NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion

## Abstract

Abstract Adversarial samples exploit irregularities in the manifold “learned” by deep learning models to cause misclassifications. The study of these adversarial samples provides insight into the features a model uses to classify inputs, which can be leveraged to improve robustness against future attacks. However, much of the existing literature focuses on constrained adversarial samples, which do not accurately reflect test-time errors encountered in real-world settings. To address this, we propose ‘NatADiff’, an adversarial sampling scheme that leverages denoising diffusion to generate natural adversarial samples. Our approach is based on the observation that natural adversarial samples frequently contain structural elements from the adversarial class. Deep learning models can exploit these structural elements to shortcut the classification process, rather than learning to genuinely distinguish between classes. To leverage this behavior, we guide the diffusion trajectory towards the intersection of the true and adversarial classes, combining time-travel sampling with augmented classifier guidance to enhance attack transferability while preserving image fidelity. Our method achieves comparable attack success rates to current state-of-the-art techniques, while exhibiting significantly higher transferability across model architectures and better alignment with natural test-time errors as measured by FID. These results demonstrate that NatADiff produces adversarial samples that not only transfer more effectively across models, but more faithfully resemble naturally occurring test-time errors.

## 1 Introduction

Deep learning models can react unpredictably when there is domain difference between training and test data [1, 2]. Constrained adversarial attacks exploit this vulnerability, adding visually imperceptible pixel-level perturbations to deliberately fool models into misclassification [1, 2, 3, 4]. More recently, unconstrained adversarial attacks have been proposed which allow for unrestricted perturbation magnitudes, provided the resulting adversarial image lies sufficiently close to the natural image manifold [5, 6, 7].

Defences to these attacks have been proposed [1, 3, 8, 9, 10, 11]; however, they largely target attacks formed by adding perturbations to natural images–overlooking the existence of natural adversarial samples. These natural adversaries can be viewed as test-time errors and represent the strongest class of inference-time adversary, as they are valid (perturbation-free and naturally occurring) model inputs that are erroneously classified [12]. The absence of an adversarial perturbation renders many defensive measures ineffective [13]. Furthermore, it has been hypothesized that these samples arise because deep learning models often rely on erroneous contextual cues to shortcut classification, rather than learning to robustly distinguish between classes [12, 14, 15].

Generating natural adversarial samples offers an opportunity to better understand the mechanisms underpinning test-time errors. Prior work has sought to achieve this by using classifier gradients to perturb the sampling process of generative adversarial networks (GANs) and denoising diffusion models [5, 16]. However, GAN-based approaches lack theoretical justification for perturbing the sample path, and doing so often degrades image quality [17, 18, 19, 20]. Alternatively, directly injecting a classifier gradient into the diffusion sampling trajectory can result in generating constrained adversarial samples [21, 22] (see Figure [1](https://arxiv.org/html/2505.20934v1#S2.F1) (c)). Moreover, these methods do not account for the link between the use of erroneous contextual cues and test-time errors.

We propose NatADiff, a highly transferable, diffusion-based [23, 24] adversarial sample generation method. NatADiff leverages the link between contextual cues and test-time errors by guiding the diffusion sampling trajectory towards the intersection of the adversarial and true classes, a technique we define as “adversarial boundary guidance”. Additionally, we incorporate classifier augmentations to improve the quality of off-the-shelf classifier-guided diffusion [22], and use time-travel sampling to enhance overall sample quality [25]. We find that NatADiff-generated samples achieve comparable attack success rates to current state-of-the-art adversarial attacks, while exhibiting significantly higher transferability across models. Furthermore, samples generated using NatADiff align closely with known test-time errors with respect to their Fréchet inception distance (FID) [26]. These results demonstrate that NatADiff produces adversarial samples that not only transfer more effectively across models, but also more faithfully resemble naturally occurring test-time errors. To summarize our contributions:
(i) We propose NatADiff, incorporating classifier transformations, gradient normalization, and time-travel sampling [22, 25, 27] to improve adversarial classifier guidance and image fidelity;
(ii) We design an adversarial boundary guidance algorithm to reliably navigate the complex, learned manifold, allowing us to generate natural adversarial samples, with significantly high transferability.
(iii) We explore how convolution and transformer based classifiers perceive natural adversarial samples, exposing interesting properties of the feature representations learned by deep learning models.

## 2 Related work

Natural adversarial samples are a well-documented phenomenon in deep learning. Literature suggests that they arise because deep learning models often rely on contextual cues to shortcut classification as opposed to truly learning to distinguish between classes [12, 14, 15] (see Figure [4](https://arxiv.org/html/2505.20934v1#A4.F4) in Appendix [D](https://arxiv.org/html/2505.20934v1#A4)). These cues typically take the form of structural elements commonly associated with the target class; for instance, a model that uses oceanic environments as a cue for predicting “shark” may misclassify an image of a shark lying on sand. By exploiting these easy-to-learn cues, models can reduce training loss without correctly learning the underlying class distinctions.

Hendrycks et al. [12] were among the first to frame test-time errors as natural adversarial samples, curating the ImageNet-A dataset. Unlike perturbation-based adversarial samples, natural adversarial samples exist on the natural image manifold and are not created using adversarial perturbations (see Figure [1](https://arxiv.org/html/2505.20934v1#S2.F1) (b)). This renders perturbation-based adversarial defences ineffective [13]. Additionally, it is known that natural adversarial samples are more difficult to detect than perturbation-based ones [13], and they exhibit high transferability i.e., the same image is misclassified by multiple classifiers [12].

Figure: Figure 1: A comparison of different types of adversarial samples. Green and red borders indicate non-adversarial and adversarial samples, respectively. A dotted border denotes images generated using Stable Diffusion 1.5 [28], while a solid border indicates real-world photographs. (a) Constrained adversarial attacks (PGD [3] used here) add perturbations to clean images. (b) Natural adversarial samples are test-time errors that do not contain perturbations. (c) Adversarial classifier guidance [16] produces constrained adversarial samples, as the difference between images generated with and without the guidance is minimal–their difference amounts to a constrained perturbation. (d) Adversarial samples generated with NatADiff diverge from those generated without NatADiff.
Refer to caption: x1.jpg

Generating unconstrained adversarial samples.
Previous work has shown that GANs and diffusion models can generate unconstrained adversarial samples [5, 6, 16, 29, 30]. GANs are a class of latent generative model, $\mathcal{G}(\boldsymbol{z},y):\mathbb{R}^{\eta}\times\mathcal{Y}\rightarrow
\mathbb{R}^{m}$, that maps a point in the latent space, $\boldsymbol{z}\in\mathbb{R}^{\eta}$, to a natural image, $\boldsymbol{x}\in\mathbb{R}^{m}$, subject to some conditioning information, $y\in\mathcal{Y}$ [31, 32]. Song et al. [5] injected the adversarial gradient produced by a victim classifier with adversarial label $\tilde{y}$ into the latent space of a GAN model with generation label $y$. To mitigate violations to the sampling procedure, the adversarial perturbation was constrained to an $\epsilon$-neighborhood around an initial point $\boldsymbol{z}_{0}$ in the latent space. The proposed sampling method successfully generated unconstrained adversarial samples; however, it frequently “fell off” the image manifold, creating samples unidentifiable by a human. This instability stems from GAN’s sensitivity to latent space perturbations, where small variations in the latent space can significantly degrade image quality [17, 18, 19, 20].

Diffusion models possess superior generation quality to GANs [33], and provide theoretical justification for perturbing the sampling path [33, 34, 35]. Dai et al. [16] leveraged these properties to develop AdvDiff, which treats the true image class, $y$, and adversarial target, $\tilde{y}$, as random variables. The joint distribution can be decomposed as $p(\boldsymbol{x}_{t},y,\tilde{y})=p(y|\boldsymbol{x}_{t})p(\tilde{y}|
\boldsymbol{x}_{t})p(\boldsymbol{x}_{t})$, where it is assumed that $y$ and $\tilde{y}$ are conditionally independent given the noisy image, $\boldsymbol{x}_{t}$. Thus, given the forward diffusion in ([2](https://arxiv.org/html/2505.20934v1#S3.E2)), the corresponding diffusion score function (see Section [3.1](https://arxiv.org/html/2505.20934v1#S3.SS1)) becomes

$$ $\nabla_{\boldsymbol{x}_{t}}\log(\bar{p}(\boldsymbol{x}_{t}|y,\tilde{y}))=- \frac{1}{\beta(t)}\bigl{[}\omega\boldsymbol{\epsilon}_{\theta^{\star}}( \boldsymbol{x}_{t},t,y)+(1-\omega)\boldsymbol{\epsilon}_{\theta^{\star}}( \boldsymbol{x}_{t},t)\bigr{]}+s\nabla_{\boldsymbol{x}_{t}}\log(p(\tilde{y}| \boldsymbol{x}_{t})),$ (1) $$

where $\omega$ and $s$ control the strength of the guidance, $\boldsymbol{\epsilon}_{\theta^{\star}}$ is a network trained to remove noise from $\boldsymbol{x}_{t}$, and the adversarial gradient, $\nabla_{\boldsymbol{x}_{t}}\log(p(\tilde{y}|\boldsymbol{x}_{t}))$, is derived from a victim classifier that provides class probabilities. Since AdvDiff directly uses the victim classifier gradient, it can be considered a form of classifier guidance, and is therefore susceptible to the same issues as classifier-guided diffusion.

Classifier-guided diffusion requires training a model, $p_{\theta}(y|\boldsymbol{x}_{t})$, to predict the class of an image that has been corrupted with Gaussian noise [33], which is a form of adversarial training [36, 37]. When a non-adversarially robust classifier is used instead, the diffusion process typically generates visually coherent samples that do not adhere to the desired class conditioning, but are erroneously classified as the desired class [21, 22]. We hypothesize that this phenomenon arises due to constrained adversarial samples frequently lying within an $\epsilon$-neighborhood of natural samples [2, 3]. Under this hypothesis, the diffusion model acts as a constraint that pushes the sample towards the natural image manifold, while the non-adversarially robust classifier introduces a perturbation that directs the sample towards the nearest region containing samples of the desired class. The resulting trade-off between the diffusion model and classifier guidance incentivizes the diffusion trajectory to converge towards the adversarial regions that frequently lie imperceptibly close to the natural image manifold–that is, pockets of constrained adversarial samples [22].

## 3 Methodology

### 3.1 Preliminaries

Denoising diffusion generative models [23] leverage a stochastic differential equation (SDE) to “learn” the space of natural images, allowing for the generation of natural, within-distribution images. The SDE is characterized by the forward process:

$$ $d\boldsymbol{x}_{t}=f(t)\boldsymbol{x}_{t}dt+g(t)\cdot d\boldsymbol{B}_{t} \quad\forall\ t\in[0,T].$ (2) $$

where $\boldsymbol{x}_{t}\in\mathbb{R}^{m}$, $f(t):\mathbb{R}\rightarrow\mathbb{R}$ and $g(t):\mathbb{R}\rightarrow\mathbb{R}$ are continuous functions of $t$, and $\mathop{\cdot}d\boldsymbol{B}_{t}$ denotes an Itô integral with respect to the standard multi-dimensional Brownian motion process $\boldsymbol{B}_{t}\in\mathbb{R}^{m}$ [38, 39]. Functions $f$ and $g$ are chosen such that the forward process progressively “destroys” structure in the image, $\boldsymbol{x}_{0}$, adding noise until it is approximately marginally Gaussian at some termination time, T, i.e., $p(\boldsymbol{x}_{T})\approx\mathcal{N}(0,\sigma^{2}_{T}I)$. To generate a natural image, the forward process can be reversed, and structure recovered from Gaussian noise using either Anderson’s [40] reverse-time diffusion or the flow ODE [41] derived from ([2](https://arxiv.org/html/2505.20934v1#S3.E2)). Both formulations [40, 41] require an estimate of the score function, $\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}))$, which is approximated by a neural network, $\boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t)$. This network is trained to predict the original image from a noisy version using the objective:

$$ $\underset{\theta}{\min}\ {\operatorname*{\mathbb{E}}}_{\boldsymbol{x}_{0}, \boldsymbol{x}_{t},t\sim p(\boldsymbol{x}_{0},\boldsymbol{x}_{t},t)}\left[ \left\lVert\boldsymbol{x}_{0}-(\boldsymbol{x}_{t}-\beta(t)\boldsymbol{\epsilon }_{\theta}(\boldsymbol{x}_{t},t))/\alpha(t)\right\rVert_{2}^{2}\right],$ (3) $$

where $\alpha(t)=e^{\int_{0}^{t}f(u)du}$ and $\beta(t)^{2}=\alpha(t)^{2}\int_{0}^{t}\frac{g(u)^{2}}{\alpha(u)^{2}}du$. Given an optimal solution to the above, the score function is given by (see Theorem [H.3](https://arxiv.org/html/2505.20934v1#A8.Thmtheorem3) in Appendix [H](https://arxiv.org/html/2505.20934v1#A8)):

$$ $\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}))=-\boldsymbol{\epsilon}_ {\theta^{\star}}(\boldsymbol{x}_{t},t)/\beta(t)\quad\forall\ t\in(0,T],\ \boldsymbol{x}_{t}\in\mathbb{R}^{m}.$ (4) $$

Additionally, while $\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)$ can be used to directly estimate $\boldsymbol{x}_{0}$, it is typically of a lower quality than samples generated iteratively from the reverse-time diffusion or flow ODE [23, 41, 42].

Denoising diffusion class guidance provides finer control over the diffusion process by sampling from $\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0}|y)$ instead of $\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0})$, where $y$ represents some conditioning information. To control the strength of class-guided diffusion, the marginal distribution is treated as $\bar{p}(\boldsymbol{x}_{t}|y)\propto p(y|\boldsymbol{x}_{t})^{\omega}p(
\boldsymbol{x}_{t})/p(y)$, where $\omega\in\mathbb{R}_{>0}$ governs how strictly the diffusion adheres to the class constraint. For $\omega>1$, the probability mass of $p(y|\boldsymbol{x}_{t})^{\omega}$ is “tightened” around the regions of most probable $y$, while for $\omega<1$, the probability mass is more diffuse. This results in stronger and weaker class adherence, respectively.

Class conditioning is incorporated directly into the diffusion score function in ([4](https://arxiv.org/html/2505.20934v1#S3.E4)) by replacing $p(\boldsymbol{x}_{t}|y)$ with $\bar{p}(\boldsymbol{x}_{t}|y)$ as follows:

$$ $\displaystyle\nabla_{\boldsymbol{x}_{t}}\log(\bar{p}(\boldsymbol{x}_{t}|y))$ $\displaystyle=\omega\nabla_{\boldsymbol{x}_{t}}\log(p(y|\boldsymbol{x}_{t}))- \frac{1}{\beta(t)}\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)$ (5) $\displaystyle=-\frac{1}{\beta(t)}\bigl{[}\omega\boldsymbol{\epsilon}_{\theta^{ \star}}(\boldsymbol{x}_{t},t,y)+(1-\omega)\boldsymbol{\epsilon}_{\theta^{\star }}(\boldsymbol{x}_{t},t)\bigr{]},$ (6) $$

where $\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)$ and $\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t,y)$ are neural networks trained to estimate the noise added in the forward diffusion process when $\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0})$ and $\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0}|y)$, respectively. The distinction between ([5](https://arxiv.org/html/2505.20934v1#S3.E5)) and ([6](https://arxiv.org/html/2505.20934v1#S3.E6)) illustrates the difference between the two forms of class-guided diffusion: classifier and classifier-free guidance. In classifier guidance, a separate model, $p_{\theta}(y|\boldsymbol{x}_{t})$, is trained to predict the probability of $y$ given $\boldsymbol{x}_{t}$ [33]. In contrast, classifier-free guidance requires training a diffusion model to directly estimate $\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y))$ [34].

It is important to note that $\bar{p}(\boldsymbol{x}_{t}|y)$ does not represent the marginal distribution that arises from applying the diffusion in ([2](https://arxiv.org/html/2505.20934v1#S3.E2)) to $\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0}|y)$ [35]. Instead, it is a mechanism that forces the sampling trajectory of $\boldsymbol{x}_{t}$ into regions with a higher probability of $p(y|\boldsymbol{x}_{t})$, and in doing so, deviates from reverse-time diffusion and flow ODE dynamics. However, despite foregoing theoretical guarantees of sampling convergence, class-guided diffusion often exhibits superior sampling quality [33, 34].

### 3.2 NatADiff

Natural adversarial samples consistently exploit an over-reliance on contextual cues to shortcut classification. We incorporate this key observation into our proposed, diffusion-based natural adversarial sampling scheme–NatADiff (see Algorithm [1](https://arxiv.org/html/2505.20934v1#alg1)). NatADiff leverages adversarial boundary guidance to incorporate structural elements from the adversarial class. In addition, we use augmented classifier guidance and time-travel sampling to enhance attack transferability while preserving image fidelity.

Accounting for sample noise. Classifier-guided diffusion specifically trains a classifier to predict the class label of a noisy sample $\boldsymbol{x}_{t}$. However, in adversarial diffusion guidance, the victim model is typically an “off-the-shelf” classifier that was never trained on noisy samples. Directly passing $\boldsymbol{x}_{t}$ to this classifier will likely degrade classification accuracy, leading to inferior diffusion guidance. To address this, we take the same approach as [22, 27, 43, 44] and instead pass the classifier the current estimate of $\boldsymbol{x}_{0}$ at time $t$:

$$ $\hat{\boldsymbol{x}}_{0}(\boldsymbol{x}_{t})=(\boldsymbol{x}_{t}-\beta(t) \boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t,y))/\alpha(t).$ (7) $$

Reducing adversarial gradient. Perturbation-based adversarial attacks are sensitive to image transformations, with rotations, crops, and translations reducing the success rates of common attack algorithms [45]. This can be leveraged to improve classifier-guided diffusion by applying differentiable image transforms to reduce the effect of the adversarial gradient [22]. These transformations “average out” the adversarial signal, reducing the likelihood of generating constrained adversarial samples and improving image quality [22].

We incorporate image transformations analogous to to those used by Shen et al. [22]. However, we found directly averaging over the log-probabilities [22] introduced numerical instabilities as the diffusion sample path would often intersect low probability regions. To address these instabilities we average over class logits instead. Additionally, we normalize the adversarial gradient, as previous studies have found gradient normalization improves the consistency of classifier guidance [21, 22, 44]. Thus, given a collection of differentiable image transforms: $\boldsymbol{\mathcal{T}}=\{\mathcal{T}_{1},\mathcal{T}_{2},\dots\}$, we compute the adversarial classifier gradient as

$$ $\nabla_{\boldsymbol{x}_{t}}\log(p(\tilde{y}|\boldsymbol{x}_{t}))=\boldsymbol{g }(\boldsymbol{x}_{t})/\lVert\boldsymbol{g}(\boldsymbol{x}_{t})\rVert_{2},$ (8) $$

where $\boldsymbol{g}(\boldsymbol{x}_{t})=\nabla_{\boldsymbol{x}_{t}}\log\left(\sigma
_{\tilde{y}}\left(\frac{1}{\lvert\boldsymbol{\mathcal{T}}\rvert}\sum_{i=1}^{
\lvert\boldsymbol{\mathcal{T}}\rvert}h(\mathcal{T}_{i}(\hat{\boldsymbol{x}}_{0
}(\boldsymbol{x}_{t})))\right)\right)$, $h:\mathbb{R}^{m}\rightarrow\mathbb{R}^{|\mathcal{Y}|}$ is a function that returns the victim classifier’s logit predictions, and $\sigma_{\tilde{y}}:\mathbb{R}^{|\mathcal{Y}|}\rightarrow\mathbb{R}$ is a sigmoid function that returns the probability of the target adversarial class.

Adversarial boundary guidance. Initial experiments showed that substituting the improved adversarial gradient from ([8](https://arxiv.org/html/2505.20934v1#S3.E8)) into ([1](https://arxiv.org/html/2505.20934v1#S2.E1)) did not steer the diffusion trajectory towards natural adversarial samples (see Figure [2](https://arxiv.org/html/2505.20934v1#S3.F2)). This may occur because classifier augmentations eliminate many of the constrained adversarial samples that lie close to the image manifold, but not those further away. Consequently, if the initial sampling point of the diffusion trajectory is too distant from a region of natural adversarial samples, adversarial guidance will push the sample off the image manifold.

Figure: Figure 2: Effect of adversarial classifier guidance, classifier augmentations, adversarial boundary guidance, and time-travel sampling on samples generated by Stable Diffusion 1.5 [28]. Prompt = “tiger”, adversarial target = “toilet paper”, victim classifier = ResNet-50 [46]. Classification scores are given for ResNet-50, Inception [47], ViT [48], and adversarially trained ResNet-50 and Inception models [49]. Note: “T”: “Tiger”, “TP”: “Toilet Paper”, “TC”: “Tiger Cat”.
Refer to caption: extracted/6483093/images/GradDiagram/CleanTiger.jpg

To address this, we leverage the connection between natural adversarial samples and the use of contextual cues as a classification shortcut [12, 14, 15]. We propose adversarial boundary guidance as a method of directing the diffusion trajectory towards samples that incorporate erroneous contextual cues, i.e., structural elements from the adversarial class. We define adversarial boundary guidance as

$$ $\nabla_{\boldsymbol{x}_{t}}\log(\bar{p}(\boldsymbol{x}_{t}|y,\tilde{y}))=- \frac{1}{\beta(t)}\bigl{[}\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x }_{t},t)+(\omega-\mu\omega)\boldsymbol{v}_{y}+\mu\rho\boldsymbol{v}_{y\cap \tilde{y}}\bigr{]}+s\nabla_{\boldsymbol{x}_{t}}\log(p(\tilde{y}|\boldsymbol{x} _{t})),\\$ (9) $$

where $\omega,\rho,s\in\mathbb{R}_{\geq 0}$, $\mu\in[0,1]$, $\boldsymbol{v}_{y}=\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t
,y)-\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)$, and $\boldsymbol{v}_{y\cap\tilde{y}}=\boldsymbol{\epsilon}_{\theta^{\star}}(
\boldsymbol{x}_{t},t,y\cap\tilde{y})-\boldsymbol{\epsilon}_{\theta^{\star}}(
\boldsymbol{x}_{t},t)$. $\omega$ and $\rho$ govern the strength of classifier-free guidance, $s$ controls adversarial classifier guidance strength, and $\mu$ regulates how strongly the sample tends towards the intersection of the true and adversarial classes. For sufficiently large $\mu$, the sampling trajectory should tend towards the class intersection, incorporating enough elements from the adversarial class to cause a misclassification, while remaining visually within the bounds of the true class from a human’s perspective. Note that when $\mu=0$, adversarial boundary guidance is equivalent to adversarial classifier guidance [16].

To justify ([9](https://arxiv.org/html/2505.20934v1#S3.E9)), we note that the classifier-free score function can be rewritten as $\nabla_{\boldsymbol{x}_{t}}\log(\bar{p}(\boldsymbol{x}_{t}|y))=-\frac{1}{\beta
(t)}\left[\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)+\omega
\boldsymbol{v}_{y}\right]$ where $\boldsymbol{v}_{y}=\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t
,y)-\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t)$ is a vector that points towards regions of the manifold containing images of class $y$. Additionally, recall that $\bar{p}(\boldsymbol{x}_{t}|y)$ is not the marginal density arising from a valid diffusion, rather it is a magnification of the guidance provided by a network that has “learned” the image manifold. To further exploit the information contained in this network, we introduce $\boldsymbol{v}_{y\cap\tilde{y}}$, which directs the sampling trajectory towards the class intersection.

Time-travel sampling. Significant disruption to the diffusion sampling path risks degradation in sample quality, or falling off the image manifold [25, 27] (see Figure [2](https://arxiv.org/html/2505.20934v1#S3.F2)). To mitigate these issues, we incorporate time-travel sampling into our diffusion scheme, which has been shown to increase image quality in cases where standard diffusion sampling would otherwise fail [22, 25, 27].

By injecting additional sampling steps, time-travel sampling allows the diffusion model to explore a wider region of the sample space and recover from suboptimal trajectories. This helps maintain sample quality and prevents the generation process from diverging away from the image manifold. More concretely, given a sequence of sampling times $\{t_{i}\}_{i=1}^{N}$ with $t_{i+1}>t_{i}$ for all $i$, time-travel sampling resets the diffusion state at time $t_{i}$ by running the forward process, $\boldsymbol{x}_{t_{i+k}}\sim p(x_{t_{i+k}}|x_{t_{i}})$, and then resampling $\boldsymbol{x}_{t_{i}}$ using either the reverse-time diffusion [40] or flow ODE [41]. This process is repeated $R$ times before $\boldsymbol{x}_{t_{i}}$ is accepted, after which sampling proceeds to $\boldsymbol{x}_{t_{i-1}}$. To improve efficiency, time-travel sampling can be applied to a subset of diffusion steps [27].

Figure: Algorithm 1 NatADiff

Similarity targeting.
Many popular adversarial attacks operate in an untargeted setting [1, 2, 3, 4], where the only requirement is that the predicted class differs from the true class, i.e., $\tilde{y}\neq y$. These attacks often update the adversarial target dynamically during optimization, selecting the most probable incorrect class at each step [1, 2, 3], and they frequently outperform targeted variants [50]. To extend NatADiff to untargeted settings, we propose similarity targeting (see Algorithm [2](https://arxiv.org/html/2505.20934v1#alg2) in Appendix [E](https://arxiv.org/html/2505.20934v1#A5)).

Similarity targeting is based on the assumption that it is easier to incorporate adversarial structures from classes that are semantically similar to the true class. To heuristically measure this similarity, we leverage the CLIP [51] text encoder, which maps class labels into a shared image-text embedding space. We then select the adversarial target as the class most similar to the true class in this embedding space, as measured by cosine similarity. Concretely, given the CLIP text encoder $C_{\text{enc}}:\mathcal{Y}\rightarrow\mathbb{R}^{m}$, the true class label, $y_{i}$, and the set of candidate adversarial labels $\mathcal{Y}_{\text{cand}}=\{y_{1},\dots,y_{n}\}\setminus y_{i}$, we define the adversarial target as

$$ $\tilde{y}=\underset{y\in\mathcal{Y}{\text{cand}}}{\textup{arg}\min}\frac{C_{ \text{enc}}(y_{i})\cdot C_{\text{enc}}(y)}{\lVert C_{\text{enc}}(y_{i})\rVert_ {2}\lVert C_{\text{enc}}(y)\rVert_{2}}.$ (10) $$

## 4 Experiments

### 4.1 Experiment details

We evaluate the effectiveness of NatADiff on ImageNet, a large-scale dataset containing 1,000 object classes [52]. We target a range of off-the-shelf ImageNet classifiers and assess the attack success rates and the visual quality of the generated samples. All experiments are conducted on an NVIDIA RTX 4090 GPU, and each sample takes approximately 90 seconds to generate.

Victim models. We evaluate our method against pretrained ResNet-50 [46], Inception [47], and Vision Transformer (ViT) [48] victim models using targeted and untargeted attacks. For targeted attacks, we assign a random adversarial target to each sample. For untargeted attacks, we use similarity targeting from Section [3.2](https://arxiv.org/html/2505.20934v1#S3.SS2). For each attack we generate 2,000 samples, ensuring that every ImageNet class appears as a true label. To evaluate transferability, we examine how these attacks transfer across the victim classifiers and adversarially trained ResNet-50 and Inception models [49]. Finally, we compare our method to adversarial classifier guidance under the same parameters as [16].

Diffusion model. We use Stable Diffusion 1.5 [28] (SD1.5) as our base model. SD1.5 is a pretrained latent text-to-image diffusion model that generates $512\times 512$ images conditioned on a text prompt. The diffusion process is performed in a $64\times 64$ latent space, and a variational autoencoder (VAE) [53], $V_{\text{dec}}:\mathbb{R}^{64\times 64}\rightarrow\mathbb{R}^{512\times 512}$, is used to decode latent samples into the image space. We adopt the DDIM [24] parameterization, which defines the drift and diffusion coefficients in ([2](https://arxiv.org/html/2505.20934v1#S3.E2)) as $f(t)=\frac{1}{2}\frac{d}{dt}\log(\hat{\alpha}_{t})$ and $g(t)^{2}=-\frac{d}{dt}\log(\hat{\alpha}_{t})$, respectively [54]. Furthermore, we use 200 DDIM sampling steps with the same $\hat{\alpha}_{i}$ scale as [24].

NatADiff settings.
To facilitate the use of adversarial classifier guidance we use the VAE to decode samples from the latent space. Specifically, given a sample, $\boldsymbol{z}_{t}$, from the latent diffusion process, we introduce the VAE, $V_{\text{dec}}$, into ([7](https://arxiv.org/html/2505.20934v1#S3.E7)) as

$$ $\hat{\boldsymbol{x}}_{0}(\boldsymbol{z}_{t})=V_{\text{dec}}\left((\boldsymbol{ z}_{t}-\beta(t)\boldsymbol{\epsilon}_{\theta}(\boldsymbol{z}_{t},t,y))/\alpha( t)\right),$ (11) $$

and take the gradient with respect to $\boldsymbol{z}_{t}$ instead of $\boldsymbol{x}_{t}$ in ([8](https://arxiv.org/html/2505.20934v1#S3.E8)). To augment classifier guidance, we apply a series of transformations to the decoded image–we crop at each corner and use horizontal flips–and average the resulting gradients across the transformed and original images. Additionally, we adopt a similar time-travel parameterization to that of [27], and use $R=5$ with $k=1$ for $500\leq t\leq 700$.

During adversarial boundary guidance we use the text prompt “$<$class name of $y$$>$” as the conditioning for the true class guidance, $y$. For intersection guidance, $y\cap\tilde{y}$, we use the prompt “$<$class name of $\tilde{y}$$>$ and $<$class name of $y$$>$”. We delay adversarial classifier guidance until timestep $t\leq 700$, i.e., we set $s=0$ for all $t>700$. This allows adversarial boundary guidance to steer the sample towards the class intersection before adversarial classifier guidance directs it towards misalignments on the class boundary. Finally, we choose a conservative value of $\mu=0.2$ for all experiments, and select $s$ based on the target classifier (see Appendix [F](https://arxiv.org/html/2505.20934v1#A6) for ablation study and parameter settings).

Metrics.
To evaluate image fidelity, we use the Inception Score (IS) [55] and Fréchet Inception Distance (FID) [26]. IS provides a direct measure of image quality, while FID estimates the similarity between the distributions of generated and real images. We compute FID with respect to both the ImageNet-Val [52] and ImageNet-A [12] datasets to assess how closely NatADiff samples resemble natural images and known natural adversarial examples, respectively.

To assess attack performance, we report classifier accuracy and attack success rate (ASR). Given a set of adversarial samples, $\{\tilde{\boldsymbol{x}}_{1},\tilde{\boldsymbol{x}}_{2},\dots,\tilde{
\boldsymbol{x}}_{N}\}$, the corresponding true labels, $\{y_{1},y_{2},\dots,y_{N}\}$, and the adversarial labels targeted/reported by the adversarial attack, $\{\tilde{y}_{1},\tilde{y}_{2},\dots,\tilde{y}_{N}\}$, we define the ASR against a classifier, $f:X\rightarrow\mathcal{Y}$, as: $\text{ASR}=\sum_{i=1}^{N}\mathds{1}_{\{f(\tilde{x}_{i})=\tilde{y}_{i}\}}/N$, where $\mathds{1}_{\{\cdot\}}$ is the indicator function. For perturbation-based attacks, this definition can inflate ASR due to natural test-time errors being counted as successful attacks. However, since generative methods (e.g., NatADiff, adversarial classifier guidance) produce samples from scratch, adjusting for such errors is infeasible. To ensure a fair comparison between perturbation and generative attacks we use the above unadjusted ASR.

### 4.2 Results

Attack success.
NatADiff achieves comparable attack success rates on victim classifiers to current state-of-the-art methods, but has vastly superior transferability across the board (see Table [1](https://arxiv.org/html/2505.20934v1#S4.T1)). This is likely because perturbation attacks rely on the small pockets of adversarial samples that neighbor natural images. These adversarial regions are are not guaranteed to align across classifier architectures, especially architectures that are dissimilar, e.g., convolutional vs transformer as reported in Appendix [I](https://arxiv.org/html/2505.20934v1#A9). Conversely, NatADiff mimics natural adversarial samples by incorporating adversarial structures to act as erroneous contextual cues (as seen in Figure [3](https://arxiv.org/html/2505.20934v1#S4.F3)). These natural adversarial samples exhibit superior transferability as they lie on the misaligned regions of the class boundary, which frequently overlap across differing model architectures [12]. Furthermore, adversarial training does not offer any meaningful robustness to NatADiff, with both targeted and untargeted attacks transferring to adversarially trained ResNet and Inception models.

ViT [48] is the current state-of-the-art in image classification and is the most resistant to transfer attacks. This is unsurprising as ViT learns a more robust feature representation than convolutional models, which makes it less susceptible to both perturbation-based and natural adversarial samples. However, despite the strengths of the ViT architecture, NatADiff is able to reliably generate samples that transfer to ViT–albeit at a lower ASR than equivalent attacks against convolutional models. This surpasses the capabilities of existing attack strategies and underscores how architectural differences can lead to significant variation in learned features.

When comparing targeted attacks with their untargeted counterparts we see that untargeted attacks outperform targeted attacks both in terms of victim classifier performance and transferability. This indicates that some adversarial targets are easier to achieve than others, which further motivates the use of similarity targeting as a method of identifying classifier “weak spots”. Lastly, we found that adversarial classifier guidance [16] is able to reliably generate adversarial samples; however, they are less transferable than those generated by NatADiff.

Figure: Figure 3: Adversarial samples generated using NatADiff targeting ResNet-50 [46], Inception [47], and ViT [48] victim models (see column labels). We report the true class, adversarial target, and classification scores of both the victim and adversarially trained ResNet-50 and Inception models [49]. Superscripts T and U indicate targeted and untargeted (similarity-based) attacks, respectively.
Refer to caption: extracted/6483093/images/NatADiff_Samples/Res_T_Images/Image_2.jpg

**Table 1: Classifier accuracy and attack success rate of adversarial samples generated by AutoAttack [4], PGD [3], adversarial classifier guidance [16], and NatADiff. The classifier used for each attack is indicated in brackets. Superscripts T and U denote targeted and untargeted attacks, respectively. Superscript † denotes a performance baseline of non-adversarial samples generated using SD1.5 [28]. For each evaluation metric, bold and underlined values highlight the most effective attack and the attack with the greatest transferability, respectively.**
| Adversarial<br>Generator |  | Classifier Accuracy |  |  | Attack Success Rate (ASR) |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |
| None^† |  | $73.1\%$ | $70.3\%$ | $77.5\%$ | $71.6\%$ | $70.6\%$ |  |  |  |  |  |  |  |
| PGD^T (ResNet-50) |  | $1.2\%$ | $69.8\%$ | $76.6\%$ | $71.2\%$ | $69.9\%$ |  |  | $98.4\%$ | $0.0\%$ | $0.0\%$ | $0.1\%$ | $0.1\%$ |
| PGD^T (Inc-v3) |  | $72.9\%$ | $0.9\%$ | $76.8\%$ | $71.1\%$ | $68.9\%$ |  |  | $0.1\%$ | $98.5\%$ | $0.1\%$ | $0.1\%$ | $0.1\%$ |
| PGD^T (ViT) |  | $73.1\%$ | $69.7\%$ | $8.1\%$ | $71.5\%$ | $69.6\%$ |  |  | $0.0\%$ | $0.1\%$ | $81.2\%$ | $0.0\%$ | $0.1\%$ |
| AAttack^U (ResNet-50) |  | $0.3\%$ | $68.8\%$ | $77.1\%$ | $71.1\%$ | $69.6\%$ |  |  | $98.9\%$ | $14.7\%$ | $10.4\%$ | $14.1\%$ | $15.4\%$ |
| AAttack^U (Inc-v3) |  | $71.3\%$ | $\mathbf{0.1}\boldsymbol{\%}$ | $76.7\%$ | $70.8\%$ | $68.1\%$ |  |  | $15.5\%$ | $\mathbf{99.7}\boldsymbol{\%}$ | $10.1\%$ | $15.6\%$ | $16.9\%$ |
| AAttack^U (ViT) |  | $72.4\%$ | $69.1\%$ | $\mathbf{0.2}\boldsymbol{\%}$ | $70.6\%$ | $69.9\%$ |  |  | $13.5\%$ | $12.8\%$ | $99.4\boldsymbol{\%}$ | $12.7\%$ | $12.5\%$ |
| AdvClass^T (ResNet-50) |  | $0.4\%$ | $65.0\%$ | $74.1\%$ | $68.8\%$ | $66.6\%$ |  |  | $98.9\%$ | $0.2\%$ | $0.1\%$ | $0.3\%$ | $0.2\%$ |
| AdvClass^U (ResNet-50) |  | $\mathbf{0.0}\boldsymbol{\%}$ | $57.6\%$ | $69.9\%$ | $61.3\%$ | $58.8\%$ |  |  | $\mathbf{100}\boldsymbol{\%}$ | $13.5\%$ | $8.7\%$ | $12.2\%$ | $13.6\%$ |
| NatADiff^T (ResNet-50) |  | $2.9\%$ | $39.7\%$ | $63.4\%$ | $44.9\%$ | $41.0\%$ |  |  | $96.2\%$ | $18.7\%$ | $6.6\%$ | $18.6\%$ | $17.1\%$ |
| NatADiff^T (Inc-v3) |  | $46.1\%$ | $2.1\%$ | $64.3\%$ | $42.2\%$ | $37.3\%$ |  |  | $20.0\%$ | $96.4\%$ | $6.3\%$ | $22.0\%$ | $26.0\%$ |
| NatADiff^T (ViT) |  | $\underline{29.1\%}$ | $\underline{26.4\%}$ | $0.9\%$ | $\underline{\mathbf{28.5}\boldsymbol{\%}}$ | $27.6\%$ |  |  | $12.8\%$ | $9.7\%$ | $97.8\%$ | $12.7\%$ | $9.7\%$ |
| NatADiff^U (ResNet-50) |  | $0.5\%$ | $31.7\%$ | $\underline{54.6\%}$ | $34.7\%$ | $32.6\%$ |  |  | $99.6\%$ | $\underline{53.1\%}$ | $\underline{31.0\%}$ | $51.6\%$ | $51.8\%$ |
| NatADiff^U (Inc-v3) |  | $32.8\%$ | $0.5\%$ | $55.3\%$ | $30.1\%$ | $\underline{\mathbf{24.2}\boldsymbol{\%}}$ |  |  | $\underline{56.0\%}$ | $99.5\%$ | $30.1\%$ | $\underline{\mathbf{59.2}\boldsymbol{\%}}$ | $\underline{\mathbf{64.7}\boldsymbol{\%}}$ |
| NatADiff^U (ViT) |  | $33.5\%$ | $33.0\%$ | $0.5\%$ | $34.8\%$ | $34.4\%$ |  |  | $43.6\%$ | $39.2\%$ | $\mathbf{99.5}\boldsymbol{\%}$ | $41.1\%$ | $38.7\%$ |

**Table 2: Image fidelity of samples generated using adversarial classifier guidance [16] and NatADiff. The classifier used in each attack is listed in brackets. Superscripts T and U denote targeted and untargeted attacks, respectively. Superscript † denotes a performance baseline comprised of non-adversarial samples generated using SD1.5 [28].**
| Adversarial<br>Generator | Image Fidelity |  |  |
| --- | --- | --- | --- |
| IS ($\boldsymbol{\uparrow}$) | FID-VAL ($\boldsymbol{\downarrow}$) | FID-A ($\boldsymbol{\downarrow}$) |  |
| None^† | $70.5$ | $27.2$ | $86.6$ |
| AdvClass^U (ResNet-50) | $55.2$ | $28.7$ | $70.0$ |
| AdvClass^T (ResNet-50) | $57.6$ | $\mathbf{27.6}$ | $70.2$ |
| NatADiff^T (ResNet-50) | $37.2$ | $42.8$ | $\mathbf{53.8}$ |
| NatADiff^T (Inc-v3) | $39.4$ | $42.4$ | $55.4$ |
| NatADiff^T (ViT) | $19.0$ | $66.3$ | $70.4$ |
| NatADiff^U (ResNet-50) | $64.6$ | $30.2$ | $73.6$ |
| NatADiff^U (Inc-v3) | $\mathbf{71.1}$ | $29.6$ | $77.2$ |
| NatADiff^U (ViT) | $43.6$ | $33.4$ | $74.6$ |

Image fidelity.
We observe a clear disparity in the image quality of targeted and untargeted NatADiff variants (see Table [2](https://arxiv.org/html/2505.20934v1#S4.T2)). Targeted samples exhibit higher FID-VAL but lower FID-A, indicating that they are closer in distribution to known natural adversarial examples. This aligns with the known characteristics of natural adversarial samples, as they often blend features from disparate classes [12, 14, 15]. However, replicating this blending places a greater demand on the underlying diffusion model to locate plausible points on the image manifold, which can result in the introduction of artifacts and an overall degradation in image quality–as can be seen from the IS scores. In contrast, similarity targeting blends more related classes, yielding samples with significantly higher visual fidelity but less alignment with natural adversarial distributions.

ViT-guided samples consistently exhibit lower image fidelity than those generated with convolutional models. ViT’s robust feature representations make it harder to identify semantically plausible adversarial directions, often requiring stronger classifier guidance. This increases the risk of deviating from the image manifold, leading to artifacts; however, this is significantly reduced under untargeted attack settings.

Finally, adversarial classifier guidance maintains consistent image quality across both attack modes, with only minor degradation relative to the non-adversarial baseline. This is likely because off-the-shelf classifier guidance produces constrained-adversarial samples. These samples lie in the neighborhood of the unconditional generation result, which leads to minimal difference between samples generated under targeted and untargeted conditions.

## 5 Conclusion

We introduce NatADiff, an adversarial sampling scheme that leverages diffusion models to generate natural adversarial samples. We acknowledge that natural adversarial samples frequently contain structural elements from the adversarial class, which deep learning models exploit to shortcut the classification processes. To leverage this behavior, we guide the diffusion trajectory towards the intersection of the true and adversarial classes. Our method achieves comparable attack success rates to current state-of-the-art techniques, while exhibiting significantly higher transferability across models. Furthermore, samples generated using NatADiff align closely with known natural adversarial samples. These results demonstrate that NatADiff produces adversarial samples that transfer more effectively and more faithfully resemble naturally occurring test-time errors.

Limitations and broader impact. While NatADiff is capable of generating natural adversarial samples, it comes at a cost of increased computation. Additionally, the use of similarity targeting on datasets such as ImageNet may produce adversarial samples that achieve subtle misclassifications, e.g., between similar breeds of dog, which could limit the perceived attack severity. Finally, we acknowledge that adversarial attacks raise legitimate concerns regarding misuse. Our objective is to expose fundamental vulnerabilities of current classifiers and to better understand the structure of natural adversarial samples in order to defend against such attacks in the future.

## 6 Acknowledgements

This research was supported by National Intelligence and Security Discovery Research Grants (project number NS220100007), funded by the Department of Defence, Australia. Professor Ajmal Mian is the recipient of an Australian Research Council Future Fellowship Award (project number FT210100268) funded by the Australian Government. Max Collins is the recipient of the Research Training Program scholarship funded by the Australian Government.

## References

- Szegedy et al. [2014]
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus.
Intriguing properties of neural networks.
In *2nd International Conference on Learning Representations, ICLR*, 2014.
- Goodfellow et al. [2015]
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.
Explaining and harnessing adversarial examples.
In *3rd International Conference on Learning Representations, ICLR*, 2015.
- Madry et al. [2018]
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.
Towards deep learning models resistant to adversarial attacks.
In *6th International Conference on Learning Representations, ICLR*, 2018.
- Croce and Hein [2020]
Francesco Croce and Matthias Hein.
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.
In *Proceedings of the 37th International Conference on Machine Learning, ICML*, volume 119 of *Proceedings of Machine Learning Research*, pages 2206–2216. PMLR, 2020.
- Song et al. [2018]
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon.
Constructing unrestricted adversarial examples with generative models.
In *Advances in Neural Information Processing Systems 31, NeurIPS*, pages 8322–8333, 2018.
- Chen et al. [2023a]
Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu.
AdvDiffuser: Natural adversarial example synthesis with diffusion models.
In *IEEE/CVF International Conference on Computer Vision, ICCV*, pages 4562–4572, 2023a.
- Chen et al. [2023b]
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang.
Content-based unrestricted adversarial attack.
In *Advances in Neural Information Processing Systems 36, NeurIPS*, 2023b.
- Gu and Rigazio [2015]
Shixiang Gu and Luca Rigazio.
Towards deep neural network architectures robust to adversarial examples.
In Yoshua Bengio and Yann LeCun, editors, *3rd International Conference on Learning Representations, ICLR*, 2015.
- Xu et al. [2018]
Weilin Xu, David Evans, and Yanjun Qi.
Feature squeezing: Detecting adversarial examples in deep neural networks.
In *Network and Distributed System Security Symposium, NDSS*, NDSS 2018. Internet Society, 2018.
- Samangouei et al. [2018]
Pouya Samangouei, Maya Kabkab, and Rama Chellappa.
Defense-GAN: Protecting classifiers against adversarial attacks using generative models.
In *6th International Conference on Learning Representations, ICLR*, 2018.
- Nie et al. [2022]
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar.
Diffusion models for adversarial purification.
In *International Conference on Machine Learning, ICML*, volume 162 of *Proceedings of Machine Learning Research*, pages 16805–16827. PMLR, 2022.
- Hendrycks et al. [2021]
Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song.
Natural adversarial examples.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 15262–15271. IEEE/CVF, 2021.
- Agarwal et al. [2022]
Akshay Agarwal, Nalini Ratha, Mayank Vatsa, and Richa Singh.
Exploring robustness connection between artificial and natural adversarial examples.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 179–186, 2022.
- Geirhos et al. [2020]
Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A. Wichmann.
Shortcut learning in deep neural networks.
*Nature Machine Intelligence*, 2(11):665–673, 2020.
- Arjovsky et al. [2020]
Martin Arjovsky, Léon Bottou, Ishaan Gulrajani, and David Lopez-Paz.
Invariant risk minimization.
*arXiv preprint arXiv:1907.02893*, 2020.
- Dai et al. [2024]
Xuelong Dai, Kaisheng Liang, and Bin Xiao.
AdvDiff: Generating unrestricted adversarial examples using diffusion models.
In *European Conference on Computer Vision, ECCV*, volume 15104 of *Lecture Notes in Computer Science*, pages 93–109. Springer, 2024.
- Karras et al. [2019]
Tero Karras, Samuli Laine, and Timo Aila.
A style-based generator architecture for generative adversarial networks.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 4401–4410. IEEE/CVF, 2019.
- Wulff and Torralba [2020]
Jonas Wulff and Antonio Torralba.
Improving inversion and generation diversity in StyleGAN using a gaussianized latent space.
*arXiv preprint arXiv:2009.06529*, 2020.
- Abdal et al. [2019]
Rameen Abdal, Yipeng Qin, and Peter Wonka.
Image2StyleGAN: How to embed images into the stylegan latent space?
In *IEEE/CVF International Conference on Computer Vision, ICCV*, pages 4431–4440. IEEE, 2019.
- Li et al. [2022]
Yang Li, Yichuan Mo, Liangliang Shi, and Junchi Yan.
Improving generative adversarial networks via adversarial learning in latent space.
In *Advances in Neural Information Processing Systems 35, NeurIPS*, volume 35, pages 8868–8881. Curran Associates, Inc., 2022.
- Vaeth et al. [2024]
Philipp Vaeth, Alexander M. Fruehwald, Benjamin Paassen, and Magda Gregorova.
GradCheck: Analyzing classifier guidance gradients for conditional diffusion sampling.
*arXiv preprint arXiv:2406.17399*, 2024.
- Shen et al. [2024]
Yifei Shen, Xinyang Jiang, Yifan Yang, Yezhen Wang, Dongqi Han, and Dongsheng Li.
Understanding and improving training-free loss-based diffusion guidance.
In *Advances in Neural Information Processing Systems 38, NeurIPS*, 2024.
- Ho et al. [2020]
Jonathan Ho, Ajay Jain, and Pieter Abbeel.
Denoising diffusion probabilistic models.
In *Advances in Neural Information Processing Systems 33, NeurIPS*, 2020.
- Song et al. [2021a]
Jiaming Song, Chenlin Meng, and Stefano Ermon.
Denoising diffusion implicit models.
In *9th International Conference on Learning Representations, ICLR*, 2021a.
- Lugmayr et al. [2022]
Andreas Lugmayr, Martin Danelljan, Andrés Romero, Fisher Yu, Radu Timofte, and Luc Van Gool.
Repaint: Inpainting using denoising diffusion probabilistic models.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 11451–11461. IEEE/CVF, 2022.
- Fréchet [1957]
Maurice Fréchet.
Sur la distance de deux lois de probabilité.
*Annales de l’ISUP*, VI(3):183–198, 1957.
- Yu et al. [2023]
Jiwen Yu, Yinhuai Wang, Chen Zhao, Bernard Ghanem, and Jian Zhang.
Freedom: Training-free energy-guided conditional diffusion model.
In *IEEE/CVF International Conference on Computer Vision, ICCV*, pages 23117–23127. IEEE, 2023.
- Rombach et al. [2022]
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.
High-resolution image synthesis with latent diffusion models.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 10674–10685. IEEE/CVF, 2022.
- Zhao et al. [2018]
Zhengli Zhao, Dheeru Dua, and Sameer Singh.
Generating natural adversarial examples.
In *6th International Conference on Learning Representations, ICLR*, 2018.
- Xie et al. [2025]
Mengda Xie, Yiling He, Zhan Qin, and Meie Fang.
RetouchUAA: Unconstrained adversarial attack via realistic image retouching.
*IEEE Trans. Circuits Syst. Video Technol.*, 35(3):2586–2602, 2025.
- Goodfellow et al. [2014]
Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio.
Generative adversarial nets.
In *Advances in Neural Information Processing Systems 27, NeurIPS*, pages 2672–2680, 2014.
- Mirza and Osindero [2014]
Mehdi Mirza and Simon Osindero.
Conditional generative adversarial nets.
*arXiv preprint arXiv:1411.1784*, 2014.
- Dhariwal and Nichol [2021]
Prafulla Dhariwal and Alexander Quinn Nichol.
Diffusion models beat gans on image synthesis.
In *Advances in Neural Information Processing Systems 34, NeurIPS*, pages 8780–8794, 2021.
- Ho and Salimans [2022]
Jonathan Ho and Tim Salimans.
Classifier-free diffusion guidance.
*arXiv preprint arXiv:2207.12598*, 2022.
- Karras et al. [2024]
Tero Karras, Miika Aittala, Tuomas Kynkäänniemi, Jaakko Lehtinen, Timo Aila, and Samuli Laine.
Guiding a diffusion model with a bad version of itself.
In *Advances in Neural Information Processing Systems 38, NeurIPS*, 2024.
- He et al. [2019]
Zhezhi He, Adnan Siraj Rakin, and Deliang Fan.
Parametric noise injection: Trainable randomness to improve deep neural network robustness against adversarial attack.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 588–597. Computer Vision Foundation / IEEE, 2019.
- Li et al. [2019]
Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin.
Certified adversarial robustness with additive noise.
In *Advances in Neural Information Processing Systems 32, NeurIPS*, pages 9459–9469, 2019.
- Karras et al. [2022]
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine.
Elucidating the design space of diffusion-based generative models.
In *Advances in Neural Information Processing Systems 35, NeurIPS*, 2022.
- Pavliotis [2014a]
G. A. Pavliotis.
*Stochastic processes and applications: diffusion processes, the Fokker-Planck and Langevin equations*, chapter 4, pages 88–89.
Texts in Applied Mathematics. Springer New York, 2014a.
ISBN 9781493913237.
- Anderson [1982]
Brian D. O. Anderson.
Reverse-time diffusion equation models.
*Stochastic Processes and their Applications*, 12(3):313–326, 1982.
- Song et al. [2021b]
Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole.
Score-based generative modeling through stochastic differential equations.
In *9th International Conference on Learning Representations, ICLR*, 2021b.
- Nichol and Dhariwal [2021]
Alexander Quinn Nichol and Prafulla Dhariwal.
Improved denoising diffusion probabilistic models.
In Marina Meila and Tong Zhang, editors, *Proceedings of the 38th International Conference on Machine Learning, ICML*, volume 139 of *Proceedings of Machine Learning Research*, pages 8162–8171. PMLR, 2021.
- Avrahami et al. [2022]
Omri Avrahami, Dani Lischinski, and Ohad Fried.
Blended diffusion for text-driven editing of natural images.
In *IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR*, pages 18187–18197. IEEE, 2022.
- Bansal et al. [2024]
Arpit Bansal, Hong-Min Chu, Avi Schwarzschild, Soumyadip Sengupta, Micah Goldblum, Jonas Geiping, and Tom Goldstein.
Universal guidance for diffusion models.
In *The Twelfth International Conference on Learning Representations, ICLR*, 2024.
- Guo et al. [2018]
Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens van der Maaten.
Countering adversarial images using input transformations.
In *6th International Conference on Learning Representations, ICLR*, 2018.
- He et al. [2016]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In *IEEE Conference on Computer Vision and Pattern Recognition, CVPR*, pages 770–778. IEEE Computer Society, 2016.
- Szegedy et al. [2015]
Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott E. Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich.
Going deeper with convolutions.
In *IEEE Conference on Computer Vision and Pattern Recognition, CVPR*, pages 1–9. IEEE Computer Society, 2015.
- Dosovitskiy et al. [2021]
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby.
An image is worth 16x16 words: Transformers for image recognition at scale.
In *9th International Conference on Learning Representations, ICLR*, 2021.
- Kurakin et al. [2018]
Alexey Kurakin, Ian J. Goodfellow, Samy Bengio, Yinpeng Dong, Fangzhou Liao, Ming Liang, Tianyu Pang, Jun Zhu, Xiaolin Hu, Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, Alan L. Yuille, Sangxia Huang, Yao Zhao, Yuzhe Zhao, Zhonglin Han, Junjiajia Long, Yerkebulan Berdibekov, Takuya Akiba, Seiya Tokui, and Motoki Abe.
Adversarial attacks and defences competition.
*arXiv preprint arXiv:1804.00097*, 2018.
- Croce et al. [2020]
Francesco Croce, Jonas Rauber, and Matthias Hein.
Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks.
*Int. J. Comput. Vis.*, 128(4):1028–1046, 2020.
- Radford et al. [2021]
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever.
Learning transferable visual models from natural language supervision, 2021.
- Deng et al. [2009]
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Fei-Fei Li.
ImageNet: A large-scale hierarchical image database.
In *IEEE Conference on Computer Vision and Pattern Recognition, CVPR*, pages 248–255, 2009.
- Kingma and Welling [2014]
Diederik P. Kingma and Max Welling.
Auto-encoding variational bayes.
In *2nd International Conference on Learning Representations, ICLR*, 2014.
- Han [2024]
Manhyung Han.
DDIM redux: mathematical foundation and some extension.
*arXiv preprint arXiv:2408.07285*, 2024.
- Salimans et al. [2016]
Tim Salimans, Ian J. Goodfellow, Wojciech Zaremba, Vicki Cheung, Alec Radford, and Xi Chen.
Improved techniques for training gans.
In Daniel D. Lee, Masashi Sugiyama, Ulrike von Luxburg, Isabelle Guyon, and Roman Garnett, editors, *Advances in Neural Information Processing Systems 29, NeurIPS*, pages 2226–2234, 2016.
- Brown et al. [2018]
Tom B. Brown, Nicholas Carlini, Chiyuan Zhang, Catherine Olsson, Paul Christiano, and Ian Goodfellow.
Unrestricted adversarial examples, 2018.
- Bhattad et al. [2020]
Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A. Forsyth.
Unrestricted adversarial examples via semantic manipulation.
In *8th International Conference on Learning Representations, ICLR*, 2020.
- Wang et al. [2020]
Xiaosen Wang, Kun He, Chuanbiao Song, Liwei Wang, and John E. Hopcroft.
AT-GAN: An adversarial generator model for non-constrained adversarial examples.
*arXiv preprint arXiv:1904.07793*, 2020.
- Pavliotis [2014b]
G. A. Pavliotis.
*Stochastic processes and applications: diffusion processes, the Fokker-Planck and Langevin equations*.
Texts in Applied Mathematics. Springer New York, 2014b.
ISBN 9781493913237.
- Hyvärinen [2005]
Aapo Hyvärinen.
Estimation of non-normalized statistical models by score matching.
*Journal of Machine Learning Research*, 6:695–709, 2005.
- Vincent [2011]
Pascal Vincent.
A connection between score matching and denoising autoencoders.
*Neural Computation*, 23:1661–1674, 2011.
- Cybenko [1989]
G. Cybenko.
Approximation by superpositions of a sigmoidal function.
*Mathematics of Control, Signals and Systems*, 2(4):303–314, 1989.
- Hornik [1991]
Kurt Hornik.
Approximation capabilities of multilayer feedforward networks.
*Neural Netw.*, 4(2):251–257, 1991.
- Kim [2020]
Hoki Kim.
Torchattacks: A pytorch repository for adversarial attacks.
*arXiv preprint arXiv:2010.01950*, 2020.

## Appendix A Limitations

While NatADiff is effective at generating transferable natural adversarial samples, it remains computationally expensive due to the iterative nature of diffusion and the overhead introduced by adversarial guidance. This is an inherent limitation of diffusion-based generative methods, and one unlikely to change without significant advances in generative modeling or architectural design. Additionally, the use of similarity targeting on datasets like ImageNet can lead to subtle misclassifications–e.g., between similar dog breeds–which may diminish the perceived severity of the attack. A potential refinement would be to surface a ranked list of similar classes, allowing users to select more divergent adversarial targets while retaining the semantic grounding of similarity-based selection. We also note that we used a conservative setting for the adversarial boundary guidance term, $\mu$, as larger values caused generated samples to occasionally include the adversarial class, as discussed in Appendix [F](https://arxiv.org/html/2505.20934v1#A6). Finally, we restrict our evaluation to ImageNet classifiers, as ImageNet offers a diverse label space, which supports varied attack scenarios. Extending NatADiff to more specialized domains remains an avenue for future work.

## Appendix B Ethics and broader impacts

This work explores the use of generative models as a means of creating highly transferable natural adversarial samples. While adversarial attacks raise legitimate concerns regarding misuse, our objective is to expose fundamental vulnerabilities of current classifiers and to better understand the structure of natural adversarial samples. By making our models and code publicly available, we aim to support transparency and reproducibility, and we believe that insight into generative adversarial mechanisms is a necessary step toward building more secure and interpretable classifiers. We do not use private or sensitive data, and all data and models used are publicly released and broadly studied. In future work, we plan to explore how NatADiff can be extended to detect or defend against naturally occurring adversarial samples.

## Appendix C Perturbation-Based Attacks and Defences

In this section, we provide a brief overview of existing perturbation-based attack and defense strategies for image classification models. We focus on the optimization-based formulation of adversarial attacks and highlight the theoretical underpinnings of common training-time defenses.

### C.1 Adversarial attacks

Szegedy et al. [1] were the first to demonstrate that imperceptible perturbations to an image’s pixel values could cause deep learning models to misclassify the image with a high probability (see Figure 1). Mathematically, these constrained adversarial attacks can be considered a solution to the following constrained optimization problem:

$$ $\min_{\boldsymbol{\delta}\in\mathcal{S}}\ \mathcal{L}_{h}(\boldsymbol{x}+ \boldsymbol{\delta};\boldsymbol{\theta},\tilde{y}),$ (12) $$

where $\boldsymbol{\delta}\in\mathbb{R}^{m}$ is the computed perturbation, $\boldsymbol{x}\in\mathbb{R}^{m}$ is the vectorized “clean” image, $h:\mathbb{R}^{m}\xrightarrow{}\mathcal{Y}$ is a “trained” classifier model with parameters $\boldsymbol{\theta}$, $\tilde{y}\in\mathcal{Y}$ is the class targeted by the adversarial attack, $\mathcal{L}_{h}(\cdot;\boldsymbol{\theta},\tilde{y})$ is the loss of the classifier with respect to the target adversarial class, and $\mathcal{S}\vcentcolon=\{\boldsymbol{\delta}\in\mathbb{R}^{m}:\lVert
\boldsymbol{\delta}\rVert_{p}<L\}$ is a convex set of allowable perturbation sizes. Algorithms such as fast gradient sign method (FGSM) [2], projected gradient descent (PGD) [3], and AutoAttack [4], have been proposed to efficiently solve the optimization problem in ([12](https://arxiv.org/html/2505.20934v1#A3.E12)).

Other attack methods have relaxed the constraint on the magnitude of the adversarial perturbation. These unconstrained adversarial attacks seek to alter the semantic information within an image, resulting in misclassification without visually altering the perceptible class. Additionally, techniques like selective cropping and rotation, texture remapping, color pallette transformations, and generative sampling have all been used to successfully “fool” modern deep learning models [56, 57, 5, 58, 16, 30].

### C.2 Defences against adversarial attacks

Several defensive measures have been proposed that aim to purify adversarial inputs [10, 11], harden model architectures against attacks [8, 9], or improve training procedures [1, 3]. A key challenge in designing adversarial defences is preventing attackers from crafting new attacks that exploit the adapted model. For this reason adversarial training has become one of the most popular defences, as it both addresses the source of the adversarial attack, while providing theoretical guarantees of robustness against all possible perturbation-based adversaries.

Adversarial training can be formulated as the following saddle-point optimization problem:

$$ $\min_{\boldsymbol{\theta}}\ {\operatorname*{\mathbb{E}}}_{(\boldsymbol{x},y) \sim\mathcal{D}}\left[\max_{\boldsymbol{\delta}\in\mathcal{S}}\ \mathcal{L}_{h }(\boldsymbol{x}+\boldsymbol{\delta};\boldsymbol{\theta},y)\right],$ (13) $$

where $\mathcal{D}$ is the joint distribution of naturally occurring images and classes, and $y\in\mathcal{Y}$ is the true class label of $\boldsymbol{x}$ [1, 3]. The optimization problem in ([13](https://arxiv.org/html/2505.20934v1#A3.E13)) can be thought of as minimizing the loss caused by the strongest possible adversarial attack. Thus, any model that minimizes ([13](https://arxiv.org/html/2505.20934v1#A3.E13)) is theoretically guaranteed to be resistant to its strongest possible adversarial perturbations.

## Appendix D Example natural adversarial samples

Figure [4](https://arxiv.org/html/2505.20934v1#A4.F4) shows natural adversarial samples from the ImageNet-A dataset [12], each paired with a heatmap of the classifier-guidance gradient with respect to the adversarial class. These gradients highlight the image structures that contribute to the misclassification and that would be emphasized during adversarial classifier-guided diffusion [16].

The heatmaps in Figure [4](https://arxiv.org/html/2505.20934v1#A4.F4) provide insight into the erroneous contextual cues exploited by the ResNet-50 classifier [46]. In the first image the classifier gradient is focused around the school bus and the snowbanks running alongside the road, in the second the gradient is focused on the snail and its shadow, and in the third it is focused on the power switch. This suggests the classifier has “learned” to associate vehicles beside snowbanks with snowplows, dark elliptical objects with cockroaches, and vertical rectangular boxes with pay-phones.

Figure: Figure 4: Top: Natural adversarial samples compiled by Hendrycks et al. [12] for ImageNet [52] classifiers. The green labels denote the ground-truth classes; the red labels are the classes assigned by a ResNet-50 classifier [46]. Bottom: Heatmap of the ResNet-50 adversarial classifier-guidance [16] gradient with respect to the adversarial classes. Arrows point to structural elements from the adversarial class that affect the ResNet-50 classification.
Refer to caption: extracted/6483093/images/ImageNetA_Samples/a7_im.jpg

## Appendix E NatADiff similarity attack algorithm

Algorithm [2](https://arxiv.org/html/2505.20934v1#alg2) provides the algorithm for the similarity targeted variant of NatADiff.

Figure: Algorithm 2 NatADiff–Similarity

## Appendix F Selection of NatADiff parameters

Here we provide the NatADiff parameter values used in our experiments (see Table [3](https://arxiv.org/html/2505.20934v1#A6.T3)), and provide a discussion on the selection of the adversarial classifier guidance term, $s$, and adversarial boundary guidance term, $\mu$.

**Table 3: Experiment parameters used in diffusion-based adversarial sampling experiments. Parameters refer to those defined in Algorithms 1 and [2](https://arxiv.org/html/2505.20934v1#alg2).**
| Experiment Name | $\omega$ | $\rho$ | $\mu$ | $s$ | $R$ | $r_{l}$ | $r_{u}$ | $c_{l}$ | $c_{u}$ | $S$ | $\delta_{\mu}$ | $\delta_{s}$ |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| AdvClass^T (ResNet-50) | $7.5$ | $0.0$ | $0.0$ | $500$ | 0 0 | 0 0 | 0 0 | 0 0 | $200$ | $5$ | 0 0 | $250$ |
| AdvClass^U (ResNet-50) | $7.5$ | $0.0$ | $0.0$ | $500$ | 0 0 | 0 0 | 0 0 | 0 0 | $200$ | $5$ | 0 0 | $250$ |
| NatADiff^T (ResNet-50) | $7.5$ | $7.5$ | $0.2$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff^T (Inc-v3) | $7.5$ | $7.5$ | $0.2$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $20$ |
| NatADiff^T (ViT) | $7.5$ | $7.5$ | $0.2$ | $100$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $50$ |
| NatADiff^U (ResNet-50) | $7.5$ | $7.5$ | $0.2$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $25$ |
| NatADiff^U (Inc-v3) | $7.5$ | $7.5$ | $0.2$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $20$ |
| NatADiff^U (ViT) | $7.5$ | $7.5$ | $0.2$ | $100$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $50$ |
| NatADiff-A1 (ResNet-50) | $7.5$ | $7.5$ | $0.0$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff-A2 (ResNet-50) | $7.5$ | $7.5$ | $0.1$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff-A3 (ResNet-50) | $7.5$ | $7.5$ | $0.2$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff-A4 (ResNet-50) | $7.5$ | $7.5$ | $0.3$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff-A5 (ResNet-50) | $7.5$ | $7.5$ | $0.4$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |
| NatADiff-A6 (ResNet-50) | $7.5$ | $7.5$ | $0.5$ | $50$ | $5$ | $500$ | $800$ | 0 0 | $700$ | $5$ | 0 0 | $15$ |

### F.1 Blending and classifier guidance parameters

The adversarial classifier guidance term, $s$, controls the strength of the guidance provided by the victim classifier. We found that the optimal value of $s$ varied across classifiers and exhibited a near-binary behaviour—attacks would consistently fail until a “large enough” value was selected. For each classifier, we manually tuned $s$ by incrementally increasing it until NatADiff successfully generated adversarial samples; the selected values for each experiment are provided in Table [3](https://arxiv.org/html/2505.20934v1#A6.T3).

The adversarial boundary guidance term, $\mu$, governs how strongly structural elements from the adversarial class are incorporated into the generated sample. To evaluate the effect of this parameter, we conducted an ablation study across $\mu\in\{0.0,0.1,0.2,0.3,0.4,0.5\}$ using a ResNet-50 [46] victim classifier and applying NatADiff in targeted mode, i.e., with adversarial classes selected at random. To assess the success of the attack, we report classifier accuracy and attack success rate (ASR). To evaluate image fidelity of the generated samples, we report Inception Score (IS) [55] and Fréchet Inception Distance (FID) [26]. We compute FID with respect to both the ImageNet-Val [52] and ImageNet-A [12] datasets, capturing similarity to both general natural images and known natural adversarial examples.

From Table [4](https://arxiv.org/html/2505.20934v1#A6.T4), we observe that classifier accuracy decreases as $\mu$ increases, while attack success rate increases. Image quality also generally increases with $\mu$, with $\mu=0.5$ yielding the best IS and FID-Val scores (see Table [5](https://arxiv.org/html/2505.20934v1#A6.T5)). Interestingly, the lowest FID-A was observed at $\mu=0.2$. These quantitative results suggest that larger values of $\mu$ tend to improve NatADiff performance; however, they do not capture the qualitative shift in sample structure. Large values of $\mu$ introduce two distinct phenomena: dual class samples, in which both the true and adversarial classes are present in the image (see Figure [5](https://arxiv.org/html/2505.20934v1#A6.F5) (a) and (b)), and flipped class samples, in which the original class is entirely overwritten by the adversarial target (see Figure [5](https://arxiv.org/html/2505.20934v1#A6.F5) (c) and (d)). Furthermore, as seen in Figure [5](https://arxiv.org/html/2505.20934v1#A6.F5), the optimal value of $\mu$ appears to vary across true-adversarial class pairs. Thus, we select a conservative value of $\mu=0.2$, as manual qualitative investigation found this did not lead to dual and flipped class samples, and experimental results indicate it best aligns with natural adversarial samples as measured by FID-A (see Table [5](https://arxiv.org/html/2505.20934v1#A6.T5)).

**Table 4: Classifier accuracy and attack success rate of adversarial samples generated by NatADiff under targeted conditions using a ResNet-50 victim classifier. The value of the blending parameter, $\mu$, is provided in brackets. Superscript † denotes a performance baseline of non-adversarial samples generated using SD1.5 [28]. For each evaluation metric, bold values highlight the most effective attack.**
| Adversarial<br>Generator |  | Classifier Accuracy |  |  | Attack Success Rate (ASR) |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |
| None^† |  | $73.1\%$ | $70.3\%$ | $77.5\%$ | $71.6\%$ | $70.6\%$ |  |  |  |  |  |  |  |
| NatADiff ($\mu=0.0$) |  | $4.6\%$ | $45.5\%$ | $67.4\%$ | $51.0\%$ | $46.3\%$ |  |  | $93.9\%$ | $7.3\%$ | $0.5\%$ | $7.3\%$ | $7.7\%$ |
| NatADiff ($\mu=0.1$) |  | $4.4\%$ | $44.6\%$ | $66.4\%$ | $48.3\%$ | $46.2\%$ |  |  | $94.4\%$ | $11.6\%$ | $2.2\%$ | $10.6\%$ | $11.2\%$ |
| NatADiff ($\mu=0.2$) |  | $2.9\%$ | $39.7\%$ | $63.4\%$ | $44.9\%$ | $41.0\%$ |  |  | $96.2\%$ | $18.7\%$ | $6.6\%$ | $18.6\%$ | $17.1\%$ |
| NatADiff ($\mu=0.3$) |  | $2.4\%$ | $37.6\%$ | $57.3\%$ | $41.7\%$ | $39.1\%$ |  |  | $97.2\%$ | $24.7\%$ | $12.7\%$ | $25.8\%$ | $23.8\%$ |
| NatADiff ($\mu=0.4$) |  | $1.4\%$ | $32.3\%$ | $50.3\%$ | $37.3\%$ | $34.7\%$ |  |  | $98.1\%$ | $32.8\%$ | $21.7\%$ | $32.7\%$ | $31.6\%$ |
| NatADiff ($\mu=0.5$) |  | $\mathbf{1.2}\boldsymbol{\%}$ | $\mathbf{28.5}\boldsymbol{\%}$ | $\mathbf{46.1}\boldsymbol{\%}$ | $\mathbf{31.5}\boldsymbol{\%}$ | $\mathbf{29.4}\boldsymbol{\%}$ |  |  | $\mathbf{98.5}\boldsymbol{\%}$ | $\mathbf{40.4}\boldsymbol{\%}$ | $\mathbf{28.3}\boldsymbol{\%}$ | $\mathbf{41.5}\boldsymbol{\%}$ | $\mathbf{39.8}\boldsymbol{\%}$ |

**Table 5: Image fidelity of adversarial samples generated by NatADiff under targeted conditions using a ResNet-50 victim classifier. The value of the blending parameter, $\mu$, is provided in brackets. Superscript † denotes a performance baseline of non-adversarial samples generated using SD1.5 [28].**
| Adversarial<br>Generator | Image Fidelity |  |  |
| --- | --- | --- | --- |
| IS ($\boldsymbol{\uparrow}$) | FID-VAL ($\boldsymbol{\downarrow}$) | FID-A ($\boldsymbol{\downarrow}$) |  |
| None^† | $70.5$ | $27.2$ | $86.6$ |
| NatADiff ($\mu=0.0$) | $34.4$ | $43.9$ | $54.7$ |
| NatADiff ($\mu=0.1$) | $36.8$ | $42.2$ | $54.1$ |
| NatADiff ($\mu=0.2$) | $37.2$ | $42.8$ | $\mathbf{53.8}$ |
| NatADiff ($\mu=0.3$) | $38.6$ | $41.4$ | $54.8$ |
| NatADiff ($\mu=0.4$) | $42.5$ | $40.1$ | $56.5$ |
| NatADiff ($\mu=0.5$) | $\mathbf{47.0}$ | $\mathbf{38.1}$ | $57.2$ |

Figure: Figure 5: Samples generated by NatADiff using the same random seed while varying $\mu$ from $0.0$ to $0.5$, shown left to right. Green and red labels denote the true and adversarial classes, respectively. Images in (a) and (b) exhibit the dual class phenomenon, where large $\mu$ values cause objects from both the true and adversarial classes to appear. Images in (c) and (d) demonstrate the flipped class phenomenon, where large $\mu$ values causes the sample to fully adopt the adversarial class, suppressing the original class features.
Refer to caption: extracted/6483093/images/mu_Blend/Image_1.jpg

## Appendix G Additional NatADiff samples

### G.1 ResNet-50 samples

Figure: Figure 6: Adversarial samples generated using NatADiff targeting a ResNet-50 [46] victim model. We report the true class, adversarial target, and classification scores of ResNet-50 [46], Inception-v3 [47], ViT [48], and adversarially trained ResNet-50 and Inception models [49]. Superscripts T and U indicate targeted and untargeted (similarity-based) attacks, respectively.
Refer to caption: extracted/6483093/images/NatADiff_Samples/Res_T_Images/Image_3.jpg

### G.2 Inception-v3 samples

Figure: Figure 7: Adversarial samples generated using NatADiff targeting an Inception-v3 [47] victim model. We report the true class, adversarial target, and classification scores of ResNet-50 [46], Inception-v3 [47], ViT [48], and adversarially trained ResNet-50 and Inception models [49]. Superscripts T and U indicate targeted and untargeted (similarity-based) attacks, respectively.
Refer to caption: extracted/6483093/images/NatADiff_Samples/Inc_T_Images/Image_1.jpg

### G.3 ViT samples

Figure: Figure 8: Adversarial samples generated using NatADiff targeting a ViT [48] victim model. We report the true class, adversarial target, and classification scores of ResNet-50 [46], Inception-v3 [47], ViT [48], and adversarially trained ResNet-50 and Inception models [49]. Superscripts T and U indicate targeted and untargeted (similarity-based) attacks, respectively.
Refer to caption: extracted/6483093/images/NatADiff_Samples/ViT_T_Images/Image_1.jpg

## Appendix H Useful denoising diffusion results

This section outlines results necessary for working with denoising diffusion models. Citations of original authors are provided where applicable.

### H.1 Conditional forward distribution

The following theorem describes the conditional forward distribution of the denoising diffusion model when conditioned on an arbitrary time $\tau$.

###### Theorem H.1 (Conditional Forward Distribution for Denosing Diffusion) .

Let $\boldsymbol{x}_{t}\in\mathbb{R}^{m}$, $f(t):\mathbb{R}\rightarrow\mathbb{R}$ and $g(t):\mathbb{R}\rightarrow\mathbb{R}$ be continuous functions of $t$, and $\mathop{\cdot}d\boldsymbol{B}_{t}$ denote an Itô integral with respect to the standard multi-dimensional Brownian motion process. Then the denoising diffusion model with forward process,

$$ $d\boldsymbol{x}_{t}=f(t)\boldsymbol{x}_{t}dt+g(t)\cdot d\boldsymbol{B}_{t},$ (14) $$

admits a conditional forward distribution of

$$ $X_{t}|X_{\tau}\sim\mathcal{N}\left(\alpha(\tau,t)x_{\tau},\ \beta(\tau,t)^{2}I ^{(m\times m)}\right)\ \forall\ t>\tau,$ $$

where $\alpha(\tau,t)=\exp\left(\int_{\tau}^{t}f(u)du\right)$, $\beta(\tau,t)^{2}=\alpha(\tau,t)^{2}\int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(\tau
,u)^{2}}du$, and $I^{(m\times m)}$ is the $m$-dimensional identity matrix. Additionally, it is understood that with slight abuse of notation $\alpha(t)=\alpha(0,t)$ and $\beta(t)=\alpha(0,t)$

###### Proof.

The diffusion in ([14](https://arxiv.org/html/2505.20934v1#A8.E14)) has Stratonovich representation (see [59] for a treatment of Itô and Stratonovich SDE formulations),

$$ $d\boldsymbol{x}_{t}=f(t)\boldsymbol{x}_{t}dt+g(t)\circ d\boldsymbol{B}_{t},$ $$

where $\mathop{\circ}d\boldsymbol{B}_{t}$ denotes a Stratonovich integral with respect to the standard multi-dimensional Brownian motion process. Thus, the SDE can be solved in the usual manner:

$$ $\displaystyle d\boldsymbol{x}_{t}$ $\displaystyle=f(t)\boldsymbol{x}_{t}dt+g(t)\circ d\boldsymbol{B}_{t}$ $\displaystyle\frac{d\boldsymbol{x}_{t}}{dt}$ $\displaystyle=f(t)\boldsymbol{x}_{t}+g(t)\circ\frac{d\boldsymbol{B}_{t}}{dt}$ $\displaystyle\implies\left(e^{-\int_{\tau}^{t}f(u)du}\right)\frac{d\boldsymbol {x}_{t}}{dt}$ $\displaystyle=\left(e^{-\int_{\tau}^{t}f(u)du}\right)f(t)\boldsymbol{x}_{t}$ $\displaystyle\quad+\left(e^{-\int_{\tau}^{t}f(u)du}\right)g(t)\circ\frac{d \boldsymbol{B}_{t}}{dt}\quad\forall\ t>\tau$ $\displaystyle\implies\left(e^{-\int_{\tau}^{t}f(u)du}\right)g(t)\circ\frac{d \boldsymbol{B}_{t}}{dt}$ $\displaystyle=\left(e^{-\int_{\tau}^{t}f(u)du}\right)\frac{d\boldsymbol{x}_{t} }{dt}-\left(e^{-\int_{\tau}^{t}f(u)du}\right)f(t)\boldsymbol{x}_{t}$ $\displaystyle\implies\int_{\tau}^{t}\left(e^{-\int_{\tau}^{v}f(u)du}\right)g(v )\circ\frac{d\boldsymbol{B}_{v}}{dv}dv$ $\displaystyle=\int_{\tau}^{t}\left(e^{-\int_{\tau}^{v}f(u)du}\right)\frac{dx_{ v}}{dv}-\left(e^{-\int_{\tau}^{v}f(u)du}\right)f(v)x_{v}dv$ $\displaystyle\int_{\tau}^{t}\left(e^{-\int_{\tau}^{v}f(u)du}\right)g(v)\circ d \boldsymbol{B}_{v}$ $\displaystyle=\left.\left[x_{v}\left(e^{-\int_{\tau}^{v}f(u)du}\right)\right] \right\rvert_{\tau}^{t}$ $\displaystyle\int_{\tau}^{t}\left(e^{-\int_{\tau}^{v}f(u)du}\right)g(v)\circ d \boldsymbol{B}_{v}$ $\displaystyle=\boldsymbol{x}_{t}\left(e^{-\int_{\tau}^{t}f(u)du}\right)-x_{\tau}$ $\displaystyle\int_{\tau}^{t}\frac{g(v)}{\alpha(\tau,v)}\circ d\boldsymbol{B}_{v}$ $\displaystyle=\frac{\boldsymbol{x}_{t}}{\alpha(\tau,t)}-x_{\tau}$ $\displaystyle\implies\boldsymbol{x}_{t}$ $\displaystyle=\alpha(\tau,t)x_{\tau}+\alpha(\tau,t)\int_{\tau}^{t}\frac{g(v)}{ \alpha(\tau,v)}\circ d\boldsymbol{B}_{v}.$ (15) By rewriting ( 15 ) in its Itô representation we have $\displaystyle\boldsymbol{x}_{t}$ $\displaystyle=\alpha(\tau,t)x_{\tau}+\alpha(\tau,t)\int_{\tau}^{t}\frac{g(v)}{ \alpha(\tau,v)}\cdot d\boldsymbol{B}_{v},$ and as $\int_{\tau}^{t}\frac{g(u)}{\alpha(\tau,u)}\cdot d\boldsymbol{B}_{u}\sim \mathcal{N}\left(0,\ \int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(\tau,u)^{2}}du\cdot I ^{(m\times m)}\right)$ , it follows that $\displaystyle\boldsymbol{x}_{t}|\boldsymbol{x}_{\tau}$ $\displaystyle\sim\mathcal{N}\left(\alpha(\tau,t)x_{\tau},\ \alpha(\tau,t)^{2} \int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(\tau,u)^{2}}du\cdot I^{(m\times m)} \right).$ $$

∎

###### Theorem H.1 (Conditional Forward Distribution for Denosing Diffusion) .

###### Proof.

### H.2 Conditional forward alternate parameterisation

When implementing time-travel sampling [25] we require access to the conditional forward distribution, $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{\tau})$. However, it is frequently the case that diffusion schemes are formulated with respect to the full forward distribution, $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})$, and some proposed method of sampling the reverse-time diffusion [40], or solving the flow ODE [41]. Thus, we provide a simple result to derive the conditional forward distribution, $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{\tau})$, from the parameterisation of the full forward, $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})$.

###### Lemma H.2 (Conditional Forward Alternate Parameterisation) .

Given the diffusion formulation in Theorem [H.1](https://arxiv.org/html/2505.20934v1#A8.Thmtheorem1), then the conditional forward distribution can alternately be expressed as

$$ $X_{t}|X_{\tau}\sim\mathcal{N}\left(ax_{\tau},\ b^{2}I^{(m\times m)}\right)\ \forall\ t>\tau,$ $$

where

$$ $X_{t}|X_{0}\sim\mathcal{N}\left(\alpha(0,t)x_{0},\ \beta(0,t)^{2}I^{(m\times m )}\right)\ \forall\ t>0,$ $$

$a=\frac{\alpha(0,t)}{\alpha(0,\tau)}$, $b^{2}=\beta(0,t)^{2}-\left(a\beta(0,\tau)\right)^{2}$, , and $I^{(m\times m)}$ is the $m$-dimensional identity matrix. Additionally, it is understood that with slight abuse of notation $\alpha(t)=\alpha(0,t)$ and $\beta(t)=\alpha(0,t)$

###### Proof.

We need to show that $a=\alpha(\tau,t)=\exp\left(\int_{\tau}^{t}f(u)du\right)$ and $b^{2}=\beta(\tau,t)^{2}=\alpha(\tau,t)^{2}\int_{\tau}^{t}\frac{g(u)^{2}}{
\alpha(\tau,u)^{2}}du$ as per Theorem [H.1](https://arxiv.org/html/2505.20934v1#A8.Thmtheorem1). It follows that

$$ $\displaystyle a$ $\displaystyle=\frac{\alpha(0,t)}{\alpha(0,\tau)}$ $\displaystyle=\frac{\exp\left(\int_{0}^{t}f(u)du\right)}{\exp\left(\int_{0}^{ \tau}f(u)du\right)}$ $\displaystyle=\exp\left(\int_{0}^{t}f(u)du-\int_{0}^{\tau}f(u)du\right)$ $\displaystyle=\exp\left(\int_{\tau}^{t}f(u)du\right)$ $\displaystyle=\alpha(\tau,t),$ (16) and $\displaystyle b^{2}$ $\displaystyle=\beta(0,t)^{2}-\left(a\beta(0,\tau)\right)^{2}$ $\displaystyle=\beta(0,t)^{2}-a^{2}\beta(0,\tau)^{2}$ $\displaystyle=\alpha(0,t)^{2}\int_{0}^{t}\frac{g(u)^{2}}{\alpha(0,u)^{2}}du- \frac{\alpha(0,t)^{2}}{\alpha(0,\tau)^{2}}\alpha(0,\tau)^{2}\int_{0}^{\tau} \frac{g(u)^{2}}{\alpha(0,u)^{2}}du$ $\displaystyle=\alpha(0,t)^{2}\left[\int_{0}^{t}\frac{g(u)^{2}}{\alpha(0,u)^{2} }du-\int_{0}^{\tau}\frac{g(u)^{2}}{\alpha(0,u)^{2}}du\right]$ $\displaystyle=\alpha(0,t)^{2}\int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(0,u)^{2}}du$ $\displaystyle=\alpha(0,t)^{2}\int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(0,\tau)^{2} \alpha(\tau,u)^{2}}du\quad\text{as $\alpha(0,u)=\alpha(0,\tau)\alpha(\tau,u)$ by (\ref{eq:conditional forward alternate parameterisation a})}$ $\displaystyle=\frac{\alpha(0,t)^{2}}{\alpha(0,\tau)^{2}}\int_{\tau}^{t}\frac{g (u)^{2}}{\alpha(\tau,u)^{2}}du$ $\displaystyle=\alpha(\tau,t)^{2}\int_{\tau}^{t}\frac{g(u)^{2}}{\alpha(\tau,u)^ {2}}du$ $\displaystyle=\beta(\tau,t)^{2}.$ $$

∎

###### Lemma H.2 (Conditional Forward Alternate Parameterisation) .

###### Proof.

### H.3 Score-model link

The following Score-Model Link theorem is based on Karras et al.’s [38] argument. However, we provide a minor extension by conditioning on measurable sets taken from the sigma-algebra of an auxiliary random variable, $Y$. For additional treatments see [38, 60, 61].

###### Theorem H.3 (Score-Model Link) .

Let $\boldsymbol{x}_{t}\in\mathbb{R}^{m}$, $f(t):\mathbb{R}\rightarrow\mathbb{R}$ and $g(t):\mathbb{R}\rightarrow\mathbb{R}$ be continuous functions of $t$, and $\mathop{\cdot}d\boldsymbol{B}_{t}$ denote an Itô integral with respect to the standard multi-dimensional Brownian motion process. Suppose that $\boldsymbol{x}_{t}$ evolves according to the diffusion,

$$ $d\boldsymbol{x}_{t}=f(t)\boldsymbol{x}_{t}dt+g(t)\cdot d\boldsymbol{B}_{t},$ (17) $$

with observed initial data distribution, $p_{\text{data}}(\boldsymbol{x}_{0}|y\in\xi)$, where $\xi$ is taken to be an arbitrary element of the sigma-algebra, $\mathcal{Y}$, associated with the random variable(^1^11Note that this is a slight abuse of notation. We are assuming that $(\Omega_{Y},\mathcal{Y},P)$ is a probability space and $Y:\Omega_{Y}\rightarrow\Omega_{Y}$ a random variable such that $Y(\omega)=\omega\ \forall\ \omega\in\Omega_{Y}$. That is to say, we do not need to take the pre-image when crafting probability statements.) $Y$, i.e., $\xi\in\mathcal{Y}$.

Define

$$ $\hat{\boldsymbol{x}}_{0}(\boldsymbol{x}_{t},t,\xi)=\frac{\boldsymbol{x}_{t}- \beta(t)\boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t,\xi)}{\alpha(t)},$ (18) $$

where $\alpha(t)=\exp\left(\int_{0}^{t}f(u)du\right)$, $\beta(t)^{2}=\alpha(t)^{2}\int_{0}^{t}\frac{g(u)^{2}}{\alpha(u)^{2}}du$, and $\boldsymbol{\epsilon}_{\theta}:\mathbb{R}^{m}\times\mathbb{R}\times\mathcal{Y}
\rightarrow\mathbb{R}^{m}$ is a model parameterised by $\theta\in\Theta$ with sufficient capacity such that the Universal Approximation Theorem [62, 63] holds for all $\xi\in\mathcal{Y}$. Then if $\beta(t)^{2}>0\ \forall\ t\in(0,T]$, the following statements are true:

$$ 1. $\displaystyle\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y\in\xi))$ $\displaystyle=-\frac{1}{\beta(t)}\boldsymbol{\epsilon}_{\theta^{\star}}( \boldsymbol{x}_{t},t,\xi)\quad\forall\ t\in(0,T],\ \boldsymbol{x}_{t}\in \mathbb{R}^{m},\ \xi\in\mathcal{Y};$ (19) 2. $\displaystyle\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t,\xi)$ $\displaystyle=\frac{{\operatorname*{\mathbb{E}}}_{\boldsymbol{x}_{0}\sim p_{ \text{data}}(\boldsymbol{x}_{0}|y\in\xi)}\left[\frac{1}{\beta(t)}\bigl{(} \boldsymbol{x}_{t}-\alpha(t)\boldsymbol{x}_{0}\bigr{)}p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0})\right]}{p(\boldsymbol{x}_{t}|y\in\xi)}\quad\forall\ t\in(0 ,T],$ (20) $\boldsymbol{x}_{t}\in\mathbb{R}^{m},\ \xi\in\mathcal{Y}$ ; where $\displaystyle\theta^{\star}$ $\displaystyle\vcentcolon=\underset{\theta}{\textup{arg}\min}\ {\operatorname*{ \mathbb{E}}}_{\boldsymbol{x}_{0},\boldsymbol{x}_{t},t\sim p(\boldsymbol{x}_{0} ,\boldsymbol{x}_{t},t|y\in\xi)}\left[\left\lVert\boldsymbol{x}_{0}-\hat{ \boldsymbol{x}}_{0}(\boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\right],$ (21) $p(\boldsymbol{x}_{0},\boldsymbol{x}_{t},t|y\in\xi)=p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0})p_{\text{data}}(\boldsymbol{x}_{0}|y\in\xi)p(t)$ , and $p(t)\vcentcolon=\frac{1}{T}$ . $$

###### Proof.

Let $\{\boldsymbol{x}_{0}^{(1)},\boldsymbol{x}_{0}^{(2)},\dots,\boldsymbol{x}_{0}^{
(N)}\}$ and $\{y^{(1)},y^{(2)},\dots,y^{(N)}\}$ denote observed values of $\boldsymbol{x}_{0}$ and $Y$. Then the data density function is given by:

$$ $p_{\text{data}}(\boldsymbol{x}_{0}|y\in\xi)=\frac{\sum_{i=1}^{N}\delta( \boldsymbol{x}_{0}-\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}{ \sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}},$ (22) $$

where $\delta(\cdot)$ denotes the Dirac delta function and $\mathds{1}_{\{\cdot\}}$ is the indicator function. The forward diffusion process in ([17](https://arxiv.org/html/2505.20934v1#A8.E17)) is independent of $Y$, and thus,

$$ $\displaystyle p(\boldsymbol{x}_{t}|y\in\xi)$ $\displaystyle=\int_{\Omega}p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})p_{\text{ data}}(\boldsymbol{x}_{0}|y\in\xi)d\boldsymbol{x}_{0}$ $\displaystyle=\frac{\sum_{i=1}^{N}p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i) })\mathds{1}_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}.$ (23) Substituting ( 23 ) into the LHS of ( 19 ), $\displaystyle\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y\in\xi))$ $\displaystyle=\nabla_{\boldsymbol{x}_{t}}\log\left(\frac{\sum_{i=1}^{N}p( \boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}{ \sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}\right)$ $\displaystyle=\nabla_{\boldsymbol{x}_{t}}\log\left(\sum_{i=1}^{N}p(\boldsymbol {x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}\right)$ $\displaystyle=\frac{\sum_{i=1}^{N}\nabla_{\boldsymbol{x}_{t}}p(\boldsymbol{x}_ {t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}p( \boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}.$ By Theorem H.1 , $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})=\mathcal{N}\left(\alpha(t)\boldsymbol {x}_{0},\ \beta(t)^{2}I^{(m\times m)}\right)\implies\nabla_{\boldsymbol{x}_{t} }p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})=-\frac{1}{\beta(t)^{2}}(\boldsymbol{ x}_{t}-\alpha(t)\boldsymbol{x}_{0})p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})$ , thus, $\displaystyle\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y\in\xi))$ $\displaystyle=-\frac{1}{\beta(t)^{2}}\frac{\sum_{i=1}^{N}(\boldsymbol{x}_{t}- \alpha(t)\boldsymbol{x}_{0}^{(i)})p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i) })\mathds{1}_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}.$ (24) $$

Now we consider the optimisation problem in ([21](https://arxiv.org/html/2505.20934v1#A8.Ex35)).

$$ $\displaystyle\mathcal{L}(\xi;\theta)={\operatorname*{\mathbb{E}}}_{\boldsymbol {x}_{0},\boldsymbol{x}_{t},t\sim p(\boldsymbol{x}_{0},\boldsymbol{x}_{t},t|y \in\xi)}\left[\left\lVert\boldsymbol{x}_{0}-\hat{\boldsymbol{x}}_{0}( \boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[{\operatorname*{ \mathbb{E}}}_{\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0}|y\in\xi)}\left[{ \operatorname*{\mathbb{E}}}_{\boldsymbol{x}_{t}\sim p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0})}\left[\left\lVert\boldsymbol{x}_{0}-\hat{\boldsymbol{x}}_{ 0}(\boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\right]\right]\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[{\operatorname*{ \mathbb{E}}}_{\boldsymbol{x}_{0}\sim p(\boldsymbol{x}_{0}|y\in\xi)}\left[\int_ {\Omega_{\boldsymbol{x}_{t}}}\left\lVert\boldsymbol{x}_{0}-\hat{\boldsymbol{x} }_{0}(\boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\ p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0})d\boldsymbol{x}_{t}\right]\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[\int_{\Omega_{ \boldsymbol{x}_{0}}}\int_{\Omega_{\boldsymbol{x}_{t}}}\left\lVert\boldsymbol{x }_{0}-\hat{\boldsymbol{x}}_{0}(\boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\ p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})d\boldsymbol{x}_{t}\ p(\boldsymbol{x}_ {0}|y\in\xi)d\boldsymbol{x}_{0}\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[\int_{\Omega_{ \boldsymbol{x}_{0}}}\int_{\Omega_{\boldsymbol{x}_{t}}}\left\lVert\boldsymbol{x }_{0}-\hat{\boldsymbol{x}}_{0}(\boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\ p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0})d\boldsymbol{x}_{t}\ \left(\frac{\sum_ {i=1}^{N}\delta(\boldsymbol{x}_{0}-\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{( i)}\in\xi\}}}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}\right)d\boldsymbol {x}_{0}\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[\frac{1}{\sum_{i= 1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}\sum_{i=1}^{N}\int_{\Omega_{\boldsymbol{x }_{t}}}\left\lVert\boldsymbol{x}_{0}^{(i)}-\hat{\boldsymbol{x}}_{0}( \boldsymbol{x}_{t},t,\xi)\right\rVert_{2}^{2}\ p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0}^{(i)})d\boldsymbol{x}_{t}\ \mathds{1}_{\{y^{(i)}\in\xi\}}\right]$ $\displaystyle={\operatorname*{\mathbb{E}}}_{t\sim p(t)}\left[\frac{1}{\sum_{i= 1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}\int_{\Omega_{\boldsymbol{x}_{t}}}\sum_{i =1}^{N}p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in \xi\}}\left\lVert\boldsymbol{x}_{0}^{(i)}-\hat{\boldsymbol{x}}_{0}(\boldsymbol {x}_{t},t,\xi)\right\rVert_{2}^{2}d\boldsymbol{x}_{t}\right]$ $\displaystyle=\frac{1}{T}\frac{1}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}} }\int_{0}^{T}\int_{\Omega_{\boldsymbol{x}_{t}}}\sum_{i=1}^{N}p(\boldsymbol{x}_ {t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}\left\lVert \boldsymbol{x}_{0}^{(i)}-\hat{\boldsymbol{x}}_{0}(\boldsymbol{x}_{t},t,\xi) \right\rVert_{2}^{2}d\boldsymbol{x}_{t}dt$ $\displaystyle=\frac{1}{T}\frac{1}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}} }\int_{0}^{T}\int_{\Omega_{\boldsymbol{x}_{t}}}\underbrace{\sum_{i=1}^{N}p( \boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}} \left\lVert\boldsymbol{x}_{0}^{(i)}-\frac{\boldsymbol{x}_{t}-\beta(t) \boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t,\xi)}{\alpha(t)}\right \rVert_{2}^{2}}_{\ell(\boldsymbol{x}_{t},t,\xi;\theta)}d\boldsymbol{x}_{t}dt$ (25) $$

To minimise ([25](https://arxiv.org/html/2505.20934v1#A8.Ex51)) with respect to $\theta$, it suffices to find $\theta$ such that $\ell(\boldsymbol{x}_{t},t,\xi;\theta)$ is minimised for each combination of $\boldsymbol{x}_{t}$ and $t$. That is to say, we find the optimal value of $\boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t,\xi)$ for each combination of $\boldsymbol{x}_{t}$ and $t$. Furthermore, $\ell(\boldsymbol{x}_{t},t,\xi;\theta)$ constitutes a convex optimisation problem with respect to $\boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t,\xi)$. Thus,

$$ $\displaystyle 0$ $\displaystyle=\frac{\partial\ell}{\partial\boldsymbol{\epsilon}_{\theta}}$ $\displaystyle=\sum_{i=1}^{N}\frac{2\beta(t)}{\alpha(t)}p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}\left(\boldsymbol{x}_{0 }^{(i)}-\frac{\boldsymbol{x}_{t}-\beta(t)\boldsymbol{\epsilon}_{\theta}( \boldsymbol{x}_{t},t,\xi)}{\alpha(t)}\right)$ $\displaystyle=\sum_{i=1}^{N}p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)}) \mathds{1}_{\{y^{(i)}\in\xi\}}\left(\alpha(t)\boldsymbol{x}_{0}^{(i)}- \boldsymbol{x}_{t}+\beta(t)\boldsymbol{\epsilon}_{\theta}(\boldsymbol{x}_{t},t ,\xi)\right)$ $\displaystyle\implies\sum_{i=1}^{N}(\boldsymbol{x}_{t}-\alpha(t)\boldsymbol{x} _{0}^{(i)})$ $\displaystyle p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{( i)}\in\xi\}}=\sum_{i=1}^{N}\beta(t)\boldsymbol{\epsilon}_{\theta}(\boldsymbol{ x}_{t},t,\xi)p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1}_{\{y^{(i )}\in\xi\}}$ $\displaystyle\implies\boldsymbol{\epsilon}_{\theta}^{\star}(\boldsymbol{x}_{t} ,t,\xi)$ $\displaystyle=\frac{1}{\beta(t)}\frac{\sum_{i=1}^{N}(\boldsymbol{x}_{t}-\alpha (t)\boldsymbol{x}_{0}^{(i)})p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)}) \mathds{1}_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}p(\boldsymbol{x}_{t}|\boldsymbol {x}_{0}^{(i)})\mathds{1}_{\{y^{(i)}\in\xi\}}}$ (26) $\displaystyle=\frac{1}{\beta(t)}\frac{\frac{\sum_{i=1}^{N}(\boldsymbol{x}_{t}- \alpha(t)\boldsymbol{x}_{0}^{(i)})p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i) })\mathds{1}_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}} }}{\frac{\sum_{i=1}^{N}p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}^{(i)})\mathds{1 }_{\{y^{(i)}\in\xi\}}}{\sum_{i=1}^{N}\mathds{1}_{\{y^{(i)}\in\xi\}}}}$ $\displaystyle=\frac{{\operatorname*{\mathbb{E}}}_{\boldsymbol{x}_{0}\sim p_{ \text{data}}(\boldsymbol{x}_{0}|y\in\xi)}\left[\frac{1}{\beta(t)}\bigl{(} \boldsymbol{x}_{t}-\alpha(t)\boldsymbol{x}_{0}\bigr{)}p(\boldsymbol{x}_{t}| \boldsymbol{x}_{0})\right]}{p(\boldsymbol{x}_{t}|y\in\xi)},$ (27) $$

$\forall\ \boldsymbol{x}_{t}\in\mathbb{R}^{m},\ t\in(0,T],\ \xi\in\mathcal{Y}$. As $f(t)$ and $g(t)$ are both continuous functions then $\alpha(t)$ and $\beta(t)$ are also continuous. It follows that ([26](https://arxiv.org/html/2505.20934v1#A8.Ex56)) is continuous with respect to $\boldsymbol{x}_{t}$ and $t$, as it is the sum of continuous functions and $\beta(t)^{2}>0\ \forall\ t\in(0,T]$. Thus, the Universal Approximation Theorem [62, 63] holds and there exists a $\theta^{\star}\in\Theta$ such that $\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t,\xi)=\boldsymbol{
\epsilon}_{\theta}^{\star}(\boldsymbol{x}_{t},t,\xi)\ \forall\ \boldsymbol{x}_
{t}\in\mathbb{R}^{m},\ t\in(0,T],\ \xi\in\mathcal{Y}$. Finally, by comparing ([24](https://arxiv.org/html/2505.20934v1#A8.Ex42)) and ([26](https://arxiv.org/html/2505.20934v1#A8.Ex56)) we observe that,

$$ $\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y\in\xi))=-\frac{1}{\beta (t)}\boldsymbol{\epsilon}_{\theta^{\star}}(\boldsymbol{x}_{t},t,\xi),$ $$

which proves ([19](https://arxiv.org/html/2505.20934v1#A8.Ex33)), and ([20](https://arxiv.org/html/2505.20934v1#A8.Ex34)) follows from ([27](https://arxiv.org/html/2505.20934v1#A8.Ex58)).
∎

It is worth noting that Theorem [H.3](https://arxiv.org/html/2505.20934v1#A8.Thmtheorem3) unifies the score-model link between conditional and unconditional models. That is to say,

$$ $\displaystyle\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}))$ $\displaystyle=\nabla_{\boldsymbol{x}_{t}}\log(p(\boldsymbol{x}_{t}|y\in\Omega_ {y}))$ $\displaystyle=-\frac{1}{\beta(t)}\boldsymbol{\epsilon}_{\theta^{\star}}( \boldsymbol{x}_{t},t,\Omega_{y}).$ $$

###### Theorem H.3 (Score-Model Link) .

###### Proof.

## Appendix I Transferability of perturbation-based attacks on ImageNet-Val

Here we provide the results of an investigation into the transferability of AutoAttack [4] and PGD [3] on the ImageNet-Val [52] dataset. We use AutoAttack implementations from both the original repository [4] and an implementation within the torchattacks [64] Python package. The torchattacks implementation of PGD is used. We generate all samples using the ImageNet-Val dataset, default attack parameters and a ResNet-50 [46] victim classifier. We examine the performance of ResNet-8, ResNet-34, ResNet-152, Incetption-v3 [47] and ViT [48] classifiers on these adversarial samples.

Note that unlike in the main paper, we have both “clean” and “adversarial” versions of the same image i.e., the image before the attack ($\boldsymbol{x}$) and the image after the attack ($\tilde{\boldsymbol{x}}$); thus, in this experiment we report an “adjusted” attack success rate that accounts for natural errors in the dataset(^2^22This was not possible in the main paper as NatADiff and other generative approaches create an adversarial image from scratch, i.e., there is no “clean” version. To ensure a fair comparison in the main paper we use an unadjusted definition of ASR). Furthermore, we allow the class of the unconstrained attack to vary between classifiers, which increases ASR of untargeted transfer attacks(^3^33This was not done in the main paper as it would have resulted in $\text{untargeted ASR}=1-\text{accuracy}$.). Given a set of clean samples, $\{\boldsymbol{x}_{1},\boldsymbol{x}_{2},\dots,\boldsymbol{x}_{N}\}$, the corresponding adversarial samples, $\{\tilde{\boldsymbol{x}}_{1},\tilde{\boldsymbol{x}}_{2},\dots,\tilde{
\boldsymbol{x}}_{N}\}$, the associated true labels, $\{y_{1},y_{2},\dots,y_{N}\}$, and–in the case of targeted attacks–the target adversarial labels, $\{\tilde{y}_{1},\tilde{y}_{2},\dots,\tilde{y}_{N}\}$, we define the targeted and untargeted attack success rate (ASR) against a classifier, $f:X\rightarrow\mathcal{Y}$, as:

$$ targeted ASR $\displaystyle=\frac{\sum_{i=1}^{N}\mathds{1}_{\{f(x_{i})=y_{i}\}}\cdot\mathds{ 1}_{\{f(\tilde{x}_{i})=\tilde{y}_{i}\}}}{\sum_{i=1}^{N}\mathds{1}_{\{f(x_{i})= y_{i}\}}};$ untargeted ASR $\displaystyle=\frac{\sum_{i=1}^{N}\mathds{1}_{\{f(x_{i})=y_{i}\}}\cdot\mathds{ 1}_{\{f(\tilde{x}_{i})\neq y_{i}\}}}{\sum_{i=1}^{N}\mathds{1}_{\{f(x_{i})=y_{i }\}}},$ $$

where $\mathds{1}_{\{\cdot\}}$ is the indicator function.

**Table 6: Classifier accuracy on adversarial samples generated by AutoAttack [4] and PGD [3] using a ResNet-50 victim classifier. Bold values highlight the most effective attack per classifier.**
| Adversarial<br>Generator | Classifier Accuracy |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| ResNet-18 | ResNet-34 | ResNet-50 | ResNet-152 | Inc-v3 | ViT |  |
| None | $42.4\%$ | $52.2\%$ | $78.7\%$ | $79.9\%$ | $54.9\%$ | $82.1\%$ |
| AutoAttack (Original) | $36.7\%$ | $46.9\%$ | $\mathbf{0.0}\boldsymbol{\%}$ | $72.2\%$ | $52.7\%$ | $81.5\%$ |
| AutoAttack (torchattacks) | $\mathbf{30.7}\boldsymbol{\%}$ | $\mathbf{38.9}\boldsymbol{\%}$ | $\mathbf{0.0}\boldsymbol{\%}$ | $\mathbf{59.8}\boldsymbol{\%}$ | $\mathbf{49.14}\boldsymbol{\%}$ | $\mathbf{79.9}\boldsymbol{\%}$ |
| PGD (torchattacks) | $37.4\%$ | $47.9\%$ | $0.3\%$ | $76.6\%$ | $53.4\%$ | $81.7\%$ |

**Table 7: Untargeted attack success rate on adversarial samples generated by AutoAttack [4] and PGD [3] using a ResNet-50 victim classifier. Bold values highlight the most effective attack per classifier.**
| Adversarial<br>Generator | Untargeted Attack Success Rate (ASR) |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| ResNet-18 | ResNet-34 | ResNet-50 | ResNet-152 | Inc-v3 | ViT |  |
| AutoAttack (Original) | $16.2\%$ | $12.9\%$ | $\mathbf{100.0}\boldsymbol{\%}$ | $10.7\%$ | $6.4\%$ | $2.1\%$ |
| AutoAttack (torchattacks) | $\mathbf{31.2}\boldsymbol{\%}$ | $\mathbf{28.7}\boldsymbol{\%}$ | $\mathbf{100.0}\boldsymbol{\%}$ | $\mathbf{27.2}\boldsymbol{\%}$ | $\mathbf{13.9}\boldsymbol{\%}$ | $\mathbf{5.0}\boldsymbol{\%}$ |
| PGD (torchattacks) | $16.6\%$ | $12.2\%$ | $99.6\%$ | $4.9\%$ | $6.6\%$ | $2.5\%$ |

**Table 8: Targeted attack success rate on adversarial samples generated by PGD [3] using a ResNet-50 victim classifier.**
| Adversarial<br>Generator | Targeted Attack Success Rate (ASR) |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| ResNet-18 | ResNet-34 | ResNet-50 | ResNet-152 | Inc | ViT |  |
| PGD (torchattacks) | $0.1\%$ | $0.1\%$ | $99.2\%$ | $0.1\%$ | $0.0\%$ | $0.0\%$ |

The experiments show that perturbation-based adversarial samples generated by AutoAttack and PGD transfer well within classifier families (e.g., ResNet), but their effectiveness drops significantly when transferred to architecturally distinct models such as Inception-v3 and ViT. In particular, transfer attacks against ViT exhibit minimal success. This supports the findings of the main paper and indicates that perturbation-based attacks leverage architectural properties of a classifier to cause misclassifications. These attacks are tailored towards specific architectures and do not transfer well when there are significant architectural differences between classifiers. Furthermore, ViT is the current state-of-the-art in image classification, and it appears that it learns richer and more robust feature representations which are less susceptible to perturbation-based adversaries. The findings of this investigation support the results from the main paper and strengthen the argument for the use of adversarial structural elements as a means to create highly transferable adversarial samples.

## Appendix J Resistance to adversarial defences

It has previously been shown that perturbation-based adversarial attacks are sensitive to image transformations–such as rotations, crops, and translations–which can substantially reduce attack success rates [45]. In addition to such transformation-based defences, purification approaches aim to remove adversarial noise prior to classification. One such method is DiffPure [11], which leverages a denoising diffusion model to project adversarial samples back onto the natural image manifold. Given an adversarial image, $\tilde{\boldsymbol{x}}_{0}$, the forward diffusion process, $p(\boldsymbol{x}_{t}|\boldsymbol{x}_{0}=\tilde{\boldsymbol{x}}_{0})$, is applied for $t\ll T$ (recall that $T$ is the termination time of the forward process), introducing Gaussian noise without fully destroying the original signal. The sample is then passed through the reverse-time diffusion process [40] or flow ODE [41] to recover a purified image. Nie et al. [11] empirically demonstrated and theoretically proved that this procedure effectively removes perturbation-based adversarial noise, enabling the reverse process to reconstruct a “clean” version of the image. Intuitively, the noise injected during forward diffusion overwhelms the adversarial signal, allowing the diffusion model to project the corrupted sample back onto the natural image manifold.

We evaluate the robustness of standard image transformations and DiffPure against adversarial samples generated by PGD [3], AutoAttack [4], adversarial classifier guidance [16], and NatADiff. For each method, we generate 2,000 adversarial samples using a ResNet-50 [46] victim classifier. NatADiff and adversarial classifier guidance are tested in both targeted and untargeted modes, with target classes selected either at random or via similarity targeting (see Section 3.2). Defences are applied as a pre-processing step to classification; for image transformations, we average classification probabilities over augmented views obtained via cropping, rotation, and grayscale conversion. To quantify defence effectiveness, we report classifier accuracy and attack success rate (ASR).

Our results show that DiffPure provides a stronger defence than transformation-based methods, as seen in Tables [9](https://arxiv.org/html/2505.20934v1#A10.T9) and [10](https://arxiv.org/html/2505.20934v1#A10.T10). For PGD and adversarial classifier guidance attacks, DiffPure effectively neutralizes the adversarial perturbations—reducing ASR to approximately $0\%$ and recovering classifier accuracy to within $5\%$ of the clean baseline. However, neither defence is able to fully return model performance to the attack-free baseline, particularly when faced with the samples produced via generative methods. AutoAttack, while appearing more resilient to purification, has inflated ASR values due to its treatment of pre-existing test-time errors as successful attacks. This is most notable when comparing AutoAttack’s reported ASR with the classifier accuracy in Table [10](https://arxiv.org/html/2505.20934v1#A10.T10)–there is minimal accuracy drop from the attack-free baseline, which indicates that the adversarial perturbations were successfully mitigated.

Consistent with findings in the main paper, untargeted attacks outperform their targeted counterparts across all defences, both in terms of classifier accuracy and ASR (see Tables [9](https://arxiv.org/html/2505.20934v1#A10.T9) and [10](https://arxiv.org/html/2505.20934v1#A10.T10)). Furthermore, NatADiff surpasses all other attack methods under both transformation and DiffPure defences, achieving higher ASR and inducing greater accuracy degradation. Given that natural adversarial samples are known to bypass perturbation-based defences and image transformations [13], these results further support our claim that NatADiff generates adversarial examples that are more semantically aligned with naturally occurring test-time errors.

**Table 9: Classifier accuracy and attack success rate of transform-purified adversarial samples generated by AutoAttack PGD [3], [4], adversarial classifier guidance [16], and NatADiff, each using a ResNet-50 [46] victim classifier. Superscripts T and U denote targeted and untargeted attacks, respectively. Superscript † denotes a performance baseline of non-purified, non-adversarial samples generated using SD1.5 [28]. For each evaluation metric, bold values highlight the most effective attack.**
| Adversarial<br>Generator |  | Classifier Accuracy |  |  | Attack Success Rate (ASR) |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |
| None^† |  | $73.1\%$ | $70.3\%$ | $77.5\%$ | $71.6\%$ | $70.6\%$ |  |  |  |  |  |  |  |
| PGD^T |  | $46.4\%$ | $68.5\%$ | $70.0\%$ | $64.3\%$ | $62.4\%$ |  |  | $12.6\%$ | $0.1\%$ | $0.1\%$ | $0.2\%$ | $0.2\%$ |
| AAttack^U |  | $20.2\%$ | $67.5\%$ | $70.4\%$ | $63.1\%$ | $61.0\%$ |  |  | $58.9\%$ | $15.2\%$ | $9.9\%$ | $13.2\%$ | $13.3\%$ |
| AdvClass^T |  | $44.9\%$ | $65.2\%$ | $66.7\%$ | $60.3\%$ | $58.0\%$ |  |  | $8.8\%$ | $0.1\%$ | $0.0\%$ | $0.2\%$ | $0.2\%$ |
| AdvClass^U |  | $25.3\%$ | $57.0\%$ | $62.1\%$ | $53.1\%$ | $51.6\%$ |  |  | $48.8\%$ | $12.8\%$ | $8.4\%$ | $9.9\%$ | $10\%$ |
| NatADiff^T |  | $22.8\%$ | $40.0\%$ | $50.0\%$ | $36.0\%$ | $33.1\%$ |  |  | $35.6\%$ | $13.9\%$ | $4.4\%$ | $12.9\%$ | $11.1\%$ |
| NatADiff^U |  | $\mathbf{14.4}\boldsymbol{\%}$ | $\mathbf{33.9}\boldsymbol{\%}$ | $\mathbf{47.9}\boldsymbol{\%}$ | $\mathbf{30.8}\boldsymbol{\%}$ | $\mathbf{29.2}\boldsymbol{\%}$ |  |  | $\mathbf{68.1}\boldsymbol{\%}$ | $\mathbf{47.5}\boldsymbol{\%}$ | $\mathbf{30.1}\boldsymbol{\%}$ | $\mathbf{45.0}\boldsymbol{\%}$ | $\mathbf{42.8}\boldsymbol{\%}$ |

**Table 10: Classifier accuracy and attack success rate of DiffPure-purified adversarial samples generated by AutoAttack PGD [3], [4], adversarial classifier guidance [16], and NatADiff, each using a ResNet-50 [46] victim classifier. Superscripts T and U denote targeted and untargeted attacks, respectively. Superscript † denotes a performance baseline of non-purified, non-adversarial samples generated using SD1.5 [28]. For each evaluation metric, bold values highlight the most effective attack.**
| Adversarial<br>Generator |  | Classifier Accuracy |  |  | Attack Success Rate (ASR) |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |  | ResNet-50 | Inc-v3 | ViT | AdvRes | AdvInc |  |
| None^† |  | $73.1\%$ | $70.3\%$ | $77.5\%$ | $71.6\%$ | $70.6\%$ |  |  |  |  |  |  |  |
| PGD^T |  | $68.5\%$ | $65.3\%$ | $73.3\%$ | $67.4\%$ | $65.8\%$ |  |  | $0.0\%$ | $0.0\%$ | $0.1\%$ | $0.1\%$ | $0.1\%$ |
| AAttack^U |  | $69.1\%$ | $65.2\%$ | $73.3\%$ | $68.3\%$ | $67.6\%$ |  |  | $16.0\%$ | $13.2\%$ | $10.8\%$ | $11.7\%$ | $12.9\%$ |
| AdvClass^T |  | $64.8\%$ | $62.7\%$ | $69.9\%$ | $64.3\%$ | $62.7\%$ |  |  | $0.1\%$ | $0.0\%$ | $0.1\%$ | $0.2\%$ | $0.1\%$ |
| AdvClass^U |  | $57.5\%$ | $57.6\%$ | $65.6\%$ | $60.0\%$ | $58.5\%$ |  |  | $11.7\%$ | $7.4\%$ | $6.8\%$ | $7.6\%$ | $8.3\%$ |
| NatADiff^T |  | $43.8\%$ | $43.2\%$ | $57.8\%$ | $47.1\%$ | $45.4\%$ |  |  | $16.4\%$ | $6.4\%$ | $3.9\%$ | $7.3\%$ | $7.1\%$ |
| NatADiff^U |  | $\mathbf{28.7}\boldsymbol{\%}$ | $\mathbf{37.9}\boldsymbol{\%}$ | $\mathbf{52.3}\boldsymbol{\%}$ | $\mathbf{39.1}\boldsymbol{\%}$ | $\mathbf{38.6}\boldsymbol{\%}$ |  |  | $\mathbf{54.5}\boldsymbol{\%}$ | $\mathbf{35.7}\boldsymbol{\%}$ | $\mathbf{27.9}\boldsymbol{\%}$ | $\mathbf{37.7}\boldsymbol{\%}$ | $\mathbf{36.5}\boldsymbol{\%}$ |

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 4
presentation: 3
questions: Concerns are in the weakness section
soundness: 3
strengths: (S1) Vastly Superior Transferability
The paper's primary strength lies in its demonstration of vastly superior transferability. As shown in Table 1, the proposed NatADiff significantly outperforms all competitors, including SOTA diffusion-based attacks like AdvClass and DiffAttack, in average transfer ASR. The ability to successfully attack a ViT-H model with samples generated from a CNN (RN-50) at such a high success rate strongly suggests the method identifies fundamental, architecture-agnostic vulnerabilities.
(S2) Novel and Well-Motivated Methodology
This strong empirical result is supported by a novel and well-motivated methodology. The core idea of “Adversarial Boundary Guidance”, which leverages the diffusion model’s text-conditioning to guide the sampling trajectory toward the intersection of the true and adversarial classes (e.g., using an “A and B” prompt), is a clever way to operationalize the “shortcut learning” hypothesis. This is logically combined with “augmented classifier guidance” to suppress non-transferable, pixel-level perturbations and force the model to manifest more robust structural features.
(S3) Effectiveness Against Adversarial Defenses
The effectiveness of NatADiff against adversarially trained models (AdvRes and AdvInc) is a significant finding. These models are specifically designed to resist traditional perturbation-based attacks, and NatADiff’s success against them underscores that it operates via a fundamentally different and more robust attack vector.
(S4) Insightful Analysis of Attack Variants
Finally, the paper provides an insightful analysis of the trade-off between the random-targeted (T) and similarity-untargeted (U) variants. The observation that the (T) variant achieves a better FID-A score (alignment with natural errors) at the cost of ASR, while the (U) variant does the opposite, lends support to the hypothesis that natural errors often arise from blending features of disparate classes.
summary: This paper proposes NatADiff, a novel diffusion-based sampling scheme designed to generate natural adversarial samples. The method is motivated by the observation that deep learning models often rely on “contextual cues” to perform “shortcut learning”, which is hypothesized to be the cause of natural test-time errors. The core methodology is termed “Adversarial Boundary Guidance”, a technique that guides the diffusion trajectory toward the intersection of the true and adversarial class manifolds, notably implemented by manipulating text prompts (e.g., “True Class and Adversarial Class”). To enhance attack transferability, this method is combined with “augmented classifier guidance”, and “time-travel sampling” is used to preserve image quality. Experimental results demonstrate that while NatADiff achieves comparable white-box ASR to SOTA methods, it exhibits vastly superior transferability. Furthermore, the generated samples prove effective even against adversarially trained models, suggesting the attack targets a more fundamental vulnerability than traditional perturbation-based attacks.
weaknesses: (W1) Inconsistent motivation for Similarity Targeting: The authors motivate the use of similarity targeting (U) by stating that it “outperform[s] targeted attacks (T)”. While this holds true for CNN surrogates (RN-50, Inc-v3), the paper fails to acknowledge or analyze the contradictory result from the ViT-H surrogate, where the random targeted attack (T) significantly outperforms the similarity-based untargeted attack (U) in average ASR (73.2% vs 69.7%). This omission weakens the claim that similarity targeting is a universally superior strategy, especially for Transformer-based models.
(W2) Lack of Direct Evidence for the “Class Intersection” Claim: The paper’s core hypothesis is that NatADiff guides the trajectory towards the “intersection of the true and adversarial classes” 6. However, the evidence provided is indirect (FID-A scores) or qualitative (image samples). The paper would be significantly strengthened by providing direct, quantitative evidence. For example, a t-SNE/UMAP visualization plotting the embeddings of the generated samples against the manifolds of the true and adversarial classes would be necessary to truly validate that the generated samples lie in this hypothesized “intersection”.
(W3) Limited Scope of Evaluation: The evaluation is confined to the broad, 1000-class ImageNet dataset. It remains unclear how the “contextual cue” hypothesis holds on fine-grained datasets (e.g., Oxford-Pet) where inter-class similarity is high and shortcuts might be far more subtle. While the authors acknowledge this limitation in the appendix, an experiment on a fine-grained dataset would have substantially strengthened the paper's claims of generalizability.
(W4) In Equation 10, it seems you should use argmax instead of argmin. In this equation, you should specify the class with the highest similarity, not the lowest, as the adversarial target.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: - Why do you only limit to ImageNet?
- Alg 1: What does the star after $\epsilon$ mean?
- Will you provide your code?
- You use the RTX 4090. You havn't specified the memory size. Maybe only 24 GB. Can you only attack one image after another or more images at once?
soundness: 3
strengths: - Novel integration of adversarial boundary guidance and classifier augmentations in diffusion models.
- Strong empirical results: high transferability and competitive white-box performance.
- Well-motivated by the link between contextual cues and natural adversarial samples.
- Comprehensive evaluation across multiple architectures and adversarial defenses.
summary: This paper proposes NatADiff, a diffusion-based method for generating highly transferable natural adversarial samples. It introduces adversarial boundary guidance and classifier augmentations to steer diffusion sampling toward class intersections, mimicking naturally occurring test-time errors. NatADiff achieves strong white-box attack success rates and significantly higher transferability than existing methods, with samples more closely resembling natural adversarial examples.
weaknesses: - Computationally expensive due to iterative diffusion sampling.
- Limited to ImageNet; evaluation on more specialized domains is future work.
- Similarity targeting may lead to subtle misclassifications (e.g., between similar classes).

---

confidence: 3
contribution: 2
initial_rating: 6
presentation: 3
questions: 1. Could the authors provide more technical details or ablation results on the construction and effect of the intersection prompt `y ∩ ỹ`? Specifically, how stable are the results under different prompt generation strategies?
2. Could the authors provide rigorous analysis or experimental results on how the adversarial guidance strength s influences gradient vanishing or explosion phenomena, particularly given its threshold-like behavior and dependence on classifier architectures?
3. The paper has a great idea. What needs to be done to adapt NatADiff to domains beyond natural images (e.g., audio, tables, or multimodal data)? Are there any inherent limitations?
soundness: 3
strengths: 1. This paper connects the concept of adversarial bound guidance with the generation of natural adversarial examples, formalizing the intuition that natural errors occur due to overreliance on contextual cues. This is a well-thought-out approach.
2. The method demonstrates excellent technical depth and implementation. It combines time-travel sampling, classifier-free guidance, gradient normalization, and boosting; ablation experiments are conducted for each component to evaluate its contribution.
3. Experimental results demonstrate that NatADiff achieves comparable or even higher attack success rates than state-of-the-art methods in both white-box and transfer settings. The high transferability of its attack is demonstrated across a variety of victim architectures, including convolutional and Transformer-based models.
summary: This study introduces NatADiff, an adversarial sampling framework that leverages a denoising diffusion model to synthesize "natural adversarial examples" by guiding sampled images toward the intersection of the manifold between true and adversarial categories. The authors propose an adversarial boundary guidance method to generate adversarial examples that are more realistic and transferable than baseline attack strategies. Empirical results on ImageNet classifiers and a range of model architectures demonstrate that this approach improves attack transferability and approaches true test-time error.
weaknesses: 1. The manuscript provides no ablation study or discussion on the robustness of the adversarial boundary guidance to variations in the textual implementation of the intersection prompt `y ∩ ỹ`. The stability of results across different prompt engineering strategies (e.g., varying templates or phrasing) remains entirely unexplored.
2. The appendix mentions that the adversarial guidance strength was "manually tuned" and notes that s behaves close to binarization (the attack succeeds only after reaching a threshold). The paper mentions "the optimal value of s varied across classifiers" and reports the specific values in Table 4 but does not verify how s affects gradient stability or vanishing/divergence.
3. All experiments were conducted only on ImageNet and its commonly used architectures. Whether this method can be extended to non-image data modalities, domain-transfer scenarios, or truly open-world environments has not been discussed or empirically verified.

---

confidence: 4
contribution: 2
initial_rating: 4
presentation: 3
questions: 1. Why does adversarial boundary guidance improve transferability? Is there a theoretical link between class intersection and model shortcut learning?

2. How do humans perceive NatADiff-generated samples? Do they align with human judgment of class membership?

3. Can NatADiff be adapted to a "guided editing" setting, where it modifies a provided source image towards an adversarial target, rather than generating from scratch?
soundness: 2
strengths: 1. The adversarial boundary guidance mechanism is a novel and intuitive way to incorporate adversarial features without deviating entirely from the true class, leading to more plausible and transferable samples.

2. NatADiff achieves significantly higher transferability than existing methods across a wide range of models, including adversarially trained classifiers.

3. The paper includes thorough ablation studies and visualizations that validate design choices and provide interpretability.
summary: This paper presents a novel and well-motivated method for generating natural adversarial samples using diffusion models. The proposed NatADiff framework effectively combines adversarial boundary guidance, classifier augmentations, and time-travel sampling to produce highly transferable and semantically meaningful adversarial examples. 

This paper introduces NatADiff, a diffusion-based method for generating natural adversarial samples. The key contributions are: 1）It proposes a novel technique that guides the diffusion sampling trajectory toward the intersection of the true and adversarial classes, encouraging the inclusion of adversarial features in a semantically plausible manner; 2) It uses differentiable image transformations to reduce the influence of constrained adversarial perturbations and promote more robust and transferable adversarial features; 3) 
 It presents an untargeted attack strategy that selects adversarial classes based on semantic similarity using CLIP embeddings, improving attack success and visual quality.
weaknesses: 1. The methodological novelty is limited; the core components of NatADiff lack fundamental innovation. Classifier augmentations and time-travel sampling are directly borrowed from prior works to address known issues (e.g., constrained perturbations and sample quality degradation). The main proposed contribution, adversarial boundary guidance, is essentially a weighted interpolation between two established concepts: classifier-free guidance and the novel but straightforward idea of guiding towards a class intersection ($y ∩ ȳ$) using a composite text prompt. While the combination of these elements is new and effective, the paper does not introduce a groundbreaking new algorithm or theoretical insight. It is better characterized as a skillful and well-engineered integration of existing techniques towards a new objective.


2. NatADiff is computationally expensive (103 seconds per sample), primarily due to the iterative diffusion process and time-travel sampling.

3. Experiments are confined to ImageNet. It is unclear how well NatADiff generalizes to other domains. (eg. CUB-200, Stanford Cars in DiffAttack ).

4.  NatADiff often introduces significant semantic changes to the original content, leading to the generation of implausible or unnatural features (e.g., objects with distorted shapes or unrealistic textures). While this may effectively fool classifiers, it limits the applicability of the attack in real-world scenarios where the adversarial sample must remain a faithful representation of the source semantic content. For instance, in content authentication, medical imaging, or any context where the integrity of specific visual features is paramount, such drastic alterations are not permissible and would be easily flagged by a human observer.

5. The experimental comparison is skewed in favor of NatADiff. Methods like DiffAttack and ACA are reference-based attacks; they are constrained to be similar to a given clean source image. In contrast, NatADiff and AdvClass are generative-based attacks that start from random noise and have the freedom to generate any image on the manifold. This fundamental difference grants NatADiff a significantly larger attack surface, as it is not bound by the semantic content of a specific source image. Comparing these two distinct paradigms under the same "unconstrained attack" umbrella is misleading and overstates NatADiff's advantages.


Decision: Accept (Poster)