Research map / Adversarial robustness and security / Attacks on text and graphs

DiffAdvMAP: Flexible Diffusion-Based Framework for Generating Natural Unrestricted Adversarial Examples

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Diffusion-based adversarial purification

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DiffAdvMAP, a training-free diffusion-based MAP framework that samples unrestricted adversarial examples from an approximated posterior under adversarial and reconstruction constraints, supporting multiple attack scenarios on ImageNet.

Problem

Unrestricted adversarial examples generated by diffusion models are often unnatural and existing diffusion-based attacks are tailored to specific attack conditions (e.g., noise-to-image, reference-image-similar), limiting flexibility and naturalness.

Approach

Derives a Bayesian posterior over diffusion latents conditioned on an adversarial (CW-style logit margin) constraint and a customizable reconstruction constraint, then approximates it with one-step x0 estimates and greedily maximizes it along a truncated DDIM trajectory starting from a partially destroyed reference image.

Key results

• DiffAdvMAP achieves near 100% white-box attack success rate on normal ResNet-50 and robust models (e.g., 99.3% on robust Wide-ResNet50-2 vs AdvDiffuser 99.5%), with FID 6.83 vs AdvDiffuser 20.9 on normal ResNet-50 (Table 4).
• In generating UAEs from noise, DiffAdvMAP reaches FID 99.2 and transfer rates of 30.0/26.1/21.7% (Inc-v3 surrogate) vs AdvDiff's 10.5/11.3/7.9%, with run time 16.4s vs 14.3s (Table 1).
• In global image-similar UAEs, DiffAdvMAP runs in 6.0s versus 28.2s for DiffAttack and has the best FID (42.8) vs the baselines' ones reported, but DiffAttack and NCF achieve higher transfer rates in some settings.

Measured effects reported in the paper

Surprising findings

• DiffAttack and NCF achieve better transferability than DiffAdvMAP in some transfer settings, despite DiffAdvMAP outperforming other baselines in most cases.
• Random square masks for regional UAEs produce extremely significant perturbations and sometimes fail, which the authors mitigate by combining with Grad-CAM masks.

Limitations

• Transferability is sometimes lower than DiffAttack and NCF, and the reconstruction constraint reduces transferability to some extent.
• Image quality degrades as adversarial confidence level magnitude increases, creating a naturalness-strength trade-off.
• Regional attacks with random square masks can produce unnatural adversarial examples or fail.

Experimental setup

Datasets: ImageNet-compatible dataset (1,000 ImageNet validation images) ImageNet

Benchmarks: ImageNet-compatible dataset

Metrics: white-box attack success rate transfer attack success rate FID LPIPS TRES HyperIQA SSIM run time

Baselines: AdvDiff cAdv ReColorAdv NCF Diff-PGD DiffAttack AdvDiffuser

Builds on: DDIM CW attack AdvDiff DiffAttack Diff-PGD

Closest papers by meaning

• AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks (NeurIPS 2024 · similarity 0.90)
• Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models (CVPR 2024 · similarity 0.88)
• LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.88)
• DiffBreak: Is Diffusion-Based Purification Robust? (NeurIPS 2025 · similarity 0.88)
• Robust Classification via a Single Diffusion Model (ICML 2024 · similarity 0.87)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.87)