Research map / Adversarial robustness and security / Attacks on text and graphs
AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AdvAD, a non-parametric diffusion-process attack that crafts imperceptible adversarial examples using only the attacked classifier's gradients (AMG + PC modules), plus AdvAD-X with skipping, CAM masking and a floating-point ideal setting.
Problem
Imperceptible adversarial attacks need small perturbations that still fool DNNs; existing methods rely on perceptual losses or generative models that can change semantics. The paper asks how to attack with inherently minimal perturbation from a modeling perspective.
Approach
Treats the attack as a non-parametric deterministic DDIM-style diffusion trajectory from fixed initial noise. At each step, adversarial guidance is computed from the attacked classifier's probability (conditional sampling on the adversarial condition) and projected into an l_inf ball around the initial noise (Pixel-level Constraint), so no extra network or generative model is needed.
Key results
- AdvAD reaches 99.9% average ASR across four models with l2 of 1.34 and PSNR of 49.74 (averages over ResNet-50, ConvNeXt-B, Swin-B, VisionMamba-S per abstract), versus state-of-the-art imperceptible attacks.
- AdvAD achieves 75.3% average ASR against adversarially trained robust models, the best among imperceptible attacks evaluated.
- AdvAD still reaches 87.4% ASR at xi=1/255 with 57.87 PSNR on ResNet-50 per the smaller-xi analysis.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AdvAD instead of SSAH | White-box attacks · ImageNet-compatible, ResNet-50 | ASR (%): 99.7 -> 99.7 | No clear effect |
| Use AdvAD instead of PerC-AL | White-box attacks · ImageNet-compatible, ResNet-50 | l2 distance: 2.05 -> 1.06 | Helped |
| Use AdvAD instead of SSAH | White-box attacks · ImageNet-compatible, ConvNeXt-Base | ASR (%): 84.6 -> 100.0 | Helped |
| Use AdvAD instead of SSAH | White-box attacks · ImageNet-compatible, Swin Transformer-Base | ASR (%): 96.3 -> 100.0 | Helped |
| Use AdvAD instead of SSAH | White-box attacks · ImageNet-compatible, VisionMamba-Small | ASR (%): 49.8 -> 99.7 | Helped |
| Use AdvAD-X instead of AdvAD | Attacks in the ideal floating-point scenario · ImageNet-compatible, ResNet-50 | l2 distance: 1.06 -> 0.34 | Helped |
| Use AdvAD-X instead of AdvAD | Attacks in the ideal floating-point scenario · Adversarially trained models | ASR average (%): 75.3 -> 34.2 | Hurt |
| Set T=100 instead of T=1000 (ablation) | AdvAD · Transferability from ResNet-50 to MobileNetV2 | ASR (%): 18.3 -> 23.5 | Helped |
| Set T=10 instead of T=1000 (ablation) | AdvAD · Transferability from ResNet-50 to MobileNetV2 | ASR (%): 18.3 -> 44.3 | Helped |
| Reduce xi to 1/255 (ablation) | AdvAD · ImageNet-compatible, ResNet-50 | ASR (%): 94.8% -> 87.4% | Hurt |
| Reduce xi to 1/255 (ablation) | AdvAD · ImageNet-compatible, ResNet-50 | PSNR: 57.87 | Helped |
Surprising findings
- AdvAD-X in the floating-point ideal scenario achieves near-100% ASR with very small perturbation (l2 about 0.34 on ResNet-50), but it is weak against purification and adversarial-training defenses (17.1% and 34.2% average ASR).
Limitations
- AdvAD-X relies on an ideal floating-point input setting without quantization, which is not a realistic image-space attack.
- AdvAD runtime is high relative to some baselines (e.g., 2201 s on ResNet-50 vs 25 s for PGD in the reported table).
- Robustness of AdvAD-X against purification and adversarial training is weak.
Experimental setup
Datasets: ImageNet-compatible dataset (1,000 images)
Benchmarks: ImageNet-compatible dataset
Metrics: ASR l_inf l_2 PSNR SSIM FID LPIPS MUSIQ
Baselines: PGD AdvDrop PerC-AL SSAH NCF ACA DiffAttack Diff-PGD
Builds on: DDIM conditional sampling for score-based models Class Activation Mapping (Grad-CAM) PGD
Closest papers by meaning
- DiffAdvMAP: Flexible Diffusion-Based Framework for Generating Natural Unrestricted Adversarial Examples (ICML 2025 · similarity 0.90)
- Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model (AAAI 2024 · similarity 0.90)
- MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model (CVPR 2024 · similarity 0.88)
- CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models (ICML 2025 · similarity 0.88)
- AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion Models (ICML 2025 · similarity 0.88)
- LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.