Assessing Robustness via Score-Based Adversarial Image Generation
Authors: Marcel Kollovieh
Lukas Gosch
Marten Lienen
Yan Scholten
Leo Schwinn
Stephan Günnemann
Venue: Accepted by TMLR ()

Abstract: Most adversarial attacks and defenses focus on perturbations within small $\ell_p$-norm constraints. However, $\ell_p$ threat models cannot capture all relevant semantics-preserving perturbations, and hence, the scope of robustness evaluations is limited. In this work, we introduce Score-Based Adversarial Generation (ScoreAG), a novel framework that leverages the advancements in score-based generative models to generate unrestricted adversarial examples that overcome the limitations of $\ell_p$-norm constraints. Unlike traditional methods, ScoreAG maintains the core semantics of images while generating adversarial examples, either by transforming existing images or synthesizing new ones entirely from scratch. We further exploit the generative capability of ScoreAG to purify images, empirically enhancing the robustness of classifiers. Our extensive empirical evaluation demonstrates that ScoreAG improves upon the majority of state-of-the-art attacks and defenses across multiple benchmarks. This work highlights the importance of investigating adversarial examples bounded by semantics rather than $\ell_p$-norm constraints. ScoreAG represents an important step towards more encompassing robustness assessments.

Published in Transactions on Machine Learning Research (11/2024)
Assessing Robustness via Score-Based Adversarial Image Generation
Marcel Kollovieh Lukas Gosch1223, Marten Lienen', Yan Scholten* Leo Schwinn Stephan Günnemann123 1.23
m.kollovieh@tun de
'Shooo of Computation, Information and Technology, Technical University of Munich, Munich Data Science Institute, Munich Center for Machine Learning
Reviewed on OpenReview: https: // openreview. net/ formm? id= 70gb6621GG
Abstract
Most adversarial atlacks and defenses focus on perturbations within small fy-norm straints. However, Ep threat models cannot capture all relevant semantics- semantics-prserringg per- turbations, and hence, the scope of robustness evaluations is limited. In this work, we introduce Score-Best Based Adversarial Generation (ScoreAG), a novel framework that leverages the advancements in score-based generative models to generate unrestricted adversarial ex- amples that overcome the limitations of f--norm constraints. Unlike traditional methods, ScoreAG maintains the core semantics of images while generating adversarial examples, ci- ther by transforming existing images or synthesizing new ones entirely from scratch. We further exploit the generative capability of ScoreAG to purify images, empirically enhancing the robustness of classificrs. Our extensive empirical evaluation demonstrates that ScoreAG improves upon the majority of state-of-the-art attacks and defenses across multiple bench- marks. This work highlights the importance of investigating adversarial examples bounded by semantics rather than f--norm constraints. ScoreAG represents an important step wards more encompassing robustness assessments.
1 Introduction
(a) Original
(b) ScoreAG-GAT (Ous)
(c) APGD (l2
(d) APGD (Exo)
Figure 1: Examples of various adversarial attacks on an image of the class "tiger shark' (a). The inset visualizes heatmap of the strength of the corresponding perturbation. Despite the fact that the perturbation generated by ScoreAG-GAT (b) lies outside of common f--orm constraints (Ex = 1188/255 & = 18.47). it is aware of the semanttcc:: removing a small fish to change the predicted label to "hammer shark". This is in stark contrast to APGD (Croce & Hein, 2020b) with matching norm constraints, which either (c) results in highly perceptible and unnatural changes, or (d) fails to preserve image semantics completely. This an example of Generative Adversarial Transformation (GAS), one of the three usc-cascs of ScoreAG.

---

Published in Transactions on Machine Learning Research (11/2024)
Ensuring robustness against noisy data malicious interventions has become major concern in various applications ranging from autonomous driving (Eykholt et al., 2018) and medical diagnostics (Dong et al., 2023) to the financial sector (Fursov et al., 2021). Even though adversarial robustness has received significant research attention (Goodfellow et al., 2014; Madry et al., 2017; Croce & Hcin, 2020b), it is still an unsolved problem. Most works on adversarial robustness define adversarial perturbations lie within a restricted 4-norm from the input. However, recent works have shown that significant semantic changes can occur within common perturbation norms, and that many relevant centanniccs-reserviin corruptions lie outside specific norm ball choices (Tramèr et al, 2020; Gosch et al., 2023). Examples include physical perturbations such as stickers on stop signs (Fykholt et al., 2018) natural corruptions such lighting or fog (Kar et al., 2022; Hendrycks & Dietterich, 2019). This led to the inclusion of a first 4--orm independent robustness benchmark to Robust Bench (Croce et al., 2020), and a call to further investigation into robust beyond b b--uuddddd adversaries (Hendrycks et al., 2022). Thus, in this work, we address the following research question:
How can we generate semantics-preserringg adversarial examples beyond t--norm constraints?
We propose to leverage the significant progress in diffusion models (Sohl-Dicksteinn et al., 2015; Ho et al., 2020) and score-based generative models (Song et al., 2020) in generating realistic images. Specifically, we introduce Score-Based Adversarial Generation (ScoreAG), a framework designed to synthesize adversarial examples, transform existing images into adversarial ones, and purify images. Using diffusion guidance (Dhariwal & Nichol, 2021), ScorcAG can generate mamantics-proserving adversarial examples that are not capturod by common f--norms (see Fig. 1). Overall, ScoreAG represents a novel tool for assessing and enhancing the empirical robustness of image classifiers.
Our key contributions are summarized as follows:
We overcome limitations of lp threat models by proposing ScoreAG, a framework utilizing diffusion guid- ance on pre-trained models, enabling the generation of unrestricted but semantics- semantics-preservnng adversarial examples.
With ScoreAG we transform existing images into adversarial ones as well as synthesize completely new adversarial examples.
We show that ScoreAG enhances classifier robustness by purifying adversarial examples and common corruptions.
We demonstrate ScoreAG's capability in an exhaustive empirical evaluation and show it is able to out- perform a majority of existing attacks and defenses on several benchmarks. Additionally, we underscore ScoreAG's semantic preserving ability in a human study.
2
Background
Score- Basee Generative Modelling. Score-based generative models (Song et al., 2020) are class of generative models based contimuous-time diffusion process {xx)=efo1 accompanied by their correspond- ing probability densities pxx).. The diffusion process progressively perturbs data distribution Xy Po into prior distribution Pt- This transformation is formalized as Stochastic Differential Equation (SDE),
i.e.,
dx, ((xx)))d + g(()dw,
where f(.,t): Rdd the standard Wiener process (i.e., Brownian motion). Furthermore, let (xt x.) describe the transition kernel from x, to X,, where < t.
:Rd + Rd represents the drift coefficient of xt, g()) R + R the diffusion coefficient, and
By appropriately choosing f and Pı asymptotically converges to an isotropic Gaussian distribution, i.c., Pi R NN I). To generate data, the reverse-time SDE needs to be solved:
dx, -f(x,,) g(t)2 Vx, log
(rgpr(x:))er (x:) + g())dw.
(2)
2

---

Published in Transactions on Machine Learning Research (11/2024)
Solving the SDE requires access to the time-dependent score function Vx, log (xx). which is typically unknown. Instead, the score function is estimated using a neural network so sx(x,, (). The parameters of this network are learned by minimizing the following cost function:
Ex (x [[|s (x,, Vx, Po: xo)]l²]
(3)
Here, A()) [0,1] R200 serves as time-dependent weighting parameter, and t is uniformly sampled from the interval [0, 1].
In this formulation, diffusion process at time t. The goal is to train the network Se to accurately match the true score function Vx, log (x, Xn), enabling data generation through the reverse diffusion process, which can be solved using numerical solvers.
~ Po is sampled from the data distribution, and Por xo) follows the
Diffusion Guidance. To enable conditional generation with unconditionally trained diffusion models, Dhariwal & Nichol (2021) introduce classifier guidance. The central idea is to generate samples from the conditional distribution p(xo c), where represents specific class, iee, sampling images of class c. To achieve this, the authors replace the gradient of the unconditional distribution px,x)) in the reverse process (see equation 2) with its conditional counterpart.
By applying Bayes' theorem, the gradient of the conditional gradient can be decomposed as:
Xx, logp(xi c) = Vx, log)(x)) + Vx, logp(c xx),
where Xx, log)(x;) represents unconditional score function and Vx, logp(c xx) represents the guidance score. The unconditional score function is approximated using the neural network Sø, which is trained using the loss in equation 3.
To compute the guidance score Vx, logp(c xt), Dhariwal & Nichol (2021) utilize the gradients of time- dependent classifier f(x,,t) t) with respect to X,. The guidance score steers the generation process towards samples that are consistent with the desired class c. This method allows an unconditional diffusion model, i.e., a model trained without conditional information, to be adapted for conditional lasks, enabling the generation of class-specific samples.
Classifier guidance has since been extended to handle arbitrary conditions c, such guiding generation towards CLIP embeddings (Nichol et al., 2021). This flexibility in choosing different conditions is essential to ScoreAG and enables us to adapt the model for three distinct tasks by adjusting the guidance condition, as described in the next section.
3 Score-Based Adversarial Generation
In this section, we introduce Score-Based Adversarial Generation (ScoreAG), framework employing gen- crative models evaluate robustness beyond the f--norm constraints. ScoreAG is designed to perform the following Uhree tasks: (1) the generation of adversarial images (see Sec. 3.2), (2) the transformation of exist- ing images into adversarial examples (see Sec. 3.3), and (3) the purification of images to enhance empirical robustness of classifiers (see Sec. 3.4).
ScoreAG consists of three steps: (1) select a guidance term for the corresponding task to model the con- ditional score function Vx, log c), (2) adapt the reverso-time SDE with the task-specific conditional score function, and (3) solve the adapted reverse-time SDE for an initial noisy image xi (N(0, I) using numerical methods. Depending the task, the result is either adversarial or purified image. We provide an overview of ScoreAG in Fig. 2.
In detail, the conditional score function is composed of the normal score function Vx, log and the task-specific guidance term Vx, logp(c xx), that is
x, (x; e) Vx, (x + Vx, log xt),
(5)
3

---

Published in Transactions on Machine Learning Research (11/2024)
(1) Select task-specific guidance term Vx, (o to model the conditional score function: Vx, Po
(2) Adapt reverse time SDE dx, [f(x;, g(t)² (xg g(t)dw
(3) Solve adapted reverse-time SDE
ScoreAG
Vx, (o
x1
Sp Sp(x,, 1)
X0
X0
Vx (c((e(
dxx dt
X,
Xx, x, log Pr (xx): Score function
Xx. log Pr )
Guidance term
vx. x. log pr (x] Conditional score function
C : Task specific condition
Figure 2: An overview of ScoreAG and its three steps. ScoreAG starts from noise and iteratively
denoises it into an image It uses the lask-specific guidance terms Vx, log xx) and the score function Xx, logp:(X)) to guide the process towards the task specific condition The network Se is used for approximating the score function Vx, (x;))(x;) and for the one-step Euler prediction &n.
where log (x.)) is modeled by a score-based generative model. Solving the adapted reverso-time SDE yields sample of the conditional distribution p(xo c), i.e., an adversarial or purified image. To simplify the presentation, we will denote conditonniiional functions Py rather than the more verbose p(x; y)-
3.1 Problem Statement.
In the realm of adversarial robustness, traditional evaluation methods often constrain adversarial perturba- tions within an fn-norm ball, providing a limited robustncss assessment. Those limitations are addressed by unrestricted attacks. In this work, we consider the following three key tasks: (1) Generating new adversarial images that inherently belong a specific class y" but are misclassified by the classifier as ÿ; (2) Transform- ing existing images x" into adversarial examples, i.e., images that are misclassified as ÿ (see adversary) while maintaining their semantics and true class y"; and (3) Purifying adversarial images XADV recover correct classification and enhance empirical robustness.
Adversary. Let y" E {l,...,K K} denote the true class of a clean image x E [0, C 7 + y² be a different class, and f(-) [0, [0,1)xxxx + fI....,,K K} a classifier. An image X E [0, 1xxHixx is termed misclassified by f, i.c., f(x) = y + z f(AADV) while preserving the semantics, i.c., ((x) ((xADV) with Q denoting a somantics-describing oracle. Therefore, adversarial examples do not change the true label of the image. To enforce this, conventional adversarial altacks restrict the perturbation to lie in certain f--norm, avoiding large differences to the original image. In contrast, ScoreAG is not limited by fo-norm restrictions but preserves the semantics by employing a class-conditional generative model. In the following, we introduce each task in detail.
an adversarial example
3.2 Generative Adversarial Synthesis
Generative Adversarial Synthesis (GAS) aims to synthesize images that are adversarial by nature. While these images maintain the semantics of certain class y", they are misclassified by a classifier into a different class ÿ. The formal objective of GAS is to sample from the distribution py (xn f û), where f(x)) ÿ corresponds to the guidance condition
Applying Bayes' theorem according to equation 5, the conditional score can be expressed as:
Vx, Pog ptyy (xx (xxo) 5) Vxx log (xx) + Sy Vx, log Pta (f(xo) 7 xx);
(6)
4

---

Published in Transactions on Machine Learning Research (11/2024)
where Sy is scaling parameter adjusting the strength of the attack. While Vx log Pt.. (xx) can be learned with a class-conditional score network (,),,, Vx, log Pt.y" ((a)( = ū x.) requires further analysis. By
marginalizing over Xo and using the Markov property that f(x)) and x, are independent given Xo. we see
that
Pt. (f(x)) = 1 xx) = Exolxtt (x( 5 xo)]
is the expected probability of classifying generated samples xo as class y-
While a direct Monte Carlo approximation to equation 7 is theoretically feasible, drawing samples from the
class-conditional generative model Pt.y (Xo xt) would be expensive. Instead, we approximate pt.y (xo xx)
as Dirac distribution centered on the one-step Euler solution &o to equation 1 from t to 0 & = =x - t dxx which simplifies equation 7 to
dt
Pt,y (xxo = 1 xx) R p(0(2)) = 5 xt).
Thus, we approximate Xx, log Pt.y (f(x)) xx) Xx log (f ÿ xx), which, in practice, corre- sponds to maximizing the cross-entropy between the classification f(xo) of the generated sample and the target class y.
In contrast to Dhariwal & Nichol (2021); our approximation allows us to work with the classifier ʃ directly instead of funing a time-dependent variant. Moreover, this can be adapted to discrete-ting diffusion models with the approach by Kollovich al. (2023).
3.3 Generative Adversarial Transformation
While in GAS we synthesize adversarial samples from scratch, Generative Adversarial Transformation (GAT) focuses on transforming existing images into adversarial examples. For given image x* and its corresponding true class label y", the objective is to sample a perturbed image misclassified as ÿ while preserving the core semantics of x", We denote the resulting distribution as py- (xo fxx) = ÿ. x*) for the guidance condition =xx,, fxxn) = ÿ} leading to the following conditional score (cquation 5):
Vx, log (xe x", fxxo) = 5) Vx, log Pt.y (xx) + Vx, log Pt.g (x" f(xx) x.).
(9)
By assurning independence between x" and ū given Xt, we split the guidance term into 8x Vx, log (x" xx) + sy Vx, Pt. (f(x)) = 5 xt), implying that ÿ should not influence the core semantics of the given image. Note that we introduced the two scaling paramcters 8x and sy to control the possible deviation from the original image and the strength of the attack, respectively. While we treat the score function Vx, log Pt.y (x+) and the guidance term Vx, logpt.." (f(x)) distribution Pt,y (x* xx) as Gaussian centered at the one-step Euler prediction &o (equation 8),
xx) as in the GAS setup, we model the
Pt.y (x"
xx) (x) = N(oo. I).
(10)
It follows that our sampling process searches for an adversarial example while minimizing the squared error between x* and &g. Importantly, this lets us generate samples Xo close to x* without imposing specific by- norm constraints. Furthermore, our framework is not limited to the squared error, but can also utilize other differentiable similarity metrics as guidance such as the LPIPS (Zhang et al., 2018) score. Note that, while adversarial examples generated by ScoreAG are unrestricted in the sense of Ea-balls, they are constrained to the data manifold of the generative model through the construction of our generative process. This yields an wnrestricted attack that preserves the core semantics using the class-conditional score network Sg-
As a result, GAT provides a more comprehensive robustness assessment than traditional tp-threat models. This enhanced assessment capability stems from the inherent properties GAT, which (1) encompasses all semantics- prapttiiiiprreevinnggg adversarial examples within the balballs as captured by the generative model, and (2) includes semantios-pae pressevvnn adversarial examples that conventional fy-threat models do not capture.
5

---

Published in Transactions on Machine Learning Research (11/2024)
3.4 Generative Adversarial Purification
Generative Adversarial Purification (GAP) exlends ScoreAG to counter adversarial attacks. It is designed to purify adversarial images, i.e., remove ad adversarial perturbations through its generative capability to enhance the robustness of machine learning models.
Given an adversarial image XADV that was perturbed to induce a misclassification, GAP aims to sample an image from the data, distribution that resembles the semantics of XADV, which we denote as p(xo XADV) with XADV corresponding the guidance condition c. We model its score function analogously equation 9:
Xx, log (x XADV) = Vx, logp)(x;) + 8x Vx, PogDe(XADV xt);
(11)
where 8x is a scaling parameter controlling the deviation from the input. Note that we omit y" since there is no known ground-truth class label. As previously, we utilize a time-dependent score network Sy to approximate the term Xx, Logg:((.). The term (x(AADV xx) modeled according to equation 10, as before assuming it follows Gaussian distribution with a mean of the one-step Euler prediction &g- Note that ScoreAG, just as other purification methods, cannot detect adversarial images. Therefore, it also needs to preserve image semantics if there is no perturbalion.
4 Experimental Evaluation
The primary objective of our experimental evaluation is to assess the capability of ScoreAG in generating and purifying adversarial examples. More specifically, we investigate the following propcrties of ScoreAG: (1) the ability to syuthesize adversarial examples from scratch (GAS), (2) the ability to transform existing images into adversarial examples (GAT), and (3) the enhancement of classifier robustness by leveraging the generative capability of the model to purify images (GAP). This evaluation aims to provide comprehensive insights into the strengths and limitations of ScoreAG in the realm of adversarial example generation and classifier robustness.
Baselines. In our evaluation, we benchmark our adversarial attacks against a wide range of established methods covering various threat models. Specifically, we consider the fast gradient sign-based approaches FGSM (Goodfellow et al., 2014), DI-FGSM (Xie et al., 2019), and SI-NI-FGSM (Lin et al., 2019). Tn addition, we include Projected Gradient pescent-based techniques, specifically Adaptive Projected Gradient Descent (APGD) and its targeted variant (APGDT) (Croce & Hcin, 2020b). For a comprehensive asscssment, we also examine single pixel, black-box, and minimal perturbation methods, represented by OnePixel (Su et al., 2019), Square (Andrinshchenko et al., 2020) and Fast Adaptive Boundary (FAB) (Croce Hein, 2020a), respectively. Finally, we compare to the unrestricted attacks Composite Adversarial Attack (CAA) (Hsi- ung et al., 2023), PerceptualPGDAttack (PPGD), PastLaggaageeerrepttulltttt 2020), and DiffAttack (Chen et al., 2023a), which is based on latent diffusion. Furthermore, we compare to Adversarial Content Attack (ACA) (Chen et al., 2023c) in App. B.3.!
(LPA) (Laidlaw et al.,
To evaluate the efficacy of ScoreAG in purifying adversarial examples, we conduct several experiments in a preprocessor-bie breprocessor-bbackkoox blackbox setting. For the evaluation, we employ the targeted APGDT and untargeted APGD attacks (Croce & Hein, 2020b) and ScoreAG in the GAS sctup. Our experiments also incorporate the purifying methods ADP (Yoon et al., 2021) and DiflPure (Nie et al., 2022). Additionally, we compare with state-of-the-art adversarial training techniques that partially utilize supplementary data from generative models (Cui et al., 2023; Wang et al., 2023; Peng et al., 2023).
Experimental Setup. We employ three benchmark datasets for our experiments: CIFAR1O, CIFAR100 (Krizhevsky et al., 2009), and TinyImagenct. We utilize pre-trained Elucidating Diffusion Models (EDM) in the variance preserving (VP) setup (Karras et al., 2022; Wang et al., 2023) for image generation. As our classifier, we opt for the well-established WideResNet architecture WRN-28-10 (Zagoruyko & Komodakis, 2016). The classifiers are trained for 400 epochs using SGD with Nesterov momentum of 0.9 and weight decay of 5 x 10-4, Additionally, we incorporate cyclic learning rate scheduler with cosine annealing (Smith
We do not compare to Chen al. (2023h) as their code was not publicly available upon submission and multiple attempts to contact the authors were unsuccessfil
6

---

Published in Transactions on Machine Learning Research (11/2024)
20
Dataset
Accuracy (%6
Dataset
Robust Accuracy (%)
Citar-10
Citar-10
16
Cifar-100
2
60
40
Nor
20
20
=0
2-2 2-2
2
20
Sy =0
2
2
2
2
2
8
10
12
14
16
(a) FID (GAS).
(b) Robust Accuracy (GAS).
(c) Robust Accuracy (GAP).
Figure 3: FID (a) and accuracy (b) for increasing sy scales in the synthesis (GAS) sctup, and robust accuracy (c) for increasing 8x scales in the purification (GAP) setup under APGD attack. Classifier: WRN-28-10. The shaded area shows the 95% C1 over four seeds.
& Topin, 2019) with an initial learning rate of 0.2. To further stabilize the training process, we apply exponential moving average with decay rale of 0.995. Each classifier is trained four limes to ensure the reproducibility of our results, and we report standard deviations with (=). For pretrained classifiers with only one available model, we do not report standard deviations. For the restricted methods, we consider the common norms in the literature lg = 0.5 for CIFAR10 and CIFAR100, & = 2.5 for Tinylmagenet, and fx = 8/255 for all three datasets. For DiffAttack, ACA, and DiffPure we take the implementation of the official repositories, while we use Torchattacks (Kim, 2020) for the remaining baselines. The runtimes for all methods are shown in Tab. 11 in the appendix.
Evaluation Metrics. To evaluate our results, compute the robust accuracy, i.e., the accuracy after an attack. Furthermore, we use the clean accuracy, i.c., the accuracy of a (robust) model without any attack. For the GAS task, we use the FID (Heusel et al., 2017) 7) to assess the similarity between the distribution of synthetic images and the test set, providing a distribution-level measure. Since FID is not suitable for instance-based evaluation, we use the I.PIPS score (Zhang al., 2018) for the GAT task to measure perceptual similarity at the instance level.
4.1 Quantitative Results
Evaluating Generative Adversarial Synthesis. As explained in Sec. 3.2, ScoreAG is capable of synthe- sizing adversarial examples. Fig. 3(a) and Fig. 3(b) show the accuracy and the FID of a WRN-28-10 classifier 8y increases, respectively. Notably, the classifier yields nearly identical performance Sy 0. However, even a minor increase of sy to 0.125 results in substantial reduction in accuracy while maintaining a low FID. Sctting Sy to 1.0 causes the classifier's performance to drop below random guessing levels for the CIFAR10 dataset. Additionally, Fig. 4(a) presents sample images generated at various scales. Notably, increasing &y leads to subtle modifications the images. Rather than introducing random noise, these changes maintain image coherence up scale of sy 0.5. Beyond this point, specifically at sy = 1.0, there is noticeable decline in image quality, as reflected by the FID.
real data when
Since our approach leverages generative model, it enables the synthesis of an unlimited number of ad- versarial examples, thereby providing a more comprehensive robustness assessment. Moreover, in scenarios requiring the generation of adversarial examples, our method allows for rejection sampling at low sy scales, ensuring the preservation of image quality. This is particularly important for adversarial training, where synthetic images can enhance robustness (Wang et al., 2023).
Evaluating Generative Adversarial Transformation. Beyond the synthesis of new adversarial exam- ples, framework allows converting pre-existing images into adversarial ones described in Sec. 3.3. We show the accuracies and LPIPS scores of various attacks in Tab. 1. Notably, ScoreAG consistently achieves 0% accuracy, lower than the f2 and to restricted methods across all three datasets, making it competitive lo APGDT and LPA. This demonstrates ScoreAG's capability of generating adversarial examples. Surprisingly, the other unrestricted diffusion-based method, DiffAttack, yields considcrably lower attack success rates. We attribute this discrepancy the fact that it only leverages the last few iterations of the denoising diffusion process. Finally, observe that the LPIPS scores of AcoreAG comparable to the restricted meth-
7

---

Published in Transactions on Machine Learning Research (11/2024)
By 2 By = By 20
Original
Sx Fx 8x 5x
(a) Synthesis (GAS).
(b) Transform (GAT).
Figure 4: Examples on the CIFAR10 dataset. Fig. 4(a) shows the synthesis (GAS) setup and generates images of the classes "horse", "truck', , and "deer", which are classified as "automobile', "ship', and "horse', respectively, as Sy increases. Fig. 4(b) shows the transformation (GAT) setup and transforms images of the classes "ship", "horse', and "dog', into adversarial examples classified as "ship', "deer', and "cat". For Sx 32, the images are outside of common perturbation norms, i.e., l2 = 0.5 and loe 8/255, but preserve image semantics. We show examples of selected baselines in Fig. 5.
Table 1: Robust accuracy and LPIPS scores for various attacks on CIFARIO, CIFAR100, and TinyImagenel
Best scores are in bold, second best underlined.
Robust Accuracy in % (4)
LPIPS ())
CIFAR1O
CIFAR10D
Tinyhnngeee
CIFAR10
CIFAR100
TinyInagenet
t restricted
(Goodfellow al,, 2014)
31.47.11.39
10.82.1.63
1.4210177
30.2711.41
39.4411.45
180.7612.97
DI-FGSM (Xio et al., 2019)
0.5122054
0.13
0.D120.02
18.9829.68
22.87 22.87=2248
125 725-46699778
SI-N--PGSM (Lin
2019)
3,01++..3
1.20+0.16
0.69++.111
29.57
40.92-4.84
156.27+3.44
APCD (Croce Hein, 2020h)
0.1811..11
0.10
0.1810.03
12.4011.64
12.5211.52
88.1012.20
APGDT (Croce & Hein, 2020b)
0,00+0.00
0.00
0.00-0.00
12.17
11.58+0.53
65.64-1.60
Square Andriushchenko et al., 2020)
0.25.10.34
0.1910.0t
0.51
126
88.43100
127.9311.46
FAB (Croce & Hein, 2020s)
1.67#1.80
0.76
0.11s0.19
0.7820.30
0.15
7.05 09
restricted
APGD [Croce Hein, 2020b)
APGDT (Croce & Hein, 2020b)
0,11+
0.08+o.m1
0.00+0.00
2.51-o01
2.33++0.17
101.13+22.c
Square (Andriushccennko ct al., 2020)
19.6710.27
7.0219 12
1.26110:10
8.54_o.13
10.0610.58
151.4619.58
FAB (Croce
2020s)
0.10=0.01
to restricted
OnePixel (Su sl., 2019)
12.8220.94
59.17
59.4220.3
10.67
13 13.65e0.84
11.08=0.10
Unrestricted
CAA (Haiugg et al., 2023)
43, 13.77
12.8810.41
8.811
1564.621230 23.23
1266. 1266.86188 (06..86.9..00
879.52116.94
PPGD (Laidlaw et al,, 2020)
31.8222.7
39. 76.7662..8
2,7620.10
10.70.20.12
7. 7,232
31. 31.13=2.03
(Laidlaw al,, 2020)
0,01+0.03
0.00
00.008-0.77
DiflAllack (Chen et ol., 2023a)
14.40=a0.9
4. 4.89
2:13
637 89.88923..0 98
626.99 026.9924.08
808. 20.390
ScoreAG (Ours)
0.00+0.00
0.00+0.00
0.00-0.00
4.39-o.15
4.28++0.22
109.11+0.90
SooreAG-LPIIPS (Ours)
0.00
0.01
0.00_0..00
0.63.Lo.03
0.54 02
42.83_3.39
ods, and competitive the minimum perturbation method FAB when applying additional LPIPS guidance (ScoreAG-LPIPS), demonstrating its semantic preserving property. We present results on more classifiers in Tab. 8 and on high-resolution dataset in Tab. 9 in the appendix. In Tab. 2, show the accuracies of APGD, APGDT, and ScoreAG on robust classifiers. Notably, ScoreAG demonstrates considerably superior attack success rate compared to the PGD-based attacks. We attribute this to the more comprehensive ro- bustness assessment of ScoreAG, While most baselines only assess the robustness of adversarial examples on the ép-constrintt border, ScoreAG draws samples from the distribution of semantics- semantics-pressevinng adversarial examples (see Sec. 3.3).
Evaluating Generative Adversarial Purification. Finally, we examine the purification ability of ScoreAG. Tab. 2 shows the purification results for various methods the CIFAR10 dataset. Our results show that ScoreAG consistently achieves saate-ff-hhearrt performance in robust accuracy, outperforming other adversarial purification and training methods. Notably, ScoreAG not only successfully defends at- lacks but also maintains a high level of clean accuracy comparable to that of adversarial training. This demonstrates ScoreAG's capability to preserve the core semantics while effectively neutralizing the impact of adversarial perturbations by projecting samples on the manifold of clean images. Overall, our results indicate that purification methods can defend better against adversarial attacks than adversarial training approaches, which attribute to the preprocessor-blackbox setting. Note that it is not possible to detect
8

---

Published in Transactions on Machine Learning Research (11/2024)
Table 2: CIFAR10 robust accuracy of different adversarial training and purification methods for the attacks APGD, APGDT, and ScoreAG. If multiple threat models exist, denote results as foe/l2. Best purification scores are in bold, best attack success rates are underlined.
Model
Clean Accuracy
APGD
82
APGDT
SoaeAAG-GAT (Ours)
Unrestricted
Archisecture
Adversarial Training
[Cul os al.. 2023)
92.18
70.36
68.43
47.89 45.33 / 38.49
WBN-28-11
(Wang ct al., 2023)
02:44 / 95.16
70.08
84.52
68.04
83,88
WRN 28 10
(Wang al. 2024)
98.25 90.04
78.29
85.65
71.42
85.29
41.52 /
WHN-70-16
(Pong et nl., 2023)
83.27
73.67
71.82
38.87
RaWRN-70-16
Adversarial Purification
ADP (Yorm
83.09
65.45
WRN-28-10
DulPPre al., 2022)
$9.02
87.72
$8.46
$8.30
WRN-28-10
ScoreAG-GAP (Ours)
0.2
01.
1.418
00.25:00.44
$0.89=#0.40
90.74+00.6
WRN-28-10
adversarial examples. Therefore, the purification needs to be applied to all images. However, ScoreAG still achieves a high clean accuracy. We demonstrate its applicability to common corruptions in App. B.4.
Hyperparameter study. We explore the impact of the scale parameters Sy and 8x on accuracy and FID, as depicted in Fig. 3. In Fig. 3(c), examine the efficacy of purification against adversarial attacks of APGD under both l and lx norms across different 8x scales. At 8x O, the generated images without guidance and independent of the input. Therefore, the robust accuracy equals random guessing. As increases, the accuracy improves, reaching a performance plateau at approximately 8x = 10. Increasing further reduces the accuracy as the sampled images start to resemble adversarial perturbations. In practice, we scale 8 by t-
unconditional
Finally, Tab. shows the robust accuracy and median l2 distances across different scale configurations for the CIFAR1O and CIFAR100 datasets. We can observe that increase in 8y leads to reduced classifier accuracy for CIFAR1O, improving the efficacy of the adversarial at- tacks. A rise in 8x, however, increases the accuracy as the generated image closer resembles the original. The median l distance exhibits a similar behavior. While a lower Sy yields no difference for both datasets, increas- ing 8x decreases the modian distances for CIFAR10 and CIFAR100. In Fig. 4(b), show examples across vari- ous 8x scales on the CIFAR10 dataset. Notably, all scales preserve the image semantics and do not display any ob- servable differences. In practice, we iteratively increase
Table 3: Robust accuracy and median & dis- tances for various hyperparamcter configura- tions. Best scores are in bold.
Robust Accuracy
Median fg distance
Dataset
CIPAR10
CIFAR100
CIPAR10 CIFARIOD
48
16
0.10
0.02
1.12
1.09
0.65
5, 48
0.32
0.03
0.49
0.49
64
0.34
0.04
0.43
0.40
By
5, 48
0.22
0.17
0.50
0.49
64
0.24
0.02
0.43
0.40
By 96
48
0.10
0.17
0.31
0.50
5x 96
0.13
0.31
0.35
0.30
the scale 8y the attack is not successful.
4.2 Qualitative Analysis
To investigate the quality of the adversarial attacks, we deploy ScoreAG on the ImageNet dataset (Deng et al., 2009) with a resolution of 256 x 256. We use the latent diffusson model DiT proposed by Peebles & Xie (2022), along with a pre-trained latent classifier from (Kim et al., 2022). The images are sampled using the denoising procedure by Kollovieh et al. (2023) as explained in Sec. 3.2. Note that as the generative process is performed in the latent space, the model has more freedom in terms of reconstruction.
We show example image of tiger shark in Fig. with corresponding adversarial attacks. While the classifier correctly identifies the tiger shark in the baseline image, it fails to do so in the generated adversarial examples. Notably, the bp-bounded methods display noticcable noisy fragments. In contrast, ScoreAG produces clean adversarial examples, altering only minor details while retaining the core semantics most notably, the removal of a small fish which prove to be important classification cues, We provide further examples for GAS in Sec. B.6 and for GAT in Sec. B.7. The synthetic images display a high degree of realism, and the transformed images show visible differences while preserving the semantics of the original image.
9

---

Published in Transactions on Machine Learning Research (11/2024)
4.3 Human Study
To evaluate whether ScoreAG generates mananttis-presevinng adversarial examples, we perform human study on adversarially modified (real) as well as synthetically generated images. For the study, we choose CIFARIO images as it (I) avoids any class-selection bias, whereas high-resolution datasets usually contain many classes only distinguishable by human experts; and (2) is the most commonly used dataset in related work. Hyperparameters are set to produce an interesting regime, where the generated adversarial images are significantly outside common f--norm balls and constitute strong attacks for the classifier in question. In particular, we randomly sample five images from each class generale 50 adversarial examples using 8x 16 and 5y = 48. These adversarial examples have an average fy-norm difference to their clean coun- terparts of 0.68 + 0.24, exceeding the common 22-norm ball constraint of 0.5 (Croce et al., 2020) by on average 36%. For the synthetic examples, we generate 50 images without (sy = 0) and 50 images with guidance (sy = 0. 125), again in a class-balanced fashion. For the adversarial guided synthetic examples, we employ rejection sampling to only consider images that lead to misclassification by the classifier. To ensure high data quality for the study, we used the Prolific platform (Eyal et al., 2021) to employ 60 randomly chosen human evaluators to label the 200 images. To avoid bias, we presented the adversarial examples (syn- thetic modified) before the unperturbed examples and introduced the category "Other don't know'.
We compute human accuracy by choosing the majority vote class of all 60 human evaluators and compare it with the ground truth class. We show the results of the human study in Tab. 4. Notably, humans can still accurately classify 94% of the adversarial modified images despite significantly larger lg distances, establishing almost perfect scmantic preserva- tion for GAT. For GAS, humans classify 70% of the (sue- cessful) synthetic adversarial images correctly. This is lower than for adversarial modification and shows that the genera- tion of completely synthetic semantics prettesrreeeeiing adversarial examples is a harder task than adversarial modification. Still, GAS achieves good semantic preservation, significantly outperforming random guessing (10%). We believe it is critical that semantic preservation of unrestricted attacks is evaluated through human studies done in some carly works (Song et al., 2018; Khoshpasand & Ghorbani, 2020). As this is missing in all related unrestricted attack works used as base- lines in this work, we hope to contribute to establishing this as an evaluation standard, and that our results can serve as interesting baselines for future works.
Table 4: Human study to evaluate the adver- sarial examples of ScoreAG. The human ACC corresponds to the majority vote.
Dataset
Model ACC
Human ACC
Clean
Real
98%
100%
Synthetic
94%
94%
Adversarial
Real
2%
94%
Synthetic
0%
70%
5 Related Work
Diffusion Models. Diffusion models (Sohl-Dickstein et al., 2015; Ho et al., 2020) and score-based gen- erative models (Song et al., 2020) received significant attention in recent years, owing to their remarkable performance across various domains (Kong et al., 2020; Lienen et al., 2023; Kollovich et al., 2023) and have since emerged as the go-to methodology for many generative tasks. Dhariwal & Nichol (2021) proposed diffusion guidance to perform conditional sampling using unconditional models. A recent study has shown that classifiers can enhance their robust accuracy when training on images generated by diffusion models (Wang et al., 2023), demonstrating the usefulness and potential of diffusion models in the robustness domain.
Adversarial Attacks. An important line of work are white-box approaches, which have full access to the model parameters and gradients, such as the fast gradient sign method (FGSM) introduced by Goodfellow et al. (2014). While FGSM and its subsequent extensions (Xie et al., 2019; Dong et al., 2018; Lin et al., 2019; Wang, 2021) primarily focus on perturbations constrained by the foo norm, other whitc-box techniques employ projected gradient descent and explore a broader range of perturbation norms (Madry et al., 2017; Zhang et al., 2019). In contrast, black-bog attacks are closer to real-world scenarios and do not have access to model parameters or gradients (Narodytska & Kasiviswanathan, 2016; Brendel et al., 2017; Andrinshchenko et al., 2020). As ScoreAG-GAT and ScoreAG-GAS rely on the gradients of the classifier compute guidance scores, they are categorized as white-box attacks.
10

---

Published in Transactions on Machine Learning Research (11/2024)
Diffusion-Based Attacks. Two recent works by Chen et al. (2023a) and Xue et al. (2023) propose DiffAt- tack and Dift-PGD, respectively. Dift-PGD performs projected gradient descent in the latent diffussio space to obtain boo-nddd adversarial examples, whereas DiffAttack generates unrestricted adversarial examples by loveraging a latent diffusion model. However, as both methods employ only the final donoising stages of the diffusion process in a similar fashion to SDEdit. (Meng et al., 2021), the adversarial perturbations only incorporate changes of high-level features. Finally, Chen et al. (2023e) implement PGD in the -nom within the latent space of stable diffusion. In parallel, Chen al. (2023b) apply PGD iteratively at each step of the diffusion process and combine it with adversarial inpainting. Unlike previous works, ScoreAG does not rely on PGD in the latent space for its attack and semantic preservation, but solely leverages the diffusion manifold in combination with a task-specific guidance.
Adversarial Purification. In response to the introduction of adversarial attacks, a variety of adversarial purification methods to defend machine learning models have emergod. Early works utilized Generative Adversarial Networks (GANs) Song et al. (2017; 2018); Samangouci al. (2018) and Energy-Based Models (EBMs) (Hill et al., 2020) to remove adversarial perturbations from images. More recent methods have shifted focus towards score-based generative models, like ADP (Yoon et al., 2021), and diffusion models, such as DiffPure (Nic et al., 2022). However, ADP and DiffPure only denoise with small noise magnitudes during the purification process and are thereby limited to correcting high-level adversarial features, whereas ScoreAG traverses the whole diffusion process, providing more flexibility in purifying perturbations. Kang et al. (2023) have recently shown that these purification methods decrease in effectiveness in a white-bos setting by evasion attacks. However, as previously mentioned, we focus on preprocessor black-box attacks, which are more relevant. in real-world problems.
6 Discussion
Limitations and Future Work. Our work demonstrates the potential and capabilities of score-based generative models in the realm of adversarial attacks and robustness. While ScoreAG is able to generate and purify adversarial attacks, some drawbacks remain. Primarily, the evaluation of unrestricted attacks remains challenging. We resolve this limitation by performing a human study and argue that this should become standard. Moreover, the proposed purification approach is only applicable to a preprocesso--llackoo setting, as computing the gradients of the generative process efficiently an open problem.
Conclusion. In this work, we address the question of how to generate unrestricted adversarial examples. We introduce ScoreAG, a novel framework that bridges the gap between adversarial attacks and score- based generative models. Utilizing diffusion guidance and pre-trained models, ScoreAG can synthesize new adversarial attacks, transform existing images into adversarial examples, and purify images, thereby enhancing the empirical robust accuracy of classifiers. Our results indicate that ScoreAG can effectively generate momaaticcs-roserving adversarial images beyond the limitations of the fp-norms. Our experimental evaluation demonstrates that ScoreAG matches the performance of existing state-of-the-art attacks and defenses. We see unrestricted adversarial examples generated by our work vital to achieve holistic view of robustness and complementary to hand- common corruptions (Kar et al,, 2022) classical lp threat models.
Broader Impact This work contributes to the domain of robustness, focusing on unrestricted adversarial attacks. Our framework, ScoreAG, is designed for the generation and purification of adversarial images. While there exists the potential for malicious misuse, we hope for our insights to enhance the understanding of machine learning models' robustness. Moreover, despite the competitive empirical performance of ScoreAG, we advise against relying solely on the algorithm.
Acknowledgments
This paper has been supported by the Munich Center for Machine Learning and by the DAAD program Konrad Zuse Schools of Excellence in Artificial Intelligence, sponsored by the German Federal Ministry of Education and Research, and the German Research Foundation, grant GU 1409/4-1.
11

---

Published in Transactions on Machine Learning Research (11/2024)
References
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query- efficient black-box adversarial attack via random search. In European conference on computer vision, pp. 484-501. Springer, 2020.
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision-basod adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprinl arXiv:1712.04245, 2017.
Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack. arXiv preprint WrXiv2335508892, 2023a.
Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Advdiffuser: Natural adver- sarial example synthesis with diffusion models. In Proceedings of the IERE/CVF International Conference on Computer Vision, pp. 4562 4572, 2023b.
Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. unrestricted adversarial attack. arXiv preprint 100i:22305.1060,, 2023c.
Content- based
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with fast adaptive boundary attack. In International Conference Machine Learning, pp. 2196 2205. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020b.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. Robustbench: standardized adversarial robustness benchmark. arXiv preprint Xtv:2000 09670, 2020.
Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled kullback- leibler divergence loss. arxiv preprinl arXiv:2305. 13948, 2023.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A largo-scale hicrarchical image database, In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. Icce, 2009.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34:8780 (18780-87944, 2021.
Junhao Dong, Junxi Chen, Xiaohua Xie, Jianhuang Lai, and Hao Chen. Adversarial attack and defense for medical image analysis: Methods and applications. arXiv preprint orXiw:2303. 14 183, 2023.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pottern recognition, pp. 9185-9193, 2018.
Peer Eyal, Rothschild David, Gordon Andrew, Evernden Zak, and Damer Ekaterina. Data quality of plat- forms and pancls for online bchavioral rescarch. Behavior Research Methods, pp. 1-20, 2021.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. Tn 2018 TEFE/CVE /CF Conference on Computer Vision and Potlern Recognition, pp. 1625-16344 2018. doi: LLL109/CVV..201S..00
Tvan Fursov, Matvey Morozov, Nina Kaploukhaya, Elizaveta Kovtun, Rodrigo Rivera-Castin Gleb Gusev, Dmitry Babacv, Ivan Kircev, Alexey Zaytsev, and Evgeny Burnaev. Adversarial attacks on deep models for financial transaction records. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp.
2021.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint Xiv: 141 6572, 2014.
12

---

Published in Transactions on Machine Learning Research (11/2024)
Lukas Gosch, Daniel Sturm, Simon Geisler, and Stephan Günnemann. Revisiting robustness in graph machine learning. Xix preprinl ar wrXi:23355008811, 2023.
Dan Hendryeks and Thomas Dietterich. Benchmarking neural nelwork robustness to common corruptions and perturbations. In International Conference on Learning Representations, 2019.
Dan Hendrycks, Nicholas Carlini, John Schulman, and Jacob Steinhardt. Unsolved problems in ml safety, 2022.
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by two time-scale update rule converge to local nash equilibrium. Advances in neural infor- mation processing syslems, 30, 2017.
Mitch Hill, Jonathan Mitchell, and Song-Chun Zhu. Stochastic security: Adversarial defense using long-run dynamics of energy-based models. arXiv preprint arXiv:2005.13525 2020.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840-6857 6851, 2020.
Lei Hsiung, Yun-Yun Tsai, Pun-Yu Chen, and Tsung-Yi Ho. Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations. In IEEE/CVE Conference Computer Vision and Pallern Recognilion, CVPR. IEEE, June 2023.
Mintong Kang, Dawn Song, and Bo Li. Diffattack: Evasion atlacks against diflusion-based adversarial purification. arXiv preprint arXiv:281111614, 2023.
Oguzhan Fatih Kar, Teresa Yeo, Andrei Atanov, and Amir Zamir. 3d common corruptions and data aug- mentation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18963 18974, 2022.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generalive models. Advances in Newral Information Processing Systems, 1196565-225777 2022.
Mehrgan Khoshpasand and Ali Ghorbani. On the generation unrestricted adversarial examples. 2020 50th Annual IEEE/IFU /IFIP International Conference on Dependable Systems and Networks Workshops (DSN- W), pp. 9-15, 2020.
Dongjun Kim, Yeongmin Kim, Wanmo Kang, and Tl-Chul Moon. Refining generative process with discrimi- nator guidance in score-based diffusion models. arXie preprint arXiv:2211.17091, 2022.
Hoki Kim. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arXiv:2010.01950, 2020.
Marcel Kollovich, Abdul Fatir Ansari, Michael Bohlko-Schncider Jasper Zschiegner, Hao Wang, and Yuyang Wang. Predict, refine, synthesize: Self-guiding diffusion models for probabilistic time series forecasting, arXiv preprint ar Xrx:22307. 11494, 2023.
Zhifeng Kong, Wei Ping, Jiaji Huang, Kexin Zhao, and Bryan Catanzaro. Diffwave: versatile diffusion model for audio synthesis. In International Conference on Learning Representations, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. arXiv preprint xxxx:2006..126 12655, 2020.
Marten Lienen, Jan Hansen-Palmus, David Lüdke, and Stephan Günnemann. Generative diffusion for 3d turbulent flows. arXiv preprint arXiv:2306.00 01 776, 2023.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. arXiv preprint arxiv: 908. 06281, 2019.
13

---

Published in Transactions on Machine Learning Research (11/2024)
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint or arXi: Xic:1706. 700600008,, 2017.
Chenlin Meng. Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun- Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. In International Conference on Learning Represenlations, 2021.
Nina Narodytska and Shiva Prasad Kasiviswanathan. Simple black-bor adversarial perturbations for deep networks. arXiv preprint X6v: 06299, 2016.
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, llya Sutskever, and Mark Chen. Glide: Towards photorcalistic image generation and editing with text-guided diffusion models. aiviv preprinl orxiv:2112 202. 10741, 2021.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
William Peebles and Saining Xie. Scalable diffusion models with transformers. arXic preprint W:Xiv:2212.09748 2022.
YuengYun Peng, Weilin Xu, Cory Cornelius, Matthew Hull, Kevin Li, Rahul Duggal, Mansi Phute, Jason Martin, and Duen Horng Chau. Robust principles: Architectural design principles for adversarially robust cnns. Xiv preprint arXiv:2308.162 2023.
Hadi Salman, Andrew Πyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust imagenet models transfer better? Advances Neural Information Processing Systems, 33:3533 3545, 2020.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-gan: Protecting classifiers against adver- sarial attacks using generative models. arXiv preprint 15:5::180000000 2018.
Leslie N Smith and Nicholay Topin. Super-convergence: Very fast training of neural networks using large learning rates. In Artificial intelligence and machine learning for malli-domain operations applications, volume 11006, pp. 369-386. SPIE, 2019.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan,, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamics. In International conference on machine learning, pp. 2256-2265. PMLR, 2015.
Yang Song, Taesup Kim, Sebastian Nowozin, Stefano Ermon, and Nate Kushman. Pixeldefend: Lever- aging generative models to understand and defend against adversarial examples. arXiv preprint AXXiv:7110110600 2017.
Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with generative models. In Advonces Neural Information Processing Systems, volume 31, 2018.
Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.19450 2020.
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828 841, 2019.
Florian Tramèr, Jens Behrmann, Nicholas Carlini, Nicolas Papernot, and Jörn-Henrik Jacobsen. Fundamen- tal tradeoffss between invariance and sensitivity to adversarial perturbations. In International Conference on Machine Learning, pp. 9561-9571. PMLR, 2020.
Jiakai Wang. Adversarial examples in physical world. In IJCAT, pp. 4925 4926, 2021.
14

---

Published in Transactions on Machine Learning Research (11/2024)
Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. arXiv preprinl Wxxi:2302.04000 2023.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVP conference computer vision and pottern recognition, pp. 2730-2739, 2019.
Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion- blased adversarial sample generation for improved stcalthiness and controllability. arXiv preprint arXiv:2205. 16494, 2023.
Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In International Conference on Machine Learning, pp. 12062 12072. PMLR, 2021.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. ar preprint (rXte:1655.071460 2016.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-ofT between robustness and accuracy. In International conference on machine learning, pp. 7472-7482. PMLR, 2019.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586 595, 2018.
15

---

Published in Transactions on Machine Learning Research (11/2024)
A Experimental Setup and Hyperparameters
A.1 Reproducibility
Our models implemented using PyTorch with the pre-trained EDM models by Karras et al. (2022) and Wang et al. (2023), and the guidance scores are computed using automatic differentiation. In Tab. 5 and Tab. 6, we give an overview of the hyperparameters of ScoreAG. For the methods DiffAttack, DiffPure, CAA, PPGD, and LPA, we use the corresponding authors' official implementations with the suggested hyperparameters. For the remaining attacks, we use Adveraaiil--ttacks-yyy with its default paramoters (Kim, 2020).
A.2 Hyperparameters
To train the WRN-28- 10 classifiers, we use the parameters shown in Tab. 5. In Tab. 6, we show the scale parameters used to evaluate the attacks and purification of ScoreAG, i.c., the results shown in Tab. 1, Tab. 2 and Tab. 8. The attacks robust models do sequentially increase the scale sy but use fixed scales of scale of 8x 40 on the robust models. Finally,
8x 48 and Sy 80. For the common corruptions for the EDM sampler we use the default sampling scheduler and parameters by Karras et al. (2022).
Hyperparameter
Value
Number of epochs
400
Optimizer
SGD
Nesterov momentum
0.9
Weight decay
10
Exponential moving average
0.995
Learning rate scheduler
Cyelic with cosine annealing
Tnitial learning rate
0.2
Table 5: Hyperparameters used to train the WRN-28-10 classifiers.
Hyperparameter
Value
CIFARI0
by (GAT)
9x (GAT)
48
by (GAT-LPIPS)
(GAT-LPIPS)
48
SLIIPS (GAT-LPIPS)
(GAP)
10
increments (GAT)
steps (GAP)
steps (GAT)
512
CIFARI00
(GAT)
32
8x (GAT)
(GAT-LPIPS)
32
8x (GAT-LPIPSi
SLPIPS (GAT-LPIPS)
increments
20
steps
TinyImagence
By (GAT)
(GAT)
16
increments
steps
Imagenet- Imagenet-Compptiibee
Sy (GAT)
(GAT)
0.5
increments
steps
1000
Table 6: Hyperparameters used evaluate AcoreAG.
16

---

Published in Transactions on Machine Learning Research (11/2024)
Hyperparameter
Value
mmnn
0.002
max
80
Sahurn
0/4
Smoisn
Table Hyperparameters used for sampling using Alg. 15.
A.3 Pseudocode
We present the pseudocode of ScoreAG in Alg. 15, implementing the sampler proposed by Karras et al. (2022). Here, denotes the scale parameter for the task, while t, and 7 are scheduler parameters retained from the original configuration (see Tab. 7). More specifically, %
v2 1) and
= t<N tkN==
( 1 (mmxx +
o min
Fmnx )), iN =
)
(12)
N
We compute the different guidance scores using equation 6, equation 9, and equation 11.
Algorithm ScoreAG with the sampler of Karras et al. (2022).
1: procedure SCoREAG (x; o), the (o....,N (O1,
2: sample Xy ~ (0, TT)
3: for i : sample & ~ NO, Soiss
1 do
f, f 7iti
& x
x; + / 17 f Es
d, + & (so(x,, f.) + s. Vx, log log (c x:))
8:
x,+1 - x; + (t++1 -i
if 1++1 # then
10:
de + 14+1 (so(xi+1, (141) Vx.1 log (c xx+1))
11: end if
X++1 + & + (t++1 - f.) (5d, + }d)
12:
13:
end for
14: return Xy
15: end procedure
17

---

Published in Transactions on Machine Learning Research (11/2024)
B Additional Results
B.1 Qualitative Comparison of Baselines
In Fig. 5, we visualize adversarial attacks selected baselines for the images Fig. 4.
Original ScoreAG
FAB
Square
CAA
DiffAttack
Figure 5: Examples from the CIFAR10 dataset. The figure presents selected baseline images corresponding to the examples in Fig. 4(b). For ScoreAG-GAT, we used 8x = 48. As basclines, we included FAB (&2 0.5) and Square (ex 8/255) to represent restricted attacks, as they achieve the lowest and highest LPIPS scores, respectively. Additionally, we show the two unrestricted baselines, CAA and DiffAttack.
B.2 Qualitative Effect of the Scale Parameters
To provide a more intuitive understanding of ScoreAG, we show the visual effect of the scale parameters 8x and Sy in Fig. 6 and 7. These visualizations illustrate the effects of the scale parameters 8x and sy. When both scale parameters are to zero, the model behaves as standard diffusion model. Increasing Sx guides the diffusion process toward specific image, which is used in the GAP setup. Increasing 8y introduces adversarial perturbations, allowing the synthesis of adversarial images. When both parameters are greater than zero, the GAT model transforms existing images into adversarial examples.
(a) 8x
(b) 0.125
(c) 8x
(d)
(e) 8x 1.0
Original
Figure 6: Effect of the scale parameter 8x. The images display adversarial images generated by ScoreAG- GAT across different scales 8x on robust WRN-50-2 (Salman et al., 2020) with 8y = 8. For 8x 0, the setup equals the GAS setup and synthesizes an image unrelated the input. As the scale increases, the image gets closer to the original.
B.3 Additional classifiers for adversarial attacks using GAT
To verify the efficacy of ScoreAG and demonstrate its applicability across various architectures, we evaluate the accuracy of GAT on four more pretrained classifiers via PyTorch Hub" for the datasets CIFAR1O and CIFAR100 using the same hyperparameters, i..., scale parameters, as for the WRN-28-10 classifier. We show the adversarial accuracy in Tab. 8, including selected baselines. As we can observe, ScoreAG successfully generates adversarial attacks on various classifiers, reaching accuracies close to 0%. This demonstrates the flexibility of AcoreAG and applicability to arbitrary pre-trained classifiers.
hhttps:/ http:////hhhlooooom//eoooooooooe
18

---

Published in Transactions on Machine Learning Research (11/2024)
(a) Original
(b) Sy
(c) By (d) sy 16
By 32
(f) By 48
Figure Effect of the scale parameter Sy. The images display adversarial images generated by ScoreAG- GAT across different scales Sy on a robust WRN-50-2 (Salman et al., 2020) with 8x 0.25. For sy = 0, the setup equals the GAP setup and synthesizes image without adversarial perturbations. As the scale increases, the adversarial content strengthens, causing the images to diverge further from the original.
Table 8: Adversarial accuracy of ScoreAG for various classifiers on the datasets CIFARIO and CIFAR100.
ResNet-20
ResNet-86
VGG-19
RGGVGG-A2
Datases
CIFARLO CIFAR100
CIFAR10
CIFAR100
CIFARI0
CIFARIOD
CIFARIO
CIFAR100
restricted
FGSM (Goodiellow et sl., 2014]
14.95
4.97
34.33
8.09
29.96
20.87
51.37
10.20
DI-RGSM (Xie 2019)
0.00
0.12
1.06
2.17
2.17
SLNL-FGIM
2019)
2.12
APGD (Crace & Hein, 20206)
0.00
0.01
0.01
0.01
0.14
0.77
0.06
0.77
APGDT (Croce & Hein, 2020b)
0.00
0.00
0.00
0,00
0.00
0.00
0,00
0.00
Square (Andrushchenko
2020)
FAB (Crace Hein, 2020s)
0.29
0.38
0.31
0.35
4.79
2.87
1.58
0.18
restricted
APGD (Crace Hein, 20206)
APGDT (Croce Hein, 2020b)
0.00
0.00
0.00
0.00
0.00
0.00
0.00
0.00
Square (Andriushchenko et al., 2020)
0.00
0.00
0.00
0.00
0.51
0.76
0.42
0.11
FAB (Croce Hein, 2020s)
0.25
0.40
0.30
0.31
4.79
2.67
1.53
0.14
restricted
OnePixal (Su el nl., 2019)
76.39
42.28
81.00
44.60
74.49
45.47
82.79
66.17
Unrestricted
(Haiung
33.75
7.43
PPGD (Laidlaw et al, 2020)
50.93
29.76
43.88
32.52
10.95
29.33
33.14
33.53
LPA (Laidlaw al., 2020)
0.00
0.00
0.00
0.00
0.02
0.30
0.01
0.00
(Ours)
Additionally, evaluate ScoreAG on the high-resolution ImageNNtt- dataset, commonly used subset of ImageNet. We selected two robust classifiers as most attacks achieved 0% accuracy standard classifiers. More specifically, we selected the RaWideResNNetIOO0 50-2 by Salman et al. (2020). We show the results for ScoreAG and selected baselines, including Adversarial Content Attack (Chen et al., 2023c) (ACA), Tab. 9. The restricted basclines have a perturbation distance of bp = 4/255. As we can observe, ScoreAG again achieves competitive performance, i.e., best. and second-
by Peng et al. (2023) and WideResNet-
Table 9: Adversarial accuracy of ScoreAG for robust classifiers on the ImageNet-Compatible dataset.
Salman (2020)
Peng (2023)
restricted
FGSM (Goudfellow et al., 2014)
58.8
66.5
DIFGSM (Xic et al., 2019)
57.6
66.8
SI-NI-FGSM (Lin al., 2019)
74.5
APGD (Crace & Hein, 2020b]
52.2
62.3
APGDT (Croce & Hein, 2020h)
to restricted
OnePixel (Su et al., 2019)
85.3
88.2
Unrestricted
CAA (Hsiung et al., 2023)
10.4
11.9
PPGD (Laidlaw al., 2020)
5.9
18.5
I.PA (Laidlaw et al., 2020)
1.6
8.8
DiffArtack (Chen et al., 2023a)
8.5
ACA (Chen al., 2023c)
4.6
6.5
ScoreAG (Ours)
2.5
4.1
conpetition/dataset.
19

---

Published in Transactions on Machine Learning Research (11/2024)
best accuracies. We show some examples of the unrestricted attacks in Fig. 8. As expected, ScoreAG preserves the semantics of the images and displays high degree of realism. Surprisingly, the other diffusion- based attacks, DiffAttack and ACA, display more noticeable differences. ACA, in particular, has made major changes to the image.
(a) Original.
(b) AcoreAG.
(c) DiffAttack.
(d) ACA.
(c) CAA.
(8) LPA.
Figure 8: Adversarial examples the ImageNet--ompatibbe dataset of various classes for different unre-
stricted attacks.
B.4 Purification of Common Corruptions
In addition to the purification adversarial attacks, we test the applicability of ScoreAG (GAP) on common corruptions (Hendrycks & Dictterich, 2019). We show the robust accuracy of standard and robust classifiers before and after purification using DiffPure and GAP in Tab. 10. Our results show that ScoreAG consistently increases the robust accuracy the base model. Tn 5/7 settings, ScoreAG achieves better accuracy than
20

---

Published in Transactions on Machine Learning Research (11/2024)
Table 10: CIFAR10 robust accuracy of different adversarial training and purification methods for common corruptions CIFAR10. If multiple threat models exist, denote results fo/
Best scores bolds.
Model
Base
DiffPure (Nic et al., 2022)
ScoreAG-GAP (Ours)
Architecture
Standard
75.56.10.41
01.85.10.59
83.47.11.25
WRN-28-10
Adversarial Training
(Cui et al., 2023)
$1.90
82.76
82.32
WRN-28-10
(Wang et al., 2023)
87.96
86.40
WRN-28-10
(Wang et al., 2023)
83.90
89.24
84.16 87.14
84.30 89.86
WRN-70-16
[Peng et al., 2023)
$3.32
83.76
83.94
RaWRN-70-16
DiffPure. Surprisingly, purifying the standard model makes competitive with adversarially trained models, implying that purification does only benefit little when combined with a robust classifier.
B.5 Large Perturbation Norms for restricted adversarial attacks
In Fig. 9, we show adversarial examples of different attacks for the image in Fig. 1. We use the same distances ScoreAG achioves.
(a) APGD (f2)
(b) APGDT (62)
(c) Square (f2)
(d) APGD (Eoo)
(o) APGDT (f.o)
(f) Square (Rex)
Figure 9: Different adversarial attacks for the example in Fig. 1. The foo and la distances are 188/255 and 18.47 47, respectively. All mothods display major changes in the images compared to the original.
21

---

Published in Transactions on Machine Learning Research (11/2024)
B.6 Generative Adversarial Synthesis
In Fig. 10, we provide additional examples of the GAS lask. The images are synthetic adversarial samples of the ImageNet class "indigo bunting'. While all images are classified wrongly, most of them contain the right coro-semantics and display a high degrce of realism.
Figure 10: Selected synthetic adversarial examples on ImageNet for the class 'indigo bunting". All images display high degree of realism and are classified wrongly into various classes
22

---

Published in Transactions on Machine Learning Research (11/2024)
B.7 Generative Adversarial Transformation
In Fig. 11, we show additional examples of the GAT task. All original images are classified correctly into the ImageNet classes "golden retriever', "spider monkey', "football helmet', and "broccoli', while the adversarial images are classified as "cocker spanicl', "gibbon", "crash helmet", "bar- rel', "convertible', and "custard apple', respectively. While all adversarial images display subtle differences they do not alter the core semantics of the images and are not captured by common ep-norms.
"pickup truck',
(a) Original.
(b) Adversarial Examples.
Figure 11: Selected transformed adversarial examples ImageNet. While the adversarial examples are classified wrongly, the original images classified correctly. All images maintain the semantics while being outside of common perturbation norms.
B.8 Runtime comparison of the attacks.
All experiments were conducted on A100s. In Tab. 11, we report the runtimes in seconds of various met. The numbers display the average time to generate one adversarial example on the ImageNet-Comee Compatible datasct. Note that sampling an image without guidance using the same generative model as ScoreAG takes 15.00 seconds. The difference stems from the additional overhead induced by the gradient compulations.
23

---

Published in Transactions on Machine Learning Research (11/2024)
Table 11: Average runtimes in seconds of the different attacks A100 to generate adversarial images for the MnageNet-Compatibe dataset.
FCSM DIFGSM SINIFGSM
Square
FAB
APCD
APGDT
OnePixel
LPA
PPGD
DiffAttack
ACA
ScoreAG
0.45
0.18
0.68
36.04
74.39
0.40
1.86
0.64
0.96
0.50
19.14
188.80
79.34
24


Reviews:
[{"review_id": "G45DEbKwLU", "reviewer": "Reviewer_mc5Z", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper proposes and validates a useful way to leverage current generation models to study the adversarial robustness of classifiers. I think this is an important point, since the usual setup of adversarial robustness has become, in my humble opinion, obsolete.\n- Overall, the paper has commendable presentation: both in terms of language, quality of figures, and organization.\n- The high performance of the purification method, combined with the fact that by construction it is applied on all images, suggests it is most likely also a good detector no? If you purify and the original label differs from the new label then that instance could be predicted to be adversarial?\n- The purification method is even tested on common corruptions\n\n---\nWeaknesses that affect my rating:\n- Could the authors elaborate on the intuition behind the purification method? By the looks of the equation in 3.3, it seems like the denoising process is conducted essentially with the hopes that the model will recover the true class of the image, without further information about the image. If my intuition is correct, does this mean that the model is kind of expected to map the image back to the manifold of unperturbed images by itself? Or is there something else I'm missing?\n- For evaluation of the purification method, I understand the argument for performing the method on top of black-box-generated adversarial examples. However, do the authors know how well/bad does the proposed purification method work on white-box attacks?\n- For the evaluation metrics, I'm unsure about the usage of FID. That distance is for distributions, while in this case we would most likely intend for something at the instance level. Could the authors elaborate more on their rationale for choosing FID?\n- Section 4.2 mentions qualitative experiments on ImageNet. Is there any specific reason why quantatitve results are not reported?\n- For the Related Work section on Adversarial Attacks, I think the paper should explicitly mention to which line of work the proposed transformation method belongs to (i.e. white box, correct? since you need the model \"f\" to compute the (modified) score function)\n- I found that the computational cost of running the attack is reported on the appendix. I think the main paper should point out that the appendix reports that information\n- Table 9 reports that ScoreAG requires about 80 seconds to run. Could the authors disagregate how much of that time is the \"regular\" denoising process itself vs. how much is actually added by the proposed terms in the score function (i.e. the overhead). I think that's a more useful piece of information, since most likely the coming months/years will see dramatic improvement in the efficiency of the denoising process itself.\n\n-----\nWeaknesses that *don't* affect my rating, but should be addressed to improve the paper:\n- Fig. 1 is a case of (in the paper's vocabulary) Generative Adversarial Transformation (Sec. 3.2), correct? If so, I think explicitly stating this fact would be informative for the figure's caption (to convey that it is one out of three things that the paper proposes).\n- All three subsections of section 3 are correct (IMO). However, in the interest of  clarity, I think the paper would benefit from explicitly stating a clearer explanation of how all synthesis, transformation, and purification are performed in practice by using either (1) a formal definition, or (2) an algorithm. I would advocate for the algorithm, since I don't see the paper reporting that it will provide an open source codebase.\n- P5L3 explicitly states \"<unrestricted> attack\". I think I understand the intention, but I would not really call this unrestricted, but rather that the restriction is much more sophisticated (and larger) than the \\ell-p restriction.\n- The second-to-last line in Sec. 3.3 says \"they also\". What subject is that? ScoreAG?\n- The first sentence in Sec. 4 states \"assess the capability of ScoreAG in generating adversarial examples.\" I don't think that statement accurately reflects the rest of the section: the evaluation is not just about capability to generate adversarial examples, is it?\n- Do the authors have thoughts on if (and how) classifier-free guidance could be used here?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes to use score-based generative models to tackle three tasks in the domain of adversarial attacks: synthesis, transformation, and purification. The paper proposes to do these three tasks in an (IMO) elegantly unified manner: by modifying the score function that is followed during the denoising process. Each of these three tasks is thus reduced to adding a term in the score function, considering the information that is provided for each of task. The individual tasks are then evaluated on standard (albeit small, by today's standard in computer vision in general) datasets. The proposed approaches work reasonably well, and the paper does a commendable job of measuring how conceptually-changing the synthesis and transformations are.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please refer to \"Weaknesses that affect my rating\" for changes I request. Some of them may be provided in the rebuttal, while others should be incorporated in the manuscript. For the other section \"Weaknesses that don't affect my rating, ...\" please change as most as possible.\n\nSome other minor complaints:\n- Another minor complaint w.r.t. notation: can the paper use \\eqref?\n- Extremely minor complaint about notation: the scaling parameters in the equation relating to the score function (say $s_x$) would look better with the corresponding boldface: $s_{\\textbf{x}}$\n- Overall, I'd encourage not to say \"FID score\", since it's a distance, so lower is probably better, while a score sounds like higher is better\n- I think Table 1 would be more readable with single-digit precision for the numbers. Right now it looks rather cluttered\n- I think Fig. 4 is referenced before Fig. 3. Maybe switch the order?\n- The table in P8 is labeled as a figure (see caption)\n- In section 4.3 I'd use the word \"distinguishable\" instead of \"differentiable\"\n- P9, last line: clerical error: \").In\"\n- P10 clerical error: \"inpainting.Unlike\"\n- P10: Kang et al. (2023) *have*", "broader_impact_concerns": "Not any that I can think of.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "7zcGfnSoot", "reviewer": "Reviewer_sFqw", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**:\n\n-- The paper is mostly well written and structured and it’s easy to follow, except for the background section.\n\n-- The experimental evaluations are mostly comprehensive -- they compare against several baselines and include multiple datasets. \n\n-- Adversarial examples can exist outside of the conventional l_p norms and diffusion generative models seem a natural choice here. \n\n**Weaknesses**:\n\n-- While the Background Section is crucial to fully understand ScoreAG, it’s not clear at all. The definitions, notations and equations are too concise and their connections to ScoreAG’s components are not explained. I suggest adding more explanation to the definitions in section 2 and making it clear how they would constitute ScoreAG. For example, in the “diffusion guidance” paragraph, “… denotes the gradient of a classifier and c the guidance condition” needs more details.\n\n-- I suggest the authors add a problem formulation section and explain some of the terms and notations there. This makes understanding Section 3 much easier. For example, the term ‘task’ is used frequently but not defined formally. Also, the \"adversary\" paragraph could be moved to a potential problem formulation section. \n\n-- In the experimental setup, mention that the ± indicates the 95th CI over 4 runs, across all the experiments in the main text. \n\n-- In Table1, why is no row bolded under LPIPS? Furthermore, some numbers corresponding to CAA and DiffAttack are significantly higher than the others. I wonder why this is the case. Maybe if you include them systematically in Figure 3, we can make a better sense of it.  \n\n-- The order of the figures is not preserved in the text. Fig 3 is cited after Fig 4. \n\n-- In the caption of Figure 3 (also in the text), what are the example values of “common perturbation norms”? \n\n-- In Table 2, why only the CIs of the last row are reported? Table 5 does not report any CI at all?\n\n-- In the “Evaluating Generative Adversarial Transformation” paragraph, you attribute the lower attack success rate of the other diffusion-based methods to the fact that they only leverage the last few iterations of the denoising diffusion process. Can you elaborate on the intuition? Also are there any experiments to support your claim?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces a new framework to generate adversarial examples. The authors use score-based diffusion models to generate unrestricted (in the sense of being out of an l_p norm bound) adversarial images. The resulting images preserve the semantics of the true labels. The framework can accomplish three tasks: a) generation of new adversarial images from scratch b) transformation of the existing images into adversarial ones, c) image purification (for training) to enhance classifiers’ robustness against adversarial attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please make changes based on what I pointed out above, in the Weaknesses part.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "pXEHkNb9T6", "reviewer": "Reviewer_2bFN", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- This paper studies very interesting topic and the diffusion process can effectively improve the quality of adversarial attack, compared to existing methods, the adversary is semantically similar to the natural examples.\n- This paper is well-organized and well-written. The content of this paper is sufficient. \n- The performance improvement is promising.\n\n\nWeaknesses:\n- Since the proposed method employs diffusion strategy, the computational burden could be largely increased. However, there is no detailed analysis about the computational efficiency. \n- Lack of intuitive qualitative analysis to understand the proposed method better. Although the effectiveness of the proposed method has been largely benefited from the diffusion process, however, why such a process can help the learning result is still unknown. It is suggested to conduct further visualizations to provide better intuition.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Summary:\nThis paper studies adversarial learning using the diffusion process. Specifically, existing adversarial generation would change the semantic information of the image data, hence, the authors propose score-based diffusion to conduct adversarial generation, which can largely preserve the original semantic feature. The score-based diffusion process requires a task-specific condition to guide the learning process. There are three different tasks are considered, namely generative adversarial synthesis, generative adversarial transformation, and generative adversarial purification. Through quantitative experimental analysis, the authors show that the proposed diffusion method can achieve improved performance compared to existing baseline method.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see the weakness part.", "broader_impact_concerns": "The proposed method is interesting, and could potentially helpful for the adversarial field.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper proposes a new "semantically-preserving" adversarial attack to evaluate the robustness of vision models beyond lp perturbations. This is an area of interest of the community. All reviewers agree this is a solid work based on an interesting idea and with a clear presentation.
Decision: Accept (poster)