for untargeted settings, the adversarial patch misleads the network to predict computer mouse as artichoke.
Transferability and Anti-Purification We presented the results when  $\epsilon = 16 / 255$  and found that: though designed for improved stealthiness and controllability, it is surprising that Diff-PGD transfers better than the original PGD to five different networks, here we show more results on different  $\ell_{\infty}$
Figure 12: More Results of Diff-PGD with  $\epsilon = 16 / 255$ : five columns of each image block follows  $x, x_{PGD}, \delta_{PGD}, x_0^n$  and  $\delta_0^n$  as is defined in the main paper. We can see that Diff-PGD can steadily generate adv-samples with higher stealthiness. Zoom in on a computer screen for better visualization.
Figure 13: More Results of Diff-PGD with  $\epsilon = 32 / 255$ : five columns of each image block represent  $x, x_{PGD}, \delta_{PGD}, x_0^n$  and  $\delta_0^n$  respectively. We can see that Diff-PGD can steadily generate adv-samples with higher stealthiness. Zoom in on a computer screen for better visualization.
bound. We take the other two settings:  $\epsilon = 8 / 255$  and  $\epsilon = 32 / 255$  to better investigate our methods, for  $\epsilon = 8 / 255$  we still use  $\eta = 2 / 255$  while for  $\epsilon = 32 / 255$ , we use  $\eta = 4 / 255$  for better attacks, both of them use  $n = 10$ . For Diff-PGD, we use DDIM50 with  $K_{s} = 2$  for  $\epsilon = 8 / 255$  case and DDIM30 with  $K_{s} = 2$  for  $\epsilon = 32 / 255$  case.
Results shown in Figure 17 reveal that both  $x_0^n$  and  $x^n$  exhibit superior transferability compared to the original PGD attack. This observation aligns with our intuition that attacks operating within the realistic domain are more likely to successfully transfer across different networks.
For anti-purification, we show some qualitative results that how the noises can be removed by running SDEdit on PGD and Diff-PGD. In Figure 17, we show visualizations of the adv-samples, purified adv-samples, and the changes during the purification. From the figure, we can find that the adversarial patterns generated by PGD can be easily removed by diffusion-based purification and Diff-PGD.
Figure 14: Effective of Diff-PGD with Smaller Bound: we show that when the attack  $\ell_{\infty}$  bound is smaller:  $\epsilon = 8 / 255$ , Diff-PGD is still effective to generate adv-samples with high success rate. (a) we use DDIM100 and  $K_{s} = 2$ , (b) we use we use DDIM50 and  $K_{s} = 2$ .
Figure 15: Results of Style-based Adv-sample Generation in Two Stages: here we should three cases in style-based adversarial attacks, for each case, we should the difference between  $\hat{x}_s$  (the left image in each case) and  $x_0^n$  (the right image in each case), which demonstrate that by employing Diff-PGD, we are able to generate adversarial samples while simultaneously mitigating the artifacts that arise during the style transfer stage.
H Human Evaluation
To better evaluate the stealthiness of Diff-PGD compared with the original PGD attack, we conduct a survey among humans with the assistance of Google Form. The user interface of the survey is shown in Figure 21, where the participants are allowed to choose multiple candidate images that they think are realistic. We randomly choose ten images from the ImageNet validation set and the choices for each question include one clean image, one adv-sample generated by PGD, and one adv-sample generated by Diff-PGD. For Diff-PGD we use DDIM50 with  $K_{s} = 3$ , and for both Diff-PGD and PGD we use  $\epsilon = 16 / 255$ ,  $\eta = 2 / 255$ ,  $n = 10$ .
We collect surveys from 87 participants up to the completion of the writing and most of them are not familiar with adversarial attacks. Figure 18 illustrates the results, indicating that Diff-PGD approach achieves higher stealthiness among human participants compared with PGD.
I Potential Social Impacts
Adversarial attacks pose a serious threat to the security of AI systems. Diff-PGD introduces a novel attack technique that effectively preserves the realism of adversarial samples through the utilization of the diffusion model. This holds true for both digital and real-world settings. The emergence of
Figure 16: Physical World Attack with Diff-PGD: to show the effectiveness of adversarial patches generated by Diff-PGD, we show the images captured from different camera viewpoints for the two cases: computer mouse (untargeted) and back bag (targeted). For each case, we randomly sample other ten poses. We present the prediction of the target network under each image, where Yorkshire is short for Yorkshire terrier.
Figure 17: More Results on Transferability Test: in the main paper we show results of transferability of  $\epsilon = 16 / 255$  settings; here we test transferability of Diff-PGD under different  $\ell_{\infty}$  bounds, (Left):  $\epsilon = 32 / 255, \eta = 4 / 255, n = 10$ , for Diff-PGD we use DDIM50 with  $K_{s} = 2$ , (Right):  $\epsilon = 8 / 255, \eta = 2 / 255, n = 10$  and for Diff-PGD we use DDIM30 with  $K_{s} = 2$ . From the plots we can see that Diff-PGD has better transferability power than PGD.
Figure 18: Human Evaluation: Collecting 87 samples using Google Form, we calculate the average choose rate of each kind of sample (real images, PGD-attacked images, and Diff-PGD-attacked images). The results show that Diff-PGD method exhibits greater stealthiness than PGD when evaluated by human participants.
such realistic domain attacks demands our attention and necessitates the development of new defense methods.
Figure 19: More Results of Diff-PGD with  $\epsilon = 16 / 255$ : five columns of each image block follows  $x, x_{PGD}, \delta_{PGD}, x_0^n$  and  $\delta_0^n$  as is defined in the main paper.
Figure 20: More Regional Attack Results: we present more results for regional attacks, the three columns are clean image,  $x_{\mathrm{rPGD}}$  and  $x_0^n$  respectively.
Diff-Adv Test
Note: (multiple choices) Choose the images that you think are realistic, some of them are attacked by adding malicious noise  $\mathbb{O}$
备注：(多选)选出你认为真实的图片，有些图片被加入了具有攻击性的噪声！
Questionnaire àCHOix multiples: Choisissez les images qui voussemblentrealistes, certaines d'entre elles ont ete modifiees par I'ajout de bruit malveillant
Choose the one(s) that you think is(are) realistic (multiple choices):
Figure 21: The Interface of our Survey for Human-Evaluations: one sample of our questions is presented, and we randomized the order of the three images for all questions. The options consisted of a clean image, a PGD-attacked image, and a Diff-PGD-attacked image, with the participants unaware of the composition of the choices.