Research map / Adversarial robustness and security / Attacks on text and graphs
Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DP-Attacker, white-box adversarial attacks (global online/offline perturbations and physical patches) that use a noise-prediction loss to degrade diffusion policies on robomimic/PushT manipulation tasks.
Problem
Diffusion policies for behavior cloning are widely adopted, but their robustness to adversarial attacks is unexplored; their chained denoising and injected randomness make standard attacks hard to apply.
Approach
Attack the conditional visual input by maximizing the denoiser's noise-prediction error (or pushing it toward a target action) instead of the end-to-end action loss, which is cheaper and more effective; extend this to offline fixed perturbations and transferable physical patches.
Key results
- Transformer-based DP on Lift PH: online untargeted attack reduces success rate from 1.0 to 0.62 and targeted attack to 0.02, while random noise leaves it at 1.0.
- Offline global attacks reduce Can PH transformer success from 0.92 to 0.10 (untargeted) and Square PH to 0.04 (untargeted), with sigma=0.03.
- Patch attack (about 5% of image) lowers CNN Can PH success from 0.98 to 0.16 and Toolhang transformer from 0.86 to 0.02; noise-prediction loss attack runs ~1.8s versus ~70s for end-to-end DDPM attack.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply online targeted global attack | Transformer diffusion policy · Global attacks, 10 task/demonstration settings | success rate: 1 -> 0; 0.92 -> 0; 0.75 -> 0.10 | Hurt |
| Apply untargeted offline global attack | Transformer diffusion policy · Global attacks across tasks | success rate: 1 -> 0.8; 0.92 -> 0.1; 0.86 -> 0 | Hurt |
| Apply untargeted online global attack | Transformer diffusion policy · Global attacks across tasks | success rate: 1 -> 0.62; 0.92 -> 0.02; 0.86 -> 0 | Hurt |
| Apply untargeted offline adversarial patch | CNN and Transformer diffusion policies · Can, Lift, Square, and Toolhang PH | success rate: 0.98 -> 0.16; 1 -> 1; 0.92 -> 0.34; 0.86 -> 0.02 | Mixed |
| Replace adversarial patch with random noise patch | Diffusion policy · Can, Lift, Square, and Toolhang PH | success rate: Can CNN: 0.9 -> 0.16; Toolhang Transformer: 0.12 -> 0.02; Lift CNN: 1 -> 1 | Mixed |
| Use end-to-end DDPM loss instead of noise-prediction loss (ablation) | Transformer diffusion policy · Lift PH | success rate: 1 -> 1; 1 -> 0.52; 0.62 -> 1; 0.02 -> 0.24 | Mixed |
| Use end-to-end DDIM-8 loss instead of noise-prediction loss (ablation) | Transformer diffusion policy · Lift PH | success rate: 0.9 -> 0.62; 0.24 -> 0.02 | Mixed |
| Increase PGD steps from N=10 to N=50 (ablation) | DP-Attacker · Lift PH | success rate: 0.94 -> 0.66 | Hurt |
| Increase PGD steps from N=20 to N=50 (ablation) | DP-Attacker · Lift PH | success rate: 0.8 -> 0.66 | Hurt |
| Increase attack budget from σ=0.01 to σ=0.03 (ablation) | DP-Attacker · Lift PH | success rate: 1 -> 0.68 | Hurt |
| Increase attack budget from σ=0.03 to σ=0.05 (ablation) | DP-Attacker · Lift PH | success rate: 0.68 -> 0.32 | Hurt |
| Use online targeted DP-Attacker instead of end-to-end DDPM loss (ablation) | Transformer diffusion policy · PushT | score: 0.11 -> 0.11 | No clear effect |
Surprising findings
- Attacking the noise-prediction loss is faster and more effective than the end-to-end action-loss attack, which the authors attribute to randomness in diffusion sampling.
- CNN-based diffusion policies are generally harder to attack than transformer-based ones in the global attack setting.
Limitations
- Experiments only in simulation; no real-world robot tests.
- No defense strategies developed or evaluated.
- Attack budget and patch experiments limited to specific checkpoints from Chi et al.
Experimental setup
Datasets: PushT Can Lift Square Transport Toolhang
Benchmarks: PushT Can Lift Square Transport Toolhang
Metrics: success rate task score attack time
Baselines: Random Noise End-to-end action loss attack (DDPM) End-to-end action loss attack (DDIM-8)
Builds on: Diffusion Policy PGD adversarial attacks on latent diffusion models DDIM
Closest papers by meaning
- DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing (ICLR 2025 · similarity 0.88)
- Diffusion Guided Adversarial State Perturbations in Reinforcement Learning (NeurIPS 2025 · similarity 0.88)
- Step Vulnerability Guided Mean Fluctuation Adversarial Attack against Conditional Diffusion Models (AAAI 2024 · similarity 0.87)
- Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models (CVPR 2024 · similarity 0.87)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.87)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.