Thanks for your reply. We hope we can further address your concern here.
Thanks a lot for your valuable reply, we are glad to answer the questions you further mentioned here, we hope it will further address your concern:
> Q1:
Yes, Diff-PGD need more steps within the same budget to success, since most PGD attacks perform with famous settings like PGD-10 and PGD-20, we think that Diff-PGD is still an effective attack.
> Q2:
Thanks for your reply. We are happy to see that we address your concerns on this.
> Q3: quantitative comparison with AdvCAM
First, in the AdvCAM paper, they report the results (Section 4.2.3 of [1]) on 2000 samples ImageNet dataset as an ablation study of hyper-parameter $\lambda$. They first sample 2000 samples in ImageNet, define the size of the region to attack, and then choose images from the same category as a style reference. The drawback is that the attacked regions are defined simply as squares or circles. In the experiment part (Section 4.3) of [1], they did the style-based attack on around 100 selected samples.
To further clarify it, we further construct a better style-based attack dataset based on ImageNet containing 200 cases with 4 categories (sport_car, street_sign, daisy, and guitar), each containing 50 images. We generate the mask using Grounded Segment Anything (Grounded-SAM) [9] using the category text of ImageNet as a prompt, which can effectively segment out the object to be attacked. Following AdvCAM, we also use randomly sampled images of the same category as a style reference. The quantitative results are as follows:
|Method|sport_car|daisy|street_sign|guitar|
|---| -- | -- | -- | -- |
|Diff-PGD|98|100|100|98|
|AdvCAM|96|98|94|96|
Moreover, we find that the samples generated by Diff-PGD consistently exhibit a high level of quality. To provide a quantitative comparison, we plan to put figures in the final versions of our appendix.
Finally, we hope it can address the concern about the scale of quantitative results.
> Q3: compared with raw AdvCAM
For the results of the lamp shown in Figure 5 of [1], the $\lambda$ was set to 2000 as it was mentioned. However, $\lambda=2000$ cannot always guarantee a high success rate (demonstrated in Figure 6 of [1]). In Section 4.2.1 of [1], it is suggested that we should sample from [1000, 10000] for better $\lambda$. With larger $\lambda$, the generated sample will have larger artifacts (e.g. noisy edges and a stippled background). During our experimental investigations, we adopted a value of $\lambda=4000$ (also set as default in their official GitHub repo) to reliably achieve a high success rate. This decision contributes to the discrepancy between our AdvCAM results and those featured in Figure 5 of the original publication [1].
Furthermore, these observations underscore the necessity for careful hyper-parameter selection in the case of AdvCAM, which may vary across cases. This inherent variability reduces controllability and adaptability compared to Diff-PGD in style-based attacks.
> Q4:
Thanks for your reply.
In the context of digital attacks, GAN-based techniques diverge significantly from conventional approaches, which is why they are typically excluded from the baseline [10, 11]. The rationale behind this exclusion is outlined below: Firstly, a majority of GAN-based methods center around the concept of adversarial training, involving a generator and a discriminator [2, 3, 4]. Importantly, these methods are not **training-free**; they necessitate training over the dataset. Moreover, GAN-based approaches do not notably excel in terms of stealthiness, as evidenced by findings in [2, 3, 4]. Also, there are other studies, such as [5], that employ GANs for producing **unrestricted attacks**; however, these fall beyond the scope of our task.
For physical-world attacks where GAN-based achieved great success. especially imethods such as [6, 7] optimize from random noise to sample from GAN as adversarial pattern, while our pipeline focuses more on cases with image reference, so we only consider methods with a reference image as input.
Still, we thank the reviewer for this question, we will better clarify why GAN-based methods are not included as baselines in our paper.
[1] Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
[2] AI-GAN: Attack-Inspired Generation of Adversarial Examples
[3] Generating Adversarial Examples with Adversarial Networks
[4] A two-stage generative adversarial networks with semantic content constraints for adversarial example generation
[5] Constructing Unrestricted Adversarial Examples with Generative Models
[6] Naturalistic physical adversarial patch for object detectors.
[7] Advart: Adversarial art for camouflaged object detection attacks
[8] Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
[9] Segment Anything
[10] Diffusion Models for Imperceptible and Transferable Adversarial Attack
[11] Content-based Unrestricted Adversarial Attack