Title: AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks
Venue: NeurIPS 2024
Accepted: yes
Keywords: Adversarial Attacks

Imperceptibility

Diffusion Models

Deep Neural Networks
Abstract: Imperceptible adversarial attacks aim to fool DNNs by adding imperceptible perturbation to the input data. Previous methods typically improve the imperceptibility of attacks by integrating common attack paradigms with specifically designed perception-based losses or the capabilities of generative models. In this paper, we propose Adversarial Attacks in Diffusion (AdvAD), a novel modeling framework distinct from existing attack paradigms. AdvAD innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring basic modeling approach rather than using the denoising or generation abilities of regular diffusion models requiring neural networks. At each step, much subtler yet effective adversarial guidance is crafted using only the attacked model without any additional network, which gradually leads the end of diffusion process from the original image to a desired imperceptible adversarial example. Grounded in a solid theoretical foundation of the proposed non-parametric diffusion process, AdvAD achieves high attack efficacy and imperceptibility with intrinsically lower overall perturbation strength. Additionally, an enhanced version AdvAD-X is proposed to evaluate the extreme of our novel framework under an ideal scenario. Extensive experiments demonstrate the effectiveness of the proposed AdvAD and AdvAD-X. Compared with state-of-the-art imperceptible attacks, AdvAD achieves an average of 99.9% (+17.3%) ASR with 1.34 (-0.97) $l_2$ distance, 49.74 (+4.76) PSNR and 0.9971 (+0.0043) SSIM against four prevalent DNNs with three different architectures on the ImageNet-compatible dataset. Code is available at https://github.com/XianguiKang/AdvAD.

AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks

Abstract

Imperceptible adversarial attacks aim to fool DNNs by adding imperceptible perturbation to the input data. Previous methods typically improve the imperceptibility of attacks by integrating common attack paradigms with specifically designed perception-based losses or the capabilities of generative models. In this paper, we propose Adversarial Attacks in Diffusion (AdvAD), a novel modeling framework distinct from existing attack paradigms. AdvAD innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring basic modeling approach rather than using the denoising or generation abilities of regular diffusion models requiring neural networks. At each step, much subtler yet effective adversarial guidance is crafted using only the attacked model without any additional network, which gradually leads the end of diffusion process from the original image to a desired imperceptible adversarial example. Grounded in a solid theoretical foundation of the proposed non-parametric diffusion process, AdvAD achieves high attack efficacy and imperceptibility with intrinsically lower overall perturbation strength. Additionally, an enhanced version AdvAD-X is proposed to evaluate the extreme of our novel framework under an ideal scenario. Extensive experiments demonstrate the effectiveness of the proposed AdvAD and AdvAD-X. Compared with state-of-the-art imperceptible attacks, AdvAD achieves an average of 99.9 % (+17.3 % ) ASR with 1.34 (-0.97) l 2 distance, 49.74 (+4.76) PSNR and 0.9971 (+0.0043) SSIM against four prevalent DNNs with three different architectures on the ImageNet-compatible dataset. Code is available at https://github.com/XianguiKang/AdvAD .

1 Introduction

Deep Neural Networks (DNNs) are shown to be vulnerable to adversarial attacks [1, 2] (i.e., add maliciously crafted perturbations to the input data), posing serious security concerns to real-world applications [3]. The research of adversarial attacks also plays an important role in proactively exposing potential threats, as well as promoting model robustness and corresponding defense methods [4-11]. Many attacks [12-15] focus on maximizing the attack success rate and transferability under relatively lenient restrictions (i.e., l ∞ or l 2 norm) of adversarial perturbation, but they could have poor stealthiness and imperceptibility since the crafted adversarial examples can be easily detected by the Human Visual System (HVS) [16]. Therefore, imperceptible adversarial attacks [17-23], aiming to maintain attacking efficacy while improving imperceptibility, have attracted considerable attention.

Current imperceptible adversarial attacks could be summarized into two categories: 1) perturbationbased attacks devised on perceptual characteristics, and 2) unrestricted attacks. The first one is motivated by the fact that adding adversarial perturbations to different components of an image has

varying perceptual quality levels to the HVS. By studying components such as image color [19], texture complexity [21], frequency spectrum [23, 24], etc., these methods design corresponding perceptual-based loss functions and incorporate them to the optimization process to craft adversarial examples where the adversarial perturbation is constrained and hidden within specific image regions. Instead of injecting noise-like adversarial perturbations, unrestricted attacks heavily but reasonably modify attributes of images like semantic content to perform attacks. Apart from early work that adopts GANs [25], some recent methods combine the prevalent diffusion models [26-28] into the adversarial optimization process in an image edition-like way of repeatedly adding noise and denoising to eliminate the noise pattern within the final adversarial examples [29, 30] or optimize the embedding of latent diffusion models [31, 32]. However, due to the uncertainty of generative models and the unrestricted setting itself, some unrestricted adversarial examples inevitably exhibit obvious unnatural texture or semantic changes and lose the imperceptibility, especially for images with complex content. Although previous methods have equipped attacks with imperceptibility utilizing various designs mentioned above, it remains an essential challenge of achieving imperceptible adversarial attacks: How to attack with inherently minimal perturbation strength from a modeling perspective?

To address this fundamental challenge, we propose Adversarial Attacks in Diffusion ( AdvAD ), a brand new modeling framework distinct from common attack paradigms of gradient ascending [2] or optimization with adversarial losses [17]. The proposed AdvAD explores a novel non-parametric diffusion process for attacks, which fully inherits two key merits of diffusion models: i) the modeling philosophy of converting a difficult task into a series of simple sub-tasks, and ii) solid theoretical foundation. Specifically, AdvAD achieves high attack efficacy with intrinsically lower perturbation strength by innovatively modeling the attack process as a decomposed diffusion trajectory from an initialized noise to an adversarial example. At each step, a much subtler (for imperceptibility) yet more effective (for attack performance) adversarial guidance is calculated and injected with two cooperating, theoretically grounded non-parametric modules called Attacked Model Guidance (AMG) and Pixel-level Constraint (PC), which gradually leads the end of this trajectory from the original image distribution to a desired adversarially conditioned distribution based on the theory of diffusion models (e.g., deterministic diffusion[27], conditional sampling [33, 34], etc.).

Here, we would like to clarify that the proposed diffusion process for attacks is considered as non-parametric since it does not require additional networks as needed in regular diffusion models for noise estimation. AdvAD firstly initializes a fixed diffusion noise, which is then ingeniously manipulated at each step via the adversarial guidance crafted by the proposed AMG and PC modules using only the attacked model with theoretically derived equations. In this way, the proposed AdvAD is facilitated with the modeling approach of diffusion models rather than their denoising or generative capabilities, which avoids the negative impact like semantic content changes caused by the uncertainty of generative models and also promises relatively low computational complexity. Based on AdvAD, we further propose an enhanced version AdvAD-X ('X' for 'eXtreme') with two extra strategies to squeeze the extreme performance in an ideal scenario of the proposed new modeling framework with unique properties, which also possesses theoretical significance and provides new insights for revealing the robustness of DNNs. In summary, our main contributions are:

Addressing the essential challenge of imperceptible adversarial attacks from a novel modeling perspective for the first time, we theoretically explore and derive the basic modeling of diffusion models to perform attacks with inherently lower perturbation strength through a non-parametric diffusion process that requires no additional networks.

We propose two attack versions, AdvAD and AdvAD-X. For the basic AdvAD, the AMG and PC modules cooperate to craft much subtler yet effective adversarial guidance which is progressively injected via initialized diffusion noise at each step, and AdvAD-X further reduces the perturbation strength to an extreme level in an ideal scenario with theoretical significance.

Extensive experiments are conducted to evaluate the effectiveness of our methods in terms of attack success rate, imperceptibility, and robustness. Experimental results demonstrate the superiority of the novel modeling approach for imperceptible adversarial attacks.

2 Preliminaries

Adversarial Attacks. Given an original image x ori with ground-truth label y gt and a classifier f ( · ) satisfying f ( x ori ) = y gt , normal untargeted attacks aim to craft the adversarial example x adv that

misleads the classifier, formulated as:

̸

where ∥ · ∥ p represents l p -norm that is usually implemented with l ∞ -norm to limit the distance between x adv and x ori within an upper bound of budget ζ . In this paper, we focus on the more general setting of untargeted attacks. More information on related works is provided in Appendix A.

Deterministic Diffusion Process. In the deterministic situation of DDIM [27] with σ t = 0 , for an image x 0 and pre-defined diffusion coefficients α 0: T ∈ (0 , 1] T for step t ∈ [0 : T ] , x t in the Forward process of adding noise to x 0 is given by x t = √ α t x 0 + √ 1 -α t ϵ , where ϵ ∼ N ( 0 , I ) represents Gaussian noise. For the Backward denoising steps, unlike the DDPM [26] based on Markov chains that each state directly depends on the previous one, DDIM employs a non-Markovian approach. In the backward process, each step first involves calculating a "prediction" of final step x 0 t from current x t , then adding noise to it again to obtain x t -1 , expressed as:

where ϵ θ ( x t ) is a estimated diffusion noise using a pretrained neural network θ for current step, and the term in the first parenthesis represents the predicted x 0 t , derived by a simple variation of Eq. (2).

Conditional sampling. Song et al. [34] propose the conditional sampling technique for the scorebased generative models with score function ∇ x t log p ( x t ) [35], a kind of generative model has close relationship to diffusion models. Without loss of generality, for a condition y (e.g., class label, mask, etc.) and corresponding conditional distribution p ( x | y ) , a score-based model can sample from p ( x | y ) by modifying the score function at each step of t to ∇ x t log ( p ( x t ) p ( y | x t )) if p ( y | x t ) is known. Subsequently, with the connection between the score function and the noise ϵ t of diffusion models as ∇ x t log p ( x t ) = -1 / √ 1 -α t ϵ t [34], this joint distribution could be expanded to the deterministic process of DDIM, achieved by updating the noise ϵ t to ϵ ′ t at each step as [33]:

3 Proposed Adversarial Attacks in Diffusion

3.1 Overview

From a novel modeling perspective, we propose Adversarial Attacks in Diffusion (AdvAD) to attack with inherently smaller perturbation strength through a non-parametric diffusion process for the first time. As shown in Figure 1, different from previous attack paradigms that employ gradient ascending or optimization with varying kinds of adversarial losses, AdvAD innovatively performs attack within a decomposed non-parametric diffusion trajectory starting from an initialized noise, in which very subtle yet effective adversarial guidance is crafted and injected to gradually push the end of this trajectory to a desired adversarially conditioned distribution from the original image.

Intuitively, given the original image x ori with an initialized Gaussian noise ϵ 0 ∼ N ( 0 , I ) , a fixed diffusion trajectory from ¯ x T to ¯ x 0 ( ¯ x 0 = x ori ) can be easily obtained using DDIM Backward for the deterministic diffusion process as:

With this deterministic diffusion trajectory of the original image, performing adversarial attacks within it requires solving two main problems: i) directing the final result of this diffusion process to a desired adversarial example rather than the original image; ii) ensuring the modified trajectory (denoted as ˆ x t , ˆ ϵ t for step t ) close to the original trajectory ( ¯ x t , ϵ 0 for step t ) of the clean image to achieve the imperceptibility of attacks. To fulfill the dual purposes, we propose two theoretically grounded modules, called Attacked Model Guidance (AMG) and Pixel-level Constraint (PC) to work together. At each step, AMG utilizes only the attacked model f ( · ) to produce the adversarial guidance without requiring any additional networks, synergistically collaborated with PC to constrain and streamline the diffusion process injected with the guidances.

𝒙𝑜𝑟𝑖

Original Image

DDIM

Forward

𝒙

𝑇

𝒙   𝑇

⋅⋅⋅ 𝒙

𝑡

+1

𝒙

𝑡

𝒙   𝑡-

1

⋅⋅⋅ 𝒙

1

𝒙   𝑇

𝒙   𝑡-

1

Start

Step:

T

-->

t+1

𝝐

𝑇

+1

𝒙

𝑡

𝝐

𝑡

+1

PC

AMG

Step:

t

𝝐

𝑇

+1

∶

=

𝝐

0

PC

AMG

𝝐

𝑡

Step:

t-1

-->

1

PC

AMG

𝒙

0

PC

AMG

Non-Markov.

Process

DDIM

Backward

Step:

t

𝒙

𝑡

𝒙

𝑡

𝝐

𝑡

+1

𝒙

𝑡

𝝐

𝑡

+1

𝝐

𝑡

𝝐

𝑡

𝒙

𝑡-

1

𝑓 ⋅

,

𝑦𝑔𝑡

Sample of Diffusion

Predicted

Final Result

Next Sample

𝒙

𝑡

0

≈ 𝒙𝑎𝑑𝑣

𝝐

0

Craft Adversarial Guidance

with

AMG

and

PC

𝝐

𝑡

𝒙

𝑡-

1

𝝐

0

Eq. (4)

Eq. (7)

Eq. (10)

Eq. (8)

Eq. (11)

Non-Parametric Diffusion without Additional Networks for       ;

Achieved by Manipulating Initialized        at Each Step.

𝝐

0

Adversarial

Example

𝒙𝑎𝑑𝑣

∶

=

𝒙

0

End

AMG

Attacked Model Guidance

PC

Pixel-level Constraint

𝝐

0

Initialized Diffusion Noise

𝑓

(

⋅

)

Attacked Model

𝑦𝑔𝑡

Ground-truth Label

𝑇

Steps

𝝐𝜃

𝝐

𝑡

′

一

一

3.2 Attacked Model Guidance Module

̸

By viewing the attack process as a distribution-to-distribution transformation through a nonparametric diffusion process, the proposed AMG module theoretically integrates the conditional sampling technique of diffusion models to craft the adversarial guidance only using the attacked model f ( · ) . For untargeted attacks, the ultimate goal is modifying x ori with f ( x ori ) = y gt to x adv so that f ( x adv ) = y gt , which can be regarded as directing the determined distribution p ( x ori ) of the original diffusion trajectory to an distribution of x adv with the attacked model as p ( x adv | f ( x adv ) = y gt ) . Thus, we regard f ( x adv ) = y gt as an adversarial condition, and employ the conditional sampling technique to the original trajectory by manipulating the diffusion noise to achieve this, expressed as:

̸

̸

However, Eq. (6) is unsolvable since x adv is unknown during the diffusing process. To address this, inspired by the properties of deterministic non-Markovian DDIM that a final diffusion result is firstly predicted at each step, we calculate ˆ x 0 t via the equation of DDIM non-Markovian process with ˆ ϵ t +1 from the previous step, and use it to approximate x adv , expressed as:

The accurate error upper bound and convergence of this approximation are given in Proposition 2 in conjunction with the proposed PC module, and the validity of this approximation can also be explained intuitively from the premise of our method. That is, we have ¯ x 0 t = x ori for all step t in the original diffusion trajectory, and the modified trajectory should be very close to the original one, so that the relationship between ˆ x 0 t and x adv should satisfy ˆ x 0 t ≈ x adv .

With Eq. (7), the term of p ( f ( x adv ) = y gt | ˆ x t ) in Eq. (6) can be written as p ( f ( ˆ x 0 t ) = y gt | ˆ x t ) = p ( f ( ˆ x 0 t ) = y gt ) since ˆ x 0 t is calculated from ˆ x t , which is exactly the output logits of f ( ˆ x 0 t ) with Softmax ( · ) function for the class y gt . Denoting this term as the classification probability of the attacked model as p f ( y gt | ˆ x 0 t ) , we can obtain the solvable equation of AMG module that injects adversarial guidance to the initialized diffusion noise using only f ( · ) without any additional network:

At this point, in addition to the benefits from modeling, this calculation process of AMG also plays a role in endowing AdvAD with imperceptibility. As the attack progresses, the probability p f , the term

̸

Algorithm 1 AdvAD

of log (1 -p f ) as well as coefficient √ 1 -α t gradually approach 0, which means the strength of injected adversarial guidance gradually converge to 0 in AdvAD, while common classification losses (e.g, Cross-Entropy, Log Loss, etc.) used in other attack paradigms may increase on the contrary. Further analysis and experiments on this property are provided in Proposition 1 and Sec. 4.5.

3.3 Pixel-level Constraint Module

Collaborating with AMG, the PC module is introduced to impose precise control and streamline the modified diffusion trajectory for attacks. A straightforward choice is to design PC for ˆ x t that constrains each ˆ x t using ¯ x t , thus ensuring ˆ x 0 t close to ¯ x 0 t and the final x adv close to x ori . However, such a "hard" constraint directly applied to ˆ x t will impair the effectiveness of AMG and disrupt coherence of the transforming trajectory. Therefore, we formulate a more suitable PC for ˆ ϵ t as in Theorem 1.

Theorem 1 Given diffusion coefficients α T :0 ∈ (0 , 1] T , the x ori , ¯ x t , ϵ 0 from the original trajectory, ˆ x t , ˆ ϵ t from the modified trajectory, and a variable ξ , if ˆ ϵ t and ϵ 0 satisfies

for all t ∈ [ T : 1] , then it follows that ∥ ˆ x t -¯ x t ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1 -α T ) ξ, ∥ ˆ x 0 t -x ori ∥ ∞ ≤ ξ, and ∥ ˆ x 0 -x ori ∥ ∞ ≤ ξ hold true.

According to Theorem 1, the PC for ˆ ϵ t is implemented as:

where P l ∞ ( ϵ ,ξ ) ( · ) is a projection operation that constrains the output ˆ ϵ ′ t of AMG ( · ) to ˆ ϵ t based on a l ∞ -norm ball of ϵ 0 to satisfy Eq. (9). After PC, the diffusion noise ˆ ϵ t for next step is obtained, and the ˆ x t -1 can be calculated using the deterministic DDIM backward equation as:

The elaborate PC for ˆ ϵ t directly cooperates with AMG to constrain the diffusion noise, which streamlines the whole diffusion process and can serve to simultaneously control the terms of ˆ x t , ˆ x 0 t , and ˆ x 0 , satisfying the premise that two trajectories are close and ensuring the effectiveness of AdvAD. The complete pseudo code of AdvAD is provided in Algorithm 1.

Subsquently, based on Theorem 1, we further give two propositions about AdvAD as:

Proposition 1 Under the conditions of Theorem 1, by denoting constrained ˆ ϵ t = ϵ 0 -δ t , we have

Proposition 2 Under the conditions of Theorem 1, the upper bound on the error of the approximation in Eq. (7) can be expressed as

Proposition 1 explicitly states the much subtler and decreasing strength of the adversarial guidance injected at each step of AdvAD's non-parametric diffusion process, and also allows for a quantitative analysis (as in Sec. 5.5). Proposition 2 indicates the validity and convergence of the approximation of x adv ≈ ˆ x 0 t in AMG (Eq. (7)). It is evident that as t goes from T to 1 , α t increases from 0 to 1 , the upper bound on the approximation error rapidly converge from 2 ξ to 0 . The detailed derivations of the mentioned PC for ˆ x t , proofs of Theorem 1 and Proposition 1, 2 are provided in Appendix B.

3.4 AdvAD to AdvAD-X: Extreme Version

Building upon AdvAD, we further propose a scheme called AdvAD-X ('X' for 'eXtreme') with two extra strategies called Dynamic Guidance Injection (DGI) and CAM Assistance (CA), aiming to squeeze the extreme performance of our novel modeling framework in an ideal scenario that is usually overlooked but has theoretical significance.

DGI and CA Strageties. As aforementioned, the attack capability of AdvAD comes from the very subtle yet effective adversarial guidance crafted by AMG and PC, and the intensity of guidance will decrease to 0 as the process progresses. Thus, the DGI is naturally emerged as a dynamic skipping stragety to skip the unnecessary calculation and injection of adversarial guidance, especially for those steps in the later process. With DGI, AdvAD-X dynamically avoids the execution of AMG and PC and adopts original ϵ 0 as the diffusion noise for the steps where the ˆ x 0 t ≈ x adv is already able to mislead the attacked model, reducing the accumulated guidance strength as well as the computational complexity. On the other hand, inspired by the Class Activation Mapping (CAM) [36] identifies critical regions of an image about a decision made of a classifier, our CA strategy calculates a mask (if available) m ranging from 0 to 1 of x ori with f ( · ) and y gt using GradCAM [37] to further suppress the strength of adversarial guidance within the non-critical image regions in those steps that are not skipped. The equation of AMG with CA strategy can be modified as:

Ideal Scenario. Equipped with DGI, AdvAD-X omits a large number of adversarial guidance that is injected by default in AdvAD, while the absolute strength of guidance in each of the remaining steps are also suppressed by CA, successfully reducing the final adversarial perturbation to an extreme level. This extreme case leads to a problem that in the default setting of attacking with 8-Bit RGB images, the adversarial perturbation of pixels where the intensity is less than 0 . 5 will be erased due to the quantization. However, in practice, the input of DNNs is normalized as floating-point data type to avoid gradient problems during training [38, 39], and white-box attack allows access to the entire of DNNs. Therefore, for AdvAD-X, we specifically consider an ideal scenario that directly input the raw final adversarial example in floating-point data to DNNs without quantization to evaluate the extreme performance of AdvAD-X. The pseudo code of AdvAD-X is provided in Appendix C.

4 Experiments

4.1 Experimental Setup

Dataset. In line with prior studies [15, 19, 32, 40], our experiments are conducted on the ImageNetcompatible Dataset 1 , containing 1,000 images of ImageNet [41] classes with size of 299 × 299 , and the images are resized to standard input size of 224 × 224 in all experiments. Models. We select the widely used CNNs of ResNet-50 [42] and enhanced ConvNeXt-Base [43], Swin Transformer-Base

[44] with Transformer [45] architecture, and VisionMamba-Small [46] with the recently emerged advanced Mamba [47] architecture. Attacks. We choose classic PGD [12] and seven attacks that claim having imperceptibility as comparison methods, including normal imperceptible attacks of AdvDrop [21], PerC-AL [19], SSAH [24], and unrestricted attacks of NCF [40], ACA [32], DiffAttack [31], Diff-PGD [30], and the generative capability of diffusion models are utilized the last three attacks. For our proposed AdvAD and AdvAD-X, we set ξ = 8 / 255 and T = 1000 for all experiments unless specifically mentioned. All the other comparison methods are evaluated using their official open-source code with the default hyper-parameters. The results of AdvAD-X are obtained in the ideal scenario with float-pointing raw data as described in Sec. 3.4. Evaluation Metrics. Attack success rate (ASR) is used to evaluate the attack efficacy, and seven metrics are adopted to comprehensively assess the imperceptibility, including l 2 and l ∞ distances for absolute perturbation strength; Peak Signal-to-Noise Ratio (PSNR), Structure Similarity (SSIM) [48], and three network-based metrics, i.e., Learned Perceptual Image Patch Similarity (LPIPS) [49], Fréchet Inception Distance (FID) [50], and a non-reference metric MUSIQ [51] for image quality.

4.2 Comparison with State-of-the-art Methods

White-Box Attacks. Table 1 reports the untargeted attack performance and imperceptibility of ten methods against four attacked models. It is evident that the proposed AdvAD with novel modeling framework consistently demonstrates superior performance in terms of both ASR and imperceptibility. For the normal imperceptible adversarial attacks, the absolute adversarial perturbation strength of AdvAD in l ∞ and l 2 distance are only 0.014 and 1.34 in average, which is about half of the state-ofthe-art restricted imperceptible attack SSAH, and AdvAD maintains almost 99.9% ASR, supporting our key idea that it inherently reduces the strength of perturbation required for attacks from a modeling perspective. When attacking more advanced models from ResNet to VisionMamba, AdvAD always demonstrates the best ASR and imperceptibility, yet other methods tend to have some performance degradation (e.g., PerC-AL and SSAH for ConvNeXt and VisionMamba). For unrestricted attacks,

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x5

x5

x5

x5

x5

x1

x1

x1

x1

x80

x100

x80

x80

x80

x5

x5

x5

x5

x5

x1

x1

x1

x1

x80

x100

x80

x80

x80

it is expected for them to perform poorly in the quantitative metrics, but if the results are poor for all image quality metrics, it usually indicates that the images are damaged. Meanwhile, since the optimizer may not find the global optimal solution, the optimization-based methods tent to show sub-optimal ASR. For AdvAD-X, surprisingly, the perturbation strength is reduced to an extremely low level with still high attack efficacy in the ideal scenario with floating-point raw data.

Visualization. The visualizations of adversarial examples againt ResNet-50 in Figure 2 clearly show the characteristics of different imperceptible attacks against ResNet-50. For the first image with a relatively simple and clear object, the unrestricted attacks of NCF, DiffAttack and ACA perform attacks by modifying the semantics fairly, while DiffPGD uses denoising to avoid significant semantic modifications, but often has lower ASR as in Table 1. However, for the image with complex content, the unrestricted attacks result in obvious unnatural color, texture, artifacts and semantic changes. For the normal attacks with perceptual-based restrictions, by amplifying the noises, it can be seen that AdvDrop has a obvious gridding effect due to the blocking operation in DCT operation, and the perturbation strength in PerC-AL and SSAH is also related to the edge or texture components of the image. In contrast, our AdvAD continuously maintains uniform and lower perturbation which is very difficult to be seen even in the adversarial examples with × 5 noise. For AdvAD-X, the perturbations are very slight modifications to the decimal places of the floating-point raw data for each pixel, thus it is still difficult to be seen even after × 100 magnification. More quantitative comparisons and visualizations are provided in Appendix D.1, D.2.

4.3 Robustness

The robustness of attacks is also evaluated against defense methods, including purification methods of NRP [4], DS [52], diffusion-based purification [5] and adversarial training robust models of Inc-V3 [8], Res-50 [9], Swin-B [53], ConvNeXt-B [53]. Two classic image transformation defenses of JPEG compression [54], Bit-depth reduction [55], and another type of defense, random smoothing [11], are also included. Considering the robustness and transferability of attacks are comparable only under close perturbation budget, the unrestricted attacks are not included in this and the next section.

type

Clean

PerC-AL

AdvAD

AdvDrop

AdvAD-X

SSAH

25

50

75

100

4

5

6

7

8

Bit-depth Reduction

ASR(%)

25

50

75

100

60

70

80

90

100

JPEG Compression

ASR(%)

As shown in Table 2, the proposed AdvAD demonstrates the best robustness in overall average compared with other imperceptible attacks of AdvDrop, PerC-AL and SSAH. Specifically, when attacking robust models, AdvAD achieved an much higher average ASR of 75.3 % . For post-processing purifications aim at eliminating adversarial perturbations, despite the inherently lower perturbation strength, AdvAD still maintains the best or second-best ASR against different purifications, which is comparable to AdvDrop with much higher perturbation strength. Similarly, for the results of classic image transformation defenses in Figure 3, AdvAD also exhibits advantages in most of the factors. In addition, since random smoothing is not a truly end-to-end method but a method that uses the base model to make multiple predictions on noise-augmented images, we adpot a semi-white-box setup to fully test the attack performance as described in the caption. Table 3 shows the experimental results, and the PerC-AL is not included because it fails to attack in this setting. It can be seen that for all σ , our AdvAD continuously achieves the best ASR with smaller perturbation strength.

We suppose the robustness of AdvAD mainly benefits from two aspects. Firstly, AdvAD performs attacks during a unique non-parametric diffusion process with adversarial guidance, which may be easier to break through existing adversarial training models using common attack paradigms. On the other hand, the inherently lower perturbation crafted by AdvAD is spread across the images more uniformly rather than gathering in some areas as can be seen in the visualization, making it more difficult to be eliminated. For AdvAD-X, it is anticipated to exhibit weak robustness since the extremely low perturbation in the ideal scenario is easy to defense.

4.4 Transferability and Effect of Step T on AdvAD

Table 4 reports the ASRs of black-box attacks and the corresponding results of imperceptibility. We also test AdvAD with different step of T for comprehensive evalua-

(a）EffectofstepTonAdvAD

Averageblack-box ASR(%)

40 353025

Res-50 (ASR)

Mob-V2 (ASR)

--Res-50 (PSNR)

-

Mob-V2 (PSNR)

50

20 15

40

35

10

25

50

100

200

250

500

1000

T

(b)Transferability-lmperceptibility RelationshipofAttacks

Average black-box ASR(%)

4035

PGD

ADvAD (Res-50)

ADvAD (Mob-V2)

■

30 25 20 15

PGD

C-AL

AdvDrop

PerC-AL

10

■

SSAH

32.5

35.0

37.5

40.0

42.5

45.0

47.5

50.0

52.5

PSNR

tion. Consistent with the diffusion models, a larger T denotes a finer decomposition granularity of the entire process, corresponding to the strength of adversarial guidance at each step. Thus, AdvAD with a larger T exhibits better imperceptibility, while a smaller T implies stronger black-box transferability. Notbly, though there is a clear negative correlation between imperceptibility and transferability, our

l

t

0.0

0.5

1.0

1.5

0

250

500

750

1000

t

value

d

t

¥

0

1e-4

2e-4

3e-4

5e-4

0

250

500

750

1000

t

value

AdvAD exceeds all comparison attacks in both of transferability and imperceptibility at different comparable levels, demonstrating the effectiveness of the proposed novel modeling framework.

To further elaborate the relationship between transferability and imperceptibility of AdvAD, as well as the optimal trade-off in practice, we plot two line graphs in Figure 4 under more values of T . As shown in Figure 4 (a), as the value of T on the horizontal axis changes, the relationship between imperceptibility and transferability shows a clear proportional trend as mentioned above, consistent across different surrogate models. For the optimal trade-off, we consider that the intersection point of the two curves represents a balance between imperceptibility and transferability. Accordingly, for the ResNet-50 and MobileNetV2 models, the optimal values of T are 50 and 25, respectively. Moreover, Figure 4 (b) illustrates more direct curves of this relationship and the positions of other comparison methods within it. Note that, all the other comparison methods are located to the lower left of the curve of AdvAD. This indicates that our method consistently achieves the best results in both transferability and imperceptibility compared with other state-of-the-art restricted imperceptible attacks, demonstrating the effectiveness of our AdvAD as a new attack framework with flexibility through the proposed non-parametric diffusion process.

4.5 Analysis

Eq. (12) in Practice. With the derived analytical formulation of Proposition 1, in Figure 5, we illustrate the actual values of λ t and ∥ δ t ∥ ∞ of Eq. (12) using 100 randomly selected images. While Proposition 1 indicates that the upper bound of ∥ δ t ∥ ∞ is invariant with respect to step t , the actual strength of the adversarial guidance produced by AMG rapidly decreases as the process progresses, which validates the unique property given at the end of Sec. 3.2. With the similarly decreasing λ t , the whole term of λ t ∥ δ t ∥ ∞ representing l ∞ distance of the guidance at step t also decreases from about 0.0008 to 0, supporting that the proposed modeling framework performs imperceptible attacks with inherently small perturbation strength. Performance with Smaller ξ . The results of AdvAD and AdvAD-X with smaller ξ for PC module are shown in Table 5. As ξ decreases from 8 to 2 , the imperceptibility is naturally improved because of the upper bound of perturbation becomes lower, yet the ASR of 94.8% only drops slightly. When ξ = 1 / 255 , AdvAD still holds 87.4% ASR with 57.87 PSNR and 0.9993 SSIM, which means a large number of examples still can fool the DNN with a maximum of ± 1 modification for each pixel, demonstrating the effectiveness of the adversarial guidance injected in the proposed diffusion process for attacks. Moreover, we provide the ablation study of AdvAD-X and additional discussions in Appendix D.3, D.4.

5 Conclusion and Outlook

In this paper, we propose a novel, fundamental modeling framework distinct from existing paradigms to tackle the challenge of imperceptible attacks. By exploring and deriving basic theory of diffusion models, the proposed AdvAD performs attacks through a non-parametric diffusion process with adversarial guidance, achieving inherently lower overall perturbation strength with high attack efficacy from a modeling perspective. Besides, the proposed AdvAD-X evaluates the extreme of this novel modeling framework and further reduces the perturbation strength to an extremely low level in an ideal scenario. Extensive experimental results support the effectiveness and progressiveness of the proposed methods. Beyond imperceptibility, AdvAD holds the potential to become a general and extensible attack paradigm thanks to the solid theoretical foundation and the innovative, controllable diffusion-based process for attacks. In addition, we also hope the new observation that AdvAD-X can successfully attack with extremely small perturbation using floating-point raw data can bring inspiration for revealing the robustness and interpretability (e.g., decision boundaries) of DNNs.

Acknowledgments and Disclosure of Funding

This work was supported by NSFC (Grant No. 62072484), Natural Science Foundation of Guangdong Province (Grant No. 2514050000889) and Guangdong Key Laboratory of Information Security (No. 2023B1212060026).

References

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations , 2014.

I. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations , 2015.

X. Yuan, P. He, Q. Zhu, and X. Li. Adversarial examples: Attacks and defenses for deep learning. IEEE Transactions on Neural Networks and Learning Systems , 30(9):2805-2824, 2019.

M. Naseer, S. Khan, M. Hayat, F. S. Khan, and F. Porikli. A self-supervised approach for adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 262-271, 2020.

M. Lee and D. Kim. Robust evaluation of diffusion-based adversarial purification. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 134-144, 2023.

N. D. Singh, F. Croce, and M. Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. Advances in Neural Information Processing Systems , 36, 2024.

A. Luo, C. Kong, J. Huang, Y. Hu, X. Kang, and A. C Kot. Beyond the prior forgery knowledge: Mining critical clues for general face forgery detection. IEEE Transactions on Information Forensics and Security , 19:1168-1182, 2023.

F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations , 2018.

H. Salman, A. Ilyas, L. Engstrom, A. Kapoor, and A. Madry. Do adversarially robust imagenet models transfer better? Advances in Neural Information Processing Systems , 33:3533-3545, 2020.

A. Luo, E. Li, Y. Liu, X. Kang, and Z J. Wang. A capsule network based approach for detection of audio spoofing attacks. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing , pages 6359-6363. IEEE, 2021.

J. Cohen, E. Rosenfeld, and Z. Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning , pages 1310-1320. PMLR, 2019.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations , 2018.

Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 9185-9193, 2018.

Y. Zhang, Y. Tan, T. Chen, X. Liu, Q. Zhang, and Y. Li. Enhancing the transferability of adversarial examples with random patch. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22 , pages 1672-1678, 2022.

Z. Wei, J. Chen, Z. Wu, and Y. Jiang. Enhancing the self-universality for transferable targeted attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1228112290, 2023.

M. Sharif, L. Bauer, and M. Reiter. On the suitability of lp-norms for creating and preventing adversarial examples. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops , pages 1605-1613, 2018.

N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy , pages 39-57. IEEE, 2017.

B. Luo, Y. Liu, L. Wei, and Q. Xu. Towards imperceptible and robust adversarial example attacks against neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 32, 2018.

Z. Zhao, Z. Liu, and M. Larson. Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 1039-1048, 2020.

C. Laidlaw, S. Singla, and S. Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations , 2021.

R. Duan, Y. Chen, D. Niu, Y. Yang, A. Qin, and Y. He. Advdrop: Adversarial attack to dnns by dropping information. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 7506-7515, 2021.

Z. Chen, Z. Wang, J. Huang, W. Zhao, X. Liu, and D. Guan. Imperceptible adversarial attack via invertible neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 37, pages 414-424, 2023.

S. Jia, C. Ma, T. Yao, B. Yin, S. Ding, and X. Yang. Exploring frequency adversarial attacks for face forgery detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4103-4112, 2022.

C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen. Frequency-driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 15315-15324, 2022.

Y. Song, R. Shu, N. Kushman, and S. Ermon. Constructing unrestricted adversarial examples with generative models. Advances in neural information processing systems , 31, 2018.

J. Ho, A. Jain, and P. Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems , 33:6840-6851, 2020.

J. Song, C. Meng, and S. Ermon. Denoising diffusion implicit models. In International Conference on Learning Representations , 2020.

R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Cision and Pattern Recognition , pages 10684-10695, 2022.

X. Chen, X. Gao, J. Zhao, K. Ye, and C. Xu. Advdiffuser: Natural adversarial example synthesis with diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 4562-4572, 2023.

H. Xue, A. Araujo, B. Hu, and Y. Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability. In Thirty-seventh Conference on Neural Information Processing Systems , 2023.

J. Chen, H. Chen, K. Chen, Y. Zhang, Z. Zou, and Z. Shi. Diffusion models for imperceptible and transferable adversarial attack. arXiv preprint arXiv:2305.08192 , 2023.

Z. Chen, B. Li, S. Wu, K. Jiang, S. Ding, and W. Zhang. Content-based unrestricted adversarial attack. Advances in Neural Information Processing Systems , 36, 2024.

P. Dhariwal and A. Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems , 34:8780-8794, 2021.

Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations , 2020.

Y. Song and S. Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems , 32, 2019.

B. Zhou, A. Khosla, A. Lapedriza, A. Oliva, and A. Torralba. Learning deep features for discriminative localization. In Proceedings of the IEEE conference on computer vision and pattern recognition , pages 2921-2929, 2016.

R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE International Conference on Computer Vision , pages 618-626, 2017.

A. Krizhevsky, I. Sutskever, and G. E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems , 25, 2012.

S. Ioffe and C. Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In International conference on machine learning , pages 448-456. pmlr, 2015.

S. Yuan, Q. Zhang, L. Gao, Y. Cheng, and J. Song. Natural color fool: Towards boosting black-box unrestricted attacks. Advances in Neural Information Processing Systems , 35:7546-7560, 2022.

O. Russakovsky, J. Deng, H. Su, J. Krause, S. Satheesh, S. Ma, Z. Huang, A. Karpathy, A. Khosla, M. Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211-252, 2015.

K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer VVision and pattern recognition , pages 770-778, 2016.

Z. Liu, H. Mao, C. Y. Wu, C. Feichtenhofer, T. Darrell, and S. Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 11976-11986, 2022.

Z. Liu, Y. Lin, Y. Cao, H. Hu, Y. Wei, Z. Zhang, S. Lin, and B. Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF International Conference on Computer Vision , pages 10012-10022, 2021.

A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems , 30, 2017.

L. Zhu, B. Liao, Q. Zhang, X. Wang, W. Liu, and X. Wang. Vision mamba: Efficient visual representation learning with bidirectional state space model. In International conference on machine learning , 2024.

A. Gu and T. Dao. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752 , 2023.

Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing , 13(4):600-612, 2004.

R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 586-595, 2018.

M. Heusel, H. Ramsauer, T. Unterthiner, B. Nessler, and S. Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017.

J. Ke, Q. Wang, Y. Wang, P. Milanfar, and F. Yang. Musiq: Multi-scale image quality transformer. In Proceedings of the IEEE/CVF international conference on computer vision , pages 5148-5157, 2021.

H. Salman, M. Sun, G. Yang, A. Kapoor, and J Z. Kolter. Denoised smoothing: A provable defense for pretrained classifiers. Advances in Neural Information Processing Systems , 33:21945-21957, 2020.

C. Liu, Y. Dong, W. Xiang, X. Yang, H. Su, J. Zhu, Y. Chen, Y. He, H. Xue, and S. Zheng. A comprehensive study on robustness of image classification models: Benchmarking and rethinking. arXiv preprint arXiv:2302.14301 , 2023.

N. Das, M. Shanbhogue, S. Chen, F. Hohman, S. Li, L. Chen, M. E. Kounavis, and D. Chau. Shield: Fast, practical defense and vaccination for deep learning using jpeg compression. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining , pages 196-204, 2018.

C. Guo, M. Rana, M. Cisse, and L. van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations , 2018.

M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L. Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , pages 4510-4520, 2018.

Contents

A Related Work

Beginning with the attack paradigm of Fast Gradient Sign Method (FGSM) [2], there are numerous great works focusing on the imperceptibility of adversarial attacks have been proposed [17-23]. In contrast to another line of attacks aimed at improving the attack success rate and the transferability for black-box models with a more lenient limitation of perturbation strength [13-15], imperceptible adversarial attacks are dedicate to accomplish attacks using as minimal perturbation as possible while deceiving human perception. Among them, PerC-AL [19] improves the imperceptibility by alternating between the classification loss and perceptual color difference when updating perturbations. AdvDrop [21] uses Discrete Cosine Transform (DCT) to discard details in images that are imperceptible for humans. SSAH [24] limits perturbation to high-frequency components using Discrete Wavelet Transform (DWT) to make it undetectable. Similarly, AdvINN [22] also utilizes the DWT and exploits invertible neural networks to specially perform targeted attacks. In addition, with an unrestriced setting [25], some recent works have incorporated the capabilities of generative models (e.g., diffusion models [26]) into common attack frameworks to make adversarial examples more natural and enhance the imperceptibility. DiffAttack [31] and ACA [32] combine the optimization of adversarial losses with the Stable Diffusion [28] to generate unrestricted adversarial examples, while Diff-PGD [30] and AdvDiffuser [29] incorporate the classic PGD method [12] into the diffusion steps to make the adversarial examples undergo denoising processing.

Compared to these traditional restricted imperceptible attacks or the recent unrestricted imperceptible attacks (e.g., diffusion-based), the proposed AdvAD is a completely novel approach distinct from existing attack paradigms. It is the first pilot framework which innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring fundamental modeling approach of diffusion models rather than using their denoising or generative abilities, achieving high attack efficacy and imperceptibility with intrinsically lower perturbation strength. Following the setting of restricted attack, the modeling of AdvAD is theoretically derived from conditional sampling of diffusion models, supporting its attack performance and imperceptibility, and does not require any loss functions, optimizers, or additional neural networks.

B Derivations and Proofs

In this section, we first introduce the specific straightforward Pixel-level Constraint (PC) for ˆ x t that is simply mentioned at the beginning of Section 3.3 of the main text as an intuitive preliminary, then we provide the detailed proofs of Theorem 1 and Proposition 1, 2 given in the PC for ˆ ϵ t .

B.1 Straightforward PC for ˆ x t

For each known ¯ x t in the fixed diffusion trajectory of the original image x ori , and modified ˆ x t in the attacking trajectory with the proposed Attacked Model Guidance (AMG) leading to the adversarial example x adv , the objective of PC is to control and constrain these two trajectories to be close, ensuring the final ˆ x 0 (i.e., x adv ) close to ¯ x 0 (i.e., x ori ). It is obvious that a straightforward way to achieve the goal by directly constrain every ˆ x t using ¯ x t . Thus, in PC for ˆ x t , we can utilize the restriction of adversarial examples and the relationship between x adv , ˆ x 0 t and ˆ x t to derive the constraint for ˆ x t . Given the budget ξ , the desired restriction of adversarial examples is

Next, since the ˆ ϵ t is unconstrained in the case of PC for ˆ x t , we adopt the initialized ϵ 0 to calculate ˆ x 0 t approximating x adv as:

where α 0 = 1 , and α 1: T ∈ (0 , 1] T is a pre-defined decreasing scalar sequence. And the ¯ x t of the original trajectory is calculated as:

By substituting Eq. (16) and Eq. (17) into Eq. (15), the constraint for ˆ x t can be easily derived, denoted as:

In this way, the PC for ˆ x t can be implemented at the start of each step to achieve the basic restrictions by employing a projection operation to ˆ x t according to Eq. (18). However, this direct modification of ˆ x t at each step obviously disrupts the entire diffusion trajectory from noise to our desired adversarial distribution, and can not achieve the final imperceptibility. Additionally, it is observed that the estimation of ˆ x 0 t in each step employs a fixed ϵ 0 , impairing the adversarial guidance crafted by AMG.

B.2 Proof of Theorem 1

Therefore, we carefully analysis the important noise term in our diffusion-based modeling approach for adversarial attacks, and present Theorem 1 to support our PC for ˆ ϵ t as described in the main text. The proof of Theorem 1 is provided as follow.

Theorem 1 Given diffusion coefficients α T :0 ∈ (0 , 1] T , the x ori , ¯ x t , ϵ 0 from the original trajectory, ˆ x t , ˆ ϵ t from the modified trajectory, and a variable ξ , if ˆ ϵ t and ϵ 0 satisfies

for all t ∈ [ T : 1] , then it follows that ∥ ˆ x t -¯ x t ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1 -α T ) ξ, ∥ ˆ x 0 t -x ori ∥ ∞ ≤ ξ, and ∥ ˆ x 0 -x ori ∥ ∞ ≤ ξ hold true.

Proof 1 We prove Theorem 1 using mathematical induction.

Initial case. For trajectories of the adversarial example x adv and original image x ori that start from ˆ ϵ T +1 = ϵ 0 , ˆ x T = ¯ x T and ˆ x 0 T = ¯ x 0 T , we can unfold the formula for computing the ˆ x 0 T -1 with the updated ˆ ϵ T as:

For ¯ x 0 T -1 from the fixed trajectory where ¯ x 0 t always equals to x ori , we have:

With ˆ x T = ¯ x T , Eq. (20) , Eq. (21) , and the relationship of ∥ ˆ ϵ T -ϵ 0 ∥ ∞ ≤ √ α T √ 1 -α T ξ , we have:

Meanwhile, for the relationship between ˆ x T -1 and ¯ x T -1 at the initial step, we have:

where the transition from Eq. (23) to Eq. (24) is obtained with the real constant value of α t . At this point, it can be seen that Theorem 1 holds in the initial case.

Inductive step. Assuming the theorem holds for some arbitrary step k , where T ≥ k > 1 , we have:

and

Based on the inductive hypothesis, we next show the validity of the theorem at step k -1 . Similar to Eq. (20) , we unfold the calculation of ˆ x 0 k -1 with ˆ x k and ˆ ϵ k as:

And the ¯ x 0 k -1 can be denoted as:

Consequently, by substituting Eq. (29) and Eq. (30) into ∥ ∥ ˆ x 0 k -1 -¯ x 0 k -1 ∥ ∥ ∞ , we have:

where Eq. (31) to Eq. (32) utilizes the triangle inequality property of l p -norm, and Eq. (33) is obtained with Eq. (28) . Then, given the imposed condition of Eq. (19) , we can get:

And the relationship between ˆ x k -1 and ¯ x k -1 at step k -1 can be expressed as:

where the triangle inequality property is utilized again to obtain Eq. (36) from Eq. (35) , then Eq. (28) and Eq. (34) is substituted to obtain Eq. (37) . Obviously, for the case of step k -1 , it is also consistent with the theorem.

Conclusion. Therefore, by extending the truth of the theorem from arbitrary step k to k -1 , and given its established validity at the initial case, the principle of mathematical induction allows us to conclude that ∥ ˆ x t -¯ x t ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1 -α T ) ξ, ∥ ˆ x 0 t -x ori ∥ ∞ ≤ ξ hold true for every step t ∈ [1 : T ] . For t = 0 and α 0 = 1 , we have ˆ x 0 0 = ˆ x 0 and ¯ x 0 = x ori , thus it is obvious that ∥ ˆ x 0 -x ori ∥ ∞ ≤ ξ . This concludes the proof of the whole Theorem 1.

B.3 Proof of Proposition 1

Next, we prove Proposition 1 about λ t and δ t by expanding and rearranging the recursive formulas in our diffusion process for attacks.

Proposition 1 Under the conditions of Theorem 1, by denoting constrained ˆ ϵ t = ϵ 0 -δ t , we have

Proof 2 With Eq. (19) in Theorem 1, by denoting ˆ ϵ t = ϵ 0 -δ t , we have: ∥ δ t ∥ ∞ = ∥ ˆ ϵ t -ϵ 0 ∥ ∞ ≤ √ α T √ 1 -α T ξ , and the ˆ x T -1 in the initial step can be written as:

Applying the recursion formula twice, we have:

Similarly, for ˆ x T -3 , we have:

It is obvious that the coefficients of each term exhibit a clear regular pattern related to the step t . Following this pattern, we can accordingly get the expression of ˆ x t as:

And the final ˆ x 0 can be expressed as:

Note that in α 0 = 1 Eq. (44) , and the coefficients of ϵ 0 can be mostly eliminated. Thus, by defining λ t as: √ √

we can rearrange Eq. (44) into:

where ˆ x 0 is the final output of the diffusing process and x adv = ˆ x 0 . This concludes the proof of Proposition 1.

B.4 Proof of Proposition 2

Finally, we prove Proposition 2 about the validity and convergence of the approximation x adv ≈ ˆ x 0 t .

Proposition 2 Under the conditions of Theorem 1 and Proposition 1, the upper bound on the error of the approximation in Eq. (22) can be expressed as

Proof 3 With Eq. (43) and the definitions of Proposition 1, ˆ x t and ˆ x 0 t can be written as:

and

For x adv , we have:

With Eq. (49) and Eq. (50) , we can obtain:

Thus, we have:

This concludes the proof of Proposition 2.

C Algorithm of AdvAD-X

D Additional Experiments

D.1 Additional Quantitative Comparisons

Table 6 reports the untargeted attack performance and imperceptibility of ten methods on Vgg-19, MobileNet-V2, and WideResNet-50 models. The results indicate that the proposed AdvAD and AdvAD-X, leveraging a novel modeling framework, consistently achieve superior performance. These findings further underscore the effectiveness of the proposed approach.

D.2 Additional Visualizations

More visualizations of adversarial examples and perturbations under the attacked model of ResNet-50 are displayed in Figure 6. The visualizations provide a clear insight into how different methods accomplish imperceptible attacks. Our AdvAD and AdvAD-X methods execute imperceptible attacks with lower overall intensity of perturbations. Notably, for images with salient objects (e.g., the bridge in the second examples), the perturbation intensity of AdvAD also naturally increases in the object regions during the gradient-based adversarial guidance calculation, while AdvAD-X, equipped with the dynamic strategy, still shows uniform and lower overall perturbation intensity.

D.3 Ablation Study of AdvAD-X

From AdvAD to AdvAD-X, Table 7 shows the effect of the two strategies of CA and DGI. It can be observed that adding CA in each step of AdvAD slightly improves impercepbility while maintaining the attack success rate of 100%. However, the DGI strategy significantly reduces the iterations of performing AMG and PC from 1000 to 3.97, which indicates that our framework theoretically only requires very little injected adversarial guidance to successfully perform attacks, proving the performance of our modeling method as well as the effectiveness of the adversarial guidance. In AdvAD-X, which finally uses both CA and DGI, the guidance strength in each step is further suppressed, resulting in a slight increase in the total number of iterations required adaptively, but the final perturbation strength continues to decrease to a more extreme level.

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

x80

SSAH

AdvDrop

PerC-AL

DiffPGD

DiffAttack

NCF

ACA

AdvAD-X (ours)

x1

x1

x1

x1

x5

x5

x5

x5

x5

x80

x80

x80

x100

D.4 Additional Discussions

Discussion on Proposition 1. In the previous sections, we obtained Proposition 1 through extensive derivations, which reformulates the AdvAD attack process using λ t and δ t . While this formulation does not represent the actual attack procedure, it enables post-analysis after the completion of attacks. In Proposition 1, although the upper bound of δ t is theoretically independent of the step t , both δ t and the coefficient λ t gradually decrease with t in quantitative results of Figure 5 due to the unique properties of AdvAD. Thus, it emerges a hypothesis that whether modifying the coefficient of gradient term of traditional attacks like PGD to decay incrementally could also achieve the imperceptibility. To isolate the impact of this hypothesis, we conduct experiments with a modified version of PGD with step size decay as:

where λ t is the same coefficient as in Eq. (39) of Proposition 1 for alignment, and η is a fixed small factor for the initial step size. We have searched a lot of values of η to determine the optimal range, and the results of attacking three models with different architectures under three typical values of η are presented in Table 8.

It can be observed that for PGD with this strategy, the ASR is clearly proportional to η , the imperceptibility is inversely proportional to η . However, regardless of how η is adjusted, this strategy can not simultaneously match AdvAD in both ASR and imperceptibility. Firstly, for η = 5e-5, when attacking VisionMamba, ASR of this strategy is 10.5 % lower than AdvAD with close PSNR, and the strategy has a 0.2 % higher ASR but a 5.09 dB lower PSNR for ResNet50. For η = 3e-5, the ASR against VisionMamba and Swin further degrade, being 10.9 % and 21.4 % lower than AdvAD, respectively. Finally, for η = 1e-5, the modified PGD with step size decay fails to attack all the models. Nevertheless, although this step size decay strategy performs worse than our AdvAD, it indeed enhances the imperceptibility of attacks compared to the original PGD in some cases, which further validates our motivation and modeling approach. This is because, while this strategy follows a completely different technical route than AdvAD, it similarly uses subtler perturbations to progressively push adversarial examples closer to the model's decision boundary. To this end, we leave further research on the potential of this strategy to future work.

Limitation. As the primary focus of AdvAD is the imperceptibility, although it achieves better transferability at lower perturbation strength compared with other restricted imperceptible attacks, its transferability is inevitably weaker than other black-box attack methods that operate in larger perturbation spaces and are specifically designed for transferability (like the unrestricted ones). However, the proposed AdvAD is essentially a general attack paradigm with a novel modeling approach and a solid theoretical foundation. By relaxing the constraint of perturbation strength and incorporating enhanced designs for the transferability into the proposed framework of non-parametric diffusion process, AdvAD also has significant potential to be modified into a specific black-box attack, and we also leave this aspect for future research.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: We present the motivation, innovation, overview of methods, experimental performance and the main contributions of our paper in the abstract and introduction. These claims are further explained and verified in Sec. 3 and Sec. 4, and detailed proofs are given in Appendix.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: For the proposed AdvAD that mainly focuses on the imperceptibility, we point that there is a trade-off between the imperceptibility and transferability for the restricted attacks. The relevant discussions and experimental results are given in Sec. 3.4, Sec. 4.3, and Appendix D.4. Additionally, for the proposed AdvAD-X, although it shows amazing performance under an ideal scenario using raw floating-point data for attacking and brings theoretical value, the very small floating-point perturbations will be easily erased by the quantization process when the image is actually stored.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best

judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The proposed attack method is built on a solid theoretical foundation, which is derived from the derivation of the diffusion models. The specific methods and theoretical properties are introduced in detail in Sec. 3, and the detailed proofs of the proposed theorem and two propositions are given in Appendix.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We present all the formulas, calculation processes, algorithms, and hyperparameters of the proposed methods in detail. And we have tested that by fixing the random seed, our method can produce consistent results with the same input on our machine, providing good reproducibility.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We open-source the code on GitHub and give the Python environment requirements, dataset preparation, running commands, etc. Following our instructions, the experimental results given in the paper can be easily reproduced.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: One of the main contributions of our paper is to propose a novel adversarial attack modeling framework based on a non-parametric diffusion process. Benefiting from the proposed modeling approach, our attack method only needs two simple hyperparameters to accurately control the entire attack process, without the need for complex training or optimization processes in other paradigms.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: Only Figure 5 reports a actual statistic numerical curve of a theoretical upper bound in the actual execution process, which is calculated from actual data using a confidence level of 0.85 and shows the confidence interval. In other experiments, due to limited computing resources, the error bar under multiple runs is not included. However, as mentioned above, the methods proposed in this paper can obtain consistent results in multiple runs by fixing the random seed.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We have indicated that all the experiments are conducted on a single NVIDIA RTX 3090 GPU, and the running time required for all methods to attack different models are included in Table 1, Table 5, and Table 8 to compare the computational complexity while providing a reference.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We ensure that the research conducted in the paper complies with the NeurIPS Code of Ethics in all respects.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: As a research on adversarial attacks of deep neural networks, the significance lies in revealing possible attack algorithms and the vulnerabilities of the models in advance, in order to help promote corresponding defense methods or the model robustness, and improve the safety of deep neural networks in real-world applications.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The dataset we used is under the MIT License, and it has been properly cited in the paper with its URL.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
In this paper, a diffusion-based adversarial attack method is proposed and extensive experiments were conducted to show the effectiveness of the method.

STRENGTHS:
1. the paper is well-written and easy to read.
2. both adversarial attack and diffusion model are hot topics.
3. both Linf and L2 results are given in the experiment.
4. An ablation study on T is provided
5. The experiment's results are convincing.

WEAKNESSES:
1. because this paper proposed a new algorithm, at least a pseudo code should be provided to show how the algorithm works.
2. In the table1, it shows that the performance of the model measured in FID sometimes does not match that in other metrics measuring similarity, e.g., psnr, ssim. For example, in the experiment on visionmemba, the FID of the proposed method is not the smallest, as that in other similar metrics. Can the author give some explanation about this?

QUESTIONS:
same

LIMITATIONS:
same
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-03

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes a novel adversarial attack framework called Adversarial Attacks in Diffusion (AdvAD). Unlike prior methods that rely on generative models or specific loss functions, AdvAD formulates attacking as a non-parametric diffusion process. This approach theoretically explores a fundamental modeling strategy instead of leveraging the denoising or generation capabilities of diffusion models with neural networks. AdvAD iteratively refines the attack by crafting subtle adversarial guidance based solely on the targeted DNN, without requiring any additional network. This process progressively transforms the original image into an imperceptible adversarial example.\n\nSTRENGTHS:\n1.\tThe concept of leveraging the core principles of diffusion models to craft adversarial examples is intriguing.\n2.\tThe writing style in the Abstract and Introduction sections is engaging.\n3.\tThe effectiveness of AdvAD is validated through experiments.\n\nWEAKNESSES:\nWhile I have carefully reviewed the work several times, some uncertainties remain. These are addressed in the following \"Questions\" section. Due to these uncertainties, the initial recommendation is a borderline decision, which can be revised upwards or downwards based on the authors' response.\n\nQUESTIONS:\n1.\tThe paper claims that AdvAD achieves superior imperceptibility compared to other methods. However, after multiple readings, the justification for this remains unclear. While the text mentions \"much subtler yet effective adversarial guidance at each step\", \"grounded on diffusion model's theoretical foundation\", and various diffusion-related formulations, it lacks a clear explanation (or theoretical verification) of how using non-parametric diffusion leads to attacks with lower perturbations.\n2.\tBased on my understanding, AdvAD shares similarities with traditional attacks like PGD, but with a fixed number of optimization iterations (controlled by the total diffusion model timesteps T) and a gradually decaying learning rate (controlled by the $α_t$ value). I hypothesize that the decayed learning rate is a key factor contributing to imperceptibility. The learning rate starts low (at the beginning of T steps) and gradually decreases to 0 (at the end of 0 steps). This suggests that small perturbations are added first, followed by even smaller ones, potentially leading to adversarial examples closer to the classification boundary and thus exhibiting higher imperceptibility. Could the authors comment on the validity of this hypothesis?\n3.\tFollowing the previous question, to isolate the impact of the decayed learning rate strategy, it would be beneficial to include comparative experiments. These experiments would directly apply a small learning rate initialization and a decayed learning rate schedule to a traditional attack algorithm. If this approach achieves similar performance to AdvAD, it would suggest that the emphasis on diffusion model theory might not be necessary. If not, the authors should highlight the specific benefits of the diffusion model mechanism that contribute to imperceptibility.\n4.\tDoes the selection of the initial Gaussian noise sample $ε_0$ affect the performance of AdvAD?\n5.\tIn Table 1, is the FID metric computed between the perturbed images and the \"imagenet-compatible dataset\"? If the goal is to assess the realism of the adversarial examples compared to natural images, a more comprehensive evaluation would be to compare them with the raw ImageNet images. The \"imagenet-compatible\" dataset, with only 1000 images, might not adequately capture the entire distribution of natural images.\n6.\tLine 248 states that \"the optimizer usually cannot find the global optimal solution, and optimization-based methods tend to show sub-optimal ASR.\" How can AdvAD achieve better ASR compared to these optimization-based methods?\n7.\tIn Table 2, which classifier was used to generate the adversarial samples? The robustness of the adversarially trained model Inc-V3_{adv} and the ensemble model Inc-V3_{ens4} appears very low (almost 100% ASR). Additionally, were Res-50, Swin-B, and ConvNeXt-B clean classifiers or adversarially trained?\n8.\tLine 292 suggests that \"a larger T exhibits better imperceptibility, while a smaller T implies stronger black-box transferability.\" Can the authors elaborate on this trade-off?\n9.\tThere are a few minor writing errors throughout the paper, such as \"a' adversarial\" (Line 140), \"fistly\" (Line 144), and \"an' scheme\" (Line 191).\n10.\tThere are specific questions regarding the proofs of theorems and propositions in the Appendix:\n\n(1)\tIn the second row equality of Eq. 6, shouldn’t $\\epsilon_T$ be $\\epsilon_{T+1}$ in the first term on the numerator of the first term?\n\n(2)\tIn Line 546, it Is clear that $\\epsilon_{T+1}$ satisfies the inequality as $\\epsilon_{T+1}$ equals $\\epsilon_0$, but how does this hold for $\\epsilon_{T}$ as well?\n\n(3)\tEq. 20, third row inequality: How is this inequality derived?\n\nLIMITATIONS:\nYes, limitations are identified in the paper.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a new method, AdvAD, for generating imperceptible adversarial attacks against deep neural networks (DNNs). AdvAD is based on a novel non-parametric diffusion process, which initializes a fixed diffusion noise and then manipulates it at each step using adversarial guidance crafted by two modules: Attacked Model Guidance (AMG) and Pixel-level Constraint (PC). This process gradually leads the image from its original distribution to a desired adversarial distribution. The paper also introduces an enhanced version, AdvAD-X, which aims to achieve extreme performance under an ideal scenario. Extensive experiments demonstrate the effectiveness of both AdvAD and AdvAD-X in terms of attack success rate, imperceptibility, and robustness compared to state-of-the-art methods.\n\nSTRENGTHS:\nThe paper's main strength lies in its novel approach to generating imperceptible adversarial attacks. The use of a non-parametric diffusion process is innovative and shows promising results in terms of attack effectiveness and imperceptibility. The paper is well-written and easy to follow, with clear explanations of the proposed method and experimental setup.\n\nWEAKNESSES:\nThe paper has several weaknesses. The technical novelty is limited, as the core idea of using diffusion models for adversarial attacks has been explored in prior work (e.g., DiffAttack, ACA). The paper lacks a clear comparison with these existing diffusion-based attack methods, making it difficult to assess the incremental contribution of AdvAD. \n\nAnother thing is how much cost is it really to generate adversarial examples this way. I mean, one important use of generating adversarial examples is for adversarial training. So if it becomes really expensive to generate adversarial examples, such a use wouldn't be really meaningful. Then what is the use of these adversarial examples really?\n\nQUESTIONS:\nWhat are the specific differences between AdvAD and existing diffusion-based attack methods like DiffAttack and ACA? A detailed comparison would help clarify the novelty of the proposed approach.\n\nWhat are the potential defensive measures against AdvAD, and how can they mitigate the threat posed by this attack?\n\nHow does the computational complexity of AdvAD compare to other state-of-the-art methods, especially for large-scale datasets or models?\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-10"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nIn this paper, the authors propose the Adversarial Attack in Diffusion method called AdvAD, which crafts imperceptible perturbations from the model perspective without the need for additional networks.\n\nDuring the non-parametric diffusion process, the proposed AdvAD method introduces Attacked Model Guidance (AMG) and Pixel-level Constraint (PC) modules to ensure both imperceptibility and transferability of the adversarial examples. \n\nMoreover, an enhanced version AdvAD-X is further introduced to achieve better imperceptibility and lower computational complexty.\n\nExperiments conducted on CNN, ViT, and Mamba architectures using the ImageNet benchmark dataset demonstrate that the proposed AdvAD method achieves superior performance compared to baseline methods in terms of attack success rate, imperceptibility, and robustness.\n\nSTRENGTHS:\n1. The proposed AdvAD method reformulates the generation of imperceptible adversarial examples as a non-parametric diffusion process, effectively eliminating the negative effects caused by the uncertainty of generative models.\n\n2. The proposed AMG and PC modules inject adversarial guidance progressively at each step without the need for additional networks, and they have a solid theoretical guarantee that the error caused by approximation is strictly bounded.\n\n3. Experimental results verify the effectiveness of the proposed AdvAD method, which achieves higher attack success rate, lower perturbation strength, and better image quality.\n\nWEAKNESSES:\n1. In section 3.4, the details of AdvAD-X are not explained clearly. The exact step of adopting original diffusion noise in the DGI strategy is not discussed. Additionally, in the CA strategy, the definition of non-critical image regions is not introduced.\n\n2. In section 4.4, the transferability experiment lacks comprehensiveness. As shown in Table 3, the proposed AdvAD method is only compared to a limited number of baseline methods.\n\n3. In Table 3, with a limited budget of updating iterations, the proposed AdvAD (T=10) performs very similarly to the classic PGD method when using Mob-V2 as a surrogate model, improving the black-box ASR by less than 1%.  \n\n4. The experimental settings for Table 4 are not fully introduced, such as the surrogate model used for crafting adversarial examples.\n\nQUESTIONS:\n1. How are non-critical image regions defined for AdvAD-X? Is this definition universally applicable to all images, or is it adjusted for each image separately?\n\n2. Why were other attack methods (such as NCF, ACA, Diff-Attack, Diff-PGD, etc.) not considered in the transferability experiment shown in Table 3?\n\n3. As only a few values (e.g., 10, 100, 1000) are discussed, how can the optimal value of the step $T$ be chosen to ensure both imperceptibility and transferability in practice?\n\nLIMITATIONS:\nThe proposed AdvAD-X method is only suitable for ideal scenarios where the crafted adversarial example is directly input to DNNs without undergoing quantization.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}

comments: SUMMARY:
This paper studies a task about generating the imperceptible adversarial noise using the diffusion model. The proposed method theoretically models the attack process as a non-parametric diffusion process. Extensive experiments demonstrate the effectives of the proposed method.

STRENGTHS:
(1) The writing is good and easy to follow.  
(2) The technique novelty is good, which studies the imperceptible adversarial perturbation generation as a non-parametric diffusion process. The behind theory is solid.  
(3) Authors conduct extensive experiments and compare many baselines to show the effectiveness of the proposed method.

WEAKNESSES:
(1 ) The adopted defense methods are not strong, lacking some strong baselines, like the random smoothing.  
[1] Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." international conference on machine learning. PMLR, 2019.

(2) Could the generated adversarial examples used for black-box (or transfer-based) attack settings? What's the limitation?

QUESTIONS:
see weakness

LIMITATIONS:
see weakness
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 3
DATE: 2024-07-22