Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via $\textit{In-the-wild}$ Cascading Flow Optimization
Authors: Yixiao Chen
Shikun Sun
Jianshu Li
Ruoyu Li
Zhe Li
Junliang Xing
Venue: NeurIPS 2025 poster ()
Keywords: adversarial attacks
diffusion models
Primary area: deep_learning

Abstract: Adversarial attacks are widely used to evaluate model robustness, and in black-box scenarios, the transferability of these attacks becomes crucial. Existing generator-based attacks have excellent generalization and transferability due to their instance-agnostic nature. However, when training generators for multi-target tasks, the success rate of transfer attacks is relatively low due to the limitations of the model's capacity. To address these challenges, we propose a novel Dual-Flow framework for multi-target instance-agnostic adversarial attacks, utilizing Cascading Distribution Shift Training to develop an adversarial velocity function. Extensive experiments demonstrate that Dual-Flow significantly improves transferability over previous multi-target generative attacks. For example, it increases the success rate from Inception-v3 to ResNet-152 by 34.58%. Furthermore, our attack method shows substantially stronger robustness against defense mechanisms, such as adversarially trained models.

Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimization
Yixiao Chen'.*, Shikun Sun' Jianshu Li?, Ruoyu LI, Zhe LI,, Junliang Xing*
"Tsinghua University, AAnt Group
{chenyixi22, ssk21) tsinghua. edu.
(jianshu.1, 1, ruoyu.li, lizhe. 1z/ com, jlxingôtsinghua edu, cn
Abstract
Adversarial attacks are widely used to evaluate model robustness, and in black-box scenarios, the transferability of these attacks becomes crucial. Existing generator- based attacks have excellent generalization and transferability due to their instance- agnostic nature. However, when training generators for multi narre-target tasks, the success rate of transfer attacks is relatively low due to the limitations of the model's capacity. address these challenges, we propose a novel Dual-Flow framework for multi-target instance-agnostic adversarial attacks, utilizing Cas- cading Distribution Shift Training to develop an adversarial velocity function. Extensive experiments demonstrate that Dual-Flow significantly improves trans- ferability over previous multi-target generative attacks. For example, it increases the success rate from Inception-v3 to ResNet-152 by 34.58%. Furthermore, our attack method shows substantially stronger robustness against defense mecha- nisms, such as adversarially trained models. The code of Dual-Flow is available at:
Introduction
Deep neural networks (DNNs) are highly vulnerable to adversarial attacks [53 22 3 19, which can significantly compromise their reliability. Among these, targeted black-box attacks where adversaries manipulate model into misclassifying an input as specific target class without direct access to the model-are are the most challenging and impactful 2
Adversarial attacks can be classified into instance-specific and instance-agnostic approaches. Instance- specific attacks [12 67 16 optimize perturbations for each input image using victim model gradients
but often suffer from poor transfcrability. Instance-agnostic attacks [65] 42
69
[7] generalize
perturbations over the dataset, leading to stronger black-box transferability. These methods typically
rely on universal adversarial perturbations 41 70
or generative models 46
43
Generative model-based attacks be further divided into single-target 42
18 61 and multi- target 669 [7] approaches. While single-target attacks achieve high success rates, they require training separate model per target class, making them impractical for large-scale attacks. Multi-target attacks address this by conditioning a single generator on target labels but often suffer from reduced transferability and weak robustness against adversarial defenses.
offer strong generative capabilities, making them promising tool for adversarial attacks. However, current diffusion-basse based attacks are all instance-specific methods, which
Diffusion models 29 51 48)
Equua contribution; the order of co-first authors is interchangeable.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Cascading
Cascuding
(BU11)))
cB/(R))
(BU(R))
Training
CB
Sampling
Figure The comparison between Cascading ODE, Cascading SDE, and Random SDE for the second flow. The star shape represents the input for training the reverse flow. Notably, the Random SDE observed to optimize in an incorrect distribution.
means they need to access the target model's gradient information during inference. Moreover, choos- ing between stochastic and deterministic sampling methods for adversarial perturbation generation remains an open challenge.
To address these challenges, we propose novel Dual-Flow framework for multi-target instance- agnostic adversarial attacks. Our approach integrates (1) a pretrained diffusion model to generate an intermediate perturbation distribution as the forward flow and (2) a fine-tuned lightweight LoRA- based velocity function as reverse flow for targeted adversarial refinement. We introduce Cascading Distribution Shift Training to improve attack capability and employ dynamic gradient clipping to enforce the foo constraint.
As illustrated by the Cascading ODE and Cascading SDE in Figure I we first follow the black trajectory to introduce slight perturbation to the image. Then, we follow either the red blue trajectory to generate an altered image, effectively exploiting this process to attack the target model. Our main contributions are:
First application of flow-based ODE velocity training for adversarial attacks, extending diffusion-based techniques beyond conventional score function training.
Dual-Flow algorithm, integrating pretrained diffusion- forward ODE with fine-tuned adversarial velocity function for structured perturbation generation.
Theoretical contribution on cascading improvement mechanism, demonstrating how our method facilitates eascading improvements later timesteps.
Extensive experiments demonstrate that our attack method achieves state-of-the-ate thrttrrttt black-box trans- ferability in multi-target scenarios and exhibits high robustness against defense mechanisms.
2 Preliminary
2.1 Instance-Agnostic Attacks
Instance-agnostic attacks 39
learn perturbations based on data distributions rather than individual instances. These approaches, employing universal adversarial perturbations [1 70 or generative models, have demonstrated superior transferability. This paper primarily focuses on the latter due to its greater flexibility and attack effectiiveness

---

Early generative model- based methods were primarily single-targer attacks 42 43
18
61
requiring a separate model be trained for each target class, Although these models exhibited high attack capabilities, the excessive training overhead limited their applicability when many target classes needed be attacked. Recent research has proposed several multi-tar multi-target attack methods [69] 17 that condition the perturbation generative model on class labels [69] or text embeddings 17] of classes. These approaches allow a single model to be trained to attack multiple target classes, significantly reducing the training overhead.
Consider a white-box image classifier characterized by the parameter 8, denoted as f : y. where the input space X' C RC* #xW corresponds to the image domain, and the output space Y C. R represents the confidence scores across various classes. Here, denotes the total number of classes. Given an original image E X' and target class e E C, the goal of transferable multi-target generative attack is to generate the perturbation
G(x, e) and the pertubed image x = x + ô, in such way that an unseen victim model F predicts for the perturbed image, ie., arg maxtec F(xx); = c. Here G' the generator trained on the known source model fo. To ensure that the manipulated images remain visually indistinguishable from the originals, the perturbation is constrained using the (o0 norm such that [X - x 1l0o = | <.
2.2 Diffusion Models and Flow-based Models
Diffusion models
50
29
51
52
have emerged as powerful generative models, particularly for
continuous data such as audio 32 and images [48). Recently, Flow-based generative models [36 15
37 developed directly from ordinary differential equations, have also gained significant momentum. Given their strong generative capabilities, exploring their applications in adversarial attacks is natural.
Sampling Algorithms. One the most appealing aspects of diffusion models is the ficxibility in designing the sampling process. The generation process of diffusion models primarily follows two formulations: one based on the Stochastic Differential Equation (SDE) and the other on the Ordinary Differential Equation (ODE). Each approach has strengths and weaknesses, making them suitable for different scenarios.
Diffusion Models in Adversarial Attack. Currently, diffusion models have found some appli- cations in adversarial attacks. Some utilize diffusion models to create unrestricted adversarial examples 5 8) while others perform instance instance-specffic attacks 4 However, they all rely on iterative optimization using the classifier model's 's gradients while generating adversarial examples, thus not qualifying as instacce-agnsstc attacks.
3 Dual-Flow for Adversarial Attack
We propose Dual-Flow pipeline designed to transform an image E X' through a perturbed distribu- tion X; and ultimately into a constrained output space X which is [x*[3x E X Xx|||x= -ax--ap x||00 < <). By construction, X¹ enforces a maximum foo perturbation of e. Our method is instance-agnostic, which means that once training is completed, inference without requiring any access to the classifier model.
model can generate adversarial examples during
Specifically, we leverage the original ODE-based diffusion flow to map X' to Xz. Using a pretrained diffusion model's velocity function vo(..-) and given input image x X. we select fixed timestep 7 E (0, 1). The perturbed image x, X, is obtained by integrating the following equation:
σ v (x(, $(x,0) ~ X, 0t
(1)
from t = 0 to
To further map Xx to X we fine-tune based score function 30,, yielding a new velocity function Vo. Then by integrating another equation:
(xx = vx t), Tx ~ Xr,
(2)
at
from == to 0.
3

---

To train this second flow, we introduce a novel Caseading Distribution Shift Training strategy, which addresses the challenges posed by the inaccessibility of intermediate distributions during training.
Finally, to ensure that outputs remain within X we apply dynamic gradient stops during train- ing, coupled with hard clipping operations at the final timestep. This approach allows for richer intermediate representations while maintaining the required perturbation bounds.
Details of our approach are provided in the following subsections.
3.1 A Construction of Better Extend Flow
Firstly, we construct an extended flow based on j. which is the negative value of the cross-entropy function:
j j= )=-CR(((x),c,
(3)
where / is the source model and c is the target label.
Proposition 1 (Morse Flow Construction). Under mild assumptions on the 2 and the function j.
there exists a unique smooth flow.
x x 10,c] -xx;
(4)
satisfying:
d $ $(x, t) -((((x,)) 1)), (xx, 0) x,
dt
(5)
such that:
1. v (xxx)xxxx almost everywhere
2. j((((x ()) 2 (xx for all x E X", and > holds almost everywhere if is not trivial
3. Each () X + X is a diffeomorphism
Proposition | indicates we can find better extend flow to hack by V.. In the following paragraphs, we will construct concrete algorithm to realize it along with an existing flow.
detailed proof is provided in Appendix A.
3.2 Cascading Distribution Shift Training
Although the in-the-wild ODE trajectory is deterministic, obtaining exact intermediate samples remains a significant challenge, which poses difficulties for our approach. To address this issue, we propose the Cascading Distribution Shift Training Algorithm, specifically designed to enhance adversarial attack efficacy through two key mechanisms: (1) Enforcing cascading hacking effect, where each perturbation step incrementally contributes to mislcading the source model. (2) Ensuring the final perturbation follows the prescribed Loe constraint. Further details are provided in Algorithm where denotes the conditional input in real diffuuion models.
Our proposed training framework not only circumvents the challenge of inaccessible intermediate timesteps but also offers additional advantages. Proposition 2 formalizes that our algorithm progres- sively refines coarse-to fine representation, thus effectively leveraging information from ahead timesteps. More concretely, due to the continuity of the ODE, our training algorithm enables cascading optimization within an increasingly refined space.
Theorem 2 (Cascading Improvement Adjoint Timesteps). Consider two consecutive timesteps t 8. Following [ when comparing the cases with and without updating O at tt, updating 0 results in an equal or lower cross poss-entropy for Xy at t 5 when sufficiently small and all functions are smooth.
One crucial consideration constraining the final result within X There are two primary methods to achieve this. The first approach incorporates the original ODE trajectory during model tuning,

---

Algorithm Cascading Distribution Shift Training
Input: т Nó, stepsize 8, model param. Φ, 0, source model f, target labels set C, training dataset
hez, learning rate
Initialize 0 = ó.
repeat
for E I do
get X I sample C for to N do
(t- v (x (t- 1)ō, Ø)8
end for
for = N to 1 do
1j8 = X Vo vx to.c)) c)6
Xg Xto vo vo 16, c)t
X6 clip (Xo, x E, c)
0 = 0 - 4, Vo(C c))
end for
end for until convergence
Return: Dual-Flow (vg, vol
Algorithm 2 Dual-Flow Sampling
Input: N8, stepsize image target label c, Dual-Flow (va, vol = I.
for to N do
X18 ((t-))8 + (x (t 1)6, 23)8
end for
for t N to 1 do
X(t-1)6 = X Vo t6, c)8
end for
Xy = clip (Xu, x - c, cc
Return: Xg
ensuring the output remains close to the original ODE flow. The second approach enforces the lo constraint or applies gradient clipping to suppress the influence of out-of-range image regions, guaranteeing that only in-range rewards contribute to model optimization. Our experiments show that dynamic gradient clipping yields the best performance among these methods.
Given the fixed model capacity, the Cascading Distribution Shift Training algorithm ensures greater consistency between the training and sampling processes, improving performance. This is visually illustrated in Figure
3.3 Dual-Flow Sampling
During the sampling process, following the proposed training algorithm, given image x E X' is first mapped x, via Eq. (L) Subsequently, transformed into intermediate state x/j using Eq. ( Finally, a hard truncation is applied to obtain the qualified perturbed sample Xo E X'..
3.4 Deterministic Flow vs. Stochastic Flow
An important consideration is the choice between a deterministic flow, modeled by an ODE, and a stochastic flow, modeled by an SDE. This decision primarily depends the second flow, the first inherited from a pretrained diffusion model.
When translating the distribution X to X simple rescaling and noise injection into X is insufficient fully recover X Consequently, this transformation falls outside the standard diffusion- based framework.
5

---

Table 1: Attack success rates (%) for multi-target attacks normally trained models using the ImageNet NeurIPS validation set. The perturbation budget constrained to Lo I 16/ 255. * indicates white-box attacks. The results averaged across 8 different target classes, and the overall average on the far right is computed solely for black-box attacks.
Source
Method
Inc-v3
Inc-v4
Ine-Res-v2
Rcs-152
DN-121
GoogleNet
VGG-16
Average
MIM
99.90"
0.80
1.00
0.40
0.20
0.20
0.30
0.48
TI-MIM
98.50'
0.50
0.50
0.30
0.20
0.40
0.40
0.38
SI-MIM
99.80'
1,50
2.00
0.80
0.70
0.70
0,50
1.03
DIM
95.60'
2.70
0.50
0.80
1.10
0.40
0.80
1.05
TI-DIM
96.00"
1.10
1.20
0.50
0.50
0.50
0.80
0.77
Inc-v3
SI-DIM
90.20'
3.80
4.40
2.00
2.20
1.70
1.40
2.58
Logit
99.60"
6.50
1.70
3.00
0.80
1,50
3.18
SU
99.59*
7.00
3.50
3.94
C-GSP
93.40"
66.90
66.60
41.60
46.40
40.00
45.00
51.08
CGNC
96.03"
59.43
48.06
42.48
62.98
51.33
52.54
52.80
Dual-Flow
90.08"
77.19
66.76
77.06
82.64
73.01
67.09
73.96
MIM
0.50
0.40
0.60
99.70"
0.30
0.30
0.20
0.38
TI-MIM
0.30
0.30
0.30
96.50'
0.30
0.40
0.30
0.32
SI-MIM
1.30
1.20
1.60
99.50'
1.00
1.40
0.70
1,20
DIM
2.30
2,20
3.00
92.30'
0.20
0.80
0.70
1.53
TI-DIM
0.80
0.70
1.00
90.60*
0.60
0.80
0.50
0.73
Res-152
SI-DIM
4.20
5.40
90.50'
4.20
3,60
2.00
4.03
Logit
10.10
12.80
95.70"
12.70
3,70
9.20
SU
12.36
11.31
16.16
95.08"
16.13
6.55
14.28
12.80
C-GSP
37.70
47.60
45.10
93.20'
64,20
41.70
45.90
47.03
CGNC
53.39
51.53
34.24
95.85*
85.66
62.23
63.36
58.40
Dual-Flow
69.58
56.10
92.39"
85.73
73.65
67.59
natural solution is construct an in-the-wild ODE (as we do) SDE that maps 2 to X In the ODE formulation, we define velocity function Vo that satisfies Eq. (2) A similar approach applies the SDE case, where stochastic noise facilitates the distribution transition.
When comparing from the perspectives of randomness and determinism, as shown in Figure I we label our framework as Cascading ODE and implement SDE-based training algorithms. One injects noise at random timestep within (0, 7). labeled as Random SDE, while the other first directly adds noise at 7 and then reverses the flow using DDPM, resulting in a weak cascading relationship. labeled as Cascading SDE. While SDE-based training algorithms more closely resemble original diffusion models, they present key challenges.
First, Cascading SDE introduces a random term, which may make it more difficult to construct the Cascading Improvement relationship stated in Proposition 2 for Cascading ODE. Second, sampling with SDEs tends to produce unstable results, where larger step sizes exacerbate accumulated errors, further impacting reliability, as demonstrated in our experiments.
As Random SDE, it exhibits the worst performance because when sampling x, by directly adding noise, the distribution of x, remains unchanged. Consequently, even slight training of the reverse flow leads to distribution mismatch, as illustrated by the star in the last column of Figure]
4 Experiments
4.1 Experimental Settings
Dataset.
Following 69 18 17), train the model the ImageNet training set[10] and evaluate
the attack performance using ImageNet-Neurlpn (1k) dataset proposed by NeurIPS 2017 adversarial competition (4))
Victim Models. We consider various naturally trained models, including Inception-v3 (Inc-v3)
(55), Inception-v4 (Inc-v4) [56), Inception Restet-2 (Ine-Res-v2) (56), ResNet-152 (Res-152) 27
DenseNet-121 (DN) 311. GoogleNet (54), and VGG-16 49

---

Table 2: Attack success rates (%) for single-target attacks against normally trained models ImageNet NeurIPS validation set. Note that CGNC and Dual-Flow denote the single-target variants of CGNC and proposed Dual-Flow, respectively. The perturbation budget is constrained to loc < 16 16/255. indicates white-box attacks. The results are averaged across 8 different target classes, and the overall average the far right computed solely for black-box attacks.
Source
Method
Inc-v3
Inc-v4
Inc-Res-v2
Res-152
DN-121
GooglcNet
VGG-16
Average
GAP
86.90"
45.06
34.48
34.48
41.74
26.89
34.34
36.16
CD-AP
94.20*
57.60
60.10
37.10
41.60
32.30
41.70
45.07
TTP
91.37"
46.04
39.37
16.40
33.47
25.73
Inc-v3
DGTA-PI
94.63*
67.95
55.03
50.50
47.38
47.67
48.11
52.77
CGNC
98.8% 84.84"
74.76
62.00
78.94
70.74
70.00
Dual-Flow
90.08
77.19
66.76
77.06
82.64
73.01
67.09
73.96
Fnol-Flow
91.41"
78.85
70.59
79.12
83.36
77.52
71.29
76.79
GAP
30.99
31.43
20.48
84.86"
58.35
29.89
39,70
35.14
CD-AP
33.30
43.70
42,70
96.60"
$3.80
36.60
34.10
40.70
TTP
62.03
49.20
38.70
95.12"
82.96
62.82
60.13
Res-152
DGTA-PI
53.62
96.48"
86.61
69.58
CGNC
68.86
69.45
45.71
98.61"
91.14
69.83
68.05
68.84
Dual-Flow
69.58
71.92
92.39"
85.73
67.59
Dual-FFoon Flow
72.25
74.35
58.44
93.65"
87.61
75.45
71.11
76.12
Table 3: Attack success rates (%) for multi-target attacks against robust models on ImageNet NeurIPS validation set. The perturbation budget 20 S 16 22/5. The results are averaged on different target classes.
Source
Method
Inc-v3adv
IR-v2ens
Res50sIN
Res50nn
Res50me
Res50Aug
Average
MIM
0.16
0.10
0.20
0.27
0.44
0.19
0,23
TI-MIM
0.21
0.19
0.33
0.49
0,68
0.31
0.37
SI-MIM
0.13
0.19
0.26
0.43
0,63
0.29
0.32
DIM
0.11
0.09
0.16
0.33
0.39
0.19
0,21
TI-DIM
0.15
0.13
0.16
0.21
0.33
0.14
0.19
Inc-v3
SI-DIM
0.19
0.21
0.43
0.71
0,84
0,46
0.47
Logit
0.30
0.30
0.70
1.23
3,14
0.86
1.09
SU
0.49
0.84
1.75
3.55
1.35
C-GSP
20.41
18.04
6.96
33.76
44.56
21.95
24.28
CGNC
24.36
22.54
8.85
40.83
52.18
22.85
28.60
Ours
51.54
55.62
45.86
74.56
78.54
67.56
62.28
MIM
0.19
0.15
0.28
1.58
2.75
0.78
0.96
TI-MIM
0.61
0.73
0.50
2.51
4.75
1.76
1.81
SI-MIM
0.24
0.24
0.39
0.66
0.84
0.36
0.46
DIM
0.63
0.37
0,94
8.50
14.22
3.77
4.74
TI-DIM
0.23
0.30
0.28
0.76
1.49
0.49
0.59
Res-152
SI-DIM
0.71
0.71
0.75
2.73
3.89
1.37
1.69
Logit
1.15
1.18
1.65
6.70
15.46
5,93
5.34
SU
2.12
1.20
1.95
7.53
21.14
6.95
6.82
C-GSP
14.60
16.01
16.84
60.30
65.51
42.88
36.02
CGNC
22.21
26.71
29.83
79.80
84.05
63.75
51.06
Ours
44.50
54.09
59.35
83.05
84.28
76.35
66.94
For further evaluation, we also analyze the performance our method on robustly trained models.
These include adv- adv-Inception-v3 (Inc-v3uuv) (22). ens-ady- www---nccttoneeseeeee
(IR-v2cms) [26], and several robustly trained ResNet-50 models. The ResNet-50 variants are: Res50sIN (trained on stylized ImageNet), Res50m (trained on mixture of stylized and Nature ImageNet), Res50 (further fine-tuned with an auxiliary dataset (2l) ) and Res50 (trained with advanced data augmentation techniques from Augmix (28)

---

Baseline Methods. We compare our attack with several attack methods. For instance-specific
attacks, we consider MIM [22, DIM [66], SIM [35.. DIM [3], Logit [7]] and SU
62
For
instance-agnoster attacks, we consider C-GSP 69] CGNC 17.. GAP 46 CD-AP
42
TTP
43
and DGTA- 18 Among them, C-GSP and CGNC [7 are multi-target generative attacks, and
the others are single-target generative attacks. For SU attack (62]. we choose to compare with its best
version DTMI-Logit-SUL For CGNC [7]. we also consider its single target variant and compare it to single target attack method.
Implementation Details. We adopt stable-diffusion 488 as our pre-trained diffusion model. We set = 0.25 and N = 6 for training and testing. The LoRA rank is 16.
choose Res-152 and Inc-v3 as source models to train our model. The perturbation budget e is 16/255. We conduct 50k steps of training for multi-target tasks. To compare our method with other single-target attacks, we further fine-tune our model for an additional 10k steps to specialize in single target class(more details provided in Appendix [.2) For target training, we use a learning rate of 2.5 x 10-3 and total batch size of 8 (distributed across two NVIDIA RTX 3090 GPUs, each with 24GB memory and batch size 4). Training under this setting takes approximately one day complete. For single-targe fine-tumin ane-tuning, we the learning rate to 1 x 10 and a batch size of 4, conducted on single NVIDIA RTX 3090 GPU, which requires approximately hours. total, the experiments involve approximately 160 GPU hours.
Following previous work 66
18 177,
4.2 Transferability Evaluation
We assess the effectiveness of our proposed Dual-Flow for black- target attacks through a series of experiments. To ensure consistency with previous work [69] 18, 17), select eight distinct target classes (70) to conduct the target black-box attack testing protocol. We use the average attack success rate (ASR) across 8 target classes evaluation metric.
Multi-Target Black-Box Attack. We initially conduct attacks on normally trained models to evaluate the performance of multi-target attacks. The results in Table [ show that our proposed Dual-Flow method exhibits significantly superior transferability, outperforming state-of-the-aa snstance-specific and instance-agnostic methods. Specifically, our method achieves an average ASR improvement of 21, 16% and 12.36% over CGNC [17] using Inc-v3 and Res-152 as source models, respectively, on black-box models. Notably, instance-specifie methods, despite higher success rates in white-box settings, tend to overfit the source models' classification boundaries, resulting in poor performance when transferred black-box models.
Single- Single-Target Black -Bx Attack. To further evaluate our method's effectiveness, we compare it with other state-of-the-ar instance-agnostic single-target attacks. Multi-target attacks are inherently more challenging than single-target ones, disadvantaging our model in such comparisons. To ensure fairness, we applied masked fine-tuning technique similar to CGNC [17] allowing us to fine-tune our model separately for each target class and create single-target variants.
The results in Table 2 show that after fine-tuning, Dual-Flow! achieves higher attack success rates and generally outperforms leading single-target methods. Notably, our method excels in average black-box attack capability even without individual fine-tuning for the eight target classes. This demonstrates our approach's significant capacity and effectiveness in multi-target attacks, reducing the need for separate models for each target class in essource-constrainee scenarios.
4.3 Attack Under Defense Strategies
To demonstrate the robustness of our proposed Dual-Flow, we evaluate its performance against several widely used defense mechanisms.
Robustly Trained Networks. We first consider attacking six robustly trained networks, with results in Table 3 Attacking robustness robustness-augmentèé models is challenging, as previous methods see significant drop success rates. However, our approach consistently misleads black-box classifiers into predicting the specified classes, showing marked improvement over earlier multi-target methods. Notably, using Inc-v3 as the source model, the average attack success rate against the six robust models increases significantly from 28.60% to 62.28%, highlighting our method's effectiveness.
8

---

Origical
Rock python
Barometer
Flg
Figure 2: Visualization results of different input images targeting various classes. For each text prompt of the target class, the left column displays the adversarial examples generated before clipping, the middle column shows the adversarial examples after clipping, and the right column presents the corresponding adversarial perturbations, which represent the differences between the clipped adversarial examples and the original images. Note that the perturbations are scaled to range between 0 and 1. The source model used is Inc-v3.
Input Process Defense. We compared
method's performance with the state-of-the-art multi-target attack method CGNC against input preprocessing defenses, such as image smooth- ing (I]] and JPEG compression [14]. As shown in Figure our method consistently outperforms CGNC under these defenses. For example, using Inc-v3 the source model and DN-121 as the target model, our method achieves 52.99% suc- cess rate under Gaussian smoothing, compared CGNC's 28.27%. This highlights the superior effectiveness of our approach in overcoming input preprocessing defenses.
CUN (3
Ouu (IV
Mudiaa
JPEG compression Input smoothing
Figure comparison of CGNC and our method regarding attack success rates against various input processing defense strategies. The results against JPEG compression are shown in (a), while (b) presents the outcomes against dif- ferent input smoothing methods. Inc-v3 is the source model and Inc-Res-v2, along with DN- 121, are the target models.
4.4 Visualization
To gain deeper understanding of the effective- ness of our method, we visualized both the un- clipped and clipped samples generated by ap- proach. Additionally, for consistency with other perturbation-base attack methods, visualized the equivalent adversarial perturbations, defined as the pixel differences between the clipped samples and the clean images. As illustrated Figure our method first transforms the original image into one that maintains a similar layout and color scheme but becomes semantically closer to the target class. This transformed image is subsequently clipped ensure its pixel differences from the original image remain within the epsilon bound. Visually, the clipped image retains substantial semantic features of the target class. Notably, the adversarial perturbations also exhibit distinct semantic patterns aligned with the target class, further validating the effectiveness of our approach.
4.5 Ablation Study
To further validate the effectiveness of our chosen Cascading ODE, we conducted se- ries of ablation experiments in this section. Here, Dual-Flow-co represents the original method, Dual-Flow-cs denotes the Cascading SDE variant, and Dual-Flow-rs denotes the Random SDE variant. During the reverse process at inference time, these variants em-

---

ploy either the DDPM scheduler or the DDIM scheduler. As shown in Table 4 our method significantly outperforms the other variants in white-box and black-box transfer attacks.
Furthermore, compared the impact of different sampling steps N during the reverse process. As shown in Figure increasing the sampling steps steadily increases success rates for both Dual- Flow-co and Dual-Flow-cs. However, for Dual- Flow-rs, the success rate quickly declines as the inference steps increase, supporting our analyses
Dual-Flom-co Dual-Flow-es
Dual-Flow-r
Attack Surcers Rate
in Section 3.4 and Figure [
80 48
Discussion
Potential Advantage SDE. Although our experiments with Cascading SDE have not yet surpassed performance of Cascading ODE, believe that methods based on Schrödinger bridges [9] have the potential to bring significant improvements. Schrödinger bridge formulations provide principled way to learn stochastic transport maps, which could offer better control over the reverse trajectory and enhance the stability of the eascading distribution shift.
10
Figure 4: The multi-target black-bor attack suc- rates of several variants of our method. The source model used is Res-152.
Table 4: The multi-target attack success rates of several variants of our method. The source model used is Res-152, The white-box attack success rate refers to the performance on Res-152, while the black-box attack success rate represents the average performance across six black-box models.
Method
White-box
Black-box
Dual-Flow-co
92.39
70.76
Dual-Flow-cs DDIM
68.56
40.12
Dual-Flow-es DDPM
74.58
46.04
Dual-Flow-rs + DDIM
55.39
33.00
Dual-Flow-rs DDPM
29.19
14.86
6 Conclusion
We have introduced Dual-Flow, novel framework for highly transferable multi-target adversarial attacks. By employing Cascading Distribution Shift Training develop an adversarial velocity function, our approach addresses the limitations of existing methods. Extensive experimental results demonstrate that Dual-Flow achieves remarkable improvements in transferability and robustness compared to previous multi-targe generative attacks. These findings highlight the potential of Dual-Flow as a powerful tool for evaluating and improving the robustness of generative models.
Acknowledgments and Disclosure of Funding
This work was supported in part by the Natural Science Foundation of China under Grant No. 62222606 and the Ant Group Security and Risk Management Fund. We sincerely thank Qixin Wang for her assistance in creating the figures for this paper.
References
[1] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In European conference on computer vision, pp. 484-501. Springer, 2020.
10

---

[2] Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust ad- versarial examples. In International conference on machine learning, pp. 284-293. PMLR, 2018.
[3] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 ieee symposium on security and privacy (sp), pp- 39-57. leee, 2017.
[4] Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024.
[5] Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Yc, and Cheng-Zhong Xu. Advdiffuser: Natural adversarial example synthesis with diffusion models. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pp. 4562-462244 -572, 2023.
[6] Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang, Content- based unrestricted adversarial attack. Advances in Neural Information Processing Systems, 36: 51719-51755 2023.
[7] Zhengsu Chen, Lingxi Xie, Jianwei Niu, Xuefeng Liu, Longhui Wei, and Qi Tian. Visformer: The vision-friendly transformer. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 1889599,220 2021.
[8] Xuelong Dai, Kaisheng Liang, and Bin Xiao. Advdiff: Generating unrestricted adversarial examples using diffusion models. In European Conference on Computer Vision, pp. 90-1099 Springer, 2025.
[9] Valentin De Bortoli, James Thortoo,, Jeremy Heng, and Arnaud Doucet. Diffusion schrödinger bridge with applications to score-based generative modeling. Advances in Neural Information Processing Systems, 34:17695-17709 2021.
[10] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. leee, 2009.
[11] Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. Advertorch vO. 1: An adversarial robustness toolbox based on pytorch. arXiv preprint arXiv:1902.07625 2019.
[12] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018.
[13] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by ienslation-invaiian attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4312-4321, 2019.
[14] Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression on adversarial images. arXiv preprint arXiv: 1608. 0008000853, 2016.
[15] Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, al. Scaling rectified flow trans- formers for high-resolution image synthesis. In Forty-firs international conference machine learning, 2024.
[16] Kevin Eykholt, Ivan Evtimov. Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-war worlld attacks on deep learning visual classification. In Proceedings of the IEEE conference on computer vision and puttern recognition, pp. 1625-1634, 2018.
[17] Hao Fang, Jiawei Kong, Bin Chen, Tao Dai, Hao Wu, and Shu-Tao Xia. Clip-guided generative networks for transferable targeted adversarial attacks. In European Conference on Computer Vision, pp. 1-19. Springer, 2025.

---

[18] Weiwei Feng, Nanqing Xu, Tianzhu Zhang, and Yongdong Zhang. Dynamic generative targeted attacks with pattern ijjection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14444,1641,, 2023.
[19] Kuofeng Gao, Yang Bai, Jiawang Bai, Yong Yang. and Shu-Tao Xia. Adversarial robustness for visual grounding of multimodal large language models. In ICLR Workshop, 2024.
[20] Lianli Gao, Yaya Cheng, Qilong Zhang, Xing Xu, and Jingkuan Song. Feature space targeted attacks by statistic alignment. arXiv preprint arXiv:2 I145, 2021.
[21] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trait trained enns are biased towards texture: increasing shape bias improves accuracy and robustness. arXiv preprint
2018.
[22] lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6522 2014.
[23] Benjamin Graham, Alaaeldin El-Nouby, Hugo Touvron, Pierre Stock, Armand Joulin, Herve Jegou, and Matthijs Douze. Levit: A vision transformer in convnet's clothing for faster inference. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 12259-12269, October 2021.
[24] Jiangfan Han, Xiaoyi Dong, Ruimao Zhang, Dongdong Chen, Weiming Zhang, Nenghai Yu, Ping Luo, and Xiaogang Wang. Once man: Towards multi-target attack via learning multi- target adversarial network once. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 1158-5167, 2019.
[25] Kai Han, An Xiao, Enhua Wu, Jianyuan Guo, Chunjing Xu, and Yunhe Wang. Transformer in transformer. Advances in neural information processing systems, 34:15908-1115 -19999, 2021.
[26] Jie Hang, Keji Han, Hui Chen, and Yun Li. Ensemble adversarial black-box attacks against deep learning systems. Pattern Recognition, 101:107184 074000184220 2020.
[27] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Dision-ECCy 2016: 14th European Conference, Amsterdam, The Netherlands, October 11 11-14, 2016, Proceedings, Part IV 14, pp. 630-645, Springer, 2016.
[28] Dan Hendrycks, Norman Mu, Ekin D Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. arXiv preprint 1rXiv:1912.02700 2019.
[29] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6851 2020.
[30] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv 2021.
preprint
[31] Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700-4708, 2017.
[32] Rongjie Huang, Jiawei Huang, Dongchao Yang. Yi Ren, Luping Liu, Mingze Li. Zhenhui Ye. Jinglin Liu, Xiang Yin. and Zhou Zhao Make-an-audio: Text-to-audio generation with prompt-enhanced diffusion models. arXiv preprint arXiv:2301.12661 2023.
[33] Zelun Kong, Junfeng Guo, Ang Li, and Cong Liu. Physgan: Generating worddaal-wrdd--essiiiin adversarial examples for autonomous driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14254-14263 2020.
[34] Qizhang Li, Yiwen Guo, and Hao Chen. Yet another intermediate-level attack. In Com- puter Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XVI 16, pp. 241-257. Springer, 2020.
12

---

[35] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arXiv:1908.0628/ 2019.
[36] Yaron Lipman, Ricky TQ Chen, Heli Ben- Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. arXiv preprint arXiv:2210.02747, 2022.
[37] Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint wrXXv:2209.0300) 2022.
[38] Yantao Lu, Yunhan Jia, Jianyu Wang, Bai Li, Weiheng Chai, Lawrence Carin, and Senem Velipasalar. Enhancing cross-task black-box transferability of adversarial examples with disper- sion reduction. In Proceedings of the IEEF/CVF conference on Computer Vision and Puttern Recognition, pp. 940-949,200 2020.
[39] Jinqi Luo, Tao Bai, and Jun Zhao. Generating adversarial yet inconspicuous patches with single image (student abstract). In Proceedings of the AAAI Conference on Artificial Intelligence. 2021.
[40]
Viscon maintainers and contributors. Torchvision: Pytorch's computer vision library.
http://///gggtoooooororor/////// 2016
[41]
Seyed-Mohsce Moosavi-Dezfoolli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1765-1773, 2017.
[42] Muhammad Muzammal Naseer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adversarial perturbations. Advances in Neural Information Processing Systems, 32, 2019.
[43] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. On generating transferable targeted perturbations. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 7708-7717, 2021.
[44] NeurlPS. http:///wwwhtp//.o.o/ooo/ootottt data Kaggle, 2017.
[45] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
[46] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial per- turbations. In Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 4422 4431, 2018.
[47] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning. pp. 7748-8763. PMLR, 2021.
[48] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10684-10695, 2022.
[49] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint urXiv::4009 1556, 2014.
[50] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsuper- vised learning using nonequilibrium thermodynamics. In International conference on machine learning, pp. 2256-2265. PMLR, 2015.
[51] Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint 2rX1v:2010.02502, 2020.
13

---

[52] Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011. 1. 13456, 2020.
[53] Christian Szegedy, Wojciech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks, arXiv preprint arXiv: 2013.
[54) Christian Szegedy, Wei Liu, Yangqing Jia, Pierre Sermanet, Scott Reed, Dragomir Anguelov, Dumitru Erhan, Vincent Vanhoucke, and Andrew Rabinovich. Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1-9,
2015.
[55] Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Re- thinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 28 18-2666, 2016.
[56] Christian Szegedy, Sergey loffe, Vincent Vanhoucke, and Alexander Alemi. Inception-v4, inception-resnet and the impact of residual connections on learning. In Proceedings of the AAAI conference on artificial intelligence, volume 31, 2017.
[57] Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficieet image transformers & distillation through attention, 2021.
[58) Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Herv'e e J'egou. Going deeper with image transformers. In Proceedings of the IEEE/CVF International Confer- ence on Computer Vision (ICCV), pp. 32-42, October 2021.
[59] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 1924-1933, 2021.
[60] Xiaosen Wang, Kun He, and John E Hopcroft. At-gan: A generative attack model for adversarial transferring on generative adversarial nets. arXiv preprint arXiv: 3(4):3, 2019.
[61] Zhibo Wang, Hongshan Yang, Yunhe Feng, Peng Sun, Hengchang Guo, Zhifei Zhang, and Kui Ren. Towards transfcrable targeted adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20534-20543, 2023.
[62] Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Enhancing the self-universality for transferable targeted attacks. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 12281-12290 2023.
[63] Ross Wightman. Pytorch image models.
httpps:/ggithaab.cmm///gggggaaae
pytorch- Berrch-mmage-o manage-models 2019.
[64] Bichen Wu, Chenfeng Xu, Xiaoliang Dai, Alvin Wan, Peizhao Zhang, Zhicheng Yan, Masayoshi Tomizuka, Joseph Gonzalez, Kurt Keutzer, and Peter Vajda. Visual transformers: Taken- image representation and processing for computer vision, 2020.
[65] Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv:1801.02611 2018.
[66] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2730-2739, 2019.
[67] Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adversaria attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14983-14992. 2022.
[68] Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion- adversarial sample generation for improved stealthiness and controllability. Advances in Neural Information Processing Systems, 36:2894-2921.. 2023.
14

---

[69] Xiao Yang, Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Boosting transferability of targeted adversarial examples via hierarchical generative networks. In European Conference on Computer Vision, pp. 725-742. Springer, 2022.
[70] Chaoning Zhang, Philipp Benz, Tooba Imtiaz, and In So Kweon. Understanding adversarial examples from the mutual influence of images and perturbations. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 14521-14530, 2020.
[71] Zhengyu Zhao, Zhuoran Liu, and Martha Larson. On success and simplicity: A second look at transferable targeted attacks. Advances in Neural Information Processing Systems, 34: 61 6115-6128, 2021.
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The claims made in the abstract and introduction are supported in Section 4
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss limitations the Appendix.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
16

---

Justification:
In the Appendix we provide the complete proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We provide full experimental details for reproducing the main results in Section and Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
17

---

Answer: [Yes]
Justification:
We will release our data, models and codebase in the final version of the paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
lc for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ccpppi.ccppulli//uuuii wwwtii/gguie///eeeeeeoocc CoodeSubeiiieeee ssi wsionnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification:
We provide full details in Section 4|and Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: We provide statistical significance information in Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
18

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of enrors is not verified.
For asymmetric distributions, the authors should be careful figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
show in tables or
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide sufficient information on the computer resources in Section 4 and Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't It make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
The research conducted in the paper conforms with the NeurIPS Code of Ethics.
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., . if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We provide discussion about potential societal impacts in Appendix.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
19

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The benchmarks and data splits are publicly available. All licenses are respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the Datasets.papersstt paperswi thcode. cow/ datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
20

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Assets will be released, and all instructions and details will be included for reproduction.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moode as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based the requirements of your country institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applicable), such the institution conducting the review.
21

---

16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy buttps://neure wwwparripp..ccoooeeeeeeeeeea /t/CCooffeeencss//2222 for what should or should be described.
22

---

A Proofs
A.1 Proof of Morse Flow Construction
Proposition 3 (Morse Flow Construction). Let B C. I be bounded open set with smooth boundary, and let - 18 a smooth Morse function that extends to C (B). There exists O, a smooth vector field X XB), and unique smooth flow
B x [0,
satisfying:
d dt
4(1 1) = (x t)),
(xr,0) 0) = I,
such that:
1. (( E)) 2 j(x) for all
2. Each ((,1))
a diffeomorphism
3. Trajectories remain bounded away from 0B for E [0,
Constructive Proof. We proceed through coordinated geometric and analytic constructions.
Step 1: Geometric Preparations
1. Smooth Defining Function: By the smooth boundary assumption, there exists μ C (B, (o)) with:
(0) = 0B
Vp(x) for 0B
u(z) dist(x, OB) near 0B
For explicit construction, take p(x) ((dist(r, 0B)) where f CO oo)) satisfies f(r) near 0.
2. Critical Point Isolation: Since is Morse on compact B, critical points 8(j) {PI....,PP .P.... are finite and non-degenerate. Choose pairwise disjoint neighborhoods
U4 3 P: with:
UcB OB and U, {p.
Step Vector Field Construction
Partition of Unity: Let {p:) be smooth functions with:
N
supp(p:) Us. 0SPILL 1
Σ pt
Define the cutoff function:
N <<x) := = Σ px(x)
Note 1 = 0 near critical points and outside UV.
2. Decay Modulation: Fix 2 n + 1. Define the boundary decay factor:
Pm (x) = u(
This ensures sufficient regularity at 0B.
23

---

3. Synthesized Vector Field: Define
( == (2 (z)
This field vanishes at critical points and near AB
Step Flow Analysis
Boundary Avoidance: For x E B, let (()) = (z t)). Compute:
dr di Vu()) ( = ( (0) ( Vi(Φ)
Using V Vil S C' near 0B:
dr
S Cn(D))(@))m) 2 Cr(t)m++
dt
Solutions A Crm+1 satisfy it will never reach 0 in finite time, establishing boundary avoidance.
Step Monotonicity Diffeomorphism
1. Energy Gain: Along trajectories:
d di (
( -
( ()) 0
Thus j is non-decreasing, with strict increase except at critical points.
2. Flow Diffeomorphisms: The differential DΦ(ar,) () satisfies:
De(a, t) = ())
dt
Since is smooth with bounded derivatives on B, Grönwall's inequality gives:
|D 1)Il S exp (,,tt 1+e
()x()(2 < oo
Thus ((-,t) remains locally diffcomorphic, and propemess follows from boundary avoid- ance.
Step Isotopy Synthesis
The time-e map (0, provides the required isotopy through diffeomorphisms.
A.2 Proof of Cascading Improvement at Adjoint Timesteps
Proposition 4 (Cascading Improvement at Adjoint Timesteps). Consider two consecutive timesteps t, 8. Following [ when comparing the cases with and without updating tt, updating 9 results in equal lower pross-entrppy for Xy at t - 5 when 8 is sufficiently small and all functions are smooth.
Proof. We want to show
()(f( s CE(f(X))), ).c)
for sufficiently small with the following statement:
Xo - - (1- ()
and
X x,_5
Vo+ 8) (t 8),
where
A0 1, Vo (CEE(((Z")))))
X = Xx - vo(xi:
24

---

Step 1. Relating Xo and Xo Since X is close to for small 6, the smoothness of vo(::-) implies
xo =
[ vo(x 6) 5)] - [x vo vo(xx, t)
can be made arbitrarily small by taking sufficiently small (and using continuity/Lipschitz arguments).. Consequently,
V CB( and VoCE([(Sa"..))
also close for small 8.
Step 2. First-order comparison at - 6. By a first-order expansion of ve- around 0 and the smoothness of vo(;,)) :), we have
Ve- - 6) = vo(x)-,,t 8) + Vovo(xi-8;t- - de + 0(12013).
Hence,
X
X0 - (0+40(20-0,--0) - vo(x (t-o) -t--5) Vovo)) A6.
Step 3. Cross-entropy decrease. Using the smoothness of the cross-entropy and another first-order expansion,
CI ) c) - CE( CE c), Xo =² xx0) O -xo1
= Cf ),e). A0) + 0112812 ||]]).
By definition of the gradient step A6 = I, (f ). and the fact that (fCE(f(XE (x))) close to VoCE(f ), c) for small 5, the above inner product is non-positive up to higher-order (small) terms. Concretely,
(V.CE(((E)) (x))). -4 VoCE(((E0)), <
when 8 is sufficiently small so that these gradients align (up to small errors). Therefore.
CE(S(x))).)) S CE CR(
which completes the proof.
B Related Works
B.1 Targeted and Untargeted Attacks
Targeted Attacks. The objective of targeted attacks is force the classifier output specified label. In other words, the attacker seeks to cause the model to produce incorrect classification results and aims for the result be specific target class. This type of attack is more hazardous due its ability to manipulate the model's 'ss output precisely but is typically more challenging to execute.
Untargeted Attacks. The goal of untargeted attacks is to make the classifier output any incorrect label. The attacker merely needs mislead the model that its classification result does not match the true label. Despite having lower requirements, untargeted attacks can still have severe consequences in certain situations.
B.2 White-Box and Black-Box Attacks
White-Box Attacks. White-box attacks assume that the attacker has complete access to the target model, including architecture, parameters, and gradient information. Using this information, the attacker generate efficient adversarial examples through iterative optimization methods.
25

---

Black-Box Attacks. Black- box attacks assume that the attacker does not have access to the internal information of the target model. common method to implement black- box attacks to utilize transferability, where adversarial examples are first generated against known source model and then used attack the unknown target model.
B.3 Instance-Specifie and Instance-Agnostic Attacks
Instance-Specific Attacks. Instance-specific attacks [2
and instance- agnostic generate adversarial perturbations for specific input samples. The attacker uses gradient information from the target model and iterative optimization algorithms to create minimal pertur- bations that achieve the attack on given sample. Such attacks usually have high success rates on individual samples but lack generalization and transferability.
20
16
67
59
38
34
Instance-Agnostic Attacks. Instance-agnostic attacks 66 input samples but instead learn universal adversarial perturbations or generative functions based on data distribution. These attack methods have better generalization across different samples, thus exhibiting stronger transferability.
39
33
43 18 do not target specific
B.4 Subcategories of Instance-Agnostic Attacks
Instance-agnostic attacks can be further subdivided into the following categories:
Universal Adversarial Perturbations. These methods learn a universal perturbation 4 70
applicable to the entire dataset. The classifier be misled by superimposing this perturbation any input sample.
Generative Models. Generative attacks 46 42 train generator that, upon receiving an input sample, can produce specific adversarial perturbations. This approach often surpasses universal adversarial perturbations regarding flexibility and attack efficacy.
B.5 Single-Target and Multi-Target Attacks
Single-Taree Target Attacks.
Single-target attacks train an individual generative model for each target class 42 43 18 [1]] Although these models achieve high success rates for single-target classes, the training cost becomes substantial when the number of target classes is large, thereby limiting practical usability.
Multi-Target Attacks. Multi-target attacks simultancously train the attack capabilities for multiple target classes within a single model as conditional inputs to generate corresponding adversarial perturbations. This method significantly reduces training costs and enhances feasibility in real-world applications.
24
69 17. Class labels or text embeddings are typically used
C Comparison with Other Diffusion-Based Methods
Currently, diffusion models have been explored in several adversarial attack methods 5
68
6
4
Among them, ACA [6] and DiffAttack 4 leverage DDIM inversion obtain the latent space of diffusion models and optimize adversarial examples within this latent space. AdvDiffuser [5]. DifiPGD (68) and AdvDiff (8) incorporate adversarial guidance during the reverse denoising process of diffusion models. Notably, although these methods are rrffusion-based they are all instance- specific attacks, requiring access to the target classifier's gradient information during inference for each input sample to perform the attack.
In contrast, method, once trained, does not require any further information from the classifier, enabling more efficient generation of adversarial examples.
Furthermore, since these prior methods either only support untargeted attacks 5 68 or focus on unrestricted adversarial examples 4 their settings are not directly compatible with ours, making direct comparisons infeasible.
26

---

D Method Details
D.1
Target Class Condition Representation
For each label in the target label set C, we first obtain its class description and format it into text condition using the template "a photo of (class)" 447. [77) Subsequently, we utilize CLIP's text encoder to derive this textual input's embedding c. Finally, this embedding is fed into our model via cross-attention mechanisms:
Q - zWz, K = =eW,, V = eWv, Attention (Q, K, V) softmorl
QKT
(6)
Vd )
where E Rd= denotes the flattened intermediate features of the unet model, We Rd.xd WK E Rd.xd Wy E Rddedd are learnable parameters.
By employing this approach, we can leverage the rich semantic priors associated with the target classes embedded in the pre-trained diffusion model, thereby facilitating a more effective training process.
Algorithm 3 Single-Targel Fine-Tuning Mechanism
Input: == -N6, stepsize 6, model param. Φ, 8, model f. target label c, training dataset {T' hei..
learning rate 4, repeat
for I do
get X I
for to N do
X = X(=-1)6 + v v. (x (t (t- 1)ó, Ø)6
end for
for t = N to do
X 1J8 = X (x t8, c)5
X X vo (215, t8, c)t
get random mask M
X6 Xo M (Xi- X0)
X = clip (Xo, X, ()
0 = 8 4, (f
end for end for until convergence
Return: Dual-Flow (Vo, Vo}
D.2 Fine-Tuning Single-Targe Tasks
We fine-tune our model for single-target tasks to enhance its performance further. Specifically, we fix the target label during training, enabling the model to focus targeted attacks for specific label. To mitigate the perturbations being confined to some areas of the image, which can reduce the robustness and transferability of adversarial examples in single-target training, we apply the mechanism introduced in [17].
In detail, we generate random mask M of the same size the image, where several randomly positioned square pixel areas are set to O, and the rest are set to 1. By multiplying this mask with the perturbation, ensure the generated adversarial samples remain consistent with the original image the masked square areas. This forces the model to create adversarial patterns distributed across the entire image rather than being localized specific regions, illustrated in Algorithm 3
Like other single-target methods, we must fine-tune separate model for each target. However, due to our model's powerful capabilities in multi-target attacks, once the model is trained on the
27

---

multi-target task, it requires only a few additional steps to adapt to each single-target task. This results in significantly lower training overhead compared to other methods.
E
Computational Cost
For training the multi-target Dual-Flow (e.g., using Res-152 as the source model), we require approximately hours of training on NVIDIA RTX 3090 GPUs, which equivalent to GPU hours. To further fine-tune single-target tasks, need additional 4 hours per class single NVIDIA RTX 3090 GPU, totaling hours classes = 32 GPU hours. Once training is complete, method only requires 15 minutes of inference single GPU to generate adversarial samples for 8 target classes across the entire ImageNet NeurlPS validation set.
Table 5: Training and inference time for Dual-Flow with Res- 15s as the source model.
Train (only multi-target)
Train (multi-target + single-target) Inference
48 GPU hours
80 GPU hours
15 min
We highlight that once our method completes training, can rapidly generate adversarial samples
with high transferability and robustness without requiring any gradient information from the classifier models.
F More Experiments
Evaluation on Transformer Models. We tested our attack method's success rate when transferred to transformer models. Specifically, we utilized Res152 as the source model. The results, included Ta demonstrate that despite fundamental architectural differences between transformer models and our source model based on convolutional networks (Res152), our method maintains high attack success rate, significantly outperforming baseline methods. This further corroborates the advantage of our method in terms of transferability.
Table 6: Attack success rates (%) for multi-target attacks on transformer models. The source model
is Res- 152.
Method
VIT-B/16 [4
CaiT-S/24 58
Visformer-S
DeiT-B 57
LeVIT-256 23
TNT-S 25
C-GSP
11.78
32.00
36.60 58. 70
35.58
37.85
31.00
CGNC
19.46
54.56
59,90
57.53
48.40
Dual-Flow 36.39
74.24
76.72
78.50
79.34
67.86
Evaluation on DiffPure, Purification (DiffPure)[45) The experimental results show the attack success rates of our method under various DifiPure t" settings and compare them with the baseline method. As illustrated Table 7 the baseline method is easily nullified by the purification process, whereas our method maintains significant success rate. This further demonstrates the robustness of our approach.
We evaluate our attack method using Diffusion Models for Adversarial
Table Attack success rates (%) for multi-target attacks on normally trained models with DiffPure. The source model is 152.
Method
Inc-v3
Inc-v4
Inc-Res-v2
Res-152
DN-121
GoogleNet
VGG-16
CGNC
16.26
19.91
8.53
67.76
49.81
21.79
29.81
0.05
Dual-Flow
49.60
51.92
37.56
79.50
70.20
51.30
52.26
CGNC
2.41
2.96
1.25
14.65
10.10
3.46
4.59
0.10
Dual-Flow
24.31
25.32
18.76
48.05
39.81
25.06
24.78
CGNC
0.47
0.46
0.34
1.84
1.46
0.62
0.92
0.15
Dual-Flow
7.20
7.87
5.89
16.70
13.72
7.71
8.34
28

---

Table 8: Attack success rates (%) for multi ttrget attacks on normally trained models using the ImageNet validation set. The perturbation budget is constrained to tx I 16/255. indicates white-box attacks. The results are averaged across different target classes, and the overall average on the far right is computed solely for black-box attacks.
Source
Method
Inc-v3
Inc-v4
Inc-Res-v2
Rcs-152
DN-121
GoogleNet
VGG-16
Average
CGNC
96.59
57.82
46.84
44.13
65,90
53.40
56.27
54.06
Ine-v3
Dual-Flow
89.89*
75.74
65.05
75.73
82.75
72.21
66.20
72.95
CGNC
56.00
50.37
32.26
96
86.69
63.84
63,90
58 84
Rcs-152
Dual-Flow
69.75
72.53
54.11
92.70"
86.71
74.08
68.22
70.90
Transferability Evaluation On ImageNet Validation Set. In addition the evaluation the ImageNet-NeuulPS (Ik) dataset [4). we conducted an assessment of our attack method on the ImageNet validation set (O0 and compared it with the state-of-the-ar multi-tate multi-target attack method, CGNC[[7]. The experimental results presented in Table & indicate that our method achieves significantly higher average black-bo attack success rate than CGNC, demonstrating its superior transferability. This outcome is consistent with the results observed on the ImageNet-Neurlle (1k) dataset.
Evaluation Smaller Perturbation Budgets. To validate the effectiveness of method when adversarial perturbations are more imperceptible, we conducted experiments at lower perturbation budgets for black-box targeted attacks. We used the 16/255 versions of trained models (CGNC and Dual-Flow) and clipped the generated samples to meet the = 12/255 and = 8/255 limits. The results are shown in Tab 9 The results show that our method achieves better attack performance than the baseline across various perturbation budgets.
Table Attack success rates (%) for multi-target attacks on normally trained models with different perturbation budgets. The source model is Inc-v3.
Method
Inc-v4
Res-Res-v2
Res-152 152
DN-121
GoogleNet
VGG-16
CGNC
59.43
48.06
42.48
62.98
51.33
52.54
16/255
Dual-Flow
77.19
66.76
77.06
82.64
73.01
67.09
CGNC 43.23
30.34
28.48
46.96
33.65
37.95
12/255
Dual-Flow
55.80
41.82
54.41
63.19
47.66
44.94
CGNC
13.33
6.54
6.95
14,65
7.51
10.29
8/255
Dual-Flow
23.86
14.04
21.21
27.68
13.39
15.55
Evaluation on Single-Targer Attacks against Robustly Trained Models. We validate the effec- tiveness of our attack method single-target settings against the robust models mentioned in the main text and compare with other single-target attacks. As shown in Table I0 the conclusions are similar to those the multi-target case in the main text, demonstrating that our method can effectively mislead robustly trained classifiers.
Table 10: Attack success rates (%) for single-target attacks against robust models ImageNet NeurIPS validation set. The perturbation budget Loo I 16/255. The results are averaged on 8 different target classes. The source model is 152.
Method
Inc-v3wtv
IR -2en
Res50sIN
Res50n
Res50mre
Res50Aug
GAP
5.72
4.51
7.33
71.04
83.64
52.07
CD-AP
3.77
6.48
7.09
63.72
76.79
49.67
TTP
27.99
26.08
24.61
72.47
74.51
70.96
DGTA-PI
31.10
30.07
27.70
77.13
80.55
76.78
CGNC
31.55
33.63
33.31
88.34
89.74
72.96
Dual-Flow
47.32
56.22
60.66
84.15
85.18
78.56
29

---

G
VGG-16 Victim Model Details
All the victim models we used employ the official weights provided for the 1K-class ImageNet dataset [TO]. For normally trained models (including transformer models), we directly call these models and their weights through the torchvision 40) timm 63 libraries. For robust models (adversarially trained models):
Inc-v3 and IR-v2ens. we call their official weights through the timm library.
Res50SIN, Res50IN. and Res50miee use the weights provided by the open-source repository -exture-vs-Shape 21
Res50Aug. we use the weights provided by the open-source repository Aug
We report the accuracy of these models on the ImageNet NeurIPS validation set in Tab
Table Accuracy (%) of victim models on ImageNet NeurIPS validation set.
Type
Model Accuracy
Inc-v3 95.1
Inc-v4 94.7
Inc-Res-v2 97.3
Res-152 94.5
DN-121 90.7
GoogleNet 87.0
VGG-16 87.2
Normal
Inc-v3atv 86.7
IR-v2ess 94.5
Res50sIN 68.4
Res50N 89.5
Res50me 93.2
Res50Amg 94.1
Robust
ViT-B/16 84.4
CaiT-S/24 98.1
Visformer-S 96.5
DeîT-B 96,9
VeVi--256 94.7
TNT-S 91.3
Transformer
H More Ablation Studies
Ablation on LoRA Fine-tuning. To demonstrate that the adversarial attack capability of our model stems from LoRA fine-tuning, we evaluated the model's performance when performing attacks directly without applying LoRA. As shown in Table [2] the original model fails to achieve effective adversarial attacks, which validates the necessity incorporating LoRA for fine-tuning.
Table 12: Attack success rates comparing the model with and without LoRA. The source model is Res-152.
Method
Inc-v3
Inc-v4
Inc-Res-v2
Res-152
DN-121
GoogleNet
VGG-16
w/o LoRA
0.075
0.075
0.05 56.10
0.05
0.075
0.05
0.075
LoRA
69.58
71.92
92.39
85.73
73.65
67.59
Ablation on Dynamic Gradient Clipping. To evaluate the effect of dynamic gradient clipping, we designed variant that does not apply dynamic clipping during training and only clips the outputs to satisfy the norm constraints during inference. As shown in Table XXX, if the model not trained with clipping, it fails to adapt to the norm constraints at inference time and thus cannot perform effective attacks.
Table 13: Attack success rates comparing the model with and without Dynamic Gradient Clipping. The source model Res-152.
Method
Inc-v3
Inc-v4
Inc-Res-v2
Res-152
DN-121
GoogleNet
w/o clip
1.85
2.32
2.84
3.51
1.82
1.19
w/ clip
69.58
71.92
56.10
92.39
85.73
73.65
67.59
30

---

Ablation on Loss. We designed variant: during training, we use new L2 loss function to make the model's output as close as possible to the original ODE trajectory. ensuring does not deviate too far from the original ODE flow. We call this variant Dual-Flow-I-2 The experimental results in Table
14 indicate that the attack capability of this variant is not ideal, as described in Section 3.2
Table 14: Comparison of Dual-Flow and Dual-Flow-Lz The source model is Res- 152.
Method
Inc-v3
Inc-v4
Inc-Res-y
Res-152
DN-121
GoogleNet
VGG-16
Average
Dual-Flow
69.58
71.92 56,26
56.10 42.94
92.39
85.73
73.65
67.59 46.36
70.76
Dual Holl-Flow-L L2
54.90
86.80
78.41
57.71
56.10
I
More Analysis
CGNC
Ours
Barometer
Sea lion
Figure 5: Visualization results comparing the adversarial perturbations generated by our method with those produced by CGNC.
Table 15: Comparison of different types of adversarial inputs. CGNC-P and Dual-Flow-P represent the adversarial perturbations generated by CGNC and our method, respectively, while Dual-Flow-A denotes the unclipped adversarial samples produced by method. The adversarial perturbations scaled to a range between 0 and before input into the classifier.
Source
Method
Inc-v3
Inc-v4
Inc-Res-v2
Res-152
DN-121
GoogleNet
VGG-16
CGNC-P
56.80*
19.15
22.06
10.56
13.14
14.56
3.41
Inc-v3
Dual-Flow-P
86.55*
81.20
74.55
74.55
70.66
76.15
55.10
Dual-Flow-A
99.12"
95.31
92.79
97.39
96.80
95.62
87.95
CGNC-P 23.61
25.72
39.07
$8.29"
39.09
37.47
Res-152
Dual-Flow-P
68.45
81.48
78.26
86.29"
80.44
74.59
55.35
Dual-Flow-A
94.38
96.60
94.62
99.19"
97.92
93.54
90.85
Semantic Adversarial Attack. We compared the adversarial perturbations generated by our method and those produced by the state-of-the-a multi-target attack method, CGNC[[7]. As illustrated in Figure the visual results indicate that while CGNC's perturbations contain some semantic features of the target class, they are primarily confined to small, repetitive patterns. contrast, our method generates perturbations that are semantically more representative of the complete target class.
To further validate this observation, we directly input the adversarial perturbations generated by CGNC and our method into the target classifier. As shown in Table our adversarial perturbations alone can induce the classifier to predict the target class with a relatively high probability. Conversely, the perturbations produced by CGNC exhibit lower likelihood, particularly when transferred to black-box models. This demonstrates that our perturbations incorporate more semantic features of the target class.
31

---

Moreover, as depicted in Figure 2 the unclipped samples generated by our method are semantically very close the target class. We also input these unclipped samples directly into the target classifier. Table 15 shows that these samples are highly likely to be classified as the target class. This confirms that semantic proximity to the target class effectively increases attack success rates.
These findings collectively suggest that our attack method's robustness and transferability result from embedding substantial target class semantics into the images, thereby reducing dependence on specific target model decision boundaries.
J More Visualization
Scx
Combination
Rerometer
Figure Visualization results of different input images targeting various classes. For each text prompt of the target class, the left column displays the adversarial examples generated before clipping, the middle column shows the adversarial examples after clipping, and the right column presents the corresponding adversarial perturbations, which represent the differences between the clipped adversarial examples and the original images. Note that the perturbations are scaled to range between 0 and 1. The source model used is Inc-v3.
K Limitations
While our proposed Dual-Flow framework demonstrates strong adversarial attack performance and transferability, several limitations remain. First, the training process involves additional computational overhead compared to some simpler attack methods, which may affect scalability to extremely large datasets or models. Second, although we observe improved semantic consistency in generated perturbations, there is still room to enhance the interpretability and controllability of adversarial patterns in more complex scenarios. Lastly, our evaluations focus primarily on standard image classification benchmarks; extending the approach to other tasks or modalities warrants further investigation.
L Statistical Significance
To rigorously evaluate the reliability of our attack success rates, we partitioned the test dataset into 5 disjoint subsets, each containing 200 images. We computed the attack success rate for each subset independently and derived the overall 95% confidence intervals (CIs) for our method. These confidence intervals provide quantitative measure of variability and statistical uncertainty. We further compared our results against the baseline method by examining the overlap of their respective confidence intervals. As shown in Table T6 the non-overlapping intervals observed in our experiments indicate that the improvement in attack success rate achieved by our method statistically significant with high confidence.
32

---

Table 16: Attack success rates with 95% confidence intervals over 5 data splits, compared to the baseline method. The source model is Res- 152.
Method
Inc-v3
Inc-v4
Res-22
DN-121
GoogleNet
VGG-16
CGNC
53.391:2.77
51.53:1252 71.9213.27
34.2411.772 56.1013.31
85,66:11.53
62.23:12.00
63.36112.95 67.5911.228
Dual-Flow
69.58.13.70
85.73
73.65422.83
M
Societal Impacts
Our work contributes a deeper understanding of adversarial vulnerabilities in deep learning models, which is essential for improving model robustness and security. By developing more effective attack methods, we provide valuable tools for evaluating and strengthening defenses against malicious exploitation. However, as with any adversarial technique, there is potential risk of misuse in compromising AI systems. We advocate for responsible use of such methods strictly within research and security auditing contexts, and encourage the community to develop corresponding mitigation strategies to safeguard AI applications.
33


Reviews:
[{"review_id": "nojaERYAzU", "reviewer": "Reviewer_iNaw", "summary": "This paper introduces Dual-Flow, a novel framework for generating multi-target, instance-agnostic adversarial attacks with high transferability in black-box settings. The method integrates a pretrained diffusion model (forward flow) with a trainable reverse flow, optimized via a new Cascading Distribution Shift Training algorithm. This reverse flow is designed to refine perturbations toward a target class using ODE-based integration. The method is empirically shown to outperform previous state-of-the-art attacks in both black-box transferability and robustness against defenses, particularly in multi-target settings.", "questions": "Please address the questions highlighted in the weaknesses.", "limitations": "No", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n\n1. **Innovative Dual-Flow Architecture:**  \n   The separation of forward and reverse flows—leveraging pretrained diffusion and a fine-tuned LoRA-based velocity function—is conceptually elegant and practically effective for structured adversarial perturbation.\n\n2. **Cascading Distribution Shift Training:**  \n   This novel optimization strategy addresses the difficulty of training with in-the-wild trajectories and enables progressive, semantically meaningful perturbation refinement.\n\n3. **Strong Empirical Results:**  \n   The method demonstrates significant improvements (e.g., +34.58% success rate from Inc-v3 to ResNet-152) over existing multi-target generative attacks across multiple black-box and robust models.\n\n## Weaknesses\n\n1. **Limited Architectural Diversity in Transfer Evaluation:**  \n   - Two surrogate models, ResNet-152 and Inception-v3, are used in training, and all target models are CNN-based. The method’s effectiveness against architecturally diverse models (e.g., Vision Transformers) is not evaluated. If the target model differs significantly from the surrogate models, transferability may be substantially reduced.  \n   - There is no detailed ablation study comparing the individual versus combined contributions of the two surrogate models. This limits the generalizability of the claimed transferability.\n\n2. **Training Cost and Practical Scalability:**  \n   While the Dual-Flow framework is positioned as a scalable alternative to single-target generative attacks, the actual training cost undermines this motivation. According to the paper:  \n   - Training the multi-target model (for 8 target classes) takes approximately 1 day on 2 RTX 3090 GPUs (about 48 GPU-hours).  \n   - In contrast, training a single-target model requires about 4 hours on 1 GPU, so training 8 single-target models would take roughly 32 GPU-hours in total.  \n   Thus, multi-target training is actually more expensive than training individual single-target models, despite the higher architectural complexity and parameter sharing across classes. This contradicts the presumed efficiency advantage of multi-target approaches and raises concerns about practical scalability, especially when extending to more target classes or higher input resolutions.  \n   Moreover, Table 2 shows that single-target fine-tuned variants (Dual-Flow†) actually outperform the multi-target model, indicating that the multi-target setup sacrifices both efficiency and performance for flexibility. The paper does not fully address or justify this trade-off.\n\n3. **No Limitation Section:** The paper claims to discuss its limitations in the Appendix, but no such section or detailed discussion is provided.\n\n4. **Terminology Confusion Regarding “Victim Model”:**  \n   - Algorithm 1 refers to the training model \\( f \\) as the \"victim model,\" which is used to compute gradients.  \n   - However, in a true black-box setting, attackers do not have access to victim gradients.  \n   - This introduces confusion: in reality, \\( f \\) should be a surrogate model, not the actual target. This inconsistency should be clarified.", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful review and detailed feedback on our paper. Below, we address the key points you raised:\n\n## Limited Architectural Diversity in Transfer Evaluation\n- As you correctly pointed out, it is important to validate the transferability of our method across models with significantly different architectures. We have already provided this content in the appendix submitted as supplementary materials, specifically in Appendix E. We tested the attack success rates from Res-152 to various Transformer architecture models. We have reproduced these data in the table below, which demonstrates that our method remains effective for transfer between models with substantially different architectures.\n\n| Method | ViT-B/16 | CaiT-S/24 | Visformer-S | DeiT-B | LeViT-256 | TNT-S |\n|:----------:|:------------:|:-------------:|:---------------:|:----------:|:-------------:|:----------:|\n| C-GSP      | 11.78        | 32.00          | 36.60            | 35.58      | 37.85         | 31.00         |\n| CGNC       | 19.46        | 54.56         | 58.70            | 59.90       | 57.53         | 48.40       |\n| Dual-Flow  | **36.39**        | **74.24**         | **76.72**           | **78.50**       | **79.34**         | **67.86**      |\n\n- Thank you for your suggestion, we will include detailed analysis and experiments for two different surrogate models in the final version. Currently, we know that transfer between structurally similar models is easier. For example, transfer from Inc-v3 to Inc-v4 is easier compared to Res-152. We will conduct further analysis in the future.\n\n## Training Cost and Practical Scalability\n- Thank you for your consideration regarding efficiency. We apologize if our description may have caused misunderstanding. In fact, the single-target variants we proposed in the paper are obtained through **further fine-tuning** of models that were previously trained under multi-target settings. That is to say, to obtain single-target models for all 8 classes, the actual computational cost required is 48+32=80 GPU hours, rather than only 32 GPU hours. Therefore, it cannot be said that multi-target training is more expensive than individual target models.\n- This also explains why our single-target variants achieve higher attack success rates than multi-target models: if there were no performance improvement, the additional 32 GPU hours would be wasted. In other words, further fine-tuning on single targets is precisely to improve success rates. Of course, your concern about the trade-off between flexibility and performance is very meaningful. Regarding this aspect, we have some explanations in Section 4.2. Specifically, our model can still achieve performance exceeding baselines (which are all single-target models) even without further fine-tuning on individual target classes. The single-target variants are only for fair comparison settings.\n- Additionally, you can observe the performance improvement that the baseline (CGNC) achieves after single-target fine-tuning. It can be seen that the performance difference between our multi-target model and single-target model is smaller. This indicates that the impact of our method's flexibility on performance is relatively small.\n\n| Source | Dual-Flow | Dual-Flow$^{\\dagger}$ | CGNC | CGNC$^{\\dagger}$ |\n|:---:|:---:|:---:|:---:|:---:|\n|Inc-v3|73.96|76.79|52.80|70.00|\n|Res-152|70.76|76.12|58.40|68.84|\n\n- Additionally, our multi-target model requires 48 GPU hours for training. Through our actual testing on the same RTX 3090, the baseline CGNC requires 250 GPU hours for training. This also demonstrates that we have lower training overhead.\n\n## No Limitation Section\nThank you for your concern about the Limitation section of our paper. In fact, our appendix is provided in the supplementary materials, and the Limitation Section is located in Appendix I.\n\n## Terminology Confusion Regarding \"Victim Model\"\nThank you for your very important suggestion regarding our terminology. As you correctly pointed out, since our goal is black-box attacks, it is inappropriate to refer to ($f$) in Algorithm 1 as \"victim model\". We will modify it to \"surrogate model\" in the final version.\n\nWe value your insights and believe they will significantly enhance our work's clarity and impact."}, {"review_id": "r6zpyuQE5w", "reviewer": "Reviewer_yjD2", "summary": "The paper tackles the problem of transferable multi-target instance-agnostic adversarial attack. To do so, it leverages the generative power of diffusion models via a Dual-flow framework. Specifically, it combines a pre-trained diffusion model and a LoRA-based adversarial velocity function. It also proposes the Cascading Distribution Shift Training, which is designed to improve the efficacy of adversarial attack. The proposed method outperforms existing multi-target adversarial attacks in diverse settings.", "questions": "N/A", "limitations": "Yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper proposes a novel concept of applying flow-based ODE velocity for adversarial attacks.\n2. The paper achieves state-of-the-art performance on multi-target adversarial attack.\n3. The paper provides an extensive number of empirical evaluations on the proposed attack.\n\nWeaknesses:\n1. The visualizations in Fig. 2 show that the perturbations are highly visible. Also, these perturbations seem to be semantically structured and resemble features of the target class. This suggests that the attack may rely on large, structured perturbations rather than subtle changes. The paper needs more visualization and evaluation on smaller perturbation budgets where such semantic structures would be less visible.\n2. The paper lacks evaluation on transferability across CNN-based and transformer-based models, which are more popular recently. How does the transferability of the attack perform across these models with larger discrepancies?", "was_revised": true, "final_justification": "My original concerns were on the validity of the proposed method under more difficult attack settings (i.e., lower perturbation bounds). The results provided in the rebuttal has shown the superiority of the proposed method under more difficult settings, which addresses my concern.", "rebuttal": "Thank you for your thoughtful review and detailed feedback on our paper. Below, we address the key points you raised:\n\n## Evaluation on Smaller Perturbation Budgets\n- Thank you for your suggestion. Unfortunately, due to NeurIPS mechanisms this time, we are unable to further demonstrate visualization effects to you. We have conducted such tests: for different original images, we input the same target class prompt and observe the resulting adversarial perturbations. It can be seen that the perturbations are highly dependent on the structure and layout of the original image, rather than being solely determined by the target class prompt. In other words, the mechanism by which our attack works is not simply adding target class structure and semantic information to the original image.\n- We chose $\\epsilon=16/255$ following the default setting used in previous work on the NIPS 2017 dataset to ensure direct comparability. However, we agree that evaluating adversarial perturbations at smaller budgets is important for enhancing visual stealthiness.\nTo address your suggestion, we conducted experiments at lower perturbation budgets for black-box targeted attacks. We used the $\\epsilon=16/255$ versions of these models and clipped the generated samples to meet the $\\epsilon=8/255$ and $\\epsilon=4/255$ limits. For Logit and SU, we regenerated adversarial perturbations under the new budgets.\nThe results are shown below. Values before the slash represent $\\epsilon=8/255$, and values after the slash represent $\\epsilon=4/255$. Our method demonstrates superior black-box transferability compared to baseline methods.\n\nMethod|Inc-v4|Inc-Res-v2|Res-152|DN-121\n:---:|:---:|:---:|:---:|:---: \nLogit|1.40/0.50|1.01/0.28|0.90/0.24|0.90/0.26\nSU|1.56/0.30|1.01/0.26|0.93/0.28|1.00/0.31\nCGNC|13.33/0.29|6.54/0.07|6.95/0.16|14.65/0.26\nDual-Flow|23.86/2.74|14.04/1.18|21.21/1.46|27.68/2.18\n\nReducing the perturbation budget makes adversarial attacks more difficult, especially for combined black-box and target attacks, which remains a challenge in adversarial research. Enhancing attack effectiveness under subtle conditions is valuable. We plan to explore this further to develop techniques that remain effective while being less perceptible to the human eye.\n\n## Transferability across CNN-based and Transformer-based Models\nAs you correctly pointed out, it is important to validate the transferability of our method across models with significantly different architectures. We have already provided this content in the appendix submitted as supplementary materials, specifically in Appendix E. We tested the attack success rates from Res-152 to various Transformer architecture models. We have reproduced these data in the table below, which demonstrates that our method remains effective for transfer between models with substantially different architectures.\n\n| Method | ViT-B/16 | CaiT-S/24 | Visformer-S | DeiT-B | LeViT-256 | TNT-S |\n|:----------:|:------------:|:-------------:|:---------------:|:----------:|:-------------:|:----------:|\n| C-GSP      | 11.78        | 32.00          | 36.60            | 35.58      | 37.85         | 31.00         |\n| CGNC       | 19.46        | 54.56         | 58.70            | 59.90       | 57.53         | 48.40       |\n| Dual-Flow  | **36.39**        | **74.24**         | **76.72**           | **78.50**       | **79.34**         | **67.86**      |\n\nWe value your insights and believe they will significantly enhance our work's clarity and impact."}, {"review_id": "ZWdED9izoS", "reviewer": "Reviewer_kcN4", "summary": "This paper introduces Dual-Flow framework for multi-target instance-agnostic adversarial attacks, utilizing Cascading Distribution Shift Training to develop an adversarial velocity function.", "questions": "The questions are the same as those mentioned in the weaknesses.", "limitations": "Please see the weaknesses.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\nThe topic of this paper is both interesting and important. The combination of a frozen diffusion ODE with a learnable reverse flow is conceptually appealing.\n\n\nWeaknesses:\n\n1. The selection of victim models is not clearly explained. It is unclear whether the victim models used in this paper are the same as those adopted in other baseline methods. The authors do not report the clean accuracy of the original classifiers, whether adversarially trained or not. In addition, the training details and procedures of these models are not provided and should be made transparent. Similarly, the selection of robust models and their relevant configurations should also be clearly stated.\n\n2. The baseline methods selected by the authors are not very recent. For example, the CGNC method used for multi-target generative attacks is from 2023. The authors should include more recent baseline methods from the past two years for a fair and up-to-date comparison.\n\n3. The baseline methods reported in Table 2 are fewer than those in Table 1. However, many methods applicable to multi-target attacks can also be adapted to the single-target setting. The authors should align the methods used in both tables for consistency. Additionally, the evaluation of the proposed method on adversarially trained models in the single-target setting is missing and should be included.\n\n4. Only two input preprocessing defense methods (Gaussian smoothing and JPEG compression) are considered in the main paper. The authors should include more recent and advanced defense methods published in the past two years for a more comprehensive comparison.\n\n5. The training efficiency of the proposed method is not reported. There is no comparison in training time or parameter count with baselines such as C-GSP or CGNC. Given that the multi-target model requires one day of training on dual RTX 3090 GPUs, such a comparison is necessary to evaluate cost-effectiveness.\n\n6. The selection criteria for target classes in multi-target and single-target black-box attacks are unclear. The authors should clarify whether these classes were randomly selected or chosen based on vulnerability. In addition, the results only report mean success rates; standard deviation or confidence intervals should be provided to reflect the method’s stability.\n\n7. The paper lacks more comprehensive ablation studies. For example, the number of target classes and the sampling steps should be ablated. Moreover, the effect of different perturbation budgets (e.g., 4/255, 8/255) is not explored. Without this, it is difficult to evaluate performance under low-budget attack constraints. In addition, the ablation experiments should include comparisons with more baseline methods. For example, in Figure 3, only the CGNC method is used for comparison, but other effective baselines should also be included.\n\n8. The authors do not provide a theoretical explanation of why the proposed Dual-Flow sampling is effective in generating adversarial examples. A theoretical analysis should be included to demonstrate why adversarial examples generated in this way exhibit better transferability in black-box settings.", "was_revised": true, "final_justification": "Most of my concerns have been addressed. Therefore, I would like to raise my rating. The authors are suggested to include their rebuttal responses and the additional experiments therein in their revised version.", "rebuttal": "Thank you for your thoughtful review and detailed feedback on our paper. Below, we address the key points you raised:\n\n**1. Victim Models**\n- **We completely follow the settings and models of baseline methods, maintaining complete consistency with them**. For the victim models we used, all models employ the **official weights** provided for the 1000-class ImageNet dataset. For normally trained models, we directly call these models and their weights through the `torchvision` or `timm` libraries. For robust models (adversarially trained models): `Inc-v3-adv` and `IR-v2-ens`, we call their official weights through the `timm` library; for `Res50-SIN`, `Res50-IN`, and `Res50-fine`, we use the weights provided by the open-source project `Texture-vs-Shape`; for `Res50-Aug`, we use the official weights provided by the open-source repository `AugMix`. \n- Since all the classifiers we use are pre-trained with official weights rather than training these models from scratch ourselves, the training details and accuracy information of these models are not reported by us. Thank you for your suggestion, we will supplement these details as much as possible in the final version!\n\n**2. Baseline Methods**\n- Thank you for your suggestion regarding the timeliness of baseline methods! We would like to point out that the CGNC method you mentioned was published at ECCV 2024. Unfortunately, for generative Instance-Agnostic Attacks methods, as of our paper submission deadline, we were unable to find more recent comparable open-source methods.\n\n\n**3. Content Reported in Tables**\n- Thank you for your careful observation! However, we must point out that those instance-specific attacks do appear in Table 1 but not in Table 2, but this is actually because for these methods, there is no distinction between multi-target attacks or single-target attacks, since their attacks do not involve training a model. In other words, these methods in Table 2 would only have exactly the same values as in Table 1. We did not show these methods in Table 2 for space-saving considerations.\n- Taking Res-152 as the surrogate model as an example, we present the complete table here.\n\n\n\n| Method | Inc-v3 | Inc-v4 | Inc-Res-v2 | Res-152 | DN-121 | GoogleNet | VGG-16 | Average |\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n| MIM | 0.50 | 0.40 | 0.60 | 99.70* | 0.30 | 0.30 | 0.20 | 0.38 |\n| TI-MIM | 0.30 | 0.30 | 0.30 | 96.50* | 0.30 | 0.40 | 0.30 | 0.32 |\n| SI-MIM | 1.30 | 1.20 | 1.60 | 99.50* | 1.00 | 1.40 | 0.70 | 1.20 |\n| DIM | 2.30 | 2.20 | 3.00 | 92.30* | 0.20 | 0.80 | 0.70 | 1.53 |\n| TI-DIM | 0.80 | 0.70 | 1.00 | 90.60* | 0.60 | 0.80 | 0.50 | 0.73 |\n| SI-DIM | 4.20 | 4.80 | 5.40 | 90.50* | 4.20 | 3.60 | 2.00 | 4.03 |\n| Logit | 10.10 | 10.70 | 12.80 | 95.70* | 12.70 | 3.70 | 9.20 | 9.87 |\n| SU | 12.36 | 11.31 | 16.16 | 95.08* | 16.13 | 6.55 | 14.28 | 12.80 |\n| GAP | 30.99 | 31.43 | 20.48 | 84.86* | 58.35 | 29.89 | 39.70 | 35.14 |\n| CD-AP | 33.30 | 43.70 | 42.70 | 96.60* | 53.80 | 36.60 | 34.10 | 40.70 |\n| TTP | 62.03 | 49.20 | 38.70 | 95.12* | 82.96 | 65.09 | 62.82 | 60.13 |\n| DGTA-PI | 66.83 | 53.62 | 47.61 | 96.48* | 86.61 | 68.29 | 69.58 | 65.42 |\n| CGNC$^{\\dagger}$ | 68.86 | 69.45 | 45.71 | 98.61* | **91.14** | 69.83 | 68.05 | 68.84 |\n| Dual-Flow | 69.58 | 71.92 | 56.10 | 92.39* | 85.73 | 73.65 | 67.59 | 70.76 |\n| Dual-Flow$^{\\dagger}$ | **72.25** | **74.35** | **58.44** | 93.65* | 87.61 | **75.45** | **71.11** | **76.12** |\n\n- Regarding the evaluation of our method on adversarially trained models in the single-target setting, we did not include this content due to considerations of the overall paper length and focus. Thank you for your suggestion, we will include this content in the final version!\n\n\n**4. Input Preprocessing Defense**\n- Thank you for your suggestion on this! We included Gaussian smoothing and JPEG compression in the main text, and included experiments on DiffPure in the appendix.  The experimental results are presented in the table below, where we show the attack success rates of our method under various DiffPure $t^*$ settings and compare them with baseline methods (using ResNet-152 as the white-box model). As illustrated in the table, baseline methods are easily nullified by the purification process, whereas our method maintains a significant success rate. This further demonstrates the robustness of our approach.\n\n| $t^*$ | Method    | Inc-v3 | Inc-v4 | Inc-Res-v2 | Res-152 | DN-121 | GoogleNet | VGG-16  |\n|:----:|:---------:|:------:|:------:|:----------:|:-------:|:------:|:---------:|:-------:|\n| 0.05 | CGNC      | 16.26  | 19.91  | 8.53       | 67.76   | 49.81  | 21.79     | 29.81   |\n| 0.05 | Dual-Flow | 49.60  | 51.92  | 37.56      | 79.50   | 70.20  | 51.30     | 52.26   |\n| 0.1  | CGNC      | 2.41   | 2.96   | 1.25       | 14.65   | 10.10  | 3.46      | 4.59    |\n| 0.1  | Dual-Flow | 24.31  | 25.32  | 18.76      | 48.05   | 39.81  | 25.06     | 24.78   |\n| 0.15 | CGNC      |  0.47  |  0.46  |  0.34      | 1.84    | 1.46   |   0.62    | 0.92    |\n| 0.15 | Dual-Flow |  7.20  | 7.87   |  5.89      | 16.70   | 13.72  |   7.71    |  8.34   |\n\n- We will continue to add updated defense methods in the final version to further improve the comprehensiveness of our comparison.\n\n**5. Training Efficiency**\n- Thank you very much for your suggestion on this! Here we tested the training time required for the baseline methods `C-GSP` and `CGNC` on multi-target attack tasks using the same RTX 3090 GPUs as ours. Specifically, we require one day of training on two RTX 3090 GPUs, corresponding to 48 GPU hours, while this number is 50 GPU hours for `C-GSP` and 250 GPU hours for `CGNC`. This demonstrates that our model achieves superior baseline performance while maintaining excellent training efficiency. We will include this content and more detailed analysis in the final version.\n\n**6. Target Classes Selection and Method Stability Reporting**\n\n- Regarding the selection of target classes, to facilitate comparison with baselines, we follow previous work that used the NeurIPS 2017 adversarial competition dataset. Consistent with these works, we select 8 fixed target classes: `150, 426, 843, 715, 952, 507, 590, 62`.\n- Thank you for your suggestion on method stability evaluation! We have provided relevant content in Appendix J. We computed 95% confidence intervals (CIs) for our method. As shown in the table below, the non-overlapping intervals observed in our experiments indicate that the improvement in attack success rate achieved by our method is statistically significant with high confidence.\n\n\n| Method | Inc-v3 | Inc-v4 | Inc-Res-v2 | DN-121 | GoogleNet | VGG-16 |\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n| CGNC | 53.39±2.77 | 51.53±2.52 | 34.24±1.72 | 85.66±1.53 | 62.23±2.20 | 63.36±2.95 |\n| Dual-Flow | 69.58±3.70 | 71.92±3.27 | 56.10±3.31 | 85.73±1.57 | 73.65±2.83 | 67.59±2.28 |\n\n**7. Ablation Studies**\nThank you for your suggestion regarding more comprehensive ablation studies! In addition to the main text, we provide some additional ablation experiments in the appendix (supplementary materials). Regarding your points:\n- For the number of target classes, we will complete this experimental content in the final version according to your suggestion as much as possible.\n- For sampling steps, we already have some experiments in Figure 4. Of course, we can find ways to complete this content more thoroughly. Thank you for your suggestion!\n- For the effect of lower perturbation budgets. This is a very good suggestion! We chose $\\epsilon=16/255$ following the default setting used in previous work on the NIPS 2017 dataset to ensure direct comparability. However, we agree that evaluating adversarial perturbations at smaller budgets is important for enhancing visual stealthiness.\nTo address your suggestion, we conducted experiments at lower perturbation budgets for black-box targeted attacks. We used the $\\epsilon=16/255$ versions of these models and clipped the generated samples to meet the $\\epsilon=8/255$ and $\\epsilon=4/255$ limits. For Logit and SU, we regenerated adversarial perturbations under the new budgets.\nThe results are shown below. Values before the slash represent $\\epsilon=8/255$, and values after the slash represent $\\epsilon=4/255$. Our method demonstrates superior black-box transferability compared to baseline methods.\n\nMethod|Inc-v4|Inc-Res-v2|Res-152|DN-121\n:---:|:---:|:---:|:---:|:---: \nLogit|1.40/0.50|1.01/0.28|0.90/0.24|0.90/0.26\nSU|1.56/0.30|1.01/0.26|0.93/0.28|1.00/0.31\nCGNC|13.33/0.29|6.54/0.07|6.95/0.16|14.65/0.26\nDual-Flow|23.86/2.74|14.04/1.18|21.21/1.46|27.68/2.18\n\n- For the suggestion of ablation experiments with more baseline methods. We will include this content in the final version as much as possible.\n\nThank you again for your detailed suggestions!\n\n**8. Theoretical Explanation**\n\nThank you for your suggestion! We will further include more detailed theoretical analysis in the final version. We have some explanations in Appendix G. Additionally, we believe that the generator constrains feasible perturbations to a low-dimensional manifold (determined by network parameters), which acts as a form of strong regularization. This makes it easier to find \"wide\" and stable adversarial regions rather than narrow edge solutions, making it less sensitive to small changes. This helps reduce dependence on any single decision boundary shape (i.e., on the surrogate model) and improves success rates under defenses/randomization. We will add more theoretical analysis content as much as possible in the future, thank you again!\n\nWe value your insights and believe they will significantly enhance our work's clarity and impact."}, {"review_id": "9DqOgtCHaj", "reviewer": "Reviewer_yoB3", "summary": "The paper introduces Dual-Flow, a novel framework for generating transferable, multi-target adversarial attacks in black-box settings. Unlike existing methods that struggle with low transferability or high computational costs, Dual-Flow leverages a two-stage flow-based approach: 1) Forward Flow: Uses a pretrained diffusion model to create an intermediate perturbed distribution; 2) Reverse Flow: Fine-tunes a LoRA-based velocity function for targeted adversarial refinement.", "questions": "- Are there any plans to extend the Dual-Flow framework to other domains or types of data beyond the current focus on image classification?\n- Besides the attack success rate, could the authors consider including additional metrics (e.g., precision, recall) to provide a more comprehensive evaluation of the method's performance?", "limitations": "yes", "rating": 4, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- The introduction of the Dual-Flow framework is a significant advancement, combining diffusion models with adversarial velocity functions for improved attack performance. The dual-flow pipeline (forward + reverse) elegantly balances perturbation generality and specificity.\n- Propositions and theorems (e.g., cascading improvement in adjoint timesteps) provide a solid foundation for the approach.\n- The authors provide extensive experiments demonstrating the effectiveness of their method across multiple benchmarks, showing clear improvements in attack success rates.\n\nWeaknesses:\n- The Dual-Flow framework may be complex for practical implementation, which could limit its accessibility for practitioners in the field.\n- The paper could benefit from a more detailed analysis of the computational costs associated with the proposed method compared to existing approaches.\n- Focused solely on image classification. Extensions to other domains (e.g., object detection, NLP) are unexplored but noted as future work.", "was_revised": true, "final_justification": "Most of my concerns have been addressed, so I am willing to maintain my original positive score.", "rebuttal": "Thank you for your thoughtful review and detailed feedback on our paper. Below, we address the key points you raised:\n\n**The Dual-Flow framework may be complex for practical implementation, which could limit its accessibility for practitioners in the field.**\nWe appreciate you raising this important point. While the conceptual framework involves two flows, the practical implementation is designed to be modular and manageable. Our approach hinges on two main components:\n\n1. A Pre-trained Diffusion Model: We leverage a publicly available, off-the-shelf diffusion model (Stable Diffusion), which practitioners do not need to train from scratch.\n\n2. A Lightweight Adversarial Flow: The core of our training is fine-tuning a velocity function using Low-Rank Adaptation (LoRA). LoRA is specifically designed to be parameter-efficient, only requiring the training of a small number of additional parameters. This significantly reduces the complexity and resource requirements compared to training a full model.\n\n\nOnce our LoRA is trained, the inference process is very simple. We can directly use the image-to-image pipeline from existing code repositories (such as `diffusers`) to complete the process. It can be understood as performing DDIM Inversion on the original image, or the process of first adding noise then denoising, to generate adversarial samples.\n\nTo further improve accessibility, we will add a detailed implementation guide in the appendix of our revised manuscript, clarifying the steps and highlighting the framework's modularity.\n\n**The paper could benefit from a more detailed analysis of the computational costs associated with the proposed method compared to existing approaches.**\n\nThank you very much for your suggestion on this! Here we tested the training time required for the baseline methods `C-GSP` and `CGNC` on multi-target attack tasks using the same RTX 3090 GPUs as ours. Specifically, we require one day of training on two RTX 3090 GPUs, corresponding to 48 GPU hours, while this number is 50 GPU hours for `C-GSP` and 250 GPU hours for `CGNC`. This demonstrates that our model achieves superior baseline performance while maintaining excellent training efficiency. We will include this content and more detailed analysis in the final version.\n\n**Focused solely on image classification. Extensions to other domains (e.g., object detection, NLP) are unexplored but noted as future work.**\n\nWe thank the reviewer for these forward-looking comments and question. Indeed, our current work establishes the Dual-Flow framework's effectiveness within the domain of image classification, which is a standard and foundational benchmark for new adversarial attack methods.\n\nWe are very optimistic about the framework's potential for broader applications. The core principle of Dual-Flow—using a general pretrained flow for initial perturbation and a specialized, fine-tuned reverse flow for task-specific optimization—is highly adaptable.\n\n- For object detection, the adversarial loss function in the reverse flow could be modified to suppress or alter bounding box predictions.\n\n- For semantic segmentation, the goal could be to force specific pixels to be misclassified.\n\n- For NLP, since it differs significantly from our domain, we will continue to explore in the future how to apply similar ideas to related tasks.\n\nThese are exciting avenues for future research that we intend to explore. We will emphasize these potential extensions more explicitly in the discussion and conclusion of the revised paper.\n\n**Are there any plans to extend the Dual-Flow framework to other domains or types of data beyond the current focus on image classification?**\n\nSee the previous content.\n\n**Besides the attack success rate, could the authors consider including additional metrics (e.g., precision, recall) to provide a more comprehensive evaluation of the method's performance?**\n\n- We appreciate the suggestion to provide a comprehensive evaluation. For the specific task of targeted adversarial attacks, the Attack Success Rate (ASR) is the most direct and universally adopted metric in the literature. Additionally, we have also included 95% confidence intervals in the appendix for verification.\n\n- The goal of a targeted attack is singular: for a given input image, to mislead a model into predicting one specific, pre-determined target class. Therefore, the outcome for each attack is binary: it either succeeds (the model outputs the target class) or it fails. The ASR, which is the percentage of successful attempts over all tests, precisely captures the efficacy of the method in achieving this goal.\n- Metrics like precision and recall are standard for evaluating the performance of a classifier across a dataset with a ground-truth distribution of multiple classes. However, in our evaluation setting, we are not evaluating a classifier but the success of an attack. There is no concept of \"true positives,\" \"false positives,\" or \"false negatives\" in the traditional sense; there is only \"attack success\" or \"attack failure\" for the chosen target. Using ASR ensures our results are directly and fairly comparable to the established body of work on this topic. We will add a sentence in the experimental setup to clarify the rationale for using ASR as the primary metric in the context of targeted attacks.\n- We will continue to explore adding more metrics in the future to more comprehensively evaluate model performance. Thank you for your suggestion!\n\n\nWe value your insights and believe they will significantly enhance our work's clarity and impact."}]

Author rebuttal:

Meta-review: This paper proposes a novel framework named as Dual-Flow for generating multi-target, instance-agnostic adversarial attacks with high transferability in black-box settings. It combines a pretrained diffusion model (forward flow) with a trainable reverse flow, optimized via a new Cascading Distribution Shift Training method. Experiments demonstrates the effectiveness of their proposed method.

Strengths
- The technology of Dual-Flow Architecture is novel. The separation of a pretrained diffusion model (forward flow) and a LoRA-finetuned velocity function (reverse flow) is conceptually clean and effectively enables structured adversarial perturbations.

- The method significantly outperforms existing approaches on multiple black-box and robust models.

Weakness

- The method uses the diffusion model, which may bring large computational cost. 

In overall, the paper is novel in its technology and effective in its results, overweigh its weakness. I recommend to its acceptance.
Decision: Accept (poster)