Summary
This work proposes a novel adversarial attack framework called Adversarial Attacks in Diffusion (AdvAD). Unlike prior methods that rely on generative models or specific loss functions, AdvAD formulates attacking as a non-parametric diffusion process. This approach theoretically explores a fundamental modeling strategy instead of leveraging the denoising or generation capabilities of diffusion models with neural networks. AdvAD iteratively refines the attack by crafting subtle adversarial guidance based solely on the targeted DNN, without requiring any additional network. This process progressively transforms the original image into an imperceptible adversarial example.
Weaknesses
While I have carefully reviewed the work several times, some uncertainties remain. These are addressed in the following "Questions" section. Due to these uncertainties, the initial recommendation is a borderline decision, which can be revised upwards or downwards based on the authors' response.
Questions
1. The paper claims that AdvAD achieves superior imperceptibility compared to other methods. However, after multiple readings, the justification for this remains unclear. While the text mentions "much subtler yet effective adversarial guidance at each step", "grounded on diffusion model's theoretical foundation", and various diffusion-related formulations, it lacks a clear explanation (or theoretical verification) of how using non-parametric diffusion leads to attacks with lower perturbations.
2. Based on my understanding, AdvAD shares similarities with traditional attacks like PGD, but with a fixed number of optimization iterations (controlled by the total diffusion model timesteps T) and a gradually decaying learning rate (controlled by the $α_t$ value). I hypothesize that the decayed learning rate is a key factor contributing to imperceptibility. The learning rate starts low (at the beginning of T steps) and gradually decreases to 0 (at the end of 0 steps). This suggests that small perturbations are added first, followed by even smaller ones, potentially leading to adversarial examples closer to the classification boundary and thus exhibiting higher imperceptibility. Could the authors comment on the validity of this hypothesis?
3. Following the previous question, to isolate the impact of the decayed learning rate strategy, it would be beneficial to include comparative experiments. These experiments would directly apply a small learning rate initialization and a decayed learning rate schedule to a traditional attack algorithm. If this approach achieves similar performance to AdvAD, it would suggest that the emphasis on diffusion model theory might not be necessary. If not, the authors should highlight the specific benefits of the diffusion model mechanism that contribute to imperceptibility.
4. Does the selection of the initial Gaussian noise sample $ε_0$ affect the performance of AdvAD?
5. In Table 1, is the FID metric computed between the perturbed images and the "imagenet-compatible dataset"? If the goal is to assess the realism of the adversarial examples compared to natural images, a more comprehensive evaluation would be to compare them with the raw ImageNet images. The "imagenet-compatible" dataset, with only 1000 images, might not adequately capture the entire distribution of natural images.
6. Line 248 states that "the optimizer usually cannot find the global optimal solution, and optimization-based methods tend to show sub-optimal ASR." How can AdvAD achieve better ASR compared to these optimization-based methods?
7. In Table 2, which classifier was used to generate the adversarial samples? The robustness of the adversarially trained model Inc-V3_{adv} and the ensemble model Inc-V3_{ens4} appears very low (almost 100% ASR). Additionally, were Res-50, Swin-B, and ConvNeXt-B clean classifiers or adversarially trained?
8. Line 292 suggests that "a larger T exhibits better imperceptibility, while a smaller T implies stronger black-box transferability." Can the authors elaborate on this trade-off?
9. There are a few minor writing errors throughout the paper, such as "a' adversarial" (Line 140), "fistly" (Line 144), and "an' scheme" (Line 191).
10. There are specific questions regarding the proofs of theorems and propositions in the Appendix:
(1) In the second row equality of Eq. 6, shouldn’t $\epsilon_T$ be $\epsilon_{T+1}$ in the first term on the numerator of the first term?
(2) In Line 546, it Is clear that $\epsilon_{T+1}$ satisfies the inequality as $\epsilon_{T+1}$ equals $\epsilon_0$, but how does this hold for $\epsilon_{T}$ as well?
(3) Eq. 20, third row inequality: How is this inequality derived?