Diffusion Models for Imperceptible and Transferable Adversarial Attack

Thank you sincerely for taking the time to review our work. We extend our heartfelt gratitude for your positive evaluation of our research, which not only encourages us but also instills confidence in our efforts.

W1: The comparison of papers may not be so fair. This proposed method additionally relies on stabe diffsion to enhance the transferability, while other methods can only rely on the substitute models.

Thank you for your insightful concern. We appreciate your consideration of potential fairness issues in comparing our method, given its reliance on stable diffusion to enhance transferability.

To comprehensively address this concern, our manuscript included a thorough analysis and extensive experiments in Appendix K. This analysis was explicitly referenced in the last sentence of Sec. 3.3, where we mentioned, "… DiffAttack exhibits an implicit ensemble characteristic … we give a detailed analysis in Appendix K".

Within Appendix K, we not only demonstrate the fairness of the comparison but also compare our method with other attack approaches that incorporate an additional CLIP classifier. This supplementary analysis aims to further support and validate the effectiveness of our approach.

Furthermore, our superior performance over GAN-based attacks that leverage additional GAN generators, as presented in Appendix J, contributes additional evidence supporting the effectiveness of our approach.

We trust that these points effectively address your concerns. Thank you.

Q1: Is the method in this paper time-consuming? Could you provide the time cost, e.g., DiffAttack vs. (NCF, PerC-AL and SI-FGSM)

Thank you for your insightful advice. We would like to acknowledge that this matter was indeed discussed in the final paragraph of Sec. 5, and a detailed comparison of computational and time costs, along with corresponding analysis, can be found in Appendix M. We hope this information suffices for your inquiry.

We hope that these responses effectively address your questions. Thank you for your continued support.

Thank you sincerely for taking the time to review our paper. We appreciate the questions you've raised, as they provide us with the opportunity to offer further clarification regarding the motivation behind our network design. Below, we present our responses to your queries, aiming to provide a clearer understanding of the rationale behind our loss design.

W1: transfer loss: It is confusing that eq.4 optimizes the objective of variance, which is not differentiable. According to the description, it optimizes the objective of evenly distributed cross-attention maps. It disturbs the attention recognition of the diffusion process, but it is unclear how the corruption can be transferred to other pure classifiers without diffusion. Briefly, the loss can help attack diffusion, but how can it help transferability?

Thank you for your insightful questions. Our transfer loss enhances DiffAttack by imbuing it with an ensemble attack-like characteristic. To offer a clearer understanding, we've organized our response into several key sections:

About the Differentiability of the Variance:

We need to clarify that the variance operation is indeed differentiable. The calculation of variance, denoted as $\sigma^2$, is expressed as follows:

$\sigma^2=\frac{1}{n}\sum_{i=1}^{n}\left(x_i-\mu\right)^2$

As both squaring and summation are differentiable operations, the variance calculation, being a composition of differentiable functions, is itself differentiable.

About the Benefit to Transferability of This Loss:

To address concerns about the benefit of our loss design to transferability, two key findings must be acknowledged first:

Finding 1: An ensemble-based attack, where adversarial examples are generated on multiple models, enhances transferability compared to a single-model attack. This principle is well-established in prior works such as [1] and [2].

Finding 2: The diffusion model, originally designed for image synthesis, implicitly possesses recognition capabilities when pretrained on extensive data like Stable Diffusion. This is highlighted in Para. 2, Sec. 3.3, and validated by [3] and [4].

Building on these findings, our design motivation is to leverage the diffusion model as an implicit surrogate recognition model. Alongside the explicit surrogate recognition model, we craft adversarial examples, making our DiffAttack operate akin to an ensemble attack. Drawing on Finding 1, this ensemble characteristic contributes to improved transferability. We elaborate on this concept in the final sentence of Sec. 3.3, and in Appendix K, we provide a detailed discussion of our method’s ensemble characteristic. The ablation study results in Table 3 affirm the effectiveness of this loss design on transferability, as evidenced by the following excerpt:

Others:

Addressing the reviewer's mention of “how the corruption can be transferred to other pure classifiers without diffusion”, we suspect there might be some ambiguity regarding the transferable attack task. In a transferable attack, the attacker crafts adversarial examples on a known recognition model (usually named the surrogate model, distinct from the target model being attacked). These crafted adversarial examples are then expected to deceive other unknown recognition models.

In our method, both the explicit classifier and the implicit diffusion model serve as the surrogate model. We craft adversarial examples based on them and can directly utilize the crafted examples to attack other pure classifiers. There is no requirement for these other classifiers to incorporate diffusion.

We hope these clarifications provide a comprehensive understanding of our design. Thanks.

[1] Liu, Yanpei, et al. "Delving into Transferable Adversarial Examples and Black-box Attacks." International Conference on Learning Representations. 2016.

[2] Dong, Yinpeng, et al. "Boosting adversarial attacks with momentum." Proceedings of the IEEE conference on computer vision and pattern recognition. 2018.

[3] Xu, Jiarui, et al. "Open-vocabulary panoptic segmentation with text-to-image diffusion models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

[4] Clark, Kevin, and Priyank Jaini. "Text-to-Image Diffusion Models are Zero-Shot Classifiers." ICLR 2023 Workshop on Mathematical and Empirical Understanding of Foundation Models. 2023.

Dear Reviewer 9mVi,

We sincerely appreciate your time and dedication to reviewing our paper. Recognizing the demands of this busy period, we are reaching out to kindly request your feedback on our rebuttal, as the discussion phase nears its conclusion.

If you have any additional comments or suggestions regarding our paper, we would be more than happy to engage in further discussion with you.

Looking forward to your response.

With deepest gratitude,

The Authors

Thank you for taking the time to review our work and for providing valuable feedback. We are grateful for your acknowledgment of the clarity of our paper and the performance of our method. In response to the highlighted weaknesses, we provide the following clarifications. We trust that these responses will enhance the understanding of the value of our work and address your concerns effectively.

W1: The method seems to have adopted the diffusion model to craft adversarial perturbations in a relatively straightforward way since crafting adversarial attacks in the latent space of generative models has existed before (the diffusion model is a new representative of generative models). Thus it hinders the technical novelty of this work.

Thank you for your insightful feedback. We value this opportunity to address your concerns and would like to underscore the uniqueness, novelty, and significance of our method to the research community. Our response is organized into key subparts for clarity:

Uniqueness of Our Method:

As depicted in Fig. 2, our approach involves projecting input images into the latent space of diffusion models and perturbing the latent codes to craft adversarial examples. The novel concept of achieving transferable, visually imperceptible adversarial examples by directly manipulating latent space variables of a generative model distinguishes our work. We have pioneered this new paradigm for adversarial attacks, striking a balance between visual imperceptibility and transferability.

The works most closely related to ours are [1,2], which optimize a pre-trained GAN generator’s latent code to craft physical adversarial patches. These crafted patches exhibit significantly different patterns from their background. In contrast, our method crafts imperceptible adversarial examples that do not alter the appearance of the original input image.

[1] Hu, Yu-Chih-Tuan, et al. "Naturalistic physical adversarial patch for object detectors." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021.

[2] Hu, Zhanhao, et al. "Adversarial texture for fooling person detectors in the physical world." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2022.

Technical Novelty of Our Method:

Within our methodology (Sec. 3), our approach consists of three integral components: Basic Framework (Sec. 3.2), "Deceive” Diffusion Model (Sec. 3.3), and Preserve Content Structure (Sec. 3.4). These segments incorporate the design of three distinct loss functions, $L_{attack}$, $L_{transfer}$, and $L_{structure}$.

Regarding the reviewer's comment on the existence of crafting attacks in the latent space of generative models, the focus appears to center solely on the Basic Framework (corresponding to $L_{attack}$). However, our innovation extends beyond this component. Our $L_{transfer}$ and $L_{structure}$ designs, highlighted in the "Deceive” Diffusion Model and Preserve Content Structure sections, enable the creation of transferable and imperceptible adversarial examples within the diffusion model’s latent space. These designs leverage the inherent attention maps of the diffusion model, presenting a distinct approach. The evidence from our ablation experiments and visualizations (Table 3, 4, and Figure 5) underscores the significance of these designs.

We kindly request the reviewer to consider the entirety of our method, encompassing all three designs, while reassessing the novelty of our work, as these innovative components collectively contribute to the advancement in this domain.

Significance to Community of Our Method:

Going beyond the specific designs of our method, we emphasize the paramount contribution of our work — the demonstration of diffusion models as a promising foundation for crafting adversarial examples. This pivotal aspect is highlighted as the first contribution in the Introduction's contribution list. Our diffusion-based approach showcases promising outcomes across diverse datasets (Appendix I), various model structures (Sec. 4.2.1 & Appendix H), and demonstrates resilience to defense models (Sec. 4.2.2). Additionally, our method also exhibits superior performance when compared to ensemble attacks (Appendix G & K) and GAN-based methods (Appendix J).

These results collectively underscore the diffusion model as a robust platform for crafting adversarial examples. Beyond empirical validation, our work offers a comprehensive exploration of potential future directions for diffusion-based methods in the discussion section (Sec. 5). We believe that this exploration not only enhances the understanding of diffusion-based models' potential within the community but also provides valuable guidance for future research endeavors.

In light of these clarifications, we believe our work stands as a very valuable contribution to the field and hope you find it equally compelling after these explanations. Many thanks.

Dear Reviewer,

Thank you for your response to our rebuttal. We appreciate the time and consideration you've dedicated to evaluating our submission.

We want to express our genuine frustration with the current evaluation outcome. It's disheartening to feel that our efforts in the previous rebuttal might not have been fully acknowledged, although we understand this can be a common occurrence in conference reviews. Nonetheless, rather than resigning to disappointment, we'd like to make a final effort to appeal for a Rating Increase.

Allow us to present some additional insights for your consideration and that of potential readers, articulated in bullet points for clarity:

• Our work stands as the pioneering venture that introduces diffusion models into the realm of adversarial attacks, garnering relatively good attention within the field.
• We have an array of experiments within the manuscript to bolster its comprehensiveness. This ICLR submission showcases numerous experiments and comparisons, with our method achieving the best results in various situations.

We're perplexed by the notion that our work lacks novelty. Being the first to delve into diffusion-based attacks, proposing effective designs of utilizing diffusion models, conducting extensive experiments and comparisons yielding promising results, and delving deeply into the future research direction of diffusion-based attacks—Don't these elements establish the novelty and value of our work?

On the other hand, the word "feel" in the reviewer's reply to our rebuttal is, to be honest, subjective and ambiguous. We genuinely hope that the reviewer can carefully reassess our contribution.

While we understand that perspectives on novelty can vary, we are eager for another opportunity to advocate for our work. We earnestly wish for this work to be shared at the conference, allowing more individuals to recognize the potential of diffusion-based attacks.

Thank you for your time and consideration.

Best regards and wishes for a good day,

Authors of Submission 2148