Title: Adversarial Attack and Defense for Denoising Diffusion Sampling
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Adversarial attack, adversarial defense, local variation, denoising diffusion sampling

Abstract: Denoising diffusion sampling (DDS) is an emerging approach for generating new samples that have the same distribution as some training samples. However, it is vulnerable to adversarial attacks by even a Gaussian perturbation. In this work, we propose a complete set of adversarial attack and defense methodology for DDS. In the attack side, we propose to inject a perturbation to the sampling stage, which significantly worsen the performance of sample generation. In the defense side, we propose a local variation based regularization model for the potential function minimization, which effectively tolerates the adversarial perturbations. Moreover, we develop a conjugate gradient algorithm to solve the defense model, which integrates with a recently-developed zeroth order rejection sampling method that saves computational and memory costs. Experimental results show that the proposed attack significantly worsen the existing state-of-the-art methods, but can be defended by the proposed local variation regularization.

TL;DR: We propose an adversarial attack and defense approach for denoising diffusion sampling.