Research map / Adversarial robustness and security / Black-box and transfer attacks

HUANG: A Robust Diffusion Model-based Targeted Adversarial Attack Against Deep Hashing Retrieval

AAAI 2025 · Adversarial robustness and security › Black-box and transfer attacks · approach: Data-free substitute training · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes HUANG, a black-box targeted adversarial attack on deep hashing retrieval that uses a pretrained diffusion model with adversarial denoising guided by adversarial perturbations and a residual image.

Problem

Targeted adversarial attacks on deep hashing image retrieval in black-box settings suffer from poor robustness, inferior image quality, and long inference time.

Approach

Uses a pretrained diffusion model's reverse process, modified by adversarial denoising: gradients of a target-image Hamming-distance term and a target-semantic term shift the sampling mean, while a residual image (x_t minus benign image) pulls samples back toward the benign distribution, yielding robust adversarial images.

Key results

• On FLICKR-25K with DPSH, HUANG averages about 10.93% higher t-MAP than the prior SOTA SAAT.
• Under JPEG, feature squeezing, and randomized smoothing defenses, HUANG keeps only a slight t-MAP drop while prior SOTA methods drop significantly.
• Ablation on FLICKR-25K shows removing adversarial perturbation drops t-MAP by 16.41% (78.15 to 61.74 at 32 bits).

Measured effects reported in the paper

Limitations

• Perceptibility is higher than DHTA and DHTA+FGSM, so HUANG trades some imperceptibility for attack strength.
• Performance depends on timestep T; too small or too large T degrades transferability.
• Evaluated only on three image datasets and three hashing models (DPSH, HashNet, CSQ).

Experimental setup

Datasets: FLICKR-25K NUS-WIDE MS-COCO

Benchmarks: FLICKR-25K NUS-WIDE MS-COCO

Metrics: t-MAP perceptibility SSIM

Baselines: DHTA ProS-GAN THA PTA SAAT DHTA+FGSM

Builds on: Denoising diffusion probabilistic models classifier-guided diffusion DHTA SAAT

Closest papers by meaning

• Once and for All: Universal Transferable Adversarial Perturbation against Deep Hashing-Based Facial Image Retrieval (AAAI 2024 · similarity 0.85)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.85)
• LoRID: Low-Rank Iterative Diffusion for Adversarial Purification (AAAI 2025 · similarity 0.84)
• CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models (ICML 2025 · similarity 0.84)
• Variance as a Catalyst: Efficient and Transferable Semantic Erasure Adversarial Attack for Customized Diffusion Models (ICML 2025 · similarity 0.84)
• Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Models (CVPR 2024 · similarity 0.84)