Concept-based Adversarial Attack: a Probabilistic Perspective
Authors: Andi Zhang
Xuan Ding
Steven McDonagh
Samuel Kaski
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial Attack
Probabilistic Generative Models
Diffusion Models
Primary area: probabilistic methods (Bayesian methods, variational inference, sampling, UQ, etc.)
TL;DR: Beyond single-image perturbations, we generate adversarial examples from scratch that retain the concept’s original meaning, while preserving the same mathematical consistency as traditional methods.

Abstract: We propose a concept-based adversarial attack framework that extends beyond single-image perturbations by adopting a probabilistic perspective. Rather than modifying a single image, our method operates on an entire concept - represented by a distribution - to generate diverse adversarial examples. Preserving the concept is essential, as it ensures that the resulting adversarial images remain identifiable as instances of the original underlying category or identity. By sampling from this concept-based adversarial distribution, we generate images that maintain the original concept but vary in pose, viewpoint, or background, thereby misleading the classifier. Mathematically, this framework remains consistent with traditional adversarial attacks in a principled manner. Our theoretical and empirical results demonstrate that concept-based adversarial attacks yield more diverse adversarial examples and effectively preserve the underlying concept, while achieving higher attack efficiency.

Published as a conference paper at ICLR 2026
CONCEPT-BASED ADVERSARIAL ATTACK: A PROBABILISTIC PERSPECTIVE
Andi Zhang*
Xuan Ding
University of Warwick University of Manchester az.8 1 wan.ecanaabbccc.m
The Chinese University of Hong Kong, Shenzhen 20232201111988 l..aalllba i.nu.... edu
Steven McDonagh
Samuel Kaski University of Manchester
University of Edinburgh
secdonnah@eede ac uk
University of Aalto
samuel kaski Baalto. fi
ABSTRACT
We propose concept-based adversarial attack framework that extends beyond single-imag perturbations by adopting a probabilistic perspective. Rather than modifying single image, method operates sented by a distribution - to generate diverse adversarial examples. Preserv- ing the concept is essential, as ensures that the resulting adversarial images remain identifiable as instances of the original underlying category or identity. By sampling from this concept-based adversarial distribution, generate images that maintain the original concept but vary in pose, viewpoint, or background, thereby misleading the classifier. Mathematically. this framework remains con- sistent with traditional adversarial attacks in principled manner. Our theoreti- cal and empirical results demonstrate that concept- adversarial attacks yield more diverse adversarial examples and effectively preserve the underlying con- cept, while achieving higher attack efficiency. Code and examples can be found at httpp::/githuu com/ andi ac/ ac/onceppAdv
entire concept repre-
INTRODUCTION
Adversarial attacks aim to deceive classifier while preserving the original meaning of the input object (Dalvi et al., 2004 Lowd & Meek, 2005a b Biggio & Roli 2018). We refer to the manipu- lated instance as adversarial example. Early work by Szegedy al. (2014) and Goodfellow al. (2015) introduced adversarial attacks against deep learning models for images.
In the image-based adversarial setting. it is widely accepted that controlling the geometric distance between the adversarial example and its original image is crucial for maintaining the original image's meaning. Consequently, many adversarial attack algorithms constrain perturbations using norms such as L, L2. L Moreover, given the rapid progress in machine learning research, fair comparisons across different adversarial methods have become essential. Numerous benchmarks and competitions (Madry et al. 2018; Croce et al. 2020 Dong et al., 2021) therefore focus on attack success rates under constraint that geometric distance does not exceed threshold
However, as adversarial defense techniques improve, small geometric perturbations alone increas- ingly fail to generate adversarial examples that reliably fool classifiers, particularly when strong transferability is required (Song et al. 2018 [iao et al.] 2018b Bhattad et al. 2020). This shortcom- ing has led researchers to explore unrestricted adversarial attacks, which involve larger geometric perturbations. Although "unrestricted" implies that adversarial examples need not be bounded by strict geometric distance, these examples must still remain faithful to the semantics of the original image; otherwise, the goal of preserving the input's meaning is lost.
"Corresponding Author.

---

Published as a conference paper at ICLR 2026
Adversarial Attack on a Single Image
Concept-based Adversarial A Attack
Adversarial Examples (TadeS)
Adversarial Examples (Tayy
Pais
Pdis
Pvic
Target Class (Ytur)
Original Image (Zori)
Target Class (Shar)
Original Concept (Cur)
Figure I: Comparison of a single-image adversarial attack (left) versus our proposed concept-based adversarial attack (right). In both cases, adversarial examples Fadv are drawn from the product of distance distribution Pais and a victim distribution Pvic- On the left, Pais is centered on a single image Jori so its overlap with Pvic is small. Consequently, adversarial examples that successfully fool the victim classifier typically lose the original image's meaning, whereas those that preserve the original meaning fail to deceive the classifier.
contrast, on the right, Pdis spans the original concept Cori. greatly increasing overlap with Pvic- As result, the generated adversarial examples both maintain the concept's meaning and easily deceive the classifier. (A green image border indicates an example that successfully fools the classifier; red indicates failure.)
Zhang et al. (2024b) introduced probabilistic perspective on adversarial attacks, demonstrating that traditional geometric constraints can be interpreted as specific "distance" distributions Pais- Under this view, generating adversarial examples amounts to sampling from the product of Jais and the "victim" distribution Pvics which represents the target classifier under attack. Importantly, Pas need not be induced solely by geometric distance. Instead, one can fit probabilistic generative model (PGM) around the original image, allowing the PGM's semantic representation to implicitly define semantics-based notion of distance. As illustrated the left side of Figure Zhang al. (2024b) indicate that Pais should be centered on the original image.
Building on Zhang al. (024b) 's probabilistic perspective, expand the distance distribution Pas from operating on single image to operating on an entire concept, which can be represented by a probability distribution over images that correspond the underlying object, identity or cate- gory. As shown on the right side of Figure]] [ this generalization introduces a new class of adversarial attacks. Rather than perturbing single image, we generate fresh image that captures the same un- derlying concept yet deceives the classifier. We refer to this approach as a concept-based adversarial attack. Mathematically, remains consistent with traditional adversarial attacks when viewed under the probabilistic framework. As we demonstrate, broadening the distance distribution to concept- level information reduces its gap from the victim distribution Prics resulting in substantially higher attack success rates.
Our main contributions are as follows:
We introduce new type of adversarial attack that moves beyond single-image perturbations to a concept represented by a distribution, this approach aligns with traditional adversarial attacks in principled manner.
Concept-based adversarial attack:
Concept augmentation: We propose practical concept augmentation strategy using mod- ern generative models, enhancing the diversity of the distance distribution.
Theoretical and empirical validation: We provide both theoretical proof and experimen- tal evidence showing that expanding the attack from a single image to an entire concept reduces the distance between Pvic and pais. boosting the attack efficiency.
2

---

Published as a conference paper at ICLR 2026
Higher success rates: Our experiments confirm that concept- adversarial attacks achieve higher targeted attack success rates while preserving the original concept.
Practical Guidelines and Scenarios: We provide practical guidelines and example appli- cation scenarios, detailed in Appendix
PRELIMINARIES
2.1 PROBABILISTIC GENERATIVE MODELS (PGMs) AND THEIR LIKELIHOODS
The goal of probabilistic generative models is to learn parameterized distribution Pe that approx- imates the true distribution In practice, we only observe finite dataset D {x11..... Fn I. and training is typically done by maximizing its likelihood. For image modeling, popular approaches such as VAEs (Kingma et al. 2013) and diffusion models (Song & Ermon [019 Ho et al., 2020) optimize lower bound the log-likelihood (the ELBO) rather than the likelihood itself. Thus, likelihood estimation in practice amounts to computing this ELBO (Burda et al. 22015 Nalisnick
al. 2019).
2.2
ADVERSARIAL ATTACK
Given classifier C:: [0, 1] + y where is the input dimension and 3 is the label space, consider an original image Fori E [0, 1] and target label Muar E V. The goal of a targeted adversarial attack construct an adversarial example aady such that C(radv) yuu while keeping Tadv close to Zoii- The corresponding optimization problem is
min (Toors Tadv) subject C(radr) Yuar and Fady E [0,
where 'D measures the distance (similarity) between and Undv. typically via an L1. L2, or Lox. norm. Directly solving this constrained optimization can be challenging. To address this, Szegedy et al. (2014) propose relaxation:
min D[rori (iave) + c. (Fatt, Ytar) subject to Jade E [0,
where is constant, and is objective function that guides the classifier's predictions toward the target label. In (Szegedy et al. (2014)'s work, f taken to be the cross-entropy loss; Carlini & Wagner 2017) present additional choices for f.
2.3 PROBABILISTIC ADVERSARIAL ATTACK
By employing Langevin Dynamics optimizer for equation [ Zhang al. (2024b) derive probabilistic perspective on adversarial attacks. They introduce the adversarial distribution:
Padv (xadv Foris Ytar) Oc Pvic (Faav Mar) Pais (Fadv
Wori),
where (Tad !uar) exp(-c (Xadv: Year) is the "victim" distribution emphasizing misclassifi- cation toward Mar. and Pais (Fadv Iurr) X exp( (-D((aaDs Fadv)) is the "distance" distribution around Jori- This formulation leverages the fact that Langevin Dynamics converges to the corresponding Gibbs distribution (Lamperski, 202I), thereby providing probabilistic interpretation of adversarial attack generation.
This probabilistic perspective aligns with traditional geometry-based adversarial attacks. exam- plc, if D is the Li norm, then Pais(au (Fadv | Fon) exp(-l|=aad Zoni Ili) takes the form of Laplace distribution. Similarly, Gaussian distribution.
the squared C2 norm, then Pdis (xadv Ioci) x exp( -||xadv - Zan is
Zhang et al. (204b) indicate that the distance distribution Pai can be any distribution centered around Tesi- meaning the choice of Pas implicitly defines the distance D. Consequently, using PGM centered on To as Pai yields a semantic-aware notion of distance. By then sampling from the corresponding adversarial distribution Padv, one generate semantic-aware adversarial examples.
3

---

Published as a conference paper at ICLR 2026
3 CONCEPT-BASED ADVERSARIAL ATTACK
3.1 CONCEPT DISTRIBUTION
We aim extend adversarial attacks from operating on single original image to operating on an original concept Con. A concept is inherently abstract and subjective: it may refer to a specific physical object (e.g., a rubber duck), a particular identity such as the long-eared corgi puppy with a lighter left cheek shown in Figure 1, or broader class such as "corgi." regardless of age, size, or specific attributes. Although defining a concept in an absolute sense is difficult (Poeta et al.) 2023), we can represent it through a concept distribution, denoted by p(- Cor)..
This distribution serves as an interface through which users can specify what the concept is. In practice, we recommend two ways for users to instantiate their notion of a concept:
Direct specification of concept distribution: The user may already possess generative model or any other mechanism that directly provides a distribution p(- Con)) representing the concept.
The user may collect a set of im- ages depicting the desired concept (e.g., different poses of the same corgi in Figure I), and then train or fine-tune probabilistic generative model (PGM) on this set to ob- tain the corresponding concept distribution p(- Con). Here, Cori is a set of images Con - { 1.... Jor
Constructing the distribution from an image set:
(K) where K is the number of images depicting Coni-
In the remainder of this paper, we demonstrate the second approach, as it allows to clearly show- case how concept-level information can incorporated into adversarial attacks using accessible image data and standard generative modeling pipelines.
3.2 CONCEPT DISTRIBUTION AS A DISTANCE DISTRIBUTION
Building on the probabilistic perspective of adversarial attacks (Zhang et al. 2024b), a distribution used distance distribution can implicitly define notion of distance. Therefore, by using the concept distribution defined in the previous subsection as the distance distribution. we implicitly define the distance between an adversarial example and the underlying concept. Formally,
Pade (Tadv Cori Mhar) Pvic (Xadv Ytar) pais (Fadv
Cori)
where Pady(: | Con. Maar) is the adversarial distribution relative to the concept Cori and the target label Star- The distance distribution (- Coa) is the concept distribution.
Comparing 2 and (3) shows that the only modification is replacing Fori with Coni- Hence, the probabilistic adversarial attack (Zhang al., (024b) is the special case Cuni {Ian) ) (i.e., |Con 1). This straightforward and compact expansion allows us to heavily reuse the implementation of the probabilistic adversarial attack, making probabilistic adversarial attack (ProbAttack") a natural ablation baseline for our method.
While intuition suggests that expanding the perturbation space should produce stronger adversarial examples, rigorous justification is needed. In the following sections, we adopt the probabilistic perspective, presenting both theoretical analysis and empirical evidence to demonstrate how this expansion enhances attack effectiveness without compromising perceptual quality.
3.3 CONCEPT-BASED ADVERSARIAL. ATTACKS GENERATE HIGHER QUALITY ADVERSARIAL EXAMPLES
From the probabilistic perspective, generating adversarial examples amounts sampling from the overlap between Pvic and Pais. since Pady is proportional to their product (Hinton 2002). For the common case of attacking single original image Foni this procedure is illustrated the left side of Figure Empirical research has shown that modern robust classifiers can produce high-quality
Both Zhang et al. 22024b) and our work present methodology applicable to any PGM (e.g.. VAE, energy- based, diffusion). Since diffusion models are the most powerful PGMs, adopt them throughout this paper. We use ProbAttack denote the diffusion-hare hased implementation of /hhng al. (2024b).
4

---

Published as a conference paper at ICLR 2026
images of the target classes (Santurkar et al., 2019 Zhang al. 2024b Zhu al. 2021 causing Pvic to concentrate on the semantics of those classes. Consequently, as Toni does not depict the target class, the intersection between Pvic and Pais is small. Since high-quality images rarely appear in low-density regions of the distribution, the resulting adversarial examples drawn from this limited intersection tend to be of lower quality.
We claim that our concept-based adversarial attacks reduce the distance between the Pvic and the Pdis thereby increasing their overlap. This broader overlap yields higher-quality adversarial examples and improves targeted attack success rates, as illustrated on the right side of Figure
To justify this claim, must address key questions:
Do roncept-based adversarial attacks indeed decrease the distance between Pvic and Pais?
Do they genuinely produce better adversarial examples?
The remainder of this paper focuses on answering these questions.
3.4 THE DISTANCE BETWEEN DISTRIBUTIONS: A THEORETICAL STUDY
In the whitebox adversarial attack scenario, both the victim classifier and target label are provided, which means Pvic remains fixed. Let Pais Cun) be Gibbs distribution of the form Pai Con) x exp(-3D(xr, ()), where is a distance function measuring the discrepancy between a point æ and the concept center μ. The following theorem shows that, under suitable conditions, increasing the dispersion of Pais (i.e., decreasing } reduces the KL divergence between pvic and Pdis:
Theorem 1, Let be probability distribution and be a Gibbs distribution of the form
1))
g(x)
Z(B)
where 7(3) is the normalizing constant, pt. is constant and D is distance function. Then L q) is increasing function of B whenever Ex<pID(X) 4]] > Ex
The proof is provided in Appendix A By Theorem I we that L Pdi)) decreases as 3 decreases, provided that Exx=p [X(, [4] > Ex T(X, In the probabilistic adversarial attack framework, this condition is always satisfied because samples drawn from Pvic lie farther from the mean of Pais than samples drawn from Pais itself. this were not the case, the fundamental assumption that Pais represents a distance distribution concentrated around Joii or Con would be
violated.
In practice, different PGMs may be used to model Pai-- When energy-based model (EBM) is adopted, it explicitly learns a Gibbs distribution (LeCun et al. (206)). When diffusion model (via score matching) is used, it instead Iearns an implicit representation function (Song & Ermon 2019). Consequently, treating Pai Gibbs distribution in this section is fully consistent with practical implementations, and also aligned with the probabilistic adversarial attack formulation in Section 2.3
the corresponding energy
3.5
THE DISTANCE BETWEEN DISTRIBUTIONS: AN EMPIRICAL STUDY
The following theorem provides tractable expression for the difference in KL divergence between a fixed victim distribution and two different distance distributions.
Let Pi pail- CoR) and ( pais(- Coni be distance distributions, and let (: yhar) be the victim distribution corresponding to a victim classifier p(yhar x). Then, the difference
Theorem 2.
A = KL [| [L ((
is given by
A = E x [log Pog (X) - log p(yur Xx] E
x [log (X) p(ytar |X)].
A smaller 8 corresponds higher "temperature" in the Gibbs distribution, which makes Pais more dis- persed.
5

---

Published as a conference paper at ICLR 2026
Vision-language Model
Ueer:
"hdo [V] cog, Please geserate
input
vismpzinta, lmapeo
the croepts consiae.
food
[V] dog playing the
prompt input
generate
Stable Diffusion XI.
parameter input
[V] dog from DreamBooth
Augmented dataset
[V] dog LoRA Model
finetune
Figure 2: Illustration of how single corgi concept ("[V] dog") is expanded into diverse dataset. DreamBooth images (left) are finetuned with LoRA in Stable Diffusion XI., guided by GPT-4o prompts, to generate various poses, viewpoints, and environments (right).
The proof is provided in Appendix A We estimate A via Monte Carlo integration and further duce variance by using common random numbers in the sampling process; details of such practical techniques are introduced in Appendix B In section 5.3 empirically show that, concept-based adversarial attacks reduce the distance between distributions pvic and Pais by showing A < O when (22) is distance distribution around only one image and Pais is distance distribution around concept.
4 GENERATING CONCEPT-BASED ADVERSARIAL EXAMPLES
In this section we introduce some practical methods to generate concept-based adversarial examples.
4.1 AUGMENT CONCEPT DATASETS BY MODERN GENERATIVE MODELS
In practice, it can be somewhat challenging obtain a high-quality, highly diverse dataset Cori depicting the same concept, as required by our method. For example, as shown on the left side of Figure the dataset provided by DreamBooth (Ruiz al. 2023) contains four images of the same long-eared corgi. Although the corgi is shown in various poses and from multiple viewpoints, the relatively uniform backgrounds do not provide sufficient diversity for our concept- based adversarial attack. Therefore, we decided to use Stable Diffusion XI. (Podell et al. 2023) to expand the concept- description dataset.
As illustrated in Figure 2 we designate the corgi as "[V] dog". Using LoRA finetuning (Hu et al.) 2022], we train an SDXL LoRA model on this concept. Next, we feed the five corgi images into GPT-4o (Hurst al. 2024), stating that these images represent the "[V] dog" and asking it to produce SDXL prompts that embody sufficient diversity for the "[V] dog." Finally, we load the corgi LoRA into SDXL and, guided by GPT-4o's prompts (on the top of Figure ( generate images featuring a wide range of viewpoints, environments, and poses for this corgi concept (see the right side of Figure 2

---

Published as a conference paper at ICLR 2026
4.2 SAMPLE SELECTION
A key advantage of probabilistic adversarial attacks is that we can draw multiple samples from Padv and select the best o In white-box scenario, we simply discard samples that fail to deceive the classifier (rejection sampling). However, if Pais and Pvic overlap only slightly, this may lead to high rejection rates (especially under top-1 success criterion).
As a workaround, we first sample M adversarial examples from Padv and select the best among them. For small batches, it is feasible to manually choose which examples preserve the original concept. However, because we need large number of adversarial examples, we use an automated approach: we sort the samples by how highly they rank the target class and, in the event one of two strategies - referred to here as the "conservative strategy" (CONS) and the "aggressive strategy" (AGGR). Under the conservative strategy, we pick the example with the lowest softmax probability, thereby filtering out samples that deviate significantly from the original concept. Under the aggressive strategy, we pick the example with the highest softmax probability, helping us select samples with the greatest adversarial potential.
tie, we employ
EXPERIMENTS
5.1
DATA PREPARATION
We use the DreamBooth dataset (Ruiz et al. 2023). which provides 30 objects (animals, dolls, and everyday items) each with 5-6 representative images. To increase diversity, we apply the augmen- tation method in Section 4.1 generating 30 additional images per concept and forming the Dream- BoothPlus dataset. Among the 30 objects of DreamBooth, we only augment 26, excluding four that pose challenges for text generation require different fine-tuning parameters for cartoon-style content.
5.2 FITTING THE DISTANCE DISTRIBUTIONS
We use the DreamBoothPlu dataset finetune a diffusion model (Dhariwal Nichol 2021] Nichol & Dhariwal 2021) to fit the distance distribution pais (Details in Appendix D). We choose this model over more advanced architectures, such as the Stable Diffusion series (Podell et al. 2023 Rombach et al. 2022 or Flux, because it directly models p(z) instead of p(z y). where ø is the image and y is a label or prompt. Our goal to employ a more principled model to illustrate our general adversarial attack method, rather than to optimize for the highest possible engineering performance.
5.3 CALCULATING THE DIFFERENCE BETWEEN KL DIVERGENCES
We empirically estimate the difference between two KL. divergences,
A = KL (1) Pvic) - KL || pvie),
by using the Monte-Carlo method and the practical techniques introduced in Section 3.5 and Ap- pendix B and we denote this estimate by Á. Concretely, for each concept in DreamBoothPlus we fine-tune diffusion model on the entire concept to obtain p We then fine-tune separate diffu- sion model on just one image obtain P/ Next, we calculate the empirical difference À and find that < for every concept. This strongly suggests that A < 0, confirming our hypothesis from Section 3.5 The table in Appendix summarizes the values of À for each concept.
5.4 GENERATING TARGETED ADVERSARIAL EXAMPLES
We evaluate the performance of the concept-based adversarial attack targeted adversarial at- tack setting, because targeted attacks are generally more difficult than untargeted attacks In our
Although deterministic methods may yield different results when sampled multiple times, their variability does not stem from algorithmic design but rather from other sources error.
"This is especially true for ImageNet classifiers, which must distinguish among 1,000 classes. In an targeted attack, the goal is simply to prevent the victim classifier from assigning the adversarial sample its
7

---

Published as a conference paper at ICLR 2026
experiments, compare NCF Yuan al.
2022 ACA (Chen et al. 2024b), DiffAttack (Chen 2024b). We include NCF because it is the strongest lt al. 2024a), and ProbAttack (Zhagg et al.
color-bascd based adversarial attack. Both ACA and DiffAttack apply adversarial gradients in the latent space induced by Stable Diffusion and DDIM, representing the state of the art in unrestricted adver- special case of our approach when |Coal = 1. For both ProbAttack and our approach, we set the number of samples M to 10. During the sample selection phase of the experiments, our method uses two strategies conservative strategy and an aggressive strategy (both described in Section 4.2) denoted in the tables as OURS (CONS) and OURS (AGGR), respectively.
sarial attacks. As discussed earlier in Section 3 ProbAttack can be viewed
For each compared method, we conduct a white-box attack on the victim classifier (also referred to as the surrogate classifier) by generating adversarial samples based on it. Next, we feed these white-box-generatee adversarial samples into other classifiers a process known black-box attack. If these additional classifiers also classify the adversarial samples into the target class, the black-box attack is deemed successful, indicating transferability.
In our experiments, ResNet50
(He et al. 2016) used as the victim classifier for white-box attacks. We measure transferability on VGGT9 (Simonyan & Zisserman 2015). ResNet152 (He et al.) 2016)
DenseNet161 (Huang et al. 2017). Inception V3 (Szegedy et al. (2016). EfficientNet B7 (Tan & Lej
) and on adversarially trained Inception V3 Adv (Kurakin et al. 2017), EfficientNet B7 Adv
(Xie et al. 2020), and Ensemble IncRes V2 (Tramèr et al.) 2018). We report both the white-box targeted attack success rate (on ResNet50) and the black-box transfer success rate (on the remaining models).
Table 1: Targeted attack success rates (%) on ImageNet classifiers. In the white-box setting, a targeted attack is counted successful if the target class is ranked first. For transferability, report top-5 success rates, counting an attack as successful the target class among the top predictions (since top-1 success was uniformly low across all methods). See Appendix for full results.
NCF
ACA
DiffAtrack
ProbArtack
OURS (CONS)
OURS (AGGR)
White-box
Torpeted-Topl
ResNet
|
1.15
84,23
59.23
97.82
Transforability
Targeted-Top
VGGI9
1.28
1.67
4.36
2.44
2.05
4.36
ResNet 152
3.33
2.82
DenseNet 161
1.41
2,05
7.44
3.97
3.85
11.54
Inception
0,90
2,56
EfficientNet B7
1.41
1.67
1.79
1.41
1.28
3.97
Adversarial Defence
Inception
1.15
2.18
EfficientNet B7 Adv
0,26
1.15
2.05
2.31
1,67
6,41
Ensemble IncRes V2
0.77
1.28
2.69
1,92
0.77
5.00
For unrestricted adversarial examples, we must also check whether they preserve the original con- cept and remain undetectable to humans. Therefore, we measure similarity via a user study (Ap- pendix F) and CLIP (Radford et al. 2021), and image quality using no-reference metries (MUSIQ (Ke et al. 2021). TReS (Golestanch et al. 2022). NIMA (Talebi & Milanfar 2018), ARNIQA (Ag- nolucci et al. 2024), DBCNN (Zhang et al. 2020). and HyperiQA (Su et al. 2020
As ImageNet has 1,000 classes, it is impractical to evaluate them all. Therefore, we randomly select 30 target classes Year listed in Appendix E Since DreamBoothPlus contains 26 concepts, each method generates 26 x 30 780 adversarial examples. This scale is comparable to current popular approaches performing untargeted adversarial attacks on the MangeNet-Compattiie dataset (Kurakin al. 2018).
Table presents the targeted attack success rates on ImageNet classifiers. Since the choice of aggres- sive or conservative strategy in the sample selection phase does not affect white-box performance,
correct class. In contrast, targeted attack requires the classifier misclassify the adversarial sample exactly the chosen target class Yur-
8

---

Published as a conference paper at ICLR 2026
Zon Cast
Tha
ambulance
basenjj
hamster
king snake
panda
goldiihh
mashroom
laptop
papillon
ACA
DiffArk
ProhAtk
OURS (CONS)
OURS (AGGR)
Figure 3: Qualitative comparison. (A green border indicates an example that successfully fools the classifier; red indicates failure.) See Appendix for a more detailed qualitative analysis.
those rates are identical. Notably, the aggressive strategy achieves significantly higher transferability than other methods. While the conservative strategy leads to slightly lower transferability, it is still roughly comparable to baseline methods. Please refer to Appendix [ full results.
Table reports the similarity between each adversarial sample and its original image, well as the image quality the generated examples. Both our aggressive and conservative strategies out- perform the other methods in these metrics. Combined with the attack success rates in Table 1, our approach not only achieves higher success but also preserves the original concept Con more effectively. Figure provides qualitative comparison, showing how well our method maintains the original concept. Notably, DiffAttack generates images missing details, which aligns with its weaker image quality scores. For additional qualitative analysis, please refer to Appendix G
Table 2: Quantitative comparison of similarity to the original images and no reference image quality metries for unrestricted adversarial examples.
Clean
NCF
ACA
DiffArack
ProhAttack
OURS (CONS)
OURS (AGGR)
Similarity 1 User Study
NIA
0.58
0,2808
0.7577
0,8041 0.8581
0.9654 0,8283
0.8808
1 Avg. Clip Score
0.8043
Image Quality
HyperiQA T DBCNN
0.7255
0.5075
0.6462
0.5551
0.6675
0.6947
0.6809
0.6956
0.5096
0.6103
0.5294
0.6161
0.6572
0.6399
ARNIQA
0.7154
MUSIQ-AVA
4.3760
3.8135
4,2687
4.07344
4,3130
4,5305
4,5250
NIMA-AVA
4.5595
3.7916
4.4511
4.0589
4.5168
4.7575
4.7401
MUSIQ KonIQ
65.0544
50.5022
59.0840
52,5399
58.1563
63.7486
62.2217
1 TRcS
93.2127
64.7050
85.84335
74.1167
84.3131
90.4488
88.0836

---

Published as a conference paper at ICLR 2026
6 RELATED WORKS
To the best of our knowledge, no existing method constructs adversarial examples conditioned on an identity-level concept. The most closely related works are [Snn et (2018)ss Dai al. (222)'ss 's and [Colins et al. 22025)s. However, they treats a "class" (e.g., cat, dog, or truck) as the concept, which cannot precisely capture an individual identity. In our framework, we represent concept through a distribution that could be learned from a set of images, allowing it to flexibly correspond single image (i.e. a set with size 1), an identity-level concept, or class-level concept. By con- trast, other unrestricted adversarial attack methods focus solely generating adversarial examples from single image: Xiao et al. (2018a) generate adversarial examples using GANs, [Chen et al. (023) employ diffusion models, and Laidlaw et al.] (2020) impose feature-space distance regularization term in the optimization objective. ACA (Chen et al. 2024b) and DiffAttack (Chen et al. 2024a) further apply the attack gradient directly in the DDIM latent space (Song al. 2020). Color- based transformations have proven effective in preserving semantic content for untargeted
attacks (Bhattad al. 2020 Hosseini & Poovendran 2018 Shamsabadi et al. 2020 Yuan al.
2022 Zhao et al., 2020). yet they perform poorly in targeted scenarios (Chen et al. 2024a a result
confirmed by experiments.
Unrestricted Adversarial Attack Method
Single-maage
Identity-level Concept
Class-level Concept
Rhattad et
2020)
Yes
No
No
Hossoini & Fooveadran 2018
Yes
No
No
Stamsabaa
2020
Zhao ot al (020)
Yes
No
No
NCF Yuan dl
2022
Yes
No
No
ACA
Chen
(0224
Yes
No
No
DifFAtack (Chem et al.
2024.
Yes
No
No
ProbAttack (Zhang
Yes
No
No
Ad+GAN Xioo et ai 2018
Yos
No
No
Xiao
20186)
Perceptual Adv. Attack
Laidlaw cl.
2020
Yes
No
No
Song et al. 2018)
No
No
Yes
NatADai
3025
No
Yes
AdvDiff
(Dar at 2024
2044
No
No
Yes
AdvDiffuser Chio 2023
Yos
Yes
Ours: Concept-hased Adv.
Table 3: Comparison of unrestricted adversarial attack methods. Our method is the only one capable of performing adversarial attacks at the identity-level concept, while also supporting single-image and class-level concepts.
Our work directly inherited from Zhang al. (2024b)'s 's probabilistic perspective, but we make novel contribution by, for the first time, defining the distance distribution in adversarial attacks with respect to distribution representing concept rather than a single image. Although, operationally, our method appears to be straightforward extension - replacing the ungle-image-centere distri- bution Pais(: Foni with concept-centered distribution P- | Cor) (as in the difference between (2) and (3)) - we rigorously demonstrate, both theoretically and empirically, why this seemingly simple generalization is remarkably effective.
CONCLUSIONS
The essence of adversarial attacks is create examples that are imperceptible to humans yet harmful to computational systems. Our work demonstrates that in an era of powerful generative models, creating an adversarial example from scratch one that humans pereeive as conceptually correct can be more flexible, more realistic, and ultimately more potent than simply perturbing a single image. Leveraging modern generative models, adversarial noise can be concealed in subtle changes to viewpoint, pose, or background, making it exceedingly difficult to detect. We believe that our concept- based adversarial attack heralds the future of adversarial attacks, posing new challenges to the field of AI security. Defending against such threats will be crucial for advancing Al security research.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was supported by the Engineering and Physical Sciences Research Council (EPSRC) through the AI Hub in Generative Models (EP/Y028805/1).
AZ. and SK were funded by the UKRI AT Hub in Generative Models (FP/Y028805/I). SM was supported by the UKRI AI Programme Grant (EP/Y028856/1), AZ also acknowledges support from a personal grant provided by Mrs. Yanshu Wu. SK was additionally supported by the Research Council of Finland (Flagship Programme: Finnish Center for Artificial Intelligence FCAI, 359207) and the UKRI Turing World-Leading Researcher Fellowship (EP/W002973/1).
ETHICS STATEMENT
This work introduces a new class adversarial attacks that operate at the concept level. While primary goal is advance scientific understanding of adversarial robustness and stimulate the development of stronger defenses, we acknowledge the potential for malicious misuse. In particular, concept-based adversarial attacks could be exploited to evade security-sensitiv image classifiers or to manipulate systems deployed in safety-critical applications.
To mitigate these risks, we have:
Released all code and data strictly for research purposes, under licenses that encourage responsible use.
Discussed mitigation strategies in Appendix including adversarial training, Al Al-generated content detection, and hybrid defenses.
We emphasize that the broader impact (Appendix M) of this work depends on the research commu- nity's 's response. By exposing vulnerabilities of current classifiers, we aim to encourage the develop- ment of more robust and trustworthy AI systems. We strongly discourage any use of this research for harmful purposes.
REPRODUCIBILITY STATEMENT
We have taken several steps to ensure the reprodueibility our work:
We provide the full source code, including scripts for dataset prepa- ration, model fine-tuning, and adversarial example generation, at https:: / hit.hb. com/ Sanddac/Cooncpptee the code repository.
Code and models:
All hyperparameters and training details are specified in
Datasets: Our experiments are based on the DreamBooth dataset (Ruiz et al. 2023). which is publicly available under a CC-BY-4.0 license. We also describe our augmentation proce- dure using SDXL and LoRA in Section 4.1 provide scripts for generating data (Dream- BoothPlus) as part of our code repo
Hyperparameters: Fine-tuning settings for both SDXL LoRA and diffusion models are detailed in Appendix D For sampling and evaluation, we report the number of generated adversarial examples, sampling strategies, and evaluation metrics in Sections 5
Theoretical results:
Proofs of all theorems are included in Appendix and additional details on KL divergence estimation in Appendix B
Compute resources: We report hardware specifications and training times in Appendix to allow others to reproduce our experiments with similar resources.
We believe these resources provide sufficient detail for reproducing both our theoretical and empir- ical results.
11

---

Published as a conference paper at ICLR 2026
REFERENCES
Lorenzo Agnolucci, Leonardo Galteri, Marco Bertini, and Alberto Del Bimbo. Amiqa: Learning distortion manifold for image quality assessment. Proceedings of the IEEE/CVF Winter Con- ference Applications of Computer Vision, pp. 189-198, 2024.
Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A. Forsyth. Unrestricted adver- sarial examples via semantic manipulation. In 8th International Conference Learning Repre- sentations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL https://openrevaii net worumooru-iioorr Forumrid=Sye_e_eeeeeerr Si
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learn- ing. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, pp. 2154-2156, 2018.
Yuri Burda, Roger Grosse, and Ruslan Salakhutdinov. Importance weighted autoencoders. arXiv preprint arXiv: wtw...099.005550 00,00, 2015.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39-57. leee, 2017.
Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang. Zhengxia Zou, and Zhenwei Shi. Diffusion mod- els for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, pp. 1-17, 2024a. doi: 10. 10/TPAAM..22444486551..
Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Advdiffuser: Natu- ral adversarial example synthesis with diffusion models. In Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pp. 4562-4572, 2023.
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content- based unrestricted adversarial attack. Advances in Neural Information Processing Systems, 36, 2024b.
Max Collins, Jordan Vice. Tim French, and Ajmal Mian. Natadiff: Adversarial boundary guidance for natural adversarial diffusion. arXiv preprint arXiv:2505.2095: 2025.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flam- marion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: a standardized adver- sarial robustness benchmark. arXiv preprint arXiv:2010.09670 2020.
Xuelong Dai, Kaisheng Liang, and Bin Xiao. Advdiff: Generating unrestricted adversarial examples using diffusion models. In European Conference on Computer Vision, pp. 93-109. Springer, 2024.
Nilesh Dalvi, Pedro Domingos, Mausam, Sumit Sanghai, and Deepak Verma. Adversarial clas- sification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 90-108, 2004.
Prafulla Dhariwal and Alexander Quinn Nichol. Diffusion models beat gans on image synthesis. In Mare' Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan (eds.), Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pp. cc wwtp:ccpppppppceeee http://221/hhaaaa /
8790, 2021. URL http::tttt//tttm /tt/nttpss//pppceedagg..co
Yinpeng Dong, Qi-An Fu, Xiao Yang, Wenzhao Xiang, Tianyu Pang, Hang Su, Jun Zhu, Jiayu Tang, Yuefeng Chen, XiaoFeng Mao, et al. Adversarial attacks on ml defense models competition. arXiv preprint arXiv:21 2021.
S Alireza Golestanch, Saba Dadsetan, and Kris M Kitani. No-reference image quality assessment via transformers, relative ranking, and self coniissnsst. In Proceedings of the IEEÉ/CVF winter conference on applications of computer vision, pp. 1220-1230, 2022.
12

---

Published as a conference paper at ICLR 2026
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA. USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL
/atbs//111 1412. 6572
Martin Gubri, Maxime Cordy, Mike Papadakis, Yves Le Traon, and Koushik Sen. Lgv: Boosting adversarial example transferability from large geometric vicinity. In European Conference on Computer Vision, pp. 603-618. Springer, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Puttern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 770-778. IEEE Computer Society, 2016. doi: 10.1109/CVPR.2016. URL https:: //doi org/ / 10. 1109/CVPR.200111
Geoffrey E Hinton. Training products of experts by minimizing contrastive divergence. Neural computation, 14(8):1771-1800) 2002.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria-Florina Balcan, and Hsuan- Tien Lin (eds.). Advances in Neural Information Processing Systems 33: Annual Con- ference on Neural Information Processing Systems 2020, NeurlPS 2020, December 6-12, 2020, virtual, 2020. URL httpps::/proceedinggg hetp:///ppooeednnn....ee......s. #c5bcfec8584af0055 wttee//aaaa111aabbalbeaa
pccppppprr222//aast/
html
Hossein Hosseini and Radha Poovendran. Semantic adversarial examples. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pp. 1614-1619, 2018.
Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhut -hu, Yuanzhi Li, Shean Wang. Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. The Tenth Inter- national Conference Learning Representations, ICIR 2022, Virtual Event, April 25-29, 2022. OpenReview.net, 2022. URL URL https::t////. owwnreview httppp:://peeeeeiiiie.....
net www.mmid-nnneeeeeeeeeereeeeeeeee
Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Pultern Recognition, CVPR 2017, Honolulu, HI. USA, July 21-26, 2017, pp. 2261 2261,, IEEE Computer Society, 2017. doi: N0.1109/CVPR.2017.222 URL https: doi org wttp:////....1//........ 243
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Os- trow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024.
Junjie Ke, Qifei Wang. Yilin Wang, Peyman Milanfar. and Feng Yang. Musiq: Multi-scale im- age quality transformer. In Proceedings of the IEEE/CVF international conference computer vision, pp. 5148-5157 2021.
Diederik Kingma, Max Welling, et al. Auto-encoding variational bayes, 2013.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In 5th International Conference Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings. OpenReview.net, 2017. htt.tttps://ppeeeeeeeete
Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99-112. Chapman and Hall/CRC, 2018.
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. arXiv preprint arXiv:2006. 1200006.2665 /2655, 2020.
Andrew Lamperski. Projected stochastic gradient langevin algorithms for constrained sampling and non-convex learning. In Conference on Learning Theory, pp. 2891-2937. PMLR, 2021.
Yann LeCun, Sumit Chopra, Raia Hadsell, M Ranzato, Fujie Huang, et al. A tutorial on energy- based learning. Predicting structured data, (0)) 2006.
13

---

Published as a conference paper at ICLR 2026
Daniel Lowd and Christopher Meek. Adversarial learning. In Proceedings of the eleventh ACM SIGKDD international conference on Knowledge discovery in data mining, pp. 641-647, 2005a.
Daniel Lowd and Christopher Meek. Good word attacks on statistical spam filters. In CEAS, volume 2005, 2005b.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Camada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL
SorumPid-rJaIBEAAb
Eric T. Nalisnick, Akihiro Matsukawa, Yee Whye Teh, Dilan Görür, and Balaji Lakshminarayanan.
Do deep generative models know what they don't 't know? In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019. OpenReview.net, ew net. fort//? i d=H1 xwNhCcYm
2019. URLptttss://opeeeee
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning. ICML 2021, 18-24 24 July 2021, Virtual Event, volume 139 of Proceedings of Machine Learning Research, pp. 8162-81 8171. PMLR, 2021. URL http: httt:::/pprocedingss.
21a html
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. arXiv preprint arXiv:2307.01952, 2023.
Eleonora Poeta, Gabriele Ciravegna, Eliana Pastor, Tania Cerquitelli, and Elena Baralis. Concept- based explainable artificial intelligence: A survey, ACM Computing Surveys, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. PmLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björ Ommer: High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEF/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driven generation. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22500- 22510, 2023.
Shibani Santurkar, Andrew Ilyas, Dimitris Tsipras, Logan Engstrom. Brandon Tran, and Alek- sander Madry. Image synthesis with single (robust) classifier. In Hanna M. Wallach, Hugo Larochelle, Alina Beygelzimer, Florence d' Alché-Buc, Emily B. Fox, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 32: Annual Conference on Neural Informa- tion Processing Systems 2019, NewrIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pp. 1260 1271, 2019. URL httph: htt.::::/pproccediinee www.eeiiiiiinnnnnneeeeeeee html
cc/paper/2019.. 20t9/hash/ /hash/
Ali Shahin Shamsabadi, Ricardo Sánchez-Matlla. and Andrea Cavallaro. Colorfool: Seman- tic adversarial colorization. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19 2020, pp. 1148-1157 IEEE, 2020. doi: 00110999CVP42200.200000000
2020. 00123
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA. USA. May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http::/aassv..or//aaaa..
1556
14

---

Published as a conference paper at ICLR 2026
Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted ad- versarial examples with generative models. In Samy Bengio, Hanna Wallach, Hugo Larochelle, Kristen Grauman, Nicold Cesa-Bianchi, and Roman Garnett (eds.), Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pp. 8322 8333, 2018. URL httpss//pprooceddnnggg htwp://ooeeeennno.....ii..e...ee
wwtccc/cpppeee htt/ppper/201//aaat. - html
Shaolin Su, Qingsen Yan, Yu Zhu, Cheng Zhang, Xin Ge. Jinqiu Sun, and Yanning Zhang. Blindly assess image quality in the wild guided by self-adaptive hyper network. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 3667-3676, 2020.
Christian Szegedy. Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Good- fellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun (eds.), 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014. URL http:
//arxiv.org abs/ / 111.11142 6199
Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens. and Zbigniew Wojna. Re-
thinking the inception architecture for computer vision. In 2016 IEEE Conference on Com- puter Vision and Puttern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pp. 2818-2826. IEEE Computer Society, 2016. doi: 10.1109/VVP.2206..088 URL https:
www./1111...... 2016.
Hossein Talebi and Peyman Milanfar. Nima: Neural image assessment. IEEE transactions on image processing. 27(8):3998 4011, 2018
Mingxing Tan and Quoe V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, Cali- fornia, USA, volume 97 of Proceedings of Machine Learning Research, pp. 6105-6114 PMLR, 2019. URL
ml htwpinnn.............eepeeeeeeee www.pprsssssvee ttn 9a. html
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL
net//
RZ
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1924-1933, 2021.
Zhixiang Wang, Xiaosen Wang, Bo Wang, Siheng Chen, Zhibo Wang, Xingjun Ma, and Yu-Gang Jiang. Diffpatch: Generating customizable adversarial patches using diffusion models. arXiv preprint arX1v:2412.01440, 2024.
Chaowei Xiao, Bo Li, Jun-Ya Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adver- sarial examples with adversarial networks. arXiv preprint 1801 0200000 2018a.
Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially trans- formed adversarial examples. In 6th International Conference on Learning Representationss ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018h.
http::///peeeevvveeeeee net hwtt:/oromiiddHyyyootoao
15

---

Published as a conference paper at ICLR 2026
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, and Quoc V. Le. Adversarial examples improve image recognition. In 2020 IEEE/CVE Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pp. 816 825. IEEE, 2020. doi: 10. 111119/CVVPR-260022000000000 URL htt.:tts::/// /ttp:////6oooar///010000/////200 1020.00090
Shengming Yuan, Qilong Zhang. Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting blxck-box unrestricted attacks. Advances in Neural Information Processing Systems, 35:7546-7560) 2022.
Andi Zhang, Tim Xiao, Weiyang Liu, Robert Bamler, and Damon Wischik. Your fine- tuned large language model is already powerful out-of-distribution detector. arXiv preprint arXiv:2404.08679 2024a.
Andi Zhang, Mingtian Zhang, and Damon Wischik. Constructing semantics-aware adversarial ex- amples with a probabílistic perspective. Advances in Neural Information Processing Systems, 37: 136259-136285, 2024b.
Weixia Zhang, Kede Ma, Jia Yan, Dexiang Deng, and Zhou Wang. Blind image quality assessment using a deep bilinear convolutional neural network. IEEE Transactions on Circuits and Systems for Video Technology, 30(1):36-47, 2020.
Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Adversarial color enhancement: Generating unrestricted adversarial images by optimizing a color filter. In 31st British Machine Vision Con- ference 2020, BMVC 2020, Virtual Event, UK, September 7-10, 2020. BMVA Press, 2020. URL https: / www bmw www.oooooooooccccceeeeeeeee com/ assets httpp/ppppsss////// / pdd
Yao Zhu, Jiacheng Ma, Jiacheng Sun, Zewei Chen, Rongxin Jiang, Yaowu Chen, and Zhenguo Li. Towards understanding the generative capability of adversarially robust classifiers. Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 7728-7737, 2021.
Yao Zhu, Yucfeng Chen, Xiaodan Li, Kejiang Chen, Yuan He, Xiang Tian, Bolun Zheng, Yaowu Chen, and Qingming Huang. Toward understanding and boosting adversarial transferability from distribution perspective. IEEE Transactions Image Processing, 31:6487-6500 2022.
16

---

Published as a conference paper at ICLR 2026
APPENDIX
A PROOF OF THE THEOREMS
Theorem 1. Let be probability distribution and be Gibbs distribution of the form
exp(-3D(xx,)) p))
g(z)
Z(B)
where 7(3) is the normalizing constant, is constant and D is distance function. Then L II q) is increasing function of 3 whenever Ex=pID(X, > EX
Proof. According to the definition of KI. divergence, we have logp(z)de - / p(x) log q(x)dax
KL(p11) = p(ar) log p(x) dr =
-((x) p(xx)
((x))
Since p(x) logp(1))))))) p(x)ddr is independent of 3, we can treat it constant. Let us denote the 8- dependent component as f(3), which gives us
/ p(x) log logd(z)dz
f(3)
/ p(z) 1- - log 2(3) dz
p(z) 1) log ((3) p(z)dr
= Exxpl_D(XX p0] + log Z(8)
Taking the derivative with respect to B, we obtain
d
dZ(3)
d3 f(3) = Ex D(X, A)] + Z(3) dß
ddxp(=3 (.D(x..)) 11)
((X, (1) + Z(3)
dx.
d3
ExxppDDXX,,, 14)] Z(3))
-xXXX pt)
Ex D 14] - Ex p))
Therefore, when EXxp/D((X, w Ex [(X, 14), the derivative becomes positive. This implies that both f(3 and consequently K (T(plgg) increase as increases.
Let Pais Paul- ((l)) and Pais Pail (o()) be distance distributions, and let (- Bhar) be the victim distribution corresponding to a victim classifier p(thar x). Then, the difference
Theorem 2.
A = KLL [pvic) - KL
(2) Plvve)
is given by
(1)(X) A E Ex [logPad (X) - c log p(yer X)]
Ex
x
blgg (X) - c log p(yrr X)]]
Proof. Recall that for distributions and q on the same space, the
(KL) divergence
KL(p q) Exxp [Xgg(() log 9(x)]
Hence, for P- Cori) and (vi Mtar),
K L [pais (: Con) |] p- Wtrr)) = Exxpac(-ICan) logpas(X Crri - log Pric (X Ytar)
17

---

Published as a conference paper at ICLR 2026
Given that the victim distribution is proportional to
Pric (x Itar) & exp( - (xx Ytar),,
where f(x, Yur) is the cross-entropy loss, i.e. fIx Mur) = log p(yur x). Thus we can write
exp(-c yras)) I Texp(-c (2, Year)) )) da
( Year)
Let Z : === fxp( -c fxr, Mar)) dx. Then
log Pvic (X yrur) log logexp(-c f(x, Mar)) log Z -c -cf(x, Mear) loo Z.
Therefore,
KL (pais(- Cari) || Prio Bhar)) = Ex-par(-ICa)) [log pais Pais Con) + c c(X, ytar]] + log Z.
Since f(x, Ytar) log p(Maar x)), get
c (xx-pall-((ia) (X,, yrar)l - (xx (on llg X)].
Hence
K (paisl-- Cori) Pric(- (tar)) = Ex [log pais (X Cori)
log p(Shar [)] + log Z.
(2) Now take such distributions, Pais and Páis Because log Z does not depend which paic(: Cari) we use, it cancels when we form the difference:
(1)
A
LL Pric) - (L (2) Pvic)
E (x loo Pass (X) - c log P(yer X)] + log 2
[ [xmpp [logPas Pais (X) - clog (Vtar [x]] + log 2)
=B x ( log Pais (X) - log p(yer
x)] - E X xp [log (2) (x) c loo p(ytrr [x]]
which is precisely the claimed result.
B PRACTICAL STRATEGIES FOR KL DIVERGENCE ESTIMATION
B. COMMON RANDOM NUMBERS
In practice, our distance distributions (1) and (2) are instantiated by diffusion models: each image X is generated from noise via a generator G. We write X = (()) (c) to indicate that X is sampled from P and = gia) (c) to indicate that X sampled from p this common-noise setup, the difference in KL divergences becomes
A E2 (g clog P( (C)( log P (g)) + clog p(yuur (c)) (4)
B.2 LIKELIHOOD CORRECTION
We posit a probabilistic model Pahare that captures the non-semantic, shared features of the im- ages. Specifically. we assume that for samples X drawn from P and p the expected values E xx=p(t) [log (X)] and E x=x,,!?) (2) [log Pshure (X) are equal. This assumption is reasonable be-
cause the two distributions, in principle, can generate images sharing the same non-semantic details, differing only in their semantic content.
Then, under our diffusion tiffusion-model instantiation, we have
Ex (1) [log Pchare (X) = E (x
(2) Blogg Pehare (X)) + E, [log Pahare (c)( - log Pshare (g (c)) =
18

---

Published as a conference paper at ICLR 2026
for A, following equation 4 have the equations:
A -E, log P (g
(e) log (g clogp(ye (e)
E [log Psture (c)) log Pahare (c)))
-E, log Pate (g log Pshare (g (e)) clog p( (e)
log Pais (g (e)) + log Pshare (g (c)) clogp (())
In practice, however, the assumption E "x-pil) [Pature (X)) = E. Ex=p!² [P (X)) may not hold per- fectly, due differences in model capacity, finetuning steps, and other factors. For example, model (1) finetuned on more images might actually lose some non-semantic details compared to Pdis
Pdis which is finetuned on single image. The extra Pshare-based terms can thus be viewed as correction that accounts for these mismatches in non-semantic content.
(2)
Following Zhang et al. 2202a)'s work, a good practical choice for Pshare is often the pretrained model, because has been trained on a large, diverse dataset and therefore captures broad, shared non-semantic features of images.
B.3 ESTIMATED DIFFERENCES OF KL DIVERGENCES
Because A depends on both the original concept Con and the target class Yours enumcrating every pos- sible A would be impractical. Therefore, similar to the adversarial-xxampe generation experiment introduced in Section 5.4 we restrict our analysis to the 30 target classes listed in Appendix We then compute the mean and variance of the estimated A (denoted Å), as shown in Table 4
Table 4: Estimated differences of KI. divergences Å for each concept.
Concept name
Concept name
Concopt name
Ä
backpack
3507.28 d: 2040.85
backpack dog
-8372.57 1: 860.92
bear plushie
-466.69 1: 1413.40
candle
-3637.39 + 940.80
cat
4658.98 2423.05
cat2
-6654.28
1318:03
colorful_sncakrr
-195.1.0- 120.10
dog
-7159.63
dog2
-1811.63 170.95
dog3
8303366 + 2964..4444 40
dog5
-8880.70 + 2808 13
dogó
-2380.29 + 1780.36
dog?
10545.45 787.79
dog8
-12401.76 966.62
duck Joy
-2420.45 2334.07
fancy .boo
5780.99 + 1489.92
grey plushie
-6848.966 1477.
monster.toy
-7435.54 + 1698.99
pink sunglasees
-5711.26 799.99922 22
emoji
-219.27 1: 929.88
re.car
-5046. 80..88011 1. 3212.23
mhot
-7008.27 710.45
shiny sneaker
3203.81 4447.21
teapot
-7327.87 486.00
vase
5806.76 + 2435.28
wolf.plushic
-325.80 80 + 2811.99
C SENSITIVITY STUDY FOR SAMPLE SELECTION
when generating adversarial examples we first sample M candidate adversarial images and then select the "best" one. To investigate the effect of different values of M, we perform a sensitivity study. In this study, |Conl is set to either 1 or 30, while M is set to 1, 5, or 10. Note that [Corl corresponds ProbAttack (Zhang al. 2024b).
As described in Section 4.2
From Table 5 we observe that as M increases, the white-box attack success rate rises significantly. In the |Canl] case, the transferability also increases as M grows. However, in the |Cmn = 30 case, increasing M results in decrease in transferability. This happens because employ a conservative strategy (introduced in Section 4.2) to pick images that just barely fool the classifier while preserving the original concept. Evidence of this conservative strategy can be seen in Table when |Conil 30, increasing M yields higher image quality and greater similarity to the original image. In contrast, when |Cou| = 1, the ranking criterion is more influential during the sample selection stage, so the conservative strategy does not take effect. Consequently, as M grows, the image quality tends to decrease.
19

---

Published as a conference paper at ICLR 2026
Table 5: Targeted attack success rates (%) ImageNet classifiers. In the white-box setting, success is counted when the target class is the top prediction. For transferability, we report top 100 success rates, top success was uniformly low across all methods.
[cal =1
Icad M =
[Curl
[Cad 30
[Call
Carl 30
M =1
M 10
M
M 5
M = 10
White-box
Top1
Resnet 50
26.03
50.38
59.23
81.41
96.28
97.82
Transferublliy
Top100
VGG19
16.41
17.82
18.97
23.21
20.90
ResNet 152
21.79
23.97
26.79
43.85
37.69
35.13
DenseNet 161
26.67
30.26
33.08
53.08
44.10
41.03
Inception V3
16.03
17.44
18.21
22.95
19.36
19.87
EfficientNet B7
16.15
16.54
17:44
25.90
21.54
20.38
Adversarial Defence
Top100
Inception V3 Adv
18.97
17.82
20.00
25.26
20.64
20.51
EfficientNet B7 Adv
16.54
17.95
21.03
33.72
27.
24.74
Ensemble IncRes V2
Table Quantitative comparison of similarity to the original images and no reference image quality metrics for unrestricted adversarial examples.
Clean
Ical =1
Carl =
Corl 30
[Carl M
30
[arrl 30
Similarity
Study
0,9654
Avg. Clip Score
1.0
0,8953
0.8859
0,8581
0,8175
0,8286
0,8283
Image Quality
T MUSIQ KunlQ
65.0549
59.0779
59,7026
58.1563
62.8293
63.8795
63.7486
MUSIQ-AVA
4,3760
4,3016
4.3400
4,3130
4.5013
4,5356
4,5305
1 TReS
93.2127
86.4084
86.9480
84.3131
88 9667
90.6312
90.4488
NIMA-AVA
4.7575
HyperIQA
0.7255
0.6800
0.6808
0.6675
0.6880
0.6952
0.6947
DBCNN
0.6956
0.6303
0.6340
0.6161
0.6459
0.6564
0.6572
ARNIQA
0,7667
0.7222
0,7153
0.7009
0.7187
0.7323
0.7335
D FINETUNING DETAILS
In this section, we provide the key parameters required fine-tune the models. For all parameters, please refer to the code repository of this paper.
D.1 FINETUNING DETAILS OF SDXL LORAS
In the SDXL LoRA finetuning described in Section and Section 5.1 we use LoRA rank 128 with corresponding LoRA alpha of 128, and set the dropout rate to 0.05. We employ the AdamW optimizer and train for 250 epochs, using a learning rate of 10-4 for UNet parameters and 10-6 for text encoder parameters. For more detailed settings, please refer to the accompanying code.
D.2 FINETUNING DETAILS OF DISTANCE DISTRIBUTIONS
For the diffusion model fine-tuning described in Section 5.2 we set the learning rate to 10-6 use the AdamW W optimizer, and train for 8000 steps per image in the fine-tuning set. More details are in the code repository.
E LIST OF THE SELECTED TARGET CLASSES
Since ImageNet consists consists of 1000 classes and it is impractical to cover them all, we randomly selected 30 target classes. For details, please refer to Table 7
20

---

Published as a conference paper at ICLR 2026
Table 7: List of the selected target classes
Index
Description
golddish, Carassius
great white shark, white shark, man eater, man eating shark, Cuncharudon carcharias
56
king snake, kingsnake
134
crane
151
Chibuahua
papillon
cullie
254
hasenji
328
urchin
333
hamster
341
hog- pig. grunter, squealer, Sus scrofa
345
hippopotamus, hippo, river horse, Hippopotamus amphibius
gibbon. Hylobates lar
388
giant panda, panda, panda hear, coon bear, Alluropoda melanolenca airliner
407
ambulance
417
balloon
504
coffee mug
555
fire engine, fire truck
fountain pen
620
laptop, laptop computer
721
pillow
769
rule, ruler
817
spotts car, sport car wardrobe, closet, press
894
947
mushroom
jackfruit, jak, jack
963
pizza. pizza pic
DETAILS OF THE USER STUDY
We employed crowdsourcing approach by hiring five annotators to determine whether each adver- sarial example preserves the original concept. Since our concepts are all concrete objects, we used the term "same item" to convey the notion of "same concept" in straightforward manner. Follow- ing the user study methods of |Song et al. (2018) and ZZang et al. (2024b), all five annotators voted on whether they believed each adversarial example still represented the original concept.
Annotator Instructions.
this study, you will see two images and asked whether they show the "same item." Please follow these guidelines when making your judgment:
1. Shape/Form
If the overall shape (including any accessories) in both images closely matches or approximates each other, answer "Yes."
the object in one image appears excessively distorted or deformed com- pared to the other, answer "No."
2. Accessories
Even if the second image has additional or fewer accessories, as long as it essentially represents the same item, answer "Yes."
3. Color
there is no significant difference in color between the two images, an- swer "Yes."
If there clear and noticeable color difference that affects recognizing the item, answer "No."
Figure shows the user interface for this study.
21

---

Published as a conference paper at ICLR 2026
Content
Label
posse images Axpiat solne
20 piice
Figure 4: Screenshot of the user interface for user study.
G DETAILED QUALITATIVE ANALYSIS
Due to space constraints, the qualitative comparison figures the main text are relatively small. Therefore, in this section, we present enlarged qualitative comparisons between DiffAttack and our approach. We focus on comparing DiffAttack in particular because, although it achieves a high target attack success rate, produces lower-quality images, shown in user study and image quality tests. Here, we examine specific adversarial examples generated by DiffAttack to illustrate why its image quality is inferior.
Border Collie (first column of Figure Diff'Attack removes all the dog's fur details and replaces its eyes with those of another canine, while the nose and tongue become stylized with graffiti-like look, losing realistic details. contrast, although our concept-based adversarial example changes the dog's pose, it preserves the animal's 's fur and facial details.
Shiny Sneakers (second column). DiffAttack turns the sneakers into a shoe design with sharp edges, losing the smooth curves of the original model.
Chow Chow (third column). DiffAttack alters all of the fur details and erases the dog's forelegs, resulting in a shape that resembles a drumstick rather than chow chow.
Colorful Sneakers (fourth column). While DiffAttackk retains the purple front section and the blue rear section, it removes the yellow line in the middle and the adjacent cyan trim. Without these details, the sneaker's appearance changes to a different style altogether.
Cat (fifth column). DiffAttack modifies the cat's fur patterns and gives it a distorted facial expression.
These observations further show that DiffAttack's adversarial examples degrade crucial details, re- sulting in significant drop in image quality and diminished fidelity the original concept. To emphasize that this qualitative study not cherry-picking, we provide the complete set of adversarial examples - both from other methods and ours in the code repository.
22

---

Published as a conference paper at ICLR 2026
Tori / Cori
Ytar
basenji
hamster
goldfish
laptop
papillon
DiffAtk
OURS (CONS)
OURS
(AGGR)
Figure 5: Qualitative comparison (zoomed in). (A green border indicates an example that success- fully fools the classifier; red indicates failure.)
H ADDITIONAL COMMENTS ON TRANSFERABILJTY
As shown in Appendix Q our proposed method consistently achieves the best transferability among comparable approaches. However, its attack success rates are still considerably lower than those of methods explicitly optimized for transferability. such as works of Zhu et al. (2022), Waag & He (2021), Gubri et al. (2022) and Collins et al. (2025). We note that approaches targeting transferabil- ity often generate clear visual features of the target class. Especially in the setting of unrestricted adversarial attacks, directly synthesizing objects of the target class within the image is also consid- ered valid (see Figure 5 in the appendix Collins et al. (2025)).
From the probabilistic perspective of adversarial attack, this phenomenon is especially intuitive. As illustrated in 6 Pas denotes the distance distribution, while P and p represent the victim distributions induced by two different classifiers. Without loss of generality, suppose adversarial
(1)
examples are sampled from the product of the red distribution Pvje and the blue distribution Pais- The resulting adversarial examples concentrate in the region where these two distributions overlap. As
shown in the figure, this region corresponds to low probability density under the green distribution (2) Pvie leading to poor transferability across classifiers.
Although the overall transferability of our method relatively low, expanding Pas indeed brings the overlap between the blue and red distributions closer to the green distribution, making it reasonable that a larger Pais leads to an improvement transfcrability.
However, it is important to emphasize that our goal fundamentally differs from methods explicitly designed to maximize transferability. Approaches that achieve very high transferability. such as Zhu et al. 2002)) and [ollins et al. (2025), typically introduce strong visual features of the target class. Doing so moves samples toward the intersection of the red and green victim distributions, thereby dramatically improving transferability. Yet this strategy comes the cost of injecting target-
23

---

Published as a conference paper at ICLR 2026
class semantics into the generated images, which directly violates requirement of preserving the original identity-level concept.
In contrast, method aims to investigate how enlarging the concept-based distance distribution
Pdis affects both image quality and transfcrability, while strictly maintaining the underlying iden- tity. Under this constraint, extremely high transferability is not expected and, in fact, cannot be achieved without compromising identity preservation. Although our framework could be extended incorporate target-class features boost transferability, we view this beyond the scope of the current work and a promising direction for future research.
Pdis
(I) Pvic
Psic
Figure 6: Transferability of adversarial attacks from probabilistic perspective. Pais denotes the (1) and (2) represent the victim distributions induced by two different distance distribution, while Pvic
classifiers. Without loss generality, assume that adversarial examples are sampled from the prod- uct of the red distribution Pvic and the blue distribution Pais- In this case, the generated adversarial examples concentrate in the overlap between these two distributions, As illustrated in the figure, this overlapping region has low probability density under the green distribution Pvi resulting in poor transferability. Moreover, if sample happens contain strong visual evidence of the target class, then both classifiers would classify it as the target with high confidence, hence the high-density re- gions of Pie and p!2 would necessarily overlap.
(1)
I COMPUTE RESOURCES
All experiments are conducted on a single NVIDIA H100 Tensor Core GPU. Our method requires approximately 20 minute per concept for concept augmentation and around 8 hours per concept for diffusion model fine-tuning. For adversarial example generation, although our method is slightly slower, is still within the same order of magnitude.
To ensure that the diffusion model learns high-quality identity-level concept, we train it for long duration during the concept finetuning stage. When the concept dataset sufficiently large (e.g., the 30 images described in the main text), the diffusion model does not collapse even after many epochs of finetuning. However, in settings like ProbAttack, where finetuning is performed on single image, the number of epochs must be carefully controlled to avoid model collapse. For this reason, the concept finetuning time for ProbAttack approximately 20 minutes, whereas our concept-based method requires about 8 hours.
In our experiments, we ensured that this 8-hour finetuning worked reliably across all concepts stud- ied in the paper. In practice, the finetuning time be reduced to extent; however, maintaining an identity-level concept is inherently subjective and difficult to quantify, making it challenging to specify universally optimal finetuning duration.
S the time consumption of different methods across concept augmentation, con- cept fine-tuning, and adversarial example generation stages.
24

---

Published as a conference paper at ICLR 2026
Table 8: Time consumption of each method across different stages.
NCF
ACA
DiffAttack
ProbAttack
OURS
Concept augmentation (per concept)
20m
Concept finetune (per concept)
20m
Adversarial example generation (per image)
30s
20s
12s
75s
75s
J DATASETS AND LICENSES
In this work, the DreamBooth dataset, which is licensed under the Creative Commons Attri- bution 4.0 International license.
K PRACTICAL USAGE GUIDELINES AND EXAMPLE SCENARIOS
K.1 GUIDELINES
Although the term "concept" is difficult to define precisely, our method provides clear definition: concept be specified by either set Cun probabilistic model. Users can therefore construct Cori to include whatever concept variations they desire. In our experiments, we demonstrate broad range of concept variations background, pose, and viewpoint leading highly diverse Cori and scenarios like the one shown in Figure (right).
In practice, constraints may prevent such extensive concept variations. For example, one might need to fix the background and viewpoint, leaving only the object's pose special variations (c.g., dressing a dog in different outfits). However, if the concept variations are too limited, the inter- section between Pais and Pvic may be insufficient, making it harder to generate adversarial samples. Practitioners should be mindful of this trade-off.
K.2 EXAMPLE SCENARIOS
K.2.1
SCENARIO 1: PROHIBITED ITEM ADVERTISEMENTS ON SOCIAL PLATFORMS
Social or second-hand platforms often employ basic classifiers to preliminarily filter user-uploaded content for prohibited items (e.g., firearms, knives, protected animals). Malicious actors aim to sell prohibited items such as a specific brand and model firearm, a particular knife, or a specific protected animal eub. They prefer to upload images capturing all detailed features of the prohibited items (i.e., preserving concept/identity, such as the specific firearm model or exact animal cub) to attract precise target buyers while bypassing platform moderation (untargeted attack).
In such cases, preserving the concept and identity crucial to attracting potential customers, while background and perspective variations in images are insignificant. This perfectly aligns with the applicability of concept-based adversarial attacks.
Considering the potential societal harm of this scenario, previously discussed, social platforms should implement multiple detection systems, including Al-based detection, to prevent such attacks.
K.2.2 SCENARIO 2: IMPERCEPTIBLE ADVERSARIAL PATCHES IN REAL-WORLD SCENARIOS (ADVERSARIAL PATCH T-SHIRTS)
In practice, adversarial examples may be printed patches. Early adversarial patches, though able to evade classifiers or detectors, often appeared unnatural or suspicious, making them easily noticeable by humans and limiting their effectiveness. Creating imperceptible adversarial patches remains a significant challenge.
Our method addresses this challenge by adopting brand images. logos, cartoon characters the concept. By altering the background or viewpoint of these concepts, we create realistic adversarial patches suitable for real-world applications.
25

---

Published as a conference paper at ICLR 2026
More concretely, as demonstrated by Wang et al. (0024), adversarial examples be created as printed patches on T-shirts to deceive detection systems. However, unnatural or suspicious patches would prompt humans to comment, "You're wearing strange T-shirt," or, "The logo on your T- shirt looks odd." In such scenarios, our concept-based adversarial attack excels by preserving logos, branding, cartoon imagery while subtly changing the background making the characters per- form specific actions, resulting in adversarial patches that are difficult for humans to detect.
22024)ss work, their algorithm primarily focuses on single- image adversarial patch creation, leading to unnatural-looking printed watermarks on T-shirts. In contrast, our concept- based adversarial attack provides better solution.
Specifically referencing Wang
Given the social harm posed by these attacks, real-worid detection systems should employ multi- layered detection with varying thresholds and multiple scales of analysis prevent such vulnerabil- ities.
L NEGATIVE SOCIAL EFFECT AND MITIGATION STRATEGIES
Mitigating the risks of our proposed attack is crucial responsibility for both the machine learning community and society. Potential strategies include:
Adversarial training using concept- based adversarial examples is a direct and general miti- gation strategy. However, this may come at the cost of reduced baseline model accuracy.
Given that our adversarial examples are directly generated from probabilistic gen- erative models, contemporary Al-generated content detection techniques (open- source/commercial), such as frequency-domat analysis, heatmap analysis, anomaly de- tection, and counterfactual detection, can serve as effective countermeasures.
In practical engineering scenarios, combining various methods according to specific appli- cation needs can significantly mitigate the threat posed by this attack.
The field of adversarial attacks continually evolves through the ongoing advancement of both at- tack and defense strategies. We hope our novel attack method draws sufficient attention from the community to further enhance Al Safety research.
M BROADER IMPACTS OF THIS WORK
This study introduces concept- based adversarial attacks, providing valuable insights into the vulner- abilitics of sophisticated classifiers.
On the positive side, our work exposes critical weaknesses in systems previously considered robust, highlighting the need for enhanced security measures classifier design. By identifying these vulnerabilities, contribute to the development of more resilient artificial intelligence systems.
However, we acknowledge potential negative implications. The concept- concept-based attack methods de- scribed could be misappropriated by malicious actors, for example, for identification purposes. We emphasize the importance of developing countermeasures against such exploitation and encourage the research community consider ethical implications when building upon this work.
N LLM DISCLAIMER
In this work, we use large language models solely for text polishing.
O LIMITATIONS
Our approach is slower than similar methods because it requires tine-consuming fine-tuning on concept dataset Cons which may also need to be built or expanded if unavailable. However, in adversarial attack scenarios, even one successful example can cause severe damage, highlighting the practical importance of our method.
26

---

Published as a conference paper at ICLR 2026
Method
Sampler / Solver
# Sampling Steps
Attack Steps
Step Size
Notes
DiffAttack
DDIM
50
30
0.01
ACA
DDIM
50
10
0.04
Sampling
ProhAttack
DDPM
250
Carl
1. M 10, 30.
Concept-bosed
DDPM
250
Can
M 10,
Table 9: Hyperparameter settings for all compared methods. ProbAttack and our concept-based adversarial attack both use the standard stochastic diffusion (DDPM) sampler with classifier-guided Langevin dynamics, not DDIM. All other parameters are at default.
P BASELINE SETTINGS
We list the hyperparameter settings for all compared methods in Table Note that DifTAttack/ACA and Cttetttcc//Coepptttccc baasee Attack rely on fundamentally different attack mechanisms: the for- mer based on DDIM and operate in the latent space, while the latter directly sample from Padv- As result, the number of sampling steps is not directly comparable across these methods, and the latter do not require any additional attack steps.
27

---

Published as a conference paper at ICLR 2026
Q FULL MAIN EXPERIMENTAL RESULTS
Due to space constraints, the main text reports only the white-box Top-1 and black-box Top-5 results using ResNet-50 the surrogate classifier. In this section, we provide the full set of experimental results, including targeted attack success rates (white-box Top-1, black-box Top-1, Top-5, Top- 10, and Top- 100) in Section Q.1] and the similarity and image quality evaluations in Section Q.2
Q.1 TARGETED ATTACK SUCCESS RATES
Table 10: Attack success rates (%) ImageNet classifiers, with ResNet-50 serving as the white-box victim (surrogate) classifier.
NCF
ACA
DiffAmack
ProhAtack
OURS (CONS)
OURS (AGGR)
White-box
Torgeted-Topl
ResNet 50
L.1
6.03
84.23
59.23
97.82
97,82
Transferability
ResNet 152
0.13
0.38
1.79
0.77
0.26
1.79
DenseNer 161
0.00
0.26
1.67
0,51
0.26
2.82
Inception
EllicienNett B?
0.00
0.26
0.38
0.00
0.13
1.15
Adversarial Defence
Inception V3 Ady
0.00
0.26
1.03
0.26
0.00
1.03
Efficient Net Adv
0.38
0.26
Ensemble IncRes V2
0.00
0.26
0.38
0.64
0.00
1.28
White-box
Targeted-Tog
10.64
72.82
Transferability
VGG19
1.18
1.67
4.36
2.44
2.05
4.36
ResNet
1.11
1.92
3.33
2.82
8.72
DenseNer 161
1.41
2.05
7.44
3.97
3.85
11.54
Inception V3.
2,56
EfficientNet B?
1.41
1.67
1.79
1.41
1.28
3.97
Adversarial Defence
Inception V3 Adv
1.15
1.28
3.21
2.18
0.90
3.72
EfficientNet B7 Adv
0.26
1.15
2.05
2.31
1.67
6.41
White-box
Targeted-Topl
Transeerbillity
VGG19
2.69
2.69
8.21
3,46
3.21
6.79
DenseNe 161
2,31
3.72
12.69
6.15
8.72
19.62
Inception V3.
1.28
2.31
5.13
3.46
2.31
6.54
EdiciintNet B7
2.31
2,82
4.23
3.21
3.59
Adversarial Defence
50
1.92
3.59
Inception V3 Adv
1.79
1.79
5.13
3.16
2.31
6.54
EfficientNa Net B7 Adv
0.38
2,05
3.08
3.46
2.44
9.36
Ensemble
28

---

Published as a conference paper at ICLR 2026
Table 11: Attack success rates (%) on ImageNet classifiers,, with MobileNet v2 serving the white- box victim (surrogate) classifier.
ProbAtack
(CONS)
(AGGR)
White-box
Turgeted-Topl
MN-V2
388
12.95
91.92
51.15
97.31
97.31
Transferability
VGG19
0.00
0.13
1.79
0.00
0.00
1.54
Resher
DenceNet
0.00
0.26
0.90
1.03
0.00
1.28
Inception V3
0.00
0.13
0.51
0.38
8.00
0.90
EfficienNNet
Adversarial Defence
Inception V3 Adv
0.00
0.26
0.77
0.13
0.13
1.15
Ensemble IncRes V2
0.00
0.38
0.77
0.26
0.13
1.28
White-box
Targeted-Top5
MN-V2
6.41
17.18
95.64
64
99.74
99.74
Transferability
1.33
ResNet 152
1.15
1.54
3.72
1.79
1.92
4.87
DenseNet 161
1.15
1.54
5.51
3.46
2.56
7.18
Inception V3
0.50
1.15
2.44
1.92
1.79
3.97
EfficienNNet B7
1.03
1.41
2.05
0.51
0.90
4.36
Adversarial Defence
Inception V3 Adv
0.50
1.15
2.56
1.67
0.90
3.08
EllicientNet B7 Adv
0.38
1.15
1.92
1,54
1.41
5.77
Ensemble
White-box
Torpeted-Top10
MN--V2
8.33
20.00
97.05
72.31
99.74
99.74
Transferability
VGG19
1.28
2.95
7.34
2.69
3.33
6.92
ResNeet
1.54
DenseNes 161
1.67
3.08
9.10
5.00
4.36
12.44
Inception V3
1.41
2,82
4.23
2,82
2.82
5.90
EfficienNeet
Adversarial Defence
Inception V3 Adv
1.18
1.41
4,10
2.56
2.05
5.90
Ensemble lockes V2
0.77
2.31
3.72
2.95
2.31
7.18
29

---

Published as a conference paper at ICLR 2026
Table 12: Attack success rates (%) elassiffe with ViT-Base serving the white-box victim (surrogate) classifier.
Prob-Amack
(CONS)
(AGGR)
White-bux
Targeted-Topl
VTT-B
0.90
3,46
63.85
85.51
85.51
Transferability
VGG19
0.13
0.26
0.51
0.13
0.13
1.28
ResNet 152
0.00
0.00
1,41
DenseNet 161
0.00
0.26
1.15
0.51
0.00
1.15
Inception V3
0.00
0.38
0.38
0.15
0.13
0.64
EfficienNett
Adversarial Defence
Inception V3 Adv
0.00
0.26
0.38
0.13
0.13
0,90
EfficiemNer
Ensemble IncRes V2
0.00
0.13
1.03
0.13
0.00
1.15
White-box
Torp
VIT-B
2.44
6.67
92.44
89.74
94.87
94.87
Transforability
1.79
ResNet 1.52
0.64
1.67
3.33
1.03
1.67
4,74
DenseNet 161
0.64
1.67
4.87
2.18
1.67
5.51
Inception
0.77
1.41
2.95
1.54
3,08
EfficiemNett B7
0.90
1.92
2.69
1.28
1.15
3,08
Adversarial Defence
Inception V3 Adv
0.51
1.92
3.21
3.46
EllicinNNet 87 Adv
0.26
1.79
3.08
1.67
1.41
3.85
Ensemble IncRes
White-box
Targeled-Top10
VIT-B
3.46
8.97
95.13
92.05
95.51
95,51
Transferabälity
VGG19
1.79
2.69
3.45
2.05
2.82
4.49
DenseNer 161
1.15
2,82
6.92
3.08
4.23
8.59
Inception V3
1,28
2,05
4.87
1.79
1.92
5,00
Adversarial Defence
Inception V3 Adv
0.77
2.18
5.13
2.44
2.05
5.26
EfficienNNer
Ensemble IncRes V2
0.90
2.31
4,87
2.31
2.56
5.00
30

---

Published as a conference paper at ICLR 2026
Table 13: Attack success rates (%) on ImageNet classifiers,, with ConvNext serving the white-box victim (surrogate) classifier.
ProhAttack
(CONS)
(AGGR)
White-box
Turgeted-Topl
ConvNert
1,03
5.38
60.38
94.74
94.74
Trausferability
VGG19
0.00
0.26
1.28
0.26
0.00
1.15
Resher
0.51
DenseNet 161
0.00
0.26
1.54
0.51
0.13
2.31
Inception V3
0:13
01.26
0..77
0.38
0.00
1.28
Adversarial Defence
Inception V3 Adv
0.00
0.26
0.90
0.26
0.00
1,03
Ensemalle IncRes V2
0.00
0.26
0.51
0.51
0.00
1.28
White-box
Targeted-Top5
ConNNest
2.95
9.36
91.15
78.85
98.59
98.59
Transferabllity
ReaNet 152
1.15
1.79
6.92
2.69
2.44
7,56
DenseNet 161
1.15
1.92
6.67
3.33
3,21
9.62
Inception V3
0.90
1.41
2,18
1.15
EfficientNet B7
1.28
1.79
2.05
1.41
1,28
3.72
Adversarial Defence
Inception V3 Adv
0.90
1.41
3.21
1.67
0.90
EllicientNet B7 Adv
0.26
1.28
2.44
2,05
1,54
5.51
Ensemble
White-hox
Torgeled-Top10
ConvNext
3.97
11.67
93.97
81.54
98.72
98.72
Transferability
VGG19
2.44
2.69
6.67
2.95
3.08
6.15
Reshet
4,49
DenseNer 161
1.92
3.46
10.90
5.13
7.18
16.41
Inception V3
1,28
2.18
5.00
2,82
2,18
6.15
Adversarial Defence
Inception V3 Adv
1.41
1,92
5.13
3.08
2.18
6.15
2.18
2.69
Buscmble Incites V2
1.15
2.18
4.23
2.82
2.05
6.54
31

---

Published as a conference paper at ICLR 2026
Table 14: Attack success rates (%) ImageNet classifiers, with ResNer-50 Adv serving the white-box victim (surrogate) classifier.
ProbAtack
(CONS)
White-box
Turgeted-Topl
ResNer-50
D90
5.13
81.79
61.28
94.23
94.23
Transferability
VGG19
0.11
0.38
1.67
0.51
0.00
2.31
Resher
2.56
1.03
2.56
DenceNet
0.00
0.38
2.31
0.77
0.38
3,97
Inception V3
0.00
0.26
1.28
0,777
8.00
2.18
EfficientNet
Adversarial Defence
Inception V3 Adv
0.00
0.51
1.67
0.51
0.00
1.79
Ensemble IncRes V2
0.00
0.51
0.64
1.15
0.00
2.31
White-box
Targeted-TopS
ResNer-50 Adv
2.82
9.62
89.74
75.00
98.08
98.08
Transferability
ResNet 152
1.15
2,69
11.28
4.49
3.85
11.79
DenseNet 161
1.15
2.82
10.00
5.38
5.26
15.38
Inception V3
0.77
1.92
4.36
3,46
1.79
6.67
EfficienNNet B7
1.15
2.31
2.56
1.92
1.79
5.51
Adversarial Defence
Inception V3 Adv
0.90
1.92
5.13
3.16
1.41
6.15
EllicientNet B7 Adv
0.26
1.79
3.33
3,59
2,56
10,00
Ensemble
White-box
Targeted-Topll
ResNet- 50 Adv
3.85
11.67
92.95
77.56
98.97
98.97
Transferability
VGG19
2.18
3.72
8.97
4.62
4,36
10.77
Resieet
DenseNes 161
1.92
5.00
16.28
7.95
11.15
25.13
Inception V3
1.03
3.21
6.92
4.62
3.08
8.72
EfficienNNet
Adversarial Defence
Inception V3 Adv
1.41
2.69
8.21
5.38
3.39
10.51
Ensemble lockes V2
1.03
3.08
6.15
4.74
2.82
11.41
32

---

Published as a conference paper at ICLR 2026
Q.2 SIMILARITY AND IMAGE QUALITY
Due to cost constraints, only the ResNet-50 results reported in the main text include the user study.
Table 15: Quantitative comparison of similarity the original images and no reference image qual- ity metrics for unrestricted adversarial examples with ResNet-50 serving as the victim (surrogate) classifier.
NCF
ACA
DifTAtack
ProhAnack
OURS (CONS)
OURS (AGGR)
Similarity
User Study
0.1859
0.2808
0.7577
0.8041
0,9654
0.8808
T Avg. Clip Score
1.U
0,8728
0.7861
0,8053
0.8581
0.8283
0,8043
Image Quality
T HypezIQA
0.7255
0,5075
0.6462
0.5551
U.6675
0.6947
0.6809
DBCNN
0.6956
0.5096
0.6103
0.5294
0.6161
0.6572
0.6399
T ARNIQA
0.7667
0.5978
0.6879
0.6909
0.7009
0.7335
0.7154
MUSIQ-AVA
4.3760
3.8135
4.2687
4.0734
4,3130
4.5305
4.5250
NIMA-AVA
4.5595
3.7916
4.4511
4.0589
4,5168
4,7575
4,7401
MUSIQ-KonIQ
65. 05.0549
0840
52.5399
1563
63.7486
62.2217
TReS
93.2127
64.7050
85,8435
74.1167
84.3131
90.4488
88,0836
Table Quantitative comparison of similarity the original images and no reference image qual- ity metrics for unrestricted adversarial examples with MN-V2 serving as the victim (surrogate) clas- sifier.
Clean
NCF
ACA
DifTAtack
ProbAntack
OURS (CONS)
OURS (AGGR)
Similarity
Avg. Clip Score
0,8229
Image Quality
HyperIQA
0.7255
0.5002
0.6486
0.5471
0.6808
0.6998
0.6865
T DRCNN
0.6956
0.5040
0.6175
0.5236
0.6310
0.6377
0.6402
ARNIQA
0.7328
0.7142
1 MUSIQ-AVA
4.3760
3.7912
4,3042
4.0496
4.1236
4,6125
4,5700
NIMA-AVA
3.7879
4.4532
4.0549
4.5317
4.8172
4,7778
MUSIQ-KonIQ
65.0549
49.9072
59.5258
51.9209
59.7813
63.5363
61.6641
TReS
93.2127
63.7643
86.2644
73,0392
86.4376
90.7757
88.9947
Table 17: Quantitative comparison of similarity the original images and no reference image qual- ity metrics for unrestricted adversarial examples with ViT-Base serving as the victim (surrogate) classifier.
Clean
NCF
ACA
DiffArtack
ProbAttack
OURS (CONS)
OURS (AGGR)
Similarity
1 Avg. Clip Score
1.0
0,8733
0.7681
0.8040
0.8586
0,8222
0.8104
Image Quality
1 HyperIQA
0.7255
0,5006
0.6324
0.5475
U.6796
0.7077
0.6961
DBCNN
0.5222
0.6526
T ARNIQA
0.7667
0.5879
0.6765
0.6844
0.7120
0.7351
0.7195
MUSIQ-AVA
4.3760
3.7822
4.3131
4.0400
4.2450
4.5401
4.5345
NIMA-AVA
4.5595
3.7666
4.4775
4,0321
4,4918
4.7706
4.7747
MUSIQ KonlQ
65.0549
50.0413
$7.6105
52.0604
59,3605
64.2536
62.4264
TRcS
93.2127
64.1109
83.6834
73,4362
85,8749
91.7463
89.7815
33

---

Published as a conference paper at ICLR 2026
Table 18: Quantitative comparison of similarity the original images and reference image qual- ity metries for unrestricted adversarial examples with ConvNeXT serving as the victim (surrogate) classifier.
Clean
NCF
ACA
DitTAtack
ProbAttak
OURS (CONS)
OURS (AGGR)
Similarity
Avg. Clip Score
0.7542
0.7964
0,8467
0.8139
0.8011
Image Quality
T HyperQQ
0.7255
0.4928
0.6281
0.5392
0.6703
0.6933
0.6810
DBCNN
0.6956
0.4951
0.5784
0.5179
0.6201
0.6531
0.6405
ARNIQA
0.7667
0.5835
0.6710
0.6801
0,7066
0.7294
0.7118
T MUSIQ-AVA
4.3760
3,7511
4.2814
4.02066
4.2314
4.5116
4,5030
MUnIQ-KontQ
65.0549
49.3812
57.0114
51.7324
58.9012
63.1025
61.3571
TReS
93.2127
62.9011
82.7410
72.1109
85,2442
90.9211
88.7724
Table 19: Quantitative comparison of similarity to the original images and no reference image qual-
ity metrics for unrestricted adversarial examples with ResNet-50 Adv. serving as the victim (surro- gate) classifier.
Clean
NCF
ACA
DitTAttack
ProbAttakk
OURS (CONS)
OURS (AGGR)
Similarity
1 Avg. Clip Score
0.8556
0.7485
0.7877
0.8367
0,8059
0.7945
Image Quality
HyperIQA
0.4854
0.5297
0.6617
0.6875
0.6750
DBCNN
0.6956
0.4908
0.5718
0.5070
0.6078
0.6473
0.6342
T ARNIQA
0.7667
0.5764
0.6654
0.6683
0.6932
0.7231
0.7070
MUSIQ-AVA
4.3760
3.7435
4,2637
4,0130
4.2223
4,5031
4.4966
NIMA-AVA
4.5595
3.7453
4.4342
4.01133
4.4676
4.7399
4.7351
MUSTQ-KKnIC
65.0549
49.3740
$7,0028
51,7202
58.1513
63,09466
61.3527
1 TRcS
93.2127
62.8961
82.7340
72.1034
84,3081
90.4438
88.0786
34


Reviews:
[{"review_id": "Js4nMyYamX", "reviewer": "Reviewer_vSZj", "summary": "The paper introduces Concept-Based Adversarial Attacks, a novel framework that extends traditional image-based adversarial attacks by operating not on a single image but on an entire concept represented either by a set of images or a probabilistic generative model (e.g., a fine-tuned diffusion model). The method adopts a probabilistic perspective, where adversarial examples are sampled from the product of a “victim” distribution (encouraging misclassification) and a “distance” distribution centered on the concept rather than a single image. This allows generation of diverse adversarial examples that preserve the underlying identity or object (e.g., a specific dog) while varying pose, background, or viewpoint to fool classifiers. The approach is theoretically grounded in KL divergence analysis and empirically validated on ImageNet, showing higher attack success rates and better concept preservation than prior methods.", "questions": "Please refer to the section above.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "The main contributions (and strengths) of the paper are:\n\n* Novel formulation: First work to define adversarial distance at the concept level rather than per-image, enabling more semantically meaningful attacks.\n\n* Strong empirical results: Achieves state-of-the-art targeted attack success rates (e.g., 97.82% white-box on ResNet-50) while better preserving concept identity (validated via user studies and CLIP scores).\n\n* Theoretical justification: Provides analysis showing that expanding the distance distribution to a concept reduces KL divergence between victim and distance distributions, increasing overlap and attack efficacy.\n\n* Practical pipeline: Integrates modern generative models (Stable Diffusion XL + LoRA) and LLMs (GPT-4o) for concept augmentation, enhancing diversity and realism.", "weaknesses": "Computational cost: The proposed approach requires fine-tuning generative models per concept, which is time-consuming (≈8 hours/concept) and limits scalability.\n\n*Limited transferability. While the experimental results show strong performance on white-box attacks, black-box transfer success remains low (though better than baselines), especially under strict top-1 metrics.\n\n* Concept definition ambiguity. The proposed Relies on user-provided image sets or fine-tuned models to define a “concept,” which may vary in quality or scope and lacks a formal mathematical definition.\n\n* Ethical risk. The proposed approach enables highly realistic, identity-preserving attacks that could evade content moderation systems, raising safety concerns. While the authors discuss mitigations, it’s unclear how these would deter malicious actors. I recognize the importance of publishing sensitive research to foster community dialogue, but is merely discouraging harmful use sufficient when the technique itself carries demonstrable ethical hazards?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HQy9XetTK5", "reviewer": "Reviewer_av86", "summary": "The paper extends the probablistic framework for adversarial examples presented in Zhang et al. (Neurips 2024) to an unrestricted, concept based setting. The basic idea relies on replacing the image-based specific distance (defined in Zhang et al.). with a generalized concept-based distance. The authors surrogate \"concept\" with a probabilistic model (diffusion models in this case) by finetuning a pretrained diffusion model on a set of images, and then sample adversarial candidates. They provide two sampling strategies as well as theoretical intuition for the framework. They further showcase empirical results to support their claim that concept priors reduce to an empirical KL gap and produce high quality adversarial examples when compared to other unrestricted approaches like DiffAttack.", "questions": "1. Please provide more details on the baseline comparisons for DiffAttack and others. Specifically, number of sampling steps, solvers used and any other hyperparameters.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The presented framework is a clean and well motivated generalization of the probabilistic framework presented in Zhang et al. The idea of moving away from an image-centric distance distribution to a concept-prior through the use of finetuned diffusion models is inspired.\n\n2. Empirical performance of the given approach is encouraging, and the results support the authors' claims of better, and more semantically meaningful adversarial examples as compared to methods like DiffAttack.\n\n3. Implementing the concept-prior using finetuned SDXL models is an interesting approach, and can possibly be generalized to any set of images with common features. This opens up a new mechanism of measuring vulnerabilities of classifiers.", "weaknesses": "1. The theoretical contributions are mostly incremental with both Thm.1 and 2 being straightforward algebra. While supportive of the presented conceptual framework, it does not really provide any additional insight on how the approach can be further optimized or adapted to specific PGMs like diffusion models.\n\n2. The transferability results are extremely low.This suggests very low overlap between $p_{vic}$ and $p_{dis}$ which is a bit counterintuitive given the strong performance of these classifiers on such tasks. Shouldn't a concept based prior have a much stronger overlap?  Do the authors have any hypothesis about this? The top-100 results in the appendix are also uninformative given the weak constraints of the experiment and should be removed.\n\n3. The models presented in this work are also older. How does this attack fair with newer architectures like CLIP, ConvNext etc?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "idtWxmg2a7", "reviewer": "Reviewer_ggXr", "summary": "This paper introduces **concept-based adversarial attacks**, where a “concept” is modeled not as a single image but as a set of images or a fine-tuned generative model (e.g., diffusion). Adversarial examples are sampled from the overlap between the concept prior and the target classifier’s probability distribution, enabling identity-preserving attacks beyond norm-bounded perturbations. The authors provide theoretical justification via KL divergence analysis. They conduct extensive experiments on ImageNet, achieving **97.8% targeted white-box success**.  Perceptual quality is validated using CLIP similarity and no-reference IQA metrics such as MUSIQ, NIMA, and TReS.", "questions": "1. In Section 6, you state that prior work “treats a class (e.g., cat, dog, truck) as the concept, which cannot precisely capture an individual identity,” whereas your method represents a concept using a set of images or a probabilistic model. This suggests that your notion of ‘concept’ operates at an identity level rather than a class level. However, most related work in diffusion-based adversarial attacks defines ‘concept’ strictly at the class/category level. Can you please clarify your use of the term ‘concept’ more explicitly and explain how it differs from the class-level definition in existing work?\n\n2. Please formalize your notion of transferability by giving a precise metric (for example top1 or top5 targeted success) and describing exactly how adversarial samples are generated and evaluated across source and target models. What am I precisely asking is that correctly classified samples by source model should not be used for transferability and that should reflect in the quantitative data presented under transferability. \n\n3. How essential is the SDXL based augmentation step? Please explain why you need SDXL to build the concept dataset instead of using a large pretrained generative model trained on ImageNet or similar corpora, and include an ablation if possible.\n\n4. How would a black box query attack operate in your framework and how does its expected strength compare to the transfer based evaluation you report?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The problem is well-motivated. The paper goes beyond traditional single-image or class-level attacks and instead enables identity-level, concept-aware adversarial generation that produces realistic and semantically consistent examples. Furthermore, I believe this approach could be valuable beyond adversarial attacks. It may help future work probe model hallucination and understand the semantic priors that models rely on.\n2. The method is built on a clear probabilistic formulation rather than heuristic manipulation, making the approach principled and conceptually well-grounded.\n3. The experiments include strong perceptual fidelity evaluation, using CLIP similarity and no-reference IQA metrics such as MUSIQ and TReS to assess visual realism.", "weaknesses": "1.  **Missing compute / FLOP parity.**  \n    The appendix briefly reports compute but does not provide a clear, quantitative comparison of **FLOPs / GPU-hours** between the proposed pipeline and the baselines. Please report wall-clock GPU-hours and/or FLOP counts per concept (training + sampling) for the proposed method and for each baseline. This will help readers judge whether performance gains are due to algorithmic novelty or to much greater compute and data budgets.\n    \n2.  **Experimental structure and choice of victim models.**  \n    The experimental section lacks a systematic structure for robustness testing. I request the following additions:\n    \n\n-   Report how attacks generated against ResNet-50 behave when transferred to an **adversarially-trained ResNet-50** under an L∞ threat model. This gives a clear point of comparison with standard robustness tests.\n    \n-   Include **white-box evaluations where the victim itself is adversarially trained** (i.e., generate attacks against a robustly trained model) to show whether the concept-guided sampling can break robust classifiers in white-box settings.\n    \n-   Broaden the set of victim models beyond standard classifiers. Evaluate against models trained with mainstream non-adversarial robustness techniques (e.g., CutMix, AugMix, models tuned for OOD/generalization). These are realistic victim models and better reflect deployment settings.\n    \n\n3.  **Missing strong imperceptible / transfer baselines.**  \n    The current baselines omit important, stronger transfer/imperceptible attacks. Please include comparisons to state-of-the-art transfer methods such as **VMI-FGSM** [ii] and **LGV** [i]. These methods represent a competitive, low-compute class of attacks and are necessary to understand the relative potency of the proposed generative approach.\n\n\n[i]. LGV: Boosting Adversarial Example Transferability from Large Geometric Vicinity\n[ii]. Enhancing the Transferability of Adversarial Attacks through Variance Tuning", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ldzy8jGzK9", "reviewer": "Reviewer_2if2", "summary": "This paper presents a novel concept-based adversarial attack framework that extends probabilistic attacks from single-image perturbations to concept-level perturbations. By generalizing the distance distribution $p_{dis}$ from an individual image to an entire concept, the method effectively reduces the divergence from the victim distribution $p_{vic}$, leading to improved attack success rates and higher-quality adversarial examples. The paper also introduces a concept augmentation strategy using modern generative models to enhance distributional diversity, and demonstrates clear performance gains over existing probabilistic attack methods.", "questions": "1. Please discuss the potential limitations of assuming a Gaussian distribution for $p_{dis}$ in Theorem 1. If a non-Gaussian PGM is used, can the reduction in KL divergence still be theoretically guaranteed? Is there a more general metric that could replace KL divergence to provide broader theoretical validity?\n2. “Concept augmentation” plays a key role in improving diversity and performance, but it relies on large pretrained models such as SDXL with LoRA fine-tuning. Under limited computational resources, how would the quality, diversity, and effectiveness of adversarial samples degrade if simpler or smaller PGMs were used? Would the method remain effective in low-resource settings?\n3. Tables 4 and 5 show that under the conservative (CONS) strategy, increasing the number of selected samples $M$ (from 1 to 10) decreases transferability while improving image quality and similarity. This suggests that the conservative strategy may prioritize perceptual quality over attack strength as $M$ increases. Please discuss how to better balance this trade-off between transferability and quality, and explain the specific reasons behind the drop in transferability for larger $M$.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper presents a unified and elegant probabilistic framework that generalizes single-image attacks to concept-level attacks, treating the former as a special case of the latter and achieving a smooth transition from $x_{ori}$ to $C_{ori}$.\n2. Experimental results strongly demonstrate that the proposed method outperforms existing baselines in terms of targeted attack success rate, while generating higher-quality adversarial examples that effectively preserve the original concept semantics.", "weaknesses": "1. The proposed work builds upon the probabilistic perspective introduced in [1] and extends it to concept-level attacks. However, concept-based or unrestricted attacks using generative models have already been explored in prior works, including GAN-based [2] and diffusion-based approaches [3,4]. In addition, several studies have examined distance metrics in unrestricted attacks [5,6]. These overlaps weaken the originality of the contribution.\n2. The derivation of Theorem 1 relies on the assumption that $p_{dis}$ follows a Gaussian distribution. While this is a common simplification in theoretical analyses, the authors do not sufficiently discuss whether the theoretical guarantees still hold when using non-Gaussian PGMs (e.g., VAEs or EBMs). This raises concerns about the generality of the proposed framework.\n3. The concept augmentation process depends heavily on powerful pretrained models (e.g., SDXL) and considerable computational resources (e.g., LoRA fine-tuning), which may limit the reproducibility and applicability of the method in resource-constrained settings.\n\n**References:**\n\n[1] Zhang, Andi, Mingtian Zhang, and Damon Wischik. \"Constructing semantics-aware adversarial examples with a probabilistic perspective.\" NeurIPS, 2024.\n\n[2] Xiao, Chaowei, et al. \"Generating adversarial examples with adversarial networks.\" IJCAI, 2018.\n\n[3] Dai, Xuelong, Kaisheng Liang, and Bin Xiao. \"Advdiff: Generating unrestricted adversarial examples using diffusion models.\" ECCV, 2024.\n\n[4] Chen, Xinquan, et al. \"Advdiffuser: Natural adversarial example synthesis with diffusion models.\" ICCV, 2023.\n\n[5] Laidlaw, Cassidy, Sahil Singla, and Soheil Feizi. \"Perceptual Adversarial Robustness: Defense Against Unseen Threat Models.\" ICLR, 2021.\n\n[6] Zhao, Zhengyu, Zhuoran Liu, and Martha Larson. \"Towards large yet imperceptible adversarial image perturbations with perceptual color distance.\" CVPR, 2020.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)