Resolution Attack: Exploiting Image Compression to Deceive Deep Neural Networks
Authors: Wangjia Yu
Xiaomeng Fu
Qiao Li
Jizhong Han
Xiaodan Zhang
Venue: ICLR 2025 Poster (2025)
Keywords: Resolution Attack、Image Generation、Deep Learning Robustness、Image Classification
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: This paper introduces the concept of resolution attacks, demonstrates how dual representation of images can lead to misclassification in deep learning classifiers, and how dual-stream generation denoising modules can generate dual-semantic images.

Abstract: Model robustness is essential for ensuring the stability and reliability of machine learning systems. Despite extensive research on various aspects of model robustness, such as adversarial robustness and label noise robustness, the exploration of robustness towards different resolutions, remains less explored. To address this gap, we introduce a novel form of attack: the resolution attack. This attack aims to deceive both classifiers and human observers by generating images that exhibit different semantics across different resolutions. To implement the resolution attack, we propose an automated framework capable of generating dual-semantic images in a zero-shot manner. Specifically, we leverage large-scale diffusion models for their comprehensive ability to construct images and propose a staged denoising strategy to achieve a smoother transition across resolutions. Through the proposed framework, we conduct resolution attacks against various off-the-shelf classifiers. The experimental results exhibit high attack success rate, which not only validates the effectiveness of our proposed framework but also reveals the vulnerability of current classifiers towards different resolutions. Additionally, our framework, which incorporates features from two distinct objects, serves as a competitive tool for applications such as face swapping and facial camouflage. The code is available at https://github.com/ywj1/resolution-attack.

Published as a conference paper at ICLR 2025
RESOLUTION ATTACK: EXPLOITING IMAGE COM- PRESSION TO DECEIVE DEEP NEURAL NETWORKS
Wangjia Yu?.2, Xiaomeng Fu'.2 Qiao Li Jizhong Han' Xiaodan Zhang'*
'Institute of Information Engineering, Chinese Academy of Sciences
Schooo of Cyber Security, University Chinese Academy of Sciences {yuwangjine fuxiaomeng, liqiao, manjizzhong zhangxiaodan)8iie.eee
ABSTRACT
Model robustness is essential for ensuring the stability and reliability of machine learning systems. Despite extensive research on various aspects of model robust- ness, such as adversarial robustness and label noise robustness, the exploration of robustness towards different resolutions, remains less explored. To address this gap. we introduce novel form of attack: the resolution attack. This attack aims to deceive both classifiers and human observers by generating images that ex- hibit different semantics across different resolutions. To implement the resolution attack, we propose automated framework capable of generating dual-semantic images in zero-shot manner. Specifically, we leverage large-scale diffusion mod- els for their comprehensive ability to construct images and propose staged de- noising strategy to achieve a smoother transition across resolutions. Through the proposed framework, conduct resolution attacks against various off-the-shelf classifiers. The experimental results exhibit high attack success rate, which not only validates the effectiveness of proposed framework but also reveals the vulnerability of current classifiers towards different resolutions. Additionally, our framework, which incorporates features from distinct objects, serves as com- petitive tool for applications such as face swapping and facial camouflage. The code is available tt/ttpp::/ htap:///itttii siithub... com/ http:u.coom/ww///oolutttt..t -ttiiiinnattttt attack
INTRODUCTION
High Resolution Image
Guitar
Compress
Classifiers
Human Vision
Dog
Figure 1: An Example of the proposed Resolution Attack.
Model robustness has attracted significant attention in recent research, as it focuses on the funda- mental ability of machine learning model maintain its performance and stability in the presence of wide array of challenges, including uncertainties stemming from data variability, disturbances in environments and even deliberate attacks aimed at compromising the model's integrity. Robustness represents comeestone ensure the stability and reliability of models practical applications, particularly in critical domains such as autonomous driving and medical diagnosis.
There exists extensive research model robustness across diverse dimensions, such as adversarial robustness and label noise robustness. However, research on robustness across different resolutions
"Corresoonding Author

---

Published as a conference paper at ICLR 2025
remains underexplored. In real- scenarios, classifiers are often exposed to images ranging from very high fidelity to severely compressed. Classifiers should exhibit robustness across these varying resolutions, particularly for low-resolution images, many practical applications inevitably involve such inputs. For example, images on social media platforms or loT devices are often compressed to reduce storage and transmission costs. Similarly, in autonomous driving or surveillance systems, objects that are distant or small are frequently captured in low resolution due to technological lim- itations. These low-resolution images may degrade semantic content and introduce inaccuracies in predictions, particularly under maliciously crafted inputs. As illustrated in Figure [ an intri- cate high-resolution image (e.g.. guitar) is initially compressed align with the classifier's is training resolution, yer the quality degradation during this process leads to misclassification, in this case, identifying the image as dog.
The crafted image effectively exploits a vulnerability in classifiers, successfully executing an attack by presenting dual semantic representations. Specifically, manifests as guitar in high resolution while resembling dog in low resolution, thereby deceiving both classifiers and human observers. This novel attack paradigm, which we term the Resolution Attack (RA), also serves as a metric to assess the robustness of current classifiers towards inputs across various resolutions. The key to exe- cute the resolution attack lies in the crafted image with dual semantic representations, which entails several requirements: 1) High Resolution Fidelity. It ensures that the image appears natural and free of perceptual noise or perturbations, faithfully conveying the semantics of the high-resolution content (e.g., the guitar in Figure (T). 2) Low Resolution Misclassification. The compressed low resolution image should successfully mislead classifier algorithms. Additionally, it must convinc- ingly represent the semantic content at low resolutions (e.g.. the dog in Figure T to deceive human observers. 3) Consistency across Resolutions. The image should exhibit a seamless transition be- tween low and high resolutions, maintaining coherent and continuous depiction across resolutions.
To meet the above requirements, we developed a resolution attack framework capable of automati- cally generating images featuring dual semantic representations. Leveraging the generative priors of large-scale diffusion models, we achieve the generation of high-resolution images with naturalistic and high fidelity. To meet the dual representation requirements at different resolutions, we employ sevide-anddconquee strategy. Specifically, we partition the denoising process in the frequency do- main. The wwwffreueeccy is denoised to reveal the underlying semantics at a lower resolution, while the figh-frequency contributed to the intricate details at higher resolutions. Subsequently, these low and high frequency are seamlessly integrated to produce the desired dual representation. Addition- ally, we introduce a staged strategy that focuses different semanties in different denoising stages, facilitating a smoother transition across resolutions.
Moreover, our proposed framework is capable of generating dual representation images that embed specific entities, such as celebrities or objects, within the high-resolution content. For example, our method can effectively "hiding" the given white dog within various contents, as depicted in Figure bb) We term this variant the Resolution Attack with Source Image. Building upon the aforementioned resolution attack, the resolution attack with source image incorporates an additional source image input to guide the geometry of the generated image. Consequently, there is an additional requirement: the generated image should encapsulate the source image at low resolution. To address this, we incorporate inversion techniques and propose a structural guidance module, which enforces a rigorous structural alignment between the source and generated images.
We employ the proposed framework create images with dual representations for the purpose of resolution attack. The experimental results reveal that current classifiers are vulnerable to the resolution attack. More intriguingly, due to the capability of integrating features from two distinct objects, our framework can be utilized for face swapping and facial camouflage, posing further challenges for face recognition models. Our contributions can be summarized follows:
We define a novel form of attack: the resolution attack. By generating images with dif- ferent semantics across different resolutions, Resolution attacks effectively deceives both classifier and the human observers.
To execute the resolution attack, we propose an automated framework capable of generating dual semantic images in a zero-shot manner. Leveraging the generative priors of large-scale diffusion models and a staged strategy, our framework achieves a seamless transition across different resolutions.
2

---

Published as a conference paper at ICLR 2025
We leverage the proposed framework to attack current classifiers. The high attack success rate validates the efficacy of our proposed framework. Besides, thanks to the capability of incorporating features from two distinct objects, framework emerges viable tool for face swapping and facial camouflage.
2 PRELIMINARY
2.1 DIFFUSION MODELS
Diffusion models (Song et al. 2021 are generative models that aim to learn the inverse of a for- ward noise process, and consist of two processes: the diffusion (forward) process and the denoising (reverse) process. The diffusion process gradually adds noise to the data distribution, ultimately reaching known simple distribution (often Gaussian distribution). This process can be described as a Markov chain, iteratively introducing Gaussian noise into the original image To. with total of T steps:
((iT)/=)) = II ((
where:
( N((zi / 1,
(2)
and the variance schedule f BT predefined. As approaches T, 8g becomes closer to 1. The denoising (reverse) process iteratively denoises pure white noise samples. Diffusion models begin with Gaussian noise and, through series of denoising steps, generate images:
(o( p(or) II po (Z 12+1)
(3)
where:
pa(xr- (2x) = -N(x uo (2e, 1). Eo (a ()) and [x 1) is constant depending on 3r,, and u 1) is predicted by neural network as:
(4)
Bt vaa VI ae co(
1
(5)
2.2 DDIM INVERSION
To expedite the denoising process and ensure a unique output, deterministic DDIM sampling (Song et al. 2021) has been introduced, thereby enabling skip-step strategy. The diffusion process, named DDIM inversion, has been suggested for the DDIM sampling. The DDIM inversion technique is method for efficient data generation, which accelerates the generation process by introducing deterministic non-Markovian process, while maintaining the high quality of the generated samples. Such an inversion process, shown in Equation 6, provides deterministic transformation between an input image and corrupted version.
It. VI (xee(Is,t) - + 111-04416000
Te+1
/ar+1
(6)
Vor
In our work, we employ DDIM inversion to transform an input image into the noisy latent embed- ding. This latent embedding then used to generate images subjected resolution attack.
PROBLEM FORMULATION
In this paper, we propose Resolution Attack (RA), which are designed to craft high-resolution im- ages that exhibit entirely distinct semantic content in their low-resolution counterparts. The resolu- tion attack, as exemplified in Figure poses significant challenge to both automated classifiers and human observers, underscoring the potential vulnerabilities inherent in image recognition systems.

---

Published as a conference paper at ICLR 2025
We categorize the RA attack into two distinct types, each tailored specific scenarios. The naive resolution attack, focuses solely on generating images that exhibit dual semantic representations across resolutions, without imposing additional constraints. Conversely, in scenarios requiring the generation of tailored content for specific individuals or objects, supplementary constraints on the generative process is needed. Specifically, given source image is manipulated to exhibit the dual representation across resolutions. We specialize this form of attack as the resolution attack with source image. We will detail these two attacks in the following.
3.1 RESOLUTION ATTACK
Given paired class (Cz, CH), the resolution attack (RA) algorithm M produces a high-resolution image I that possesses dual semantic representations: the original a belongs to CH. while its low- resolution counterpart x, (obtained through downsampling) is classified as Cz. This attack not only requires zy to visually resemble C₁ but also succeeds deceiving the classifier into classifying Fy as Cz. The RA attack can be formulated as:
M(CI, f(x)= f(x)) Ct.
3.2 RESOLUTION ATTACK WITH SOURCE IMAGE
Conversely, the Resolution Attack with Source Image (RAS) aims generate specific output aligned with predefined source image 1,. In addition to the paired input class (Cr, Cи). ). an auxiliary source image I, is introduced modulate the output content. This attach not only fulfills the dual semantic representation requirements in the RAS attack, but also strives to exhibit coherence with the source image. The RAS attack can be formulated as:
M(CL, CK,L,CC,IL. 1e) =
f(x) CH f(x)) Ct. min D(
(8)
where the distance metric measure the similarity between the source image I, and the down- sampled image æ4.
4
METHOD
4.1 МETHOО OVERVIEW
We categorize the attack into two distinct types: the resolution attack and the resolution attack with source image. The framework of these two attacks is illustrated in Figure In the context of the RA attack, depicted in Fig a generator is proposed to generate the dual semantic representa- tion image. Specifically, the Dual-Stream Generative Denoising Module leverages an off-the-shelf diffusion model. Trained with large scale datasets, this diffusion model possess experienced under- standing of how to construct tive Denoising Module can handle simultaneously generating and integrating two distinct semantic contents. Conversely, the RAS attack introduces (Figure 2)) additional requirement: the syn- thesized image must closely resemble the input source image I5. To achieve this, we introduce the DDIM Inversion technique and novel module: the Structural Guidance Module. The former serves to mitigate the randomness introduced by the initial noise, while the latter is designed to more accurately capture the structural attributes of the source image. detailed description of these technologies and modules will be provided in the following.
image. Thanks to this generative priors. the Dual-Shr Stream Genera-
4.2 RESOLUTION ATTACK
The RA attack is designed to produce images that exhibit distinct semantic contents across varying resolutions. It confronts several notable challenges. First and the most significantly, it must adeptly blend two contents, possessing vastly different appearances and shapes, within a single image while simultaneously maintaining the visual quality of each content to achieve smooth conversion from
4

---

Published as a conference paper at ICLR 2025
(u) Resolution
Dual-Stream Generative Denoising Module (DS Module)
G
fy
(x
lig vew with Boveess
UNNa
DS
Down Sample
Filter
Pv
N20. 1)
legs of deg!
Intted
fregusncy Filter
frg. Berertt
Ni Mistadl
12(61)
Initial Sebce
Inversioa
DS Medule
Phonge (Pa)
Control
dagli
Madule
Prosper (P))
schodez
UiNNs
(b) Resolution Attack with Source Image
Structural Guidance Module (SG Module)
Figure 2: Overview of the RA and the RAS attack. The figure illustrates the method of attack, including the RA and the RAS attack approaches. Key components include the Dual-Stream Gener- ative Denoising Module and the Structural Guidance Module, which process noise, source images, and prompts generate dual semantic representation outputs.
one resolution to another. Furthermore, capability to generate high-resolution images also of great significance, given that images of higher resolutions inherently possess increased redundancy, allowing for the semantic content of distinct elements be intricately embedded within this redun- dant pixel space. Specifically, maintaining fine-grained details related to the high-resolution class (CH), while also ensuring that the broader, low-frequency characteristics of the low-resolution class (Cz) are preserved, requires precise control over the frequency components. To achieve this, pro- pose the the Dual-Stream Generative Denoising Module, which leverages the profound generative priors of a large scale diffusion model.
The Dual-Stream Generative Denoising Module. The Dual-Stream Generative Denoising Module (DS Module) is composed of the U-Net (Ronneberger al. 2015) of pretrained diffusion model, a high frequency filter and low frequency filter. By iteratively perform the denoising step, the DS module gradually convert the initial noise into an image with dual semantic representations. In each denoising step, the prompt representing the high and low resolution class are fed into the U-Net separately obtain corresponding noise си and cz. To ensure that the generated high- resolution image accurately represents Cи and the downsampled image faithfully represents the Cz, we manipulate the output noise the frequency domain. Concretely, the final noise is composed of two parts: the low frequency part and the high frequency part. The low frequency part comes from the eg while the rest high frequency component comes from éμ- this way, the generated image will take both C₁ and Cи into account. This process can be represented as:
= co(PL) CH co(HH)
(9)
f= + (H(E))
(10)
where PH and Py is the corresponding text prompts the class input Cи and Cz. For example, the text prompts for the class dog is "a photo of dog".
Time-Dependent Denoising Strategy. effectively generate images with dual semantic represen- tations while maintaining continuity between Cи and C,. we further propose the Time-Dependen Denoising Strategy. Previous researches (Choi et al.) 2022 Kwon et al., 2023 Park et al. 2024 Wang et al. 2024) have revealed that diffusion models first synthesize the coarse structure (cor- responding to Ct). then the finer details are established (corresponding to C₂). Inspired by these insights, design the dimendepnddent denoising strategy that comprises three stages: early, middle, and late. the early and late stage, we drop the dual-stream denoising process and solely utilize Pr, Prr respectively. Specifically, in the early stage, diffusion models focus constructing the
5

---

Published as a conference paper at ICLR 2025
structure which corresponds Cz. thus requires only PL. Conversely, in the late stage. we only employ Pa to establish finer details. The intervening middle stage leverages the dual-stream de- noising process that incorporates both Pr. and Prr By focusing on different semantics in different denoising stages, we facilitate a smoother transition across resolutions.
4.3 RESOLUTION ATTACK WITH SOURCE IMAGE
In certain applications, there is requirement to synthesize images that are tailored to specific individual or object. To address this limitation, we introduce an additional source image to further exert the content of the generated images. This modified approach, termed the RAS attack, aims to ensure that the synthesized images closely resemble the input source image, achieving a higher degree of control in the image generation process.
The Inversion technology. Previous research (Wu et al. 2025 Zhao et al. 2024) have demonstrated the pivotal role of the initial noise distribution in shaping the outcomes of the diffusion models, particularly with respect to the layout, structural composition and form of the synthesized content. Consequently, we harness the DDIM inversion (Song et al. 2021) map the source image back to its corresponding initial noise, denoted as eg- In the RAS attack, we substitute the random initial noise with so as the initialization point for the denoising module. This strategy not only mitigates the randomness introduced by the initial noise, but also ensures that the structural attributes of the source image are preserved throughout the generation process. Furthermore, it establishes a foundation for subsequent image synthesis to produce outputs that maintain structural coherence with the input source image.
The Structural Guidance Module. To further preserve the structure of the source image throughout the generation process, we introduce the Structural Guidance Module (SG Module). This module integrates supplementary guidance in the forms of two distinct structural signals (Zhang al.. (023): depth maps and softedge images. By leveraging these signals, the SG module achieves a fine- grained level of manipulation over the structural aspects of the synthesized images. The depth image provides coarse structural guidance. As an overall contour map of the source image, the depth map captures the fundamental geometric characteristics. By integrating the depth map into the image generation process, we ensure that the coarse structure of the source image is preserved in the synthesized output. In contrast, the softedge image offers more precise shape guidance, focusing on the exact boundaries and contours of the source image, ensuring that the generated images are precisely aligned with the structural and shape characteristics of the source image.
We applied the depth map and softedge image in different stages of noise prediction, experiment- ing with various combinations. Based on experimental results, when the semantic gap between the high-resolution prompt and the low-resolution prompt is relatively small, the best results are achieved when integrating the depth map into the high-resolution noise prediction process and the softedge image into the oow-resolution noise prediction process. In contrast, when the semantic gap between the nigh-resolution and low-resolution prompts is larger, control maps derived from the source image may overly constrain the high-resolution image generation process, hindering its nat- ural semantic expression. It is more effective to stop controlling the high-resolution noise prediction process and only integrate the softedge image into the low-resolution noise prediction process. The combined use of depth and softedge maps offers balanced approach to controlling the image gen- eration process. ensures that the generated image not only reflects the corresponding high and low resolution classes but also preserves the structural integrity of the source image, thereby achieving a harmonious synthesis of resolution specific details and structural coherence.
EXPERIMENT
5.1
EXPERIMENTAL SETUP
Target Classifiers and Datasets. We select a range of widely utilized classifiers to evaluate the
efficacy of our proposed resolution attack. These classifiers include ResNet-50 (224x224) (He et al.)
2016), VGGI9 (224x224) (Simonyan & Zisserman 2015), Inception (299 2299) (Szegedy et al.
2016 EfficientNet (384x 384) (Tan & Le (021). and DenseNet (224x224) (Huang et al.) (017).
All these classifiers are trained on the ImageNet (Russakovsky et al. 2013) dataset, which consists
of over a million images across 1000 categories.

---

Published as a conference paper at ICLR 2025
High resolution images
downsampled images
lion
monkey
shoe
delicious food
vase with flowers
a decorative lamp
Figure 3: Qualitative Results of RA. Top: Labeled attacks using different high-resolution cat- egories, including "lion", "monkey" and "shoe". Bottom: Unlabeled attacks using various high- resolution prompts, such as "delicious food", "a vase with flowers" and "a decorative lamp". On the right are the downsampled images correspond to the low-resolution outputs. We suggest further zooming for better details or refer to higher resolution version provided the Appendix.
High resolution images
downsampled images
lion
monkey
shoe
source image
delicious food
a vase with flowers
a decorative lamp
Figure 4: Qualitative Results of RAS. Top: Labeled attacks using different high-resolution cat- egories, including "lion", "monkey" and "shoe". Bottom: Unlabeled attacks using various high- resolution prompts, such as "delicious food"" right the downsampled images correspond to the low-resolution outputs, alongside the source image. We suggest further zooming in for better details or refer to the higher resolution version provided in the Appendix.
vase flowers"" and "a decorative lamp". On the
Labeled and Unlabeled Attack. To align with the classification capabilities of the aforementioned target classifiers, the input class pairs (Cr, are confined to the categories present within the

---

Published as a conference paper at ICLR 2025
Table 1: The quantitative results of the Resolution Attack.
Labeled Attack
Unlabeled Attack
Classifiers
Acee
Accr
ASRc f
CLIPn CLIP1 f
Acet t
CLIPu CLIPL f
Resnet-50
68.5%
71.8%
71.4%
63.2%
VGG19
65.3%
64.8%
61.6%
59.5%
InceptionV3
76.7%
43.3%
43.6%
0.298
0.248
26.0%
0.256
0.247
EfficientNet
89.6%
67.3%
68.2%
42.0%
DenseNet
69.8%
63.4%
60.5%
69.3%
Table 2: The quantitative results of the Resolution Attack with Source image.
Labeled Attack
Unlabeled Attack
Classifiers
Acce f
Acc f
ASRc
CLIP f CLIPA 1
SSIM Aocy, f
CLIP
CLIP,
SSIM
Resnet-50
59.5%
78.6%
77.1%
38.8%
VGG19
58.1%
77.1%
74.9%
40.0%
InceptionV3
61.3%
46.0%
42.6%
0.295
0.247
0.727
18. 9%
0.266
0.217
0.660
EfficientNet
79.9%
70.7%
70.3%
30.5%
DenseNet
57.4%
77.5%
75.3%
44.0%
ImageNet dataset. We refer to this type of attack as the labeled attack, as the class pairs fall within the scope of the classifiers' training label set. Nonetheless, we claim that our attack can produce dual semantic representations beyond the categories of the training labels. To demonstrate this, we select more abstract concepts as the high-resolution class CH. e.g. "a photo of a calm lake" or "a photo of a delicious plate of food". We maintain C. within the label sets to test the attack success rate. We refer to this type attack as the unlabeled attack.
Evaluation Metries. We evaluate the effectiveness of our attack in following aspects as described Equation 7 and g Biigh/Loo-RRsoltttnng Classification Accuracy (Acen/Acer.): The accuracy of the target classifiers for the high-resolution images x and low-resolution images Tyg. Specifically, we generate high-resolution images with a resolution 512x512 pixels and downsample them by factor of to obtain low wwwrresolution images with resolution of 64x64 pixels. This experimental setup is designed to simulate real-world scenarios where classifiers process low-resolution inputs. When computing accuracy, both high-resolution and low-resolution images are directly fed into the target classifiers. The classifiers preprocess these images using Py Torch'ss default pipelind to ensure alignment with the required input dimensions. Corrective Attack Success Rate (ASRc): The proportion of cases where both the high-resolution image x and its low-resolution counterpart described by their corresponding prompt classes. This metric highlights the
Iy are classified vulnerability of classifiers across resolutions. CLIP Score (CLIP, H,LL,,/CLLII //CCIIP,,): The cosine similarity between the text and image embeddings by CLIP's encoder (Radford et al., 202T) for high/low- resolution images. SSIM: As the RAS requires that the low-resolution image 24 resemble the source image 4, we evaluate this similarity using the SSIM (Wang et al. 2004) between L, and xi.
Implementation Details. We utilize the Stable Diffusion (Rombach et al., 2022) v1.5 as the de- noising U-Net within the Dual-Stream Generative Denoising Module. We iteratively generate the rual-eeerrsnnnttiion images over 300 denoising steps, employing time-dependent strategy where the first 20 steps utilize the Cz, the last 20 steps utilize the Cи and the 260 steps in between utilize both Cr, and Cи- Gaussian Filters employed as the low-frequency filter, while the high-frequency filter is constructed by substracting the low-frequency component extracted by the Gaussian Filters. For RAS. utilize the ddim inversion of 200 steps to embed the source image into the latent noise space. Notably, source image is required for RAS. For this purpose, we collect a dataset of 100 frontal images of dogs as the source images. We give more information about the implementation details in Appendix A
'Specifically, Py preprocesses the input image of varying resolutions to match the required resolution of the target classifier. For instance, ResNet first resizes then central crops the image into 224x224. More information can be found in the Py official document
8

---

Published as a conference paper at ICLR 2025
source
none
softedge
depth
none
softedge
depth
Cy: 'lion' Semantic Gap L
Ch: 'guitar' Semantic Gap t
Figure 5: Different Structure Control with different semantic gaps. When the gap is small (left), leverage the depth map as the structural guidance. When the gap is large, none guidance is used to ensure the expression of the high-resolution class Cи.
5.2 EXPERIMENTAL RESULT
Qualitative Results. Figure and Figure present qualitative examples of RA and RAS respec- tively. It can be observed that the generated images exhibit clear dual semantic representations across resolutions. Furthermore, in the context of RAS (Figure 4), the downsampled images ad- here the Ct class label while concurrently preserving structural fidelity with the source image. This observation underscores the efficacy of integrating the inversion process and the proposed SG module. Due the space constraints, the presented high-resolution images have been compressed to accommodate greater number of generated images. For more detailed view, we encourage readers zoom in on these images or refer the images provided in the Appendix for enhanced clarity.
Quantitative Evaluation. Table and exhibit the quantitative results of RA and RAS towards various classifiers. Our findings indicate that all classifiers are susceptible to the proposed resolu- tion attack. Furthermore, comparison reveals that labeled attacks outperform unlabeled attacks in presenting low-resolution semantics (higher Accr.), This is attributed to the fact that unlabeled at- tack leverage more abstract concepts as the Cи. The abstract representations images mirrored in the low-resolution images, which in turn leads to decrease in Accı, metric. Besides, we observe that both attacks demonstrate impressive CLIP score, with the optimal score reaching 0.298, which further validate that our method can generate dual semantic representations with excellent consistency across resolutions. Additional, thanks to the proposed SG module, the generated images can accurately represent the structure of the source image, achieving SSIM values of 0.727 and 0,660, respectively.
the high-resolution
5.3 ABLATION STUDY
The Structure Guidance Module. We employ both softedge and depth maps to obtain finer control over the structure of the generated images. For better comprehension of the characteristics of these two maps, we provide specific examples in Figure We fix the low-resolution structural guidance as the softedge and examine how different high-resolution structural guidance impacts the generated images. We examine two distinct scenarios: one with small semantic gaps (e.g., dog and lion) and another with large gaps (c.g., dog and guitar). When the gap is small, the absence of control (none) results in the model neglecting the source image's structure. The softedge is another extreme case where too fine-graines structure control provided that the generated image closely resemble the source image but overlook the high-resolution class CH. The depth map offers appropriate structural guidance, enabling successful generation of dual-semantic images. However, when the semantic gap is large, applying structural control like softedge and depth maps impede the expression of Cи, leading to unsatisfactory results. Therefore, the semantic gap is of great significance when leveraging structural guidance.
5.4 RESOLUTION ATTACKS THE FACE SWAPPER
Our proposed Resolution Attacks possess the capability to generate images that exhibit dual repre- sentations, incorporating features from two distinct objects within a single image. This capacity can further be harnessed for implicit face swapping by blending facial features from different identities.

---

Published as a conference paper at ICLR 2025
The results are depicted in Figure while an enhanced clarity version is provided in the Appendix Additionally, our Resolution Attacks can be employed for facial camouflage (c.g., "hiding" face in flowers). The facial camouflage results provided in the Appendix C
High resolution images
downsampled images
High resolution images
source-Trume
Biden
Boris Johnson
source-Musk
Biden
Boris Johnson
Bill Gates
Mark Zuckerberg Steve Jobs
Bill Gates
Mark Zuckerberg
Steve Jobs
Figure 6: Resolution attacks as the face swapper. High-resolution images are generated using Donald Trump (left) and Elon Musk (right) the source image, combined with various prominent figures such as Biden, Boris Johnson, Bill Gates, Mark Zuckerberg. and Steve Jobs. The middle column shows the corresponding downsampled low-resolution images.
CONCLUSION
In this paper, we investigate the vulnerability of contemporary classifiers to variations in image reso- lutions, particularly in high-resolution images and their compressed counterparts. We define novel form of attack, termed the "resolution attack", which deceives both classifiers and human observers by producing images that exhibit distinct semanties across different resolutions. Furthermore, tomated framework is contributed to execute this resolution attack. Leveraging the generative priors of large-scale diffusion models, the framework can generate images with dual semantics in zero- shot manner. Considering that the ability of generative models is becoming stronger and stronger, we hope that our work can serve an alarm to possible future attacks. We anticipate that the reso- lution attack will stimulate further research into resolution robustness, and the proposed framework will contribute to advancements this area.
ETHICS STATEMENT
Our work aims to explore vulnerabilities in machine learning classifiers through novel paradigm of resolution attacks. This research not designed for malicious purposes; rather, it serves tool to evaluate and address potential weaknesses in machine learning systems, with the ultimate goal of inspiring further research and developing more secure, reliable models. However, similar to other AI image generation technologies, our method could potentially be misused for applications such as face swapping or digital camouflage, and we unequivocally condemn any actions intended to produce harmful content. To mitigate potential risks, propose methods that reduce such vulnerabilities- for instance, the images generated by our approach can used to fine-tune existing classifiers, thereby improving their robustness against resolution-based attacks. Moreover, since our generated images are produced via stable diffusion process rather than being natural images, they can be detected using deepfake detection systems. Overall, research aims advance the understanding of model robustness while promoting responsible and ethical use of these techniques in the broader research community.
LCKNOWLEDGMENTS
This project is supported by the National Key Research and Development Program of China (No. NNo.202YYFB2702500,
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39 59-57. leee, 2017.
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content- based unrestricted adversarial attack. Advances in Neural Information Processing Systems, 36, 2024.
Jooyoung Choi, Jungbeom Lee, Chachun Shin, Sungwon Kim, Hyunwoo Kim, and Sungroh Yoon. Perception prioritized training of diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp- 11472-11481, 2022.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780-877 8794, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, and Xiaohua Zhai. Thomas unterthiner mostafa dehghani matthias minderer georg heigold sylvain gelly jakob uszko- reit and neil houlsby. an image isworth 16x 16 words: Transformers for image recognition atscale. In International Conference on Learning Representations, 2021.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. 2015.
Shuyang Gu, Dong Chen, Jianmin Bao, Fang Wen, Bo Zhang, Dongdong Chen, Lu Yuan, and Baining Guo. Vector quantized diffusion model for text-to-image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10696-10706, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Jonathan Ho and Tim Salimans. Classifier-free diffussin guidance. In NeurIPS 2021 Workshop Deep Generative Models and Downstream Applications, 2021.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
Alexey Kurakin, lan J Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference Learning Representations, 2017.
Mingi Kwon, Jaeseok Jeong, and Youngjung Uh. Diffusion models already have a semantic latent space. In The Eleventh International Conference on Learning Representations, 2023.
Alexander C Li, Mihir Prabhudesai, Shivam Duggal, Ellis Brown, and Deepak Pathak. Your dif- fusion model is secretly zero-shot classifier. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 2206-2217, 2023a.
Junnan Li, Richard Socher, and Steven C. H. Hoi. Dividemix: Learning with noisy labels as semi- supervised learning. In International Conference on Learning Representations, 2020.
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In International conference on machine learning, pp. 19730-19742. PMLR, 2023b.
Tsung- Yi Lin, Piotr Dollár, Ross Girshick, Kaiming He, Bharath Hariharan, and Serge Belongie. Feature pyramid networks for object detection. Proceedings of the IEEE conference on com- puler vision and pattern recognition, pp. 2117-2125. 2017.

---

Published as a conference paper at ICLR 2025
Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, pp. 26296-262300 2024.
Xihui Liu, Dong Huk Park, Samaneh Azadi, Gong Zhang, Arman Chopikyan, Yuxiao Hu, Humphrey Shi, Anna Rohrbach, and Trevor Darrell. More control for free! image synthesis with semantic diffusion guidance. In Proceedings of the IEEE/CVF Winter Conference on Appli- cations of Computer Vision, pp- 289-299, 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. stat, 1050(9), 2017.
Nagarajan Natarajan, Inderjit $ Dhillon, Pradeep K Ravikumar, and Ambuj Tewari. Learning with noisy labels. Advances in neural information processing systems, 26, 2013.
Ji Hi-Hoon Park, Yeong-Joon Ju. and Seong-Wor Whan Lee. Explaining generative diffusion models via visual analysis for interpretable decision-making process. Expert Systems with Applications, 248: 123231, 2024.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In The Twelfth International Conference on Learning Representations, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 7748-87654 PMLR, 2021.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140): 66, 2020.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint 07X1v:2204.06125. 1(2):3, 2022.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Olaf Ronneberger. Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomed- ical image segmentation. In Medical image computing and computer-assisted intervention- MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceed- ings, part III 18, pp. 234-241. Springer, 2015.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfrr Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 22500- 22510, 2023.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 11:21112222 2015.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- fion processing systems, 11366479-36494, 2022.
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, al. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in Neural Information Processing Systems, 02225278-52244 2022.
12

---

Published as a conference paper at ICLR 2025
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. 2015.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- lional Conference on Learning Representations, 2021.
Christian Szegedy. Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Pruceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818-2826, 2016.
Mingxing Tan and Quoc Le. Efficientnet22: Smaller models and faster training. In International conference on machine learning, pp. 10096-10106. PMLR, 2021.
Chenan Wang, Jinhao Duan, Chaowei Xiao, Edward Kim, Matthew Stamm, and Kaidi Xu. Semantic adversarial attacks via diffusion models. arXiv preprint arXiv:2339.073338 2023.
Jianyi Wang, Zongsheng Yue, Shangchen Zhou, Kelvin CK Chan, and Chen Change Loy. Exploiting diffusion prior for real-world image super-resolution. International Journal of Computer Vision, pp. 1-21, 2024.
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero Simoncelli. Image quality assessment: from error visibility structural similarity. IEEE transactions on image processing, 13(4):600- 612, 2004.
Tianxing Wu, Chenyang Si, Yuming Jiang, Ziqi Huang, and Ziwei Liu. Freeinit: Bridging initializa- tion gap in video diffusion models. In European Conference on Computer Vision, pp. 378-394. Springer, 2025.
Jiarui Xu, Sifei Liu, Arash Vahdat, Wonmin Byeon, Xiaolong Wang, and Shalini De Mello. Open- vocabulary panoptic segmentation with text-to-image diffusion models. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2955-2966, 2023,
Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability. Advances in Neural Information Pro- cessing Systems, 36:2894-2921. 2023.
Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings the IEEF/CVF International Conference on Computer Vision, pp. 3836-3847, 2023.
Min Zhao, Hongzhou Zhu, Chendong Xiang, Kaiwen Zheng, Chongxuan Li, and Jun Zhu. Identi- fying and solving conditional image leakage in image-to-video diffusion model. In The Thirty- eighth Annual Conference on Neural Information Processing Systems, 2024.
A IMPLEMENTATION DETAILS
The image generation process in experiments is handled by the Stable Diffusion (Rombach et al. 2022) v1.5 model, which is trained on the LAION-5B dataset (Schuhmann et al. 2022). This model excels at generating high-quality, high-resolution images from textual descriptions, making well-suited for our attack. In the experiment, we generate images at a fixed resolution of 512x51 12, using the DDIM (Song al., 2021) sampling technique. The sampling process consists of 300 steps, ensuring sufficient time for image refinement and convergence. In the RAS Attack, DDIM inversion (Song et al. 202T) is performed over 200 steps to accurately reconstruct and guide the generation process based on the source image. During the generation process, we utilize classifier- free guidance (CFG) (Ho & Salimans 2021) to control the fidelity and diversity of the images. Specifically, the CFG coefficient for the high-resolution prompt (PH) is set to 9, while for the low- resolution prompt (PL), the CFG coefficient is set to 7. Additionally, the generated images are downsampled by factor of 3 (downsampling to 64 resolution) for the oww-looluution attack evalu- ation. This compression process ensures that the low-resolution images differ significantly in visual quality compared to the high-resolution ones, facilitating the dual representation attack. To further
13

---

Published as a conference paper at ICLR 2025
C. = 0.1
0.5
1.0
2.0
5.0
10.0
C C.
0.5, 0.5
1.0, 1.0
2.0, 2.0
5.0, 5.0
10.0, 10.0
C 0.5, 1.0
1.0
1.0, 0.5
0.5, 2.0
2.0, 0.5
1.0, 2.0
2.0, 1.0
Figure 7: Ablation on Control Parameter Settings. Top: Effects of different control parameters in labeled object attacks. Middle and Bottom: Effects of different control parameters labeled animal attacks. CJ represents the control parameter for the depth image, and C, represents the control parameter for the softedge image.
manipulate resolution-specific features, we apply Gaussian filters during the image generation pro- cess. High frequency Gaussian filter used extract high-frequency details from noise (based on the prediction for the PH) and low frequency Gaussian filter is applied to extract low-frequency information from noise (based on the prediction for the Pt). which ensures the generation of images with clearly distinct high-resolution and low-resolution features.
To enhance the generation of images with dual semantic representations, we adopt a Time- Dependent Denoising Strategy. The denoising process is divided into three phases: the early phase (first 20 steps), middle phase (middle 260 steps), and the late phase (last 20 steps). This phased approach promotes the smooth generation of dual semantic images and ensures gradual transition between high-resolution and low-rcsolution features. For both the labeled and unlabeled attacks, generate images using the unified Pt prompt along with 10 distinct Pи prompts. Each prompt combination generates 100 images, with total of 1,000 images for the labeled attack and another 1,000 images for the unlabeled attack. The RAS attack builds upon the RA attack by introducing additional source image to guide the image generation process via DDIM inversion technology and divided into labeled and unla-
the SG module. Similar to the RA attack, the RAS experiments beled categories, and the prompts for Py and Pz remain consistent. For labeled attacks involving animals. during the noise prediction stage, the depth map the source image used control the noise prediction when the Pиr prompt is used to predict the noise, and the soft edge of the source image is used to control the noise prediction when the Pt, prompt is used to predict the noise. This ensures that the high-resolution features adhere to the overall structure of the source image, while the low-resolution image retains the detailed structural alignment with the source. For labeled attacks involving objects and unlabeled attacks, we apply the the SG module only during the Pr, prompt's noise prediction. The Ри prompts differ too much semantically from the Pz prompts, and applying the SG module during the noise prediction of the Pи prompts may lead to poor image generation. The additional structural control could constcannn the image generation process, hindering the natural representation of the Prr prompts.
14

---

Published as a conference paper at ICLR 2025
Pronye PP
SG Module
or
or
Control
source-depth
depcc
Prompt (P.)
source-softedge
sollecge
U-Ner
Sample
Down
sample
Down
source-sofiedge
source-depthl
generated imagel
source-depth2 generated imagel
Figure 8: Ablation on Multiple Source Images. We provide additional source image corre-
sponding to the high-resolution class label Cn (the lion image)..otably, the high-resolution images exhibit lion-structured artifacts (marked by red boxes).
Table The Corrective Attack Success Rate (ASRc) for labeled RAS the 768 resolution v.s. 512 resolution. A denotes the improvements achieved by increasing resolution from 512 to 768.
Resolution
ResNet-50
VGG19
Inception
EfficientNet DenseNet
512x512
71.4%
61.6%
43.6%
68.2%
60.5%
768
77.5%
74.0%
68.9%
81.4%
78.8%
At
6.1%
12.4%
25.3%
13.2%
18.3%
B ADDITIONAL ABLATION STUDY
Control parameters in the SG Module. In the SG Module, the control parameter is used to adjust the degree to which the depth (Ca) and softedge (C,) images influence the generated images. As shown in Figure 7 when the control parameter small, the similarity between the generated image and the source image decreases. As the control parameter increases, the generated images become more aligned with the source image terms of structural details. However, when the control parameter becomes too large, it negatively affects the overall quality of the generated images, introducing artifacts and potentially compromising the resolution attack effectiveness. Balancing the control parameter is thus crucial for generating high-quality images that maintain both high- resolution and low-resolution characteristics. without introducing excessive distortion.
The Resolution. We generate images with dual representations in 512x512 resolution. In this experiment, we explore an increasing resolution (i.e., 768 x 768). The Corrective Attack Success Rate (ASRc) for labeled RAS the 768 resolution is presented in Table 3 Our findings indicate that generating images with higher resolutions results in improved attack performance. This is intuitive, as higher resolutions provide additional redundancy, enabling the manifestation more intricate dual semantic representations.
Sampling Step. this experiment, we use the DDIM sampling method with different denoising sampling steps: 50, 150, 300, 500, 700, and 999. As shown in Figure several intriguing obser- vations emerges. First, the results generated with 150 steps are quite similar to those generated with 300 steps, both in terms of visual quality and structural consistency. Additionally, the images gen- erated with 50, 500, and 999 sampling steps display similar characteristics. with comparable detail and overall image quality. Interestingly, the images generated using 700 sampling steps exhibit more detailed visual features, suggesting a potential sweet spot for retaining finer details in the generated output. These observations raise interesting questions about how different sampling steps influence
15

---

Published as a conference paper at ICLR 2025
High resolution images
downsampled images
source-Trump
a vase with flowers
delicious food
snowy village
bustling street
balloon festival
source-Musk
vase with flowers
delicious food
snowy village
bustling street
balloon festival
Figure 9: Scenes-to-Face Resolution Attacks. On the left side, high-resolution images are gener- ated using Donald Trump as the source image, integrated with various scenes such as vase with flowers, delicious food, snowy village. bustling street, and balloon festival. The right side presents high-resolution images created with Elon Musk as the source image, similarly combined with the same scenes. The middle column displays the corresponding downsampled low-resolution images.
the generative process in diffusion models. Further investigation into the relationship between sam- pling steps and image quality could lead to deeper insights into the workings of diffusion models and help optimize generation quality while maintaining attack effectiveness.
Multiple Source Images. In previous RAS experiments, both the depth and softedge maps are derived from single source image. In this experiment, introduce additional source image corresponding to the high-resolution class label C₁ (the lion in Figure g). As shown in Figure 8 the generated images integrate features from both the original source image and the additional lion
16

---

Published as a conference paper at ICLR 2025
image. Notably, the high- high-resolution images exhibit lion-structured artifacts (especially in the mouth area). This may be attributed to potential conflicts between the source images (the lion and dog), leading to unsatisfactory outcomes.
C RESOLUTION ATTACKS FOR FACIAL CAMOUFLAGE
Our proposed Resolution Attacks possess the capability to generate images that exhibit dual repre- sentations, incorporating features from two distinct objects within single image. In this experiment, we extend the resolution attack framework by combining facial features with objects and scenes to generate facial camouflages. As illustrated in Figure 1 generate high-resolution images that blend faces (e.g., Donald Trump, Elon Musk) with distinct seenes (e.g., vase with flowers, snowy village). These high-resolution images exhibit detailed visual details, capturing both the facial and contextual characteristics.
D RELATED WORK
D.1 MODEL ROBUSTNESS
Model robustness refers to the ability of a model to maintain its performance and accuracy in the presence of various perturbations, such as input noise, adversarial attacks, or changes in data dis- tribution. Model robustness is crucial as it ensures the reliability and stability of machine learning systems in real-world applications. Extensive research has been conducted for model robustness. For instance, the adversarial robustness (Carlini & Wagner 2017: Goodfellow et al. 2015) aims to boost the resilience of models towards small, intentional adversarial perturbations in the imput im- age. Research on label noise (Natarajan et al. 2013 Li et al., 2020) focuses developing models that are resilient to training data with incorrect or ambiguous labels. However, existing research primarily focuses robustness to adversarial noisy perturbations, neglecting an equally signif- icant aspect: robustness across image resolutions. With advancements in generative models, the production of ultra-high-resolltion images is now feasible without significant barriers. Therefore, is of great significance to explore the robustness towards ultra-high resolutions. To address this, we define the resolution attack. which serves as metric quantify vulnerability across resolutions.
D.2 DIFFUSION MODELS
Diffusion models have seen rapid development in recent years, becoming focal point of current research and demonstrating significant progress across various applications (Dhariwal & Nichol, 2021 Liu al., 2023 Ramesh al., 2022. Ruiz al.] 2023 Saharia et al., 2022). The primary training objective of diffusion models to iteratively add Gaussian noise to data and learn how to reverse this process by denoising the noisy data to recover the original signal. In text-to-image dif- fusion models (Rombach et al., 2022), image generation is treated as iterative denoising process guided by text prompts, typically within an image encoder- decoder framework. These models uti- lize text embeddings generated by language encoder (Raffel et al. 2020) as conditions, performing denoising in the latent space (Gu et al. 2022: Podell et 2004). and subsequently reconstructing decoder. Furthermore, text-to-image diffusion mod- els are capable of capturing high-level semantic concepts (Li et al.) [223a]] Xu et al.) 2023). Our work builds on this characteristic of diffusion models explore the generation of dual semantic representations.
the latent samples back into pixel space
D.3 ADVERSARIAL EXAMPLES
Adversarial examples (Goodfellow et al. 2015) Madry et al.) 2017; Ilyas et al. 2019 Kurakin et al.) 2017) are carefully crafted inputs to machine learning models that have been intentionally designed to cause the model to make mistake. These inputs are typically created by introducing small, often imperceptible perturbations to the original data, which are specifically calculated to exploit the model's ss decision boundaries. The resulting perturbed inputs, while indistinguishable from the original to the human eye, lead to misclassifications or erroneous outputs when processed by the model.
17

---

Published as a conference paper at ICLR 2025
Diffusion Models for Adversarial Examples. With the swift development of diffusion models, several recent studies have leveraged the generative priors of the diffusion models to craft adversar- ial examples. Xue et al. (2023) specifically align adversarial examples with natural images using diffusion models. Wang et al. 2023) utilizes diffusion models to learn perturbations of the latent space create adversarial imagery. Chen et al. (2024) leverages diffusion models manipulate the texture of the target images to compose adversarial examples.
However, adversarial examples exhibit significant limitations. First, adversarial examples are model- specific. The generation of adversarial examples heavily relies on the specific architecture and train- ing data of the target model, meaning that adversarial examples crafted for one model may not effectively transfer to other models, even if they share similar tasks or architectures. This limits the generalizability of adversarial examples. Second, adversarial examples are typically based on pixel-Ievel perturbations within narrow p-ball of the target image. Considering the proliferation of various generated models on the internet and the increasing number of generated images faced by traditional classifiers, this narrow focus is problematic. In contrast, our proposed resolution attack is both model-agnostic and task-agnostic, exhibiting superior generalized performance across various architectures and tasks. By carefully crafting the semanties of the target images, the Resolution Attack can deceive not only classifiers but also human vision.
E MORE QUANTITATIVE RESULTS
Description and analysis to evaluate the effectiveness of resolution attacks (RA and RAS) across diverse model architectures, we conducted experiments on seven models grouped into three distinct categories:
Transformer-Basee Models: We employed two Vision Transformer (ViT) variants (Doso- vitskiy et al. (02I). ViT-b32 and ViT-I32, which are commonly recognized for their robust image classification capabilities.
Feature Pyramid-Basse Based Models:Two object detection models, fasterrenn resnet50 fpn and maskrenn maskrenn_resnet50.foe were tested. Both models leverage ResNet50 as their back- bone and incorporate feature pyramid structures (Lin al., 2017) to handle multi-scale information effectively. Trained on the COCO dataset (containing 80 categories), these models were evaluated only on their low-resolution attack success rate, as the categories of our high-resolution images may not fully align with the COCO dataset.
Vision-Language Models (V evaluate attacks on vision-language tasks, we tested CLIP (Radford et al. (021) for zero-shot classification,, Blip2 (Li et al. 2023b) for image captioning, and LLAVA I.5 (Liu et al. 2024) for visual question answering (VQA). In the context of Blip2, the attack is considered successful if the generated captions include the target label. Meanwhile, for LLAVA. designed the subject in the picture?" ?" Here, an attack is deemed successful if the model's response contains the target label.
ceestion-prompl format, "What is
The results of our evaluation, presented in Table 4 and Table 5 highlight the effectiveness of res- olution attacks across both labeled and unlabeled settings. For the RA attack, the low-resolution classification accuracy (Ace1) remains consistently high in the unlabeled setting, achieving values such as 87.2% in ViT-132, 91.2% in Blip2, and 90.0% in LLAVA. This is attributed to the broader semantic space of the unlabeled attack prompts, which facilitates the generation of dual-semantic images. The ability to align with both high-resolution and low-resolution categories makes the at- tack success rate higher in this setting. Conversely, in the labeled attack, the semantic constraints imposed by specific target labels narrow the scope of possible image variations. As result, the chal- lenge of generating semantically ambiguous images that satisfy both resolution levels leads to lower low-resolution classification accuracy. For the RAS attack, the introduction of source images signif- icantly enhances control over the generated outputs, balancing high-resolution feature fidelity with low-resolution attack efficacy. In labeled attacks, where the semantic space is inherently narrower due to more specific target labels, source images guide the generation process, making it easier to create dual-semantic images. Consequently, both the low-resolution classification accuracy (Acc1) and Corrective Attack Success Rate (ASRc) are generally higher compared to RA. However, in the unlabeled attack, the broad semantic scope of the high-resolution prompts allows for easier genera-
18

---

Published as a conference paper at ICLR 2025
Table 4: Additional quantitative results of the Resolution Attack.
Labeled Attack
Unlabeled Attack
Classifiers
ACCH 1
Accr.
ASRc f
Accr. f
ViT-b32 ViT-I32
55.7%
58.1% %
41.3%
83.2%
50.3%
65.3%
44.1%
87.2%
Fasterrenn resnet50 fpn Maskrenn resnet50 fpn
47.7%
19.4%
57.5%
29.1% %
Clipízero-shot)
92.1 %
34.9%
33.3%
62.8%
Blipe caption)
72.1% 1%
58.7%
53.7%
91.2%
LLAVA(VQA) 71.8%
68.9%
63.6%
90.0%
Table 5: Additional quantitative results of the Resolution Attack with Source image.
Labeled Attack
Unlabeled Attack
Classifiers
Acch
Acc1
ASRc t
AccL
ViT-b32
44.9%
74.5%
56.6%
58.0%
VIT-132
36.9%
83.9%
60.7%
62.4%
Fasterrenn_resnett fpn
53.5%
11.8%
Maskrenn_resmet55.. ret.nneeeeeettnmme
67.8%
18.6%
Clip(zero-shot)
85.7% %
44.7%
39.9%
30.9%
Blip2(image caption)
61.4%
63.5%
55.5%
51.8%
LLAVA(VQA) 63.8%
71.6%
59.7%
51.4%
tion of -eal-semantic images without souree image constraints. Introducing source image this case can limit the model's 's flexibility, leading to slightly lower low-resolution attack rates than RA.
These experiments collectively demonstrate the adaptability and generalizability of resolution tacks across diverse model architectures. The findings also expose significant vulnerabilities in widely-used machine learning frameworks, emphasizing the urgent need for robust defense strate- gies to mitigate the risks associated with resolution attacks.
F MORE QUALITATIVE RESULTS
We provide qualitative results in the main paper with enhanced clarity in Figure 11 13 (labeled
RA), Figure 14 16 (unlabeled RA), Figure 17 19 (labeled RAS), Figure 22 (unlabeled RAS),
Figure 33 42 face swapping).
We also provide more qualitative results in Figure 23 24 (labeled RA), Figure 25 27 unlabeled RA), Figure 28 29 (labeled RAS), Figure 30 32 (unlabeled RAS).
19

---

Published as a conference paper at ICLR 2025
50
150
300
500
700
999
T= 50
150
300
500
700
999
50
150
300
500
700
999
Figure 10: Ablation Denoising Sampling Steps. Top: labeled object attacks. Middle: laheled animal attacks. Bottom: unlabeled attacks. 7 represents the number of denoising sampling steps, and six different sampling steps were used: 50, 150, 300, 500, 700, and 999.
py: lion
P2: dog
Figure 11: Qualitative results on labeled resolution attack.
20

---

Published as a conference paper at ICLR 2025
py: monkey
P dog
Figure 12: Qualitative results on labeled resolution attack.
Ps: shoe
Pt: dog
Figure 13: Qualitative results on labeled resolution attack.
P delicious food
p dog
Figure 14: Qualitative results unlabeled resolution attack.
21

---

Published as a conference paper at ICLR 2025
Py with flowers
P dog
Figure 15: Qualitative results on unlabeled resolution attack.
Ps: decorative lamp
Pt: dog
Figure 16: Qualitative results on unlabeled resolution attack.
P lion
p dog
source image
Figure 17: Qualitative results on labeled resolution attack with source image.
22

---

Published as a conference paper at ICLR 2025
Py monkey
P dog
source image
Figure 18: Qualitative results on labeled resolution attack with source image.
Ps: shoe
Pl: deg
image
Figure 19: Qualitative results on labeled resolution attack with source image.
Py delicious food
P dog
source image
lh
Figure 20: Qualitative results unlabeled resolution attack with source image.
23

---

Published as a conference paper at ICLR 2025
Py with flowers
P dog
source image
Figure 21: Qualitative results on unlabeled resolution attack with source image.
Ps: decorative lamp
Pl: dog
image
Figure Qualitative results on unlabeled resolution attack with source image.
P guitar
P dog
Figure 23: Qualitative results on labeled resolution attack.
24

---

Published as a conference paper at ICLR 2025
PH sea lion
P dog
Figure 24: Qualitative results on labeled resolution attack.
Ps: snow village
Pl: dog
Figure 25: Qualitative results on unlabeled resolution attack.
py: calm lake
p dog
Figure 26: Qualitative results unlabeled resolution attack.
25

---

Published as a conference paper at ICLR 2025
py: mysterious cave
P dog
Figure 27: Qualitative results on unlabeled resolution attack.
Ps: guitar
Pl: dog
image
Figure 28: Qualitative results on labeled resolution attack with source image.
Py: sea lion
P dog
source image
Figure 29: Qualitative results on labeled resolution attack with source image.
26

---

Published as a conference paper at ICLR 2025
Py snow village
P dog
source image
Figure 30: Qualitative results on unlabeled resolution attack with source image.
Ps: calm lake
Pl: dog
image
Figure 31: Qualitative results on unlabeled resolution attack with source image.
py: mysterious cave
P dog
source image
Figure 32: Qualitative results unlabeled resolution attack with source image.
27

---

Published as a conference paper at ICLR 2025
py: Biden
Pr: Trump
source image
Figure 33: Qualitative results of face swapping.
Py: Boris Johnson
Py: Trump
image
SS
2
Figure 34: Qualitative results of face swapping.
py: Bill Gates
py Trump
source image
Figure 35: Qualitative results of face swapping.
28

---

Published as a conference paper at ICLR 2025
Pu: Mark Zuckerberg
Pr: Trump
source image
Figure 36: Qualitative results of face swapping.
Py: Steve Jobs
Py: Trump
image
Figure 37: Qualitative results of face swapping.
py: Biden
Pst Musk
source image
Figure 38: Qualitative results of face swapping.
29

---

Published as a conference paper at ICLR 2025
py: Boris Johnson
p Musk
source image
Figure 39: Qualitative results of face swapping.
Py: Bill Gates
Pe: Musk
image
Figure 40: Qualitative results of face swapping.
py: Mark Zuckerberg
Pst Musk
source image
Figure 41: Qualitative results of face swapping.
30

---

Published as a conference paper at ICLR 2025
py: Steve Jobs
Pt: Musk
image
Figure 42: Qualitative results of face swapping.
31


Reviews:
[{"review_id": "cYKDBewvP1", "reviewer": "Reviewer_2GCH", "summary": "Ensuring model robustness is critical for the stability and reliability of machine learning systems. Although substantial research has addressed areas such as adversarial and label noise robustness, robustness against variations in image resolution—especially high-resolution images—remains underexplored. To bridge this gap, this work introduces a novel form of attack: the resolution attack. This attack generates images that display different semantics at varying resolutions, deceiving both classifiers and human observers. The resolution attack is implemented through an automated framework designed to create dual-semantic images in a zero-shot manner. Specifically, it leverages large-scale diffusion models for their comprehensive image construction capabilities and employs a staged denoising strategy to achieve smooth transitions across resolutions. Using this framework, resolution attacks were conducted on several pre-trained classifiers, with experimental results demonstrating a high success rate. These findings validate the effectiveness of the proposed framework and highlight the vulnerability of current classifiers to resolution variations. Additionally, this framework, integrating features from two distinct objects, presents a powerful tool for applications like face swapping and facial camouflage.", "questions": "See weakness above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. This paper introduces a new test-time attack, the resolution attack, which demonstrates effective performance across several classifiers.", "weaknesses": "1. The attack scenario presented is quite limited. The paper uses a high resolution of $512 \\times 512$, but the size of low-resolution images is unclear, though figures suggest it might be $32 \\times 32$. In practice, this resolution is only common in classifiers trained on small-scale datasets like MNIST or CIFAR-10/100, whereas real-world classifiers, such as those trained on ImageNet, typically use a $224 \\times 224$ input resolution, making this type of attack less applicable.\n\n2. It is expected that this attack could succeed, as adversarial images here are generated from scratch. However, in practical scenarios, adversarial images are typically crafted by modifying an uploaded clean image to influence predictions while maintaining visual similarity to the original. Generating adversarial images from scratch, therefore, has limited practical application.\n\n3. The module proposed lacks novelty, as the separation of control between modules for detail and shape generation is quite standard.\n\n4. Key implementation details are missing, such as the resolutions at which images successfully achieve adversarial effects.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "VVukSXjaiG", "reviewer": "Reviewer_dpTx", "summary": "This paper introduces a novel \"resolution attack\" that deceives both classifiers and human observers by creating images with distinct semantics at different resolutions. The proposed automated framework generates dual-representation images in a zero-shot manner, using generative priors from large-scale diffusion models and a staged approach to achieve smooth transitions across resolutions.", "questions": "I am curious about the performance of transformer architecture classifiers in comparison to CNN architecture classifiers under the \"resolution attack,\" and whether methods using feature pyramids can better overcome the \"resolution attack.\"", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The designed \"resolution attack\" is very innovative and presents interesting effects.\n2. It reveals the vulnerability of classifiers under the \"resolution attack.\"\n3. The writing is clear, and the ideas are easy to follow.", "weaknesses": "1. The classifiers tested in the article are primarily based on CNN methods and do not include evaluations of the latest classifiers. I am curious about how transformer architecture models perform under the \"resolution attack,\" and whether methods using feature pyramids could better overcome the \"resolution attack.\" The authors could provide more analysis in this area.\n2. Although the authors validate the effectiveness of their method on existing classifiers, they do not provide a detailed comparison with other attacks (such as adversarial attacks). The authors might consider analyzing how the proposed \"resolution attack\" compares to other generative attacks that also utilize the diffusion model.\n3. The paper touches on applications like face swapping and camouflage without addressing the potential ethical implications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "53Qsca4bOT", "reviewer": "Reviewer_XjQe", "summary": "In this paper, the authors propose a new attack method called as resolution attack, i.e., an automated low-resolution image generative framework capable of generating dual-semantic images in a zero-shot manner. Experiments are conducted to verify the effectiveness of resolution attack.", "questions": "see the weakness", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. A new method called as resolution attack is proposed, which is interesting.  \n2.  A reasonable technique is proposed to implement the proposed idea\n3. The paper is easily understood.", "weaknesses": "1. It seems the test images are important for the success of resolution attack, because when an image is compressed into a low-resolution image, the semantic content is easily changed. In the paper, the authors don’t give the test dataset, so I don’t know whether the proposed method  is still effective for all images. \n2. The method should be compared with the compression method that randomly reduce the resolution of the test image. Compared with this baseline, the readers can better see the effectiveness of this attack. \n3. Could the proposed method is till effective for vision transformer? The authors should give the discussion.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DYEWUM0Nrp", "reviewer": "Reviewer_6DtR", "summary": "This paper introduces the “Resolution Attack”, a novel form of adversarial attack. Specifically, it generates images with semantic ambiguity across different resolutions to achieve the attack. To achieve this, the paper leverages diffusion models and a proposed staged denoising strategy to introduce two types of resolution attacks: RA (adversarial samples generated conditioned on dual text) and RAS (adversarial samples generated conditioned on images). Experimental results demonstrate a high attack success rate and show further potential in applications such as facial forgery.", "questions": "This paper is sufficient excellent, but I hope the authors can address the above concerns.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "- Well, I feel this work interesting as it presents an attack manner that is fundamentally different from previous adversarial attack approaches, that, leveraging the dual semantics introduced by resolution changes to confuse classifiers, which is quite refreshing. \n- The authors' proposed optimization framework incorporates a Dual-Stream Denoising (DS Module) that locates perturbation regions in high- and low-frequency areas to achieve the attack, providing a good baseline for this attack manner. \n- The experiments and ablation studies presented are comprehensive and solid.", "weaknesses": "Some concerns: \n- (minor, discussion) Does the author thoroughly investigate the problem being studied? Specifically, are there existing resolution-based attack methods, and if so, should they be considered baselines? I suggest the author provide a more in-depth discussion of related work. \n- (major, experimental) Although the effectiveness of the attack method on deep classifiers has been well demonstrated, all the models used are CNN-based classifiers with relatively low input resolution (224×224). In contrast, I am more interested in whether these adversarial samples can disrupt existing vision-language models (VLMs, e.g., CLIP, BLIP-2, LLAVA, etc.), which possess more excellent generalization capabilities than task-specific models. I think adding some evaluation results on VLMs, such as zero-shot classification or even image captioning and VQA, would significantly enhance the assessment of this method's value. \n- (minor, experimental) I suggest including experiments under defensive settings to evaluate whether these adversarial samples can still successfully confuse classifiers when facing adversarial preprocessing (e.g., different resolution compression methods or adversarial purification). \n- (minor discussion) Given the potential risks associated with this work, I also recommend discussing the societal impacts and potential defence strategies at the end of the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)