Research map / Adversarial robustness and security / Attacks on text and graphs
Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attack on Breast Ultrasound Images
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Prompt2Perturb (P2P), a text-guided diffusion attack that optimizes text embeddings of a frozen Stable Diffusion model in early diffusion timesteps to create imperceptible adversarial breast ultrasound images.
Problem
Adversarial attacks on DNN breast ultrasound classifiers typically use fixed-norm perturbations that look unnatural, while diffusion-based attacks need domain-specific pretrained diffusion models that are unavailable with scarce medical data.
Approach
Freeze the latent diffusion model and optimize only the text encoder's token embeddings (with a medical prompt) using a classifier cross-entropy loss plus a noise-prediction MSE term, restricted to early diffusion timesteps (t≤50), so the generated adversarial image stays close to the original ultrasound image.
Key results
- On BUSI with DenseNet121, P2P reaches 0.98 success rate with FID 45.84 and LPIPS 0.13, versus Diff-PGD's 1.0 success rate, FID 111.03 and LPIPS 0.30.
- On UDIAT with ResNet34, P2P achieves FID 20.3 and LPIPS 0.15 versus Diff-PGD's FID 80.89 and LPIPS 0.31, with 0.97 success rate.
- Restricting optimization to t=50 steps takes 178 s per image on BUSI, versus 280 s at T=100 and 98 s at T=20, with T=20 lowering success rate to 0.83.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use P2P instead of Diff-PGD | DenseNet121 attack on BUSI · BUSI | FID: 111.03 -> 45.84 | Helped |
| Use P2P instead of Diff-PGD | ResNet34 attack on BUSI · BUSI | FID: 117.49 -> 43.03 | Helped |
| Use P2P instead of Diff-PGD | SqueezeNet1.1 attack on BUSI · BUSI | FID: 79.51 -> 47.64 | Helped |
| Use P2P instead of Diff-PGD | DenseNet121 attack on BUS-BRA · BUS-BRA | FID: 90.5 -> 38.00 | Helped |
| Use P2P instead of Diff-PGD | ResNet34 attack on BUS-BRA · BUS-BRA | FID: 100.2 -> 44.09 | Helped |
| Use P2P instead of Diff-PGD | SqueezeNet1.1 attack on BUS-BRA · BUS-BRA | FID: 89.47 -> 58.60 | Helped |
| Use P2P instead of Diff-PGD | DenseNet121 attack on UDIAT · UDIAT | FID: 81.31 -> 27.18 | Helped |
| Use P2P instead of Diff-PGD | ResNet34 attack on UDIAT · UDIAT | FID: 80.89 -> 20.3 | Helped |
| Use P2P instead of Diff-PGD | SqueezeNet1.1 attack on UDIAT · UDIAT | FID: 32.47 -> 23.50 | Helped |
| Remove the MSE loss (ablation) | P2P on ResNet34 · BUSI | FID: 43.03 -> 43.58 | Hurt |
| Use T=20 rather than T=50 (ablation) | P2P on ResNet34 · BUSI | FID: 43.03 -> 49.97 | Hurt |
| Use T=100 rather than T=50 (ablation) | P2P on ResNet34 · BUSI | generation time per image: 178 -> 280 | Hurt |
Surprising findings
- Diff-PGD achieves a 1.0 success rate but at much worse perceptual quality, and PGD has low success rates (0.17-0.57) on the datasets.
Limitations
- Evaluated only on three small breast ultrasound datasets with simple classifiers (ResNet34, SqueezeNet1.1, DenseNet121).
- Success rate is lower than Diff-PGD on some configurations (e.g., 0.86 vs 1.0 on UDIAT DenseNet121) and SSIM is sometimes below Diff-PGD.
- No clinical or human reader evaluation of realism is reported.
Experimental setup
Datasets: BUSI BUS-BRA UDIAT
Benchmarks: BUSI BUS-BRA UDIAT
Metrics: success rate LPIPS SSIM FID
Baselines: FGSM PGD Diff-PGD
Builds on: Stable Diffusion Diff-PGD textual inversion BAPLe
Closest papers by meaning
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.86)
- NaFV-Net: An Adversarial Four-view Network for Mammogram Classification (AAAI 2025 · similarity 0.84)
- On Discrete Prompt Optimization for Diffusion Models (ICML 2024 · similarity 0.84)
- Attacking CNNs in Histopathology with SNAP: Sporadic and Naturalistic Adversarial Patches (Student Abstract) (AAAI 2024 · similarity 0.84)
- Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment (AAAI 2025 · similarity 0.84)
- Perturbing Attention Gives You More Bang for the Buck: Subtle Imaging Perturbations That Efficiently Fool Customized Diffusion Models (CVPR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.