AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks

Authors: jin  li
ziqiang  he
anwei  luo
jian-fang  hu
z jane wang
xiangui  kang
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-11 11:30:38

Abstract: Imperceptible adversarial attacks aim to fool DNNs by adding imperceptible perturbation to the input data. Previous methods typically improve the imperceptibility of attacks by integrating common attack paradigms with specifically designed perception-based losses or the capabilities of generative models. In this paper, we propose Adversarial Attacks in Diffusion (AdvAD), a novel modeling framework distinct from existing attack paradigms. AdvAD innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring basic modeling approach rather than using the denoising or generation abilities of regular diffusion models requiring neural networks. At each step, much subtler yet effective adversarial guidance is crafted using only the attacked model without any additional network, which gradually leads the end of diffusion process from the original image to a desired imperceptible adversarial example. Grounded in a solid theoretical foundation of the proposed non-parametric diffusion process, AdvAD achieves high attack efficacy and imperceptibility with intrinsically lower overall perturbation strength. Additionally, an enhanced version AdvAD-X is proposed to evaluate the extreme of our novel framework under an ideal scenario. Extensive experiments demonstrate the effectiveness of the proposed AdvAD and AdvAD-X. Compared with state-of-the-art imperceptible attacks, AdvAD achieves an average of 99.9% (+17.3%) ASR with 1.34 (-0.97) $l_2$ distance, 49.74 (+4.76) PSNR and 0.9971 (+0.0043) SSIM against four prevalent DNNs with three different architectures on the ImageNet-compatible dataset. Code is available at https://github.com/XianguiKang/AdvAD.

Main paper: 
 introduction: 
 Deep Neural Networks (DNNs) are shown to be vulnerable to adversarial attacks [1, 2] (i.e., maliciously crafted perturbations added to the input data), posing serious security concerns to real-world applications [3] . The research of adversarial attacks also plays an important role in proactively exposing potential threats, as well as promoting model robustness and corresponding defense methods [4] [5] [6] [7] [8] [9] [10] [11] . Many attacks [12] [13] [14] [15] focus on maximizing the attack success rate and transferability under relatively lenient restrictions (i.e., l ∞ or l 2 norm) of adversarial perturbation, but they could have poor stealthiness and imperceptibility since the crafted adversarial examples can be easily detected by the Human Visual System (HVS) [16] . Therefore, imperceptible adversarial attacks [17] [18] [19] [20] [21] [22] [23] , aiming to maintain attacking efficacy while improving imperceptibility, have attracted considerable attention.Current imperceptible adversarial attacks could be summarized into two categories: 1) perturbationbased attacks devised on perceptual characteristics, and 2) unrestricted attacks. The first one is motivated by the fact that adding adversarial perturbations to different components of an image has varying perceptual quality levels to the HVS. By studying components such as image color [19] , texture complexity [21] , frequency spectrum [23, 24] , etc., these methods design corresponding perceptual-based loss functions and incorporate them to the optimization process to craft adversarial examples where the adversarial perturbation is constrained and hidden within specific image regions. Instead of injecting noise-like adversarial perturbations, unrestricted attacks heavily but reasonably modify attributes of images like semantic content to perform attacks. Apart from early work that adopts GANs [25] , some recent methods combine the prevalent diffusion models [26] [27] [28] into the adversarial optimization process in an image edition-like way of repeatedly adding noise and denoising to eliminate the noise pattern within the final adversarial examples [29, 30] or optimize the embedding of latent diffusion models [31, 32] . However, due to the uncertainty of generative models and the unrestricted setting itself, some unrestricted adversarial examples inevitably exhibit obvious unnatural texture or semantic changes and lose the imperceptibility, especially for images with complex content. Although previous methods have equipped attacks with imperceptibility utilizing various designs mentioned above, it remains an essential challenge of achieving imperceptible adversarial attacks: How to attack with inherently minimal perturbation strength from a modeling perspective?To address this fundamental challenge, we propose Adversarial Attacks in Diffusion (AdvAD), a brand new modeling framework distinct from common attack paradigms of gradient ascending [2] or optimization with adversarial losses [17] . The proposed AdvAD explores a novel non-parametric diffusion process for attacks, which fully inherits two key merits of diffusion models: i) the modeling philosophy of converting a difficult task into a series of simple sub-tasks, and ii) solid theoretical foundation. Specifically, AdvAD achieves high attack efficacy with intrinsically lower perturbation strength by innovatively modeling the attack process as a decomposed diffusion trajectory from an initialized noise to an adversarial example. At each step, a much subtler (for imperceptibility) yet more effective (for attack performance) adversarial guidance is calculated and injected with two cooperating, theoretically grounded non-parametric modules called Attacked Model Guidance (AMG) and Pixel-level Constraint (PC), which gradually leads the end of this trajectory from the original image distribution to a desired adversarially conditioned distribution based on the theory of diffusion models (e.g., deterministic diffusion [27] , conditional sampling [33, 34] , etc.).Here, we would like to clarify that the proposed diffusion process for attacks is considered as non-parametric since it does not require additional networks as needed in regular diffusion models for noise estimation. AdvAD firstly initializes a fixed diffusion noise, which is then ingeniously manipulated at each step via the adversarial guidance crafted by the proposed AMG and PC modules using only the attacked model with theoretically derived equations. In this way, the proposed AdvAD is facilitated with the modeling approach of diffusion models rather than their denoising or generative capabilities, which avoids the negative impact like semantic content changes caused by the uncertainty of generative models and also promises relatively low computational complexity. Based on AdvAD, we further propose an enhanced version AdvAD-X ('X' for 'eXtreme') with two extra strategies to squeeze the extreme performance in an ideal scenario of the proposed new modeling framework with unique properties, which also possesses theoretical significance and provides new insights for revealing the robustness of DNNs. In summary, our main contributions are:• Addressing the essential challenge of imperceptible adversarial attacks from a novel modeling perspective for the first time, we theoretically explore and derive the basic modeling of diffusion models to perform attacks with inherently lower perturbation strength through a non-parametric diffusion process that requires no additional networks.• We propose two attack versions, AdvAD and AdvAD-X. For the basic AdvAD, the AMG and PC modules cooperate to craft much subtler yet effective adversarial guidance which is progressively injected via initialized diffusion noise at each step, and AdvAD-X further reduces the perturbation strength to an extreme level in an ideal scenario with theoretical significance.• Extensive experiments are conducted to evaluate the effectiveness of our methods in terms of attack success rate, imperceptibility, and robustness. Experimental results demonstrate the superiority of the novel modeling approach for imperceptible adversarial attacks. 
preliminaries: 
 Adversarial Attacks. Given an original image x ori with ground-truth label y gt and a classifier f (•) satisfying f (x ori ) = y gt , normal untargeted attacks aim to craft the adversarial example x adv that misleads the classifier, formulated as:EQUATIONwhere ∥ • ∥ p represents l p -norm that is usually implemented with l ∞ -norm to limit the distance between x adv and x ori within an upper bound of budget ζ. In this paper, we focus on the more general setting of untargeted attacks. More information on related work is provided in Appendix A.Deterministic Diffusion Process. In the deterministic situation of DDIM [27] with σ t = 0, for an image x 0 and pre-defined diffusion coefficients α 0:T ∈ (0, 1] T for step t ∈ [0 : T ], x t in the Forward process of adding noise to x 0 is given by x t = √ α t x 0 + √ 1 -α t ϵ, where ϵ ∼ N (0, I ) represents Gaussian noise. For the Backward denoising steps, unlike the DDPM [26] based on Markov chains that each state directly depends on the previous one, DDIM employs a non-Markovian approach. In the backward process, each step first involves calculating a "prediction" of final step x 0 t from current x t , then adding noise to it again to obtain x t-1 , expressed as:EQUATIONwhere ϵ θ (x t ) is a estimated diffusion noise using a pretrained neural network θ for current step, and the term in the first parenthesis represents the predicted x 0 t , derived by a simple variation of Eq. ( 2). Conditional sampling. Song et al. [34] propose the conditional sampling technique for the scorebased generative models with score function ∇ xt log p(x t ) [35] , a kind of generative model has close relationship to diffusion models. Without loss of generality, for a condition y (e.g., class label, mask, etc.) and corresponding conditional distribution p(x|y), a score-based model can sample from p(x|y) by modifying the score function at each step of t to ∇ xt log(p(x t )p(y|x t )) if p(y|x t ) is known. Subsequently, with the connection between the score function and the noise ϵ t of diffusion models as [34] , this joint distribution could be expanded to the deterministic process of DDIM, achieved by updating the noise ϵ t to ϵ ′ t at each step as [33] :∇ xt log p(x t ) = -1/ √ 1 -α t ϵ tEQUATION3 Proposed Adversarial Attacks in Diffusion 
overview: 
 From a novel modeling perspective, we propose Adversarial Attacks in Diffusion (AdvAD) to attack with inherently smaller perturbation strength through a non-parametric diffusion process for the first time. As shown in Figure 1 , different from previous attack paradigms that employ gradient ascending or optimization with varying kinds of adversarial losses, AdvAD innovatively performs attack within a decomposed non-parametric diffusion trajectory starting from an initialized noise, in which very subtle yet effective adversarial guidance is crafted and injected to gradually push the end of this trajectory to a desired adversarially conditioned distribution from the original image.Intuitively, given the original image x ori with an initialized Gaussian noise ϵ 0 ∼ N (0, I ), a fixed diffusion trajectory from xT to x0 (x 0 = x ori ) can be easily obtained using DDIM Backward for the deterministic diffusion process as:EQUATIONEQUATIONWith this deterministic diffusion trajectory of the original image, performing adversarial attacks within it requires solving two main problems: i) directing the final result of this diffusion process to a desired adversarial example rather than the original image; ii) ensuring the modified trajectory (denoted as xt , εt for step t) close to the original trajectory (x t , ϵ 0 for step t) of the clean image to achieve the imperceptibility of attacks. Eq. ( 4)Eq. ( 7) Eq. ( 10)Eq. ( 8) Eq. ( 11) adopts the non-Markovian process for approximating x adv using x0 t to craft adversarial guidance and injects it into the initialized diffusion noise, then Pixel-level Constraint (PC) module imposes restriction to produce the noise for the next step and serves to control the whole process precisely.By viewing the attack process as a distribution-to-distribution transformation through a nonparametric diffusion process, the proposed AMG module theoretically integrates the conditional sampling technique of diffusion models to craft the adversarial guidance only using the attacked model f (•). For untargeted attacks, the ultimate goal is modifying x ori with f (x ori ) = y gt to x adv so that f (x adv ) ̸ = y gt , which can be regarded as directing the determined distribution p(x ori ) of the original diffusion trajectory to an distribution of x adv with the attacked model as p(x adv |f (x adv ) ̸ = y gt ). Thus, we regard f (x adv ) ̸ = y gt as an adversarial condition, and employ the conditional sampling technique to the original trajectory by manipulating the diffusion noise to achieve this, expressed as:EQUATIONHowever, Eq. ( 6) is clearly unsolvable since x adv is unknown during the diffusing process. To address this, inspired by the properties of deterministic non-Markovian DDIM that a final diffusion result is firstly calculated at each step, we can calculate x0 t via the equation of DDIM non-Markovian process with εt+1 from the previous step, and use it to approximate x adv , expressed as:EQUATIONThe accurate error upper bound and convergence of this approximation are given in Proposition 2 in conjunction with the proposed PC module, and the validity of this approximation can also be explained intuitively from the premise of our method. That is, we have x0 t = x ori for all step t in the original diffusion trajectory, and the modified trajectory should be very close to the original one, so that the relationship between x0 t and x adv should satisfy x0 t ≈ x adv . With Eq. ( 7), the term of p(f (x adv ) = y gt |x t ) in Eq. ( 6) can be written as p(f (x 0 t ) = y gt |x t ) = p(f (x 0 t ) = y gt ) since x0 t is calculated from xt , which is exactly the output logits of f (x 0 t ) with Sof tmax(•) function for the class y gt . Denoting this term as the classification probability of the attacked model as p f (y gt |x 0 t ), we can obtain the solvable equation of AMG module that injects adversarial guidance to the initialized diffusion noise using only f (•) without any additional network:EQUATIONAt this point, in addition to the benefits from modeling, this calculation process of AMG also plays a role in endowing AdvAD with imperceptibility. As the attack progresses, the probability p f , the term of log(1 -p f ) as well as coefficient √ 1 -α t gradually approach 0, which means the strength of injected adversarial guidance gradually converge to 0 in AdvAD, while common classification losses (e.g, Cross-Entropy, Log Loss, etc.) used in other attack paradigms will increase on the contrary. Further analysis and experiments on this property are provided in Proposition 1 and Sec. 4.5.Collaborating with AMG, the PC is introduced to impose precise control and streamline the modified diffusion trajectory for attacks. A straightforward choice is to design PC for xt that constrains each xt using xt , thus ensuring x0 t close to x0 t and the final x adv close to x ori . However, such a "hard" constraint directly applied to xt will impair the effectiveness of AMG and disrupt coherence of the transforming trajectory. Therefore, we formulate a more suitable PC for εt as in Theorem 1.Theorem 1 Given diffusion coefficients α T :0 ∈ (0, 1] T , the x ori , xt , ϵ 0 from the original trajectory, xt , εt from the modified trajectory, and a variable ξ, if εt and ϵ 0 satisfiesEQUATIONfor all t ∈ [T : 1], then it follows that ∥x t -xt ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1-α T )ξ, ∥x 0 t -x ori ∥ ∞ ≤ ξ, and ∥x 0 -x ori ∥ ∞ ≤ ξ hold true.According to Theorem 1, the PC for εt is implemented as:EQUATIONwhere P l∞(ϵ,ξ) (•) is a projection operation that constrains the output ε′ t of AMG(•) to εt based on a l ∞ -norm ball of ϵ 0 to satisfy Eq. ( 9). After PC, the diffusion noise εt for next step is obtained, and the xt-1 can be calculated using the deterministic DDIM backward equation as:EQUATION)The elaborate PC for εt directly cooperates with AMG to constrain the diffusion noise, which streamlines the whole diffusion process and can serve to simultaneously control the terms of xt , x0 t , and x0 , satisfying the premise that two trajectories are close and ensuring the effectiveness of AdvAD. The complete pseudo code of AdvAD is provided in Algorithm 1.Subsquently, based on Theorem 1, we further give two propositions about AdvAD as: Proposition 1 Under the conditions of Theorem 1, by denoting constrained εt = ϵ 0 -δ t , we haveEQUATIONwhereλ t = √ 1-αt √ αt - √ 1-αt-1 √ αt-1 , and ∥δ t ∥ ∞ ≤ √ α T √ 1-α T ξ.Proposition 2 Under the conditions of Theorem 1, the upper bound on the error of the approximation in Eq. ( 7) can be expressed asEQUATIONProposition 1 explicitly states the much subtler and decreasing strength of the adversarial guidance injected at each step of AdvAD's non-parametric diffusion process, and also allows for a quantitative analysis (as in Sec. 5.5). Proposition 2 indicates the validity and convergence of the approximation of x adv ≈ x0 t in AMG (Eq. ( 7)). It is evident that as t goes from T to 1, α t increases from 0 to 1, the upper bound on the approximation error rapidly converge from 2ξ to 0. The detailed derivations of the mentioned PC for xt , proofs of Theorem 1 and Proposition 1, 2 are provided in Appendix B.Building upon AdvAD, we further propose a scheme called AdvAD-X ('X' for 'eXtreme') with two extra strategies called Dynamic Guidance Injection (DGI) and CAM Assistance (CA), aiming to squeeze the extreme performance of our novel modeling framework.DGI and CA Strageties. As aforementioned, the attack capability of AdvAD comes from the very subtle yet effective adversarial guidance crafted by AMG and PC, and the intensity of guidance will decrease to 0 as the process progresses. Thus, the DGI is naturally emerged as a dynamic skipping stragety to skip the unnecessary calculation and injection of adversarial guidance, especially for those steps in the later process. With DGI, AdvAD-X dynamically avoids the execution of AMG and PC and adopts original ϵ 0 as the diffusion noise for the steps where the x0 t ≈ x adv is already able to mislead the attacked model, reducing the accumulated guidance strength as well as the computational complexity. On the other hand, inspired by the Class Activation Mapping (CAM) [36] identifies critical regions of an image about a decision made of a classifier, our CA strategy calculates a mask (if available) m ranging from 0 to 1 of x ori with f (•) and y gt using GradCAM [37] to further suppress the strength of adversarial guidance within the non-critical image regions in those steps that are not skipped. The equation of AMG with CA strategy can be modified as:EQUATIONSpecific algorithm of AdvAD-X in pseudo code is provided in Appendix C.Ideal Scenario. Equipped with DGI, AdvAD-X omits a large number of adversarial guidance that is injected by default in AdvAD, while the absolute strength of guidance in each of the remaining steps are also suppressed by CA, successfully reducing the final adversarial perturbation to an extreme level. This extreme case leads to a problem that in the default setting of attacking with 8-Bit RGB images, the adversarial perturbation of pixels where the intensity is less than 0.5 will be erased due to the quantization. However, in practice, the input of DNNs is normalized as floating-point data type to avoid gradient problems during training [38, 39] , and white-box attack allows access to the entire of DNNs. Therefore, for AdvAD-X, we specifically consider an ideal scenario that is usually overlooked but has theoretical significance. That is, directly input the raw final adversarial example in floating-point data to DNNs without quantization to evaluate the extreme performance of AdvAD-X.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [Yes] Justification: The proposed attack method is built on a solid theoretical foundation, which is derived from the derivation of the diffusion models. The specific methods and theoretical properties are introduced in detail in Sec. 3, and the detailed proofs of the proposed theorem and two propositions are given in Appendix.Guidelines:• The answer NA means that the paper does not include theoretical results.• All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced. • All assumptions should be clearly stated or referenced in the statement of any theorems.• The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition. • Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material. • Theorems and Lemmas that the proof relies upon should be properly referenced. 
experimental setup: 
 Dataset. In line with prior studies [15, 19, 32, 40] , our experiments are conducted on the ImageNetcompatible Dataset1 , containing 1,000 images of ImageNet [41] classes with size of 299 × 299, and the images are resized to standard input size of 224 × 224 in all experiments. Models. We select the widely used CNNs of ResNet-50 [42] and enhanced ConvNeXt-Base [43] , Swin Transformer-Base [44] with Transformer [45] architecture, and VisionMamba-Small [46] with the recently emerged advanced Mamba [47] architecture. Attacks. We choose classic PGD [12] and seven attacks that claim having imperceptibility as comparison methods, including normal imperceptible attacks of AdvDrop [21] , PerC-AL [19] , SSAH [24] , and unrestricted attacks of NCF [40] , ACA [32] , DiffAttack [31] , Diff-PGD [30] , and the generative capability of diffusion models are utilized the last three attacks. For our proposed AdvAD and AdvAD-X, we set ξ = 8/255 and T = 1000 for all experiments unless specifically mentioned. All the other comparison methods are evaluated using their official open-source code with the default hyper-parameters. The results of AdvAD-X are obtained in the ideal scenario with float-pointing raw data as described in Sec. 3.4. Evaluation Metrics. Attack success rate (ASR) is used to evaluate the attack efficacy, and seven metrics are adopted to comprehensively assess the imperceptibility, including l 2 and l ∞ distances for absolute perturbation strength; Peak Signal-to-Noise Ratio (PSNR), Structure Similarity (SSIM) [48] , and three network-based metrics, i.e., Learned Perceptual Image Patch Similarity (LPIPS) [49] , Fréchet Inception Distance (FID) [50] , and a non-reference metric MUSIQ [51] for image quality.White-Box Attacks. degradation (e.g., PerC-AL and SSAH for ConvNeXt and VisionMamba). For unrestricted attacks, it is expected for them to perform poorly in the quantitative metrics, but if the results are poor for all image quality metrics, it usually indicates that the images are damaged. Meanwhile, since the optimizer usually cannot find the global optimal solution, the optimization-based methods tent to show sub-optimal ASR. For AdvAD-X, surprisingly, the perturbation strength is reduced to an extremely low level with still high attack efficacy in the ideal scenario with floating-point raw data.Visualization. The visualization of adversarial examples againt ResNet-50 in Figure 2 clearly show the characteristics of different imperceptible attacks against ResNet-50. For the first image with a relatively simple and clear object, the unrestricted attacks of NCF, DiffAttack and ACA perform attacks by modifying the semantics fairly, while DiffPGD uses denoising to avoid significant semantic modifications, but often has lower ASR as in Table 1 . However, for the image with complex content, the unrestricted attacks result in obvious unnatural color, texture, and semantic changes and artifacts.For the normal attacks with perceptual-based restrictions, by amplifying the noises, it can be seen that AdvDrop has a obvious gridding effect due to the blocking operation in DCT operation, and the perturbation strength in PerC-AL and SSAH is also related to the edge or texture components of the image. In contrast, our AdvAD continuously maintains uniform and lower perturbation which is very difficult to be seen even in the adversarial examples with ×5 noise. For AdvAD-X, the perturbations are very slight modifications to the decimal places of the floating-point raw data for each pixel, thus it is still difficult to be seen even after ×100 magnification. More quantitative comparisons and visualizations are provided in Appendix D.1, D.2.The robustness of attacks is also evaluated against defense methods, including purification methods of NRP [4] , DS [52] , diffusion-based purification [5] and adversarial training robust models of Inc-V3 [8] , Res-50 [9] , Swin-B [53] , ConvNeXt-B [53] . Two classic image transformation defenses of JPEG compression [54] , Bit-depth reduction [55] , and another type of defense, random smoothing [11] , are also included. Considering the robustness and transferability of attacks are comparable only under close perturbation budget, the unrestricted attacks are not included in this and the next section. As shown in Table 2 , the proposed AdvAD demonstrates the best robustness in overall average compared with other imperceptible attacks of AdvDrop, PerC-AL and SSAH. Specifically, when attacking robust models, AdvAD achieved an much higher average ASR of 75.3%. For post-processing purifications aim at eliminating adversarial perturbations, despite the inherently lower perturbation strength, AdvAD still maintains the best or second-best ASR against different purifications, which is comparable to AdvDrop with much higher perturbation strength. Similarly, for the results of classic image transformation defenses in Figure 3 , AdvAD also exhibits advantages in most of the factors.In addition, since random smoothing is not a truly end-to-end method but a method that uses the base model to make multiple predictions on noise-augmented images, we adpot a semi-white-box setup to fully test the attack performance as described in the caption. Table 3 shows the experimental results, and the PerC-AL is not included because it fails to attack in this setting. It can be seen that for all σ, our AdvAD continuously achieves the best ASR with smaller perturbation strength. We suppose the robustness of AdvAD mainly benefits from two aspects. Firstly, AdvAD performs attacks during a unique non-parametric diffusion process with adversarial guidance, which may be easier to break through existing adversarial training models using common attack paradigms. On the other hand, the inherently lower perturbation crafted by AdvAD is spread across the images more uniformly rather than gathering in some areas as can be seen in the visualization, making it more difficult to be eliminated. For AdvAD-X, it is anticipated to exhibit weak robustness since the extremely low perturbation in the ideal scenario is easy to defense apparently.Table 4 reports the ASRs of black-box attacks and the corresponding results of imperceptibility. We also test AdvAD with different step of T for comprehensive evaluation. Consistent with the diffusion models, a larger T denotes a finer decomposition granularity of the entire process, corresponding to the strength of adversarial guidance at each step. Thus, AdvAD with a larger T exhibits better imperceptibility, while a smaller T implies stronger black-box transferability. Notbly, though there is a clear negative correlation between imperceptibility and transferability, our AdvAD exceeds all comparison attacks in both of transferability and imperceptibility at different comparable levels, demonstrating the effectiveness of the proposed novel modeling framework.To further elaborate the relationship between transferability and imperceptibility of AdvAD, as well as the optimal trade-off in practice, we plot two line graphs in Figure 4 under more values of T . As shown in Figure 4 (a), as the value of T on the horizontal axis changes, the relationship between imperceptibility and transferability shows a clear proportional trend mentioned above as aforementioned, consistent across different surrogate models. For the optimal trade-off, we consider that the intersection point of the two curves represents a balance between imperceptibility and transferability. Accordingly, for the ResNet-50 and MobileNetV2 models, the optimal values of T are 50 and 25, respectively. Moreover, Figure 4 (b) illustrates more direct curves of this relationship and the positions of other comparison methods within it. Note that, all the other comparison methods are located to the lower left of the curve of AdvAD. This indicates that our method consistently achieves the best results in both transferability and imperceptibility compared with other state-of-the-art restricted imperceptible attacks, demonstrating the effectiveness of our AdvAD as a new attack paradigm with flexibility through the proposed non-parametric diffusion process.Eq. (12) in Practice. In Figure 5 , we illustrate the values of λ t and ∥δ t ∥ ∞ of Eq. ( 12), and ∥δ t ∥ ∞ is calculated with 100 randomly selected images. While Proposition 1 indicates that the upper bound of ∥δ t ∥ ∞ is invariant with respect to step t, the actual strength of the adversarial guidance produced by AMG rapidly decreases as the process progresses, which validates the unique property given at the end of Sec. 3.2. With the similarly decreasing λ t , the whole term of λ t ∥δ t ∥ ∞ representing l ∞ distance of the guidance at step t also decreases from about 0.0008 to 0, supporting that the proposed modeling framework performs imperceptible attacks with inherently small perturbation strength. Performance with Smaller ξ. The results of AdvAD and AdvAD-X with smaller ξ for PC module are shown in Table 5 . As ξ decreases from 8 to 2, the imperceptibility is naturally improved because of the upper bound of perturbation becomes lower, yet the ASR of 94.8% only drops slightly. When ξ = 1/255, AdvAD still holds 87.4% ASR with 57.87 PSNR and 0.9993 SSIM, which means a large number of examples still can fool the DNN with a maximum of ±1 modification for each pixel, demonstrating the effectiveness of the adversarial guidance injected in the proposed diffusion process for attacks. Moreover, we provide the ablation study of AdvAD-X and additional discussions in Appendix D.3, D.4.Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)? Answer: [Yes] Justification: We present all the formulas, calculation processes, algorithms, and hyperparameters of the proposed methods in detail. And we have tested that by fixing the random seed, our method can produce consistent results with the same input on our machine, providing good reproducibility. Guidelines:• The answer NA means that the paper does not include experiments.• If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not. • If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable. • Depending on the contribution, reproducibility can be accomplished in various ways.For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed. • While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. (c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset). (d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility.In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results. 
conclusion and outlook: 
 In this paper, we propose a novel, fundamental modeling framework to tackle the challenge of imperceptible attacks. By exploring and deriving basic theory of diffusion models, the proposed AdvAD performs attacks through a non-parametric diffusion process with adversarial guidance, achieving inherently lower overall perturbation strength with high attack efficacy from a modeling perspective. Besides, the proposed AdvAD-X evaluates the extreme of this novel modeling framework and further reduces the perturbation strength to an extremely low level in an ideal scenario. Extensive experimental results support the effectiveness and progressiveness of the proposed methods. Beyond imperceptibility, AdvAD holds the potential to become a general and extensible attack paradigm thanks to the solid theoretical foundation and the innovative, controllable diffusion-based process for attacks. In addition, we also hope the new observation that AdvAD-X can successfully attack with extremely small perturbation using floating-point raw data can bring inspiration for revealing the robustness and interpretability (e.g., decision boundaries) of DNNs. Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?Answer: [Yes]Justification: We open-source the code on GitHub and give the Python environment requirements, dataset preparation, running commands, etc. Following our instructions, the experimental results given in the paper can be easily reproduced.Guidelines:• The answer NA means that paper does not include experiments requiring code.• Please see the NeurIPS code and data submission guidelines (https://nips.cc/ public/guides/CodeSubmissionPolicy) for more details. • While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark). • The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: //nips.cc/public/guides/CodeSubmissionPolicy) for more details. • The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc. • The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why. • At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable). • Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted. 
experimental setting/details: 
 Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?Answer: [Yes]Justification: One of the main contributions of our paper is to propose a novel adversarial attack modeling framework based on a non-parametric diffusion process. Benefiting from the proposed modeling approach, our attack method only needs two simple hyperparameters to accurately control the entire attack process, without the need for complex training or optimization processes in other paradigms.Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [No] Justification: Only Figure 5 reports a actual statistic numerical curve of a theoretical upper bound in the actual execution process, which is calculated from actual data using a confidence level of 0.85 and shows the confidence interval. In other experiments, due to limited computing resources, the error bar under multiple runs is not included. However, as mentioned above, the methods proposed in this paper can obtain consistent results in multiple runs by fixing the random seed.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
experiments compute resources: 
 Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes] Justification: We have indicated that all the experiments are conducted on a single NVIDIA RTX 3090 GPU, and the running time required for all methods to attack different models are included in Table 1 , Table 5 , and Table 8 to compare the computational complexity while providing a reference.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?• Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Beginning with the attack paradigm of Fast Gradient Sign Method (FGSM) [2] , there are numerous great works focusing on the imperceptibility of adversarial attacks have been proposed [17] [18] [19] [20] [21] [22] [23] . In contrast to another line of attacks aimed at improving the attack success rate and the transferability for black-box models with a more lenient limitation of perturbation strength [13] [14] [15] , imperceptible adversarial attacks are dedicate to accomplish attacks using as minimal perturbation as possible while deceiving human perception. Among them, PerC-AL [19] improves the imperceptibility by alternating between the classification loss and perceptual color difference when updating perturbations. AdvDrop [21] uses Discrete Cosine Transform (DCT) to discard details in images that are imperceptible for humans. SSAH [24] limits perturbation to high-frequency components using Discrete Wavelet Transform (DWT) to make it undetectable. Similarly, AdvINN [22] also utilizes the DWT and exploits invertible neural networks to specially perform targeted attacks. In addition, with an unrestriced setting [25] , some recent works have incorporated the capabilities of generative models (e.g., diffusion models [26] ) into common attack frameworks to make adversarial examples more natural and enhance the imperceptibility. DiffAttack [31] and ACA [32] combine the optimization of adversarial losses with the Stable Diffusion [28] to generate unrestricted adversarial examples, while Diff-PGD [30] and AdvDiffuser [29] incorporate the classic PGD method [12] into the diffusion steps to make the adversarial examples undergo denoising processing.Compared to these traditional restricted imperceptible attacks or the recent unrestricted imperceptible attacks (e.g., diffusion-based), the proposed AdvAD is a completely novel approach distinct from existing attack paradigms. It is the first pilot framework which innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring fundamental modeling approach of diffusion models rather than using their denoising or generative abilities, achieving high attack efficacy and imperceptibility with intrinsically lower perturbation strength. Following the setting of restricted attack, the modeling of AdvAD is theoretically derived from conditional sampling of diffusion models, supporting its attack performance and imperceptibility, and does not require any loss functions, optimizers, or additional neural networks.In this section, we first introduce the specific straightforward Pixel-level Constraint (PC) for xt that is simply mentioned at the beginning of Section 3.3 of the main text as an intuitive preliminary, then we provide the detailed proofs of Theorem 1 and Proposition 1, 2 given in the PC for εt .For each known xt in the fixed diffusion trajectory of the original image x ori , and modified xt in the attacking trajectory with the proposed Attacked Model Guidance (AMG) leading to the adversarial example x adv , the objective of PC is to control and constrain these two trajectories to be close, ensuring the final x0 (i.e., x adv ) close to x0 (i.e., x ori ). It is obvious that a straightforward way to achieve the goal by directly constrain every xt using xt . Thus, in PC for xt , we can utilize the restriction of adversarial examples and the relationship between x adv , x0 t and xt to derive the constraint for xt . Given the budget ξ, the desired restriction of adversarial examples isEQUATIONNext, since the εt is unconstrained in the case of PC for xt , we adopt the initialized ϵ 0 to calculate x0 t approximating x adv as:EQUATION)where α 0 = 1, and α 1:T ∈ (0, 1] T is a pre-defined decreasing scalar sequence. And the xt of the original trajectory is calculated as:EQUATIONBy substituting Eq. ( 16) and Eq. ( 17) into Eq. ( 15), the constraint for xt can be easily derived, denoted as:EQUATIONIn this way, the PC for xt can be implemented at the start of each step to achieve the basic restrictions by employing a projection operation to xt according to Eq. ( 18). However, this direct modification of xt at each step obviously disrupts the entire diffusion trajectory from noise to our desired adversarial distribution, and can not achieve the final imperceptibility. Additionally, it is observed that the estimation of x0 t in each step employs a fixed ϵ 0 , impairing the adversarial guidance crafted by AMG.Therefore, we carefully analysis the important noise term in our diffusion-based modeling approach for adversarial attacks, and present Theorem 1 to support our PC for εt as described in the main text. The proof of Theorem 1 is provided as follow.Theorem 1 Given diffusion coefficients α T :0 ∈ (0, 1] T , the x ori , xt , ϵ 0 from the original trajectory, xt , εt from the modified trajectory, and a variable ξ, if εt and ϵ 0 satisfies EQUATIONfor all t ∈ [T : 1], then it follows that ∥x t -xt ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1-α T )ξ, ∥x 0 t -x ori ∥ ∞ ≤ ξ, and ∥x 0 -x ori ∥ ∞ ≤ ξ hold true.EQUATION)T -1 from the fixed trajectory where x0 t always equals to x ori , we have:EQUATIONWith xT = xT , Eq. (20), Eq. ( 21), and the relationship of∥ε T -ϵ 0 ∥ ∞ ≤ √ α T √ 1-α T ξ, we have: ∥ε T -ϵ 0 ∥ ∞ ≤ √ α T √ 1 -α T ξ ⇐ ⇒ √ 1 -α T εT √ α T - √ 1 -α T ϵ 0 √ α T ∞ ≤ ξ ⇐ ⇒ xT - √ 1 -α T εT √ α T - xT - √ 1 -α T ϵ 0 √ α T ∞ ≤ ξ ⇐ ⇒ x0 T -1 -x0 T -1 ∞ ≤ ξ (22)Meanwhile, for the relationship between xT -1 and xT -1 at the initial step, we have:EQUATION)where the transition from Eq. ( 23) to Eq. ( 24) is obtained with the real constant value of α t . At this point, it can be seen that Theorem 1 holds in the initial case.Inductive step. Assuming the theorem holds for some arbitrary step k, where T ≥ k > 1, we have:EQUATION)EQUATIONandEQUATION)Based on the inductive hypothesis, we next show the validity of the theorem at step k -1. Similar to Eq.( 20), we unfold the calculation of x0 k-1 with xk and εk as:EQUATION)And the x0 k-1 can be denoted as:EQUATIONConsequently, by substituting Eq. ( 29) and Eq. (30EQUATIONwhere Eq. (31) to Eq. (32) utilizes the triangle inequality property of l p -norm, and Eq. ( 33) is obtained with Eq. (28) . Then, given the imposed condition of Eq. ( 19), we can get:EQUATIONAnd the relationship between xk-1 and xk-1 at step k -1 can be expressed as:EQUATIONEQUATION)where the triangle inequality property is utilized again to obtain Eq. (36) from Eq. (35), then Eq. (28) and Eq. ( 34) is substituted to obtain Eq. (37) . Obviously, for the case of step k -1, it is also consistent with the theorem.Therefore, by extending the truth of the theorem from arbitrary step k to k -1, and given its established validity at the initial case, the principle of mathematical induction allows us to conclude that ∥xt -xt ∥ ∞ ≤ ( √ α t - √ 1 -α t √ α T √ 1-α T )ξ, ∥x 0 t -x ori ∥ ∞ ≤ ξ hold true for every step t ∈ [1 : T ].For t = 0 and α 0 = 1, we have x0 0 = x0 and x0 = x ori , thus it is obvious that ∥x 0 -x ori ∥ ∞ ≤ ξ. This concludes the proof of the whole Theorem 1.Next, we prove Proposition 1 about λ t and δ t by expanding and rearranging the recursive formulas in our diffusion process for attacks.Proposition 1 Under the conditions of Theorem 1, by denoting constrained εt = ϵ 0 -δ t , we haveEQUATIONwhereλ t = √ 1-αt √ αt - √ 1-αt-1 √ αt-1 , and ∥δ t ∥ ∞ ≤ √ α T √ 1-α T ξ.Proof 2 With Eq. ( 19) in Theorem 1, by denoting εt = ϵ 0 -δ t , we have:∥δ t ∥ ∞ = ∥ε t -ϵ 0 ∥ ∞ ≤ √ α T √ 1-α Tξ, and the xT -1 in the initial step can be written as:EQUATIONApplying the recursion formula twice, we have:EQUATIONSimilarly, for xT -3 , we have:EQUATION)It is obvious that the coefficients of each term exhibit a clear regular pattern related to the step t.Following this pattern, we can accordingly get the expression of xt as:xt = √ α t √ α T xT - √ α t √ 1 -α T √ α T - √ 1 -α T -1 √ α T -1 (ϵ 0 -δ T ) - √ α t √ 1 -α T -1 √ α T -1 - √ 1 -α T -2 √ α T -2 (ϵ 0 -δ T -1 ). . .EQUATIONAnd the final x0 can be expressed as:x0 = √ α 0 √ α T xT - √ α 0 √ 1 -α T √ α T - √ 1 -α T -1 √ α T -1 (ϵ 0 -δ T ) - √ α 0 √ 1 -α T -1 √ α T -1 - √ 1 -α T -2 √ α T -2 (ϵ 0 -δ T -1 ). . .EQUATIONNote that in α 0 = 1 Eq. ( 44), and the coefficients of ϵ 0 can be mostly eliminated. Thus, by defining λ t as:EQUATIONwe can rearrange Eq. (44) into:EQUATION)where x0 is the final output of the diffusing process and x adv = x0 . This concludes the proof of Proposition 1.Finally, we prove Proposition 2 about the validity and convergence of the approximation x adv ≈ x0 t . Proposition 2 Under the conditions of Theorem 1 and Proposition 1, the upper bound on the error of the approximation in Eq. ( 22) can be expressed asEQUATIONProof 3 With Eq. ( 43) and the definitions of Proposition 1, xt and x0 t can be written as:EQUATIONandEQUATIONFor x adv , we have:EQUATIONWith Eq. (49) and Eq. (50), we can obtain:EQUATIONThus, we have:EQUATIONThis concludes the proof of Proposition 2. ▷ Mask m for the CA strategy. 7: for t = T to 1 do 8:Calculate x0 t via Eq. ( 7); ▷ Approximation of x0 t ≈ x adv . 9:Transform the range of x0 t to [0, 255]; ▷ Align with data range of image. 10:// DGI strategy for performing AMG and PC dynamically.11: if f (x 0 t ) == ygt then 12:Calculate ε′ t using m with AMG via Eq. ( 14); ▷ AMG module and CA strategy. 13:Calculate εt with PC via Eq. ( 10); ▷ Same PC module as AdvAD. 14: else 15:Set εt = ϵ0; ▷ Skip the operations of current step. 16:Calculate xt-1 via Eq. ( 11); ▷ One step backward from t to t -1. 17: Transform the range of x0 to [0, 255];▷ Endpoint of the process. 18: return x adv = x0;▷ Directly return x adv in raw floating-point data for the ideal scenario.Table 6 reports the untargeted attack performance and imperceptibility of ten methods on Vgg-19, MobileNet-V2, and WideResNet-50 models. The results indicate that the proposed AdvAD and AdvAD-X, leveraging a novel modeling framework, consistently achieve superior performance. These findings further underscore the effectiveness of the proposed approach. 6 . The visualizations provide a clear insight into how different methods accomplish imperceptible attacks. Our AdvAD and AdvAD-X methods execute imperceptible attacks with lower overall intensity of perturbations. Notably, for images with salient objects (e.g., the bridge in the second examples), the perturbation intensity of AdvAD also naturally increases in the object regions during the gradient-based adversarial guidance calculation, while AdvAD-X, equipped with the dynamic strategy, still shows uniform and lower overall perturbation intensity.From AdvAD to AdvAD-X, Table 7 shows the effect of the two strategies of CA and DGI. It can be observed that adding CA in each step of AdvAD slightly improves impercepbility while maintaining the attack success rate of 100%. However, the DGI strategy significantly reduces the iterations of performing AMG and PC from 1000 to 3.97, which indicates that our framework theoretically only requires very little injected adversarial guidance to successfully perform attacks, proving the performance of our modeling method as well as the effectiveness of the adversarial guidance. In AdvAD-X, which finally uses both CA and DGI, the guidance strength in each step is further suppressed, resulting in a slight increase in the total number of iterations required adaptively, but the final perturbation strength continues to decrease to a more extreme level. Discussion on Proposition 1. In the previous sections, we obtained Proposition 1 through extensive derivations, which reformulates the AdvAD attack process using λ t and δ t . While this formulation does not represent the actual attack procedure, it enables post-analysis after the completion of attacks.In Proposition 1, although the upper bound of δ t is theoretically independent of the step t, both δ t and the coefficient λ t gradually decrease with t in quantitative results of Figure 5 due to the unique properties of AdvAD. Thus, it emerges a hypothesis that whether modifying the coefficient of gradient term of traditional attacks like PGD to decay incrementally could also achieve the imperceptibility.To isolate the impact of this hypothesis, we conduct experiments with a modified version of PGD with step size decay as:EQUATIONwhere λ t is the same coefficient as in Eq. ( 39) of Proposition 1 for alignment, and η is a fixed small factor for the initial step size. We have searched a lot of values of η to determine the optimal range, and the results of attacking three models with different architectures under three typical values of η are presented in Table 8 . It can be observed that for PGD with this strategy, the ASR is clearly proportional to η, the imperceptibility is inversely proportional to η. However, regardless of how η is adjusted, this strategy can not simultaneously match AdvAD in both ASR and imperceptibility. Firstly, for η = 5e-5, when attacking VisionMamba, ASR of this strategy is 10.5% lower than AdvAD with close PSNR, and the strategy has a 0.2% higher ASR but a 5.09 dB lower PSNR for ResNet50. For η = 3e-5, the ASR against VisionMamba and Swin further degrade, being 10.9% and 21.4% lower than AdvAD, respectively. Finally, for η = 1e-5, the modified PGD with step size decay fails to attack all the models. Nevertheless, although this step size decay strategy performs worse than our AdvAD, it indeed enhances the imperceptibility of attacks compared to the original PGD in some cases, which further validates our motivation and modeling approach. This is because, while this strategy follows a completely different technical route than AdvAD, it similarly uses subtler perturbations to progressively push adversarial examples closer to the model's decision boundary. To this end, we leave further research on the potential of this strategy to future work.Limitation. As the primary focus of AdvAD is the imperceptibility, although it achieves better transferability at lower perturbation strength compared with other restricted imperceptible attacks, its transferability is inevitably weaker than other black-box attack methods that operate in larger perturbation spaces and are specifically designed for transferability (like the unrestricted ones). However, the proposed AdvAD is essentially a general attack paradigm with a novel modeling approach and a solid theoretical foundation. By relaxing the constraint of perturbation strength and incorporating enhanced designs for the transferability into the proposed framework of non-parametric diffusion process, AdvAD also has significant potential to be modified into a specific black-box attack, and we also leave this aspect for future research.judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.https://github.com/cleverhans-lab/cleverhans/tree/master/cleverhans_v3.1.0/examples/nips17_ adversarial_competition/dataset 


Decision: This manuscript studies an imperceptible adversarial perturbation generation as a non-parametric diffusion process along with solid theoretical analyses.

The reviewers' comments have been properly addressed and most reviewers are satisfied with authors' responses.
However, some experiments are somewhat tricky.
For example, the comparison results in Table 2 indicate that the proposed attack AdvAD exhibits inferior success rates than other attacks (e.g., PGD and AdvDrop) under purification-based defenses.
The use of average ASR shows bias results.
Thus, the AC disagrees with the conclusion in Lines 272~273.

On the other hand, the AC agrees with the authors' argument that ``this is the first work to theoretically derive the fundamental modeling of diffusion models for performing imperceptible adversarial attacks with inherently low perturbation strength through a novel non-parametric diffusion process, and extensive experiments have demonstrated its effectiveness.''

So, the AC tends to accept this submission!

Reviews: review: paper_summary: paper_summary: This paper studies a task about generating the imperceptible adversarial noise using the diffusion model. The proposed method theoretically models the attack process as a non-parametric diffusion process. Extensive experiments demonstrate the effectives of the proposed method.
strength_weakness: strength_weakness: (1 ) The adopted defense methods are not strong, lacking some strong baselines, like the random smoothing.  
[1] Cohen, Jeremy, Elan Rosenfeld, and Zico Kolter. "Certified adversarial robustness via randomized smoothing." international conference on machine learning. PMLR, 2019.

(2) Could the generated adversarial examples used for black-box (or transfer-based) attack settings? What's the limitation?
questions: questions: see weakness
limitations: limitations: see weakness
paper_summary: paper_summary: In this paper, the authors propose the Adversarial Attack in Diffusion method called AdvAD, which crafts imperceptible perturbations from the model perspective without the need for additional networks.

During the non-parametric diffusion process, the proposed AdvAD method introduces Attacked Model Guidance (AMG) and Pixel-level Constraint (PC) modules to ensure both imperceptibility and transferability of the adversarial examples. 

Moreover, an enhanced version AdvAD-X is further introduced to achieve better imperceptibility and lower computational complexty.

Experiments conducted on CNN, ViT, and Mamba architectures using the ImageNet benchmark dataset demonstrate that the proposed AdvAD method achieves superior performance compared to baseline methods in terms of attack success rate, imperceptibility, and robustness.
strength_weakness: strength_weakness: 1. In section 3.4, the details of AdvAD-X are not explained clearly. The exact step of adopting original diffusion noise in the DGI strategy is not discussed. Additionally, in the CA strategy, the definition of non-critical image regions is not introduced.

2. In section 4.4, the transferability experiment lacks comprehensiveness. As shown in Table 3, the proposed AdvAD method is only compared to a limited number of baseline methods.

3. In Table 3, with a limited budget of updating iterations, the proposed AdvAD (T=10) performs very similarly to the classic PGD method when using Mob-V2 as a surrogate model, improving the black-box ASR by less than 1%.  

4. The experimental settings for Table 4 are not fully introduced, such as the surrogate model used for crafting adversarial examples.
questions: questions: 1. How are non-critical image regions defined for AdvAD-X? Is this definition universally applicable to all images, or is it adjusted for each image separately?

2. Why were other attack methods (such as NCF, ACA, Diff-Attack, Diff-PGD, etc.) not considered in the transferability experiment shown in Table 3?

3. As only a few values (e.g., 10, 100, 1000) are discussed, how can the optimal value of the step $T$ be chosen to ensure both imperceptibility and transferability in practice?
limitations: limitations: The proposed AdvAD-X method is only suitable for ideal scenarios where the crafted adversarial example is directly input to DNNs without undergoing quantization.
paper_summary: paper_summary: This paper proposes a new method, AdvAD, for generating imperceptible adversarial attacks against deep neural networks (DNNs). AdvAD is based on a novel non-parametric diffusion process, which initializes a fixed diffusion noise and then manipulates it at each step using adversarial guidance crafted by two modules: Attacked Model Guidance (AMG) and Pixel-level Constraint (PC). This process gradually leads the image from its original distribution to a desired adversarial distribution. The paper also introduces an enhanced version, AdvAD-X, which aims to achieve extreme performance under an ideal scenario. Extensive experiments demonstrate the effectiveness of both AdvAD and AdvAD-X in terms of attack success rate, imperceptibility, and robustness compared to state-of-the-art methods.
strength_weakness: strength_weakness: The paper has several weaknesses. The technical novelty is limited, as the core idea of using diffusion models for adversarial attacks has been explored in prior work (e.g., DiffAttack, ACA). The paper lacks a clear comparison with these existing diffusion-based attack methods, making it difficult to assess the incremental contribution of AdvAD. 

Another thing is how much cost is it really to generate adversarial examples this way. I mean, one important use of generating adversarial examples is for adversarial training. So if it becomes really expensive to generate adversarial examples, such a use wouldn't be really meaningful. Then what is the use of these adversarial examples really?
questions: questions: What are the specific differences between AdvAD and existing diffusion-based attack methods like DiffAttack and ACA? A detailed comparison would help clarify the novelty of the proposed approach.

What are the potential defensive measures against AdvAD, and how can they mitigate the threat posed by this attack?

How does the computational complexity of AdvAD compare to other state-of-the-art methods, especially for large-scale datasets or models?
limitations: limitations: N/A
paper_summary: paper_summary: This work proposes a novel adversarial attack framework called Adversarial Attacks in Diffusion (AdvAD). Unlike prior methods that rely on generative models or specific loss functions, AdvAD formulates attacking as a non-parametric diffusion process. This approach theoretically explores a fundamental modeling strategy instead of leveraging the denoising or generation capabilities of diffusion models with neural networks. AdvAD iteratively refines the attack by crafting subtle adversarial guidance based solely on the targeted DNN, without requiring any additional network. This process progressively transforms the original image into an imperceptible adversarial example.
strength_weakness: strength_weakness: While I have carefully reviewed the work several times, some uncertainties remain. These are addressed in the following "Questions" section. Due to these uncertainties, the initial recommendation is a borderline decision, which can be revised upwards or downwards based on the authors' response.
questions: questions: 1.	The paper claims that AdvAD achieves superior imperceptibility compared to other methods. However, after multiple readings, the justification for this remains unclear. While the text mentions "much subtler yet effective adversarial guidance at each step", "grounded on diffusion model's theoretical foundation", and various diffusion-related formulations, it lacks a clear explanation (or theoretical verification) of how using non-parametric diffusion leads to attacks with lower perturbations.
2.	Based on my understanding, AdvAD shares similarities with traditional attacks like PGD, but with a fixed number of optimization iterations (controlled by the total diffusion model timesteps T) and a gradually decaying learning rate (controlled by the $α_t$ value). I hypothesize that the decayed learning rate is a key factor contributing to imperceptibility. The learning rate starts low (at the beginning of T steps) and gradually decreases to 0 (at the end of 0 steps). This suggests that small perturbations are added first, followed by even smaller ones, potentially leading to adversarial examples closer to the classification boundary and thus exhibiting higher imperceptibility. Could the authors comment on the validity of this hypothesis?
3.	Following the previous question, to isolate the impact of the decayed learning rate strategy, it would be beneficial to include comparative experiments. These experiments would directly apply a small learning rate initialization and a decayed learning rate schedule to a traditional attack algorithm. If this approach achieves similar performance to AdvAD, it would suggest that the emphasis on diffusion model theory might not be necessary. If not, the authors should highlight the specific benefits of the diffusion model mechanism that contribute to imperceptibility.
4.	Does the selection of the initial Gaussian noise sample $ε_0$ affect the performance of AdvAD?
5.	In Table 1, is the FID metric computed between the perturbed images and the "imagenet-compatible dataset"? If the goal is to assess the realism of the adversarial examples compared to natural images, a more comprehensive evaluation would be to compare them with the raw ImageNet images. The "imagenet-compatible" dataset, with only 1000 images, might not adequately capture the entire distribution of natural images.
6.	Line 248 states that "the optimizer usually cannot find the global optimal solution, and optimization-based methods tend to show sub-optimal ASR." How can AdvAD achieve better ASR compared to these optimization-based methods?
7.	In Table 2, which classifier was used to generate the adversarial samples? The robustness of the adversarially trained model Inc-V3_{adv} and the ensemble model Inc-V3_{ens4} appears very low (almost 100% ASR). Additionally, were Res-50, Swin-B, and ConvNeXt-B clean classifiers or adversarially trained?
8.	Line 292 suggests that "a larger T exhibits better imperceptibility, while a smaller T implies stronger black-box transferability." Can the authors elaborate on this trade-off?
9.	There are a few minor writing errors throughout the paper, such as "a' adversarial" (Line 140), "fistly" (Line 144), and "an' scheme" (Line 191).
10.	There are specific questions regarding the proofs of theorems and propositions in the Appendix:

(1)	In the second row equality of Eq. 6, shouldn’t $\epsilon_T$ be $\epsilon_{T+1}$ in the first term on the numerator of the first term?

(2)	In Line 546, it Is clear that $\epsilon_{T+1}$ satisfies the inequality as $\epsilon_{T+1}$ equals $\epsilon_0$, but how does this hold for $\epsilon_{T}$ as well?

(3)	Eq. 20, third row inequality: How is this inequality derived?
limitations: limitations: Yes, limitations are identified in the paper.
paper_summary: paper_summary: In this paper, a diffusion-based adversarial attack method is proposed and extensive experiments were conducted to show the effectiveness of the method.
strength_weakness: strength_weakness: 1. because this paper proposed a new algorithm, at least a pseudo code should be provided to show how the algorithm works.
2. In the table1, it shows that the performance of the model measured in FID sometimes does not match that in other metrics measuring similarity, e.g., psnr, ssim. For example, in the experiment on visionmemba, the FID of the proposed method is not the smallest, as that in other similar metrics. Can the author give some explanation about this?
questions: questions: same
limitations: limitations: same

Comments: title: Respectful Request for Further Discussion
Respectful Request for Further Discussion
Experimental verification regarding the previous response to the comment on FID metric (Weakness 2).
Thanks for the response.
comment: Dear Reviewer ytMn,  

We sincerely thank you for your valuable feedback and the time you have taken to process our submission. As the discussion phase is nearing its end, we respectfully ask for your help once again to review our responses and let us know if they address your concerns.  

Following your valuable suggestions, we have included the pseudo code for our AdvAD and AdvAD-X in the attached PDF of the global author rebuttal, and it has also been incorporated into the revised version to further enhance clarity. Additionally, we have provided a detailed explanation and corresponding experimental verification for the FID results, which you expressed concerns about. 

Please also let us know if you have any further questions about this paper. We have made every effort to enhance our work based on your insightful comments, and we would deeply appreciate it if you could further support us!   

Best regards,  
The authors
Dear Reviewer jCt2,  

We sincerely thank you for your valuable feedback and the time you have taken to process our submission. As the discussion phase is nearing its end, we respectfully ask for your help once again to review our responses and let us know if they address your concerns.  

In brief, we have provided a detailed point-by-point comparison with other diffusion-based methods from various perspectives to further complement and highlight the significant innovations and contributions of our paper, in addition to those you kindly recognized in the Strengths section. Moreover, we have elaborated on the computational complexity and potential defense methods following your constructive suggestions. It is our pleasure to receive your feedback.  

Please also let us know if you have any further questions about this paper. We have made every effort to enhance our work based on your insightful comments, and we would deeply appreciate it if you could further support us!   

Best regards,  
The authors
Thank you for the response. We appreciate your valuable review and we will incorporate the discussions to the revised version accordingly.
Thanks for your response. It addresses most of my concerns. Hope authors could include these discussions into the revision.
Thank you for your feedback, and we are glad that we have addressed your concerns.
Thanks for the authors’ responses. My concerns have been properly addressed.
To further validate the explanation provided above and offer a better understanding, we directly calculate the cosine similarity of the extracted global features between all adversarial examples and their corresponding original images. The average results for the two backbones are shown in the last two rows of the following table, respectively.  

| Metric                             | ConvNeXt |            | VisionMamba |            |
|------------------------------------|----------|------------|-------------|------------|
|                                    | **SSAH**     | **AdvAD** (ours) | **SSAH**        | **AdvAD** (ours) |
| **ASR (%) $\\uparrow$**                        | 84.6     | 100.0        | 49.8        | 99.7       |
| **$l_2$ $\\downarrow$**                             | 2.24     | 1.49       | 1.95        | 1.62       |
| **FID $\\downarrow$**                            | 3.04     | 5.07       | 2.08        | 3.67       |
| **Avg. Feature Similarity (Attacked Model)** | 0.5745   | 0.4184     | 0.5424      | 0.2321     |  
| **Avg. Feature Similarity (Inception)** | 0.9908  | 0.9845     | 0.9938      | 0.9888     |  

It can be more easily observed that, consistent with our previous explanation, the lower FID results of the SSAH attack are due to its ineffectiveness in attacking the ConvNeXt and VisionMamba backbones. As shown in the sixth row of the table, despite the higher strength of the perturbation injected into the adversarial examples (as indicated by the $l_2$​ metric), the feature similarity of SSAH remains higher than ours. This suggests that the adversarial perturbation crafted by SSAH is more difficult to impact the high-dimensional features on which the model's final classification decision relies, leading to its lower ASR. For the Inception model, which is used to calculate the FID metric, SSAH's feature similarity is anomalously further amplified to above 0.99 (the last row), indicating that the adversarial perturbation crafted by SSAH has almost no effect on the high-dimensional features of the clean images for the Inception model, resulting in its lower FID results.  
However, when all attacks are performing correctly, the magnitude of changes in image-space and feature-space can be considered as positively correlated in the scenario of imperceptible attacks. In this case, benefiting from the inherently lower perturbation strength of our modeling approach, AdvAD consistently achieves the best FID score when attacking the other models, as shown in Table 1 and Table 5 (Appendix).
Thank you for the response. We sincerely appreciate your valuable comments and are grateful for the recognition of our work.
After reviewing the authors' response and considering the innovative nature of the attack they have implemented, I have decided to raise my score to 5.