AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks

Thanks for your time in processing our manuscript and the valuable feedback. Our point-by-point responses are as follows.
 
Weakness 1: Pseudo code.
Re: We appreciate your attention to this detail. We acknowledge that due to page limitations, we did not include the pseudo code in our initial submission. Instead, we made every effort to optimize our presentation and used clear illustrations with corresponding equation numbers (Figure 1) to introduce the workflow of our algorithm. We apologize for any difficulties this may have caused in understanding our manuscript. We have provided the complete pseudo code of our AdvAD and AdvAD-X in the attached PDF of the global author rebuttal, and it has also been included in the revised manuscript to enhance the clarity. Additionally, we have submitted runnable source code in the Supplementary Material for reproducibility, and we will also release the code after this work is accepted for publication.

Weakness 2: The results of FID are not always the best.
Re: It can be observed that the FID results of AdvAD are the second lowest only when attacking ConvNeXt and VisionMamba, with SSAH having the lowest results in these cases. Upon careful examination, we consider this to be due to the poor attack performance of SSAH on these two models, for the following reasons: Firstly, please note that the ASRs of SSAH are only 84.6% and 49.8% (ours are 100% and 99.7%) when attacking these two backbones (as shown in Table 1). As a method for directly optimizing the feature space in imperceptible attacks, SSAH shows such a low attack success rate, indicating that the added adversarial perturbations have minimal impact on the high-dimensional features within the attacked model layers. In other words, when SSAH attacks fail, the high-dimensional features of the crafted adversarial examples and the original images should be closer. Meanwhile, FID measures the Fréchet distance between the high-dimensional features of adversarial examples and original images extracted by a pre-trained Inception-V3. Therefore, the features of the adversarial examples generated by SSAH and the original images in the Inception-V3 model should also be closer, resulting in a lower FID score compared to ours. When all the attacks work normally, due to the inherently lower perturbation strength of AdvAD, the FID score, along with other metrics, achieves the best results among the comparison attacks including SSAH, demonstrating the effectiveness of our novel modeling approach.

Dear Reviewer ytMn,

We sincerely thank you for your valuable feedback and the time you have taken to process our submission. As the discussion phase is nearing its end, we respectfully ask for your help once again to review our responses and let us know if they address your concerns.

Following your valuable suggestions, we have included the pseudo code for our AdvAD and AdvAD-X in the attached PDF of the global author rebuttal, and it has also been incorporated into the revised version to further enhance clarity. Additionally, we have provided a detailed explanation and corresponding experimental verification for the FID results, which you expressed concerns about.

Please also let us know if you have any further questions about this paper. We have made every effort to enhance our work based on your insightful comments, and we would deeply appreciate it if you could further support us!

Best regards,
The authors

Thanks for your time in processing our manuscript and the valuable feedback. Our point-by-point responses are as follows.

Question 1: Explanation and verification of AdvAD.
Re:

1. Intuitive explanation. The superior imperceptibility of AdvAD first comes from its modeling philosophy inherited from diffusion models. For image generation tasks, one of the widely recognized advantages of diffusion models lies in breaking down the complex problem of directly generating images (e.g., GANs) into a series of simpler tasks, gradually pushing a Gaussian distribution toward the image distribution by approximating the noise at each diffusion step, thus to significantly reduce the difficulty of generation with a divide-and-conquer manner. Similarly, compared to previous attack frameworks that directly optimize or inject perturbations into images, the proposed non-parametric diffusion process allows AdvAD to decompose attacking into the relatively simpler task of imposing adversarial guidance by manipulating diffusion noise at each diffusion step to progressively guide the endpoint of diffusion from the original image to a desired adversarial example. Thus, the adversarial guidance injected at each step could be subtler but more effective, ultimately achieving imperceptible attacks with inherently lower perturbation strength.

2. Theoretical verification. As a completely novel attack paradigm without any loss function, optimizer, or additional neural network, the essence of AdvAD exactly lies in the subtler (for imperceptibility) yet more effective (for attack efficacy) adversarial guidance, and both the characteristics are theoretically grounded. Firstly, the conditional sampling technique enables diffusion models to sample from a given conditional distribution (Eq. 3). Derived from it, the proposed AMG module treats the goal of attack as a condition and gradually moves the original diffusion trajectory of the image towards this adversarially conditional distribution through a non-parametric diffusion process (Eq. 4-8), while the PC module synergistically ensures the process is streamlined and controllable (Theorem 1), providing guarantee of successful attack. Secondly, beyond the aforementioned modeling philosophy, the imperceptibility is also supported in the unique property of adversarial guidance as described in line 156-161. In addition, our Proposition 1, 2 and experimental results (especially for Sec. 4.5) provide further analysis and validation of this point.

Question 2, 3: Hypothesis and PGD with decaying learning rate.
Re:

1. As shown in Eq. 9, the l _\\infty upper bound of the guidance strength is irrelative with step $t$. This means that there is no 'decaying learning rate/step size' coefficient for the guidance during the non-parametric diffusion process, and no loss function (e.g., CrossEntropy) is used as in traditional algorithms for gradient ascent. We assume your hypothesis originates from the two decreasing curves about Proposition 1 in Figure 4. Actually, Proposition 1 is an analytical conclusion drawn from extensive formula derivations in Appendix B.3, which demonstrates that the effect of adversarial guidance on the entire process diminishes from strong to weak. This is because, due to the nature of the non-parametric diffusion process, the earlier the guidance is injected, the greater its cumulative impact on the subsequent steps, corresponding to more movement distance toward the target distribution for the noisy sample at that step.

2. We conduct experiments of the PGD+decaying step size strategy. We modify the PGD attack as: $x ^{t+1} = \\Pi(x ^t + \\lambda _t \\cdot \\eta \\cdot sign(\\nabla _{x _t}L _{CE}(x ^t, y)))$, where $T=1000$, $\\lambda _t$ is consistent with our Proposition 1 for alignment, and $\\eta$ is a fixed small factor for the initial learning rate. We explored a lot of $\\eta$ values to determine the optimal range, and the results attacking three models with different architectures with three typical $\\eta$ are presented in Table R2 of the attached PDF. It can be observed that for PGD with this strategy, the ASR is clearly proportional to $\\eta$, while the imperceptibility is inversely proportional to $\\eta$. However, regardless of how $\\eta$ is adjusted, this strategy can not simultaneously match AdvAD in both ASR and imperceptibility. Firstly, for $\\eta$ = $5\\times10^{-5}$, when attacking VisionMamba, ASR of this strategy is 10.5% lower than AdvAD with similar PSNR. For ResNet50, the strategy has a 0.2% higher ASR but a 5.09 dB lower PSNR. When $\\eta$ = $3\\times10^{-5}$, the ASR against VisionMamba and Swin further degrade, being 10.9% and 21.4% lower than AdvAD, respectively. When $\\eta=1\\times10^{-5}$, this method fails to attack all the models.

Question 4: Initial Gaussian noise.
Re: All Gaussian noises are randomly initialized and have almost no impact because they merely serve as a medium of the injected adversarial guidance. With various seeds, the effect on the final results is akin to slight random fluctuations, at ±0.1% for ASR and ±0.02 for PSNR.

Question 5: Calculation of FID.
Re: For adversarial attacks, our goal is to assess the similarity between adversarial examples and their corresponding clean images to measure the imperceptibility of attacks, rather than the gap with the natural image distribution. Therefore, we adopt the FID calculation method consistent with previous work. Moreover, in Table 1, we have included results of the MUSIQ metric, which assesses the realism of adversarial examples without reference images.

Due to the character limit, point-by-point responses to the remaining questions are placed in Part 2 of the global author rebuttal. Please kindly refer to that section for details.

Thanks for your time in processing our manuscript and the valuable feedback. Our point-by-point responses are as follows.
 
Weakness 1 & Question 1: Clear and detailed comparison with existing diffusion-based attack methods.
Re: Compared to other recent notable works exploring adversarial attacks based on diffusion models, the proposed AdvAD is a completely novel approach distinct from existing attack paradigms. It is the first pilot framework which innovatively conceptualizes attacking as a non-parametric diffusion process by theoretically exploring fundamental modeling approach of diffusion models rather than using their denoising or generative abilities, achieving high attack efficacy and imperceptibility with intrinsically lower perturbation strength. To further highlight and clarify our contributions, we have provided a detailed comparison below between AdvAD and other diffusion-based attack methods in various aspects.

1. Motivation. Existing diffusion-based attacks achieve imperceptibility by utilizing the denoising or generative abilities of diffusion models to heavily modify texture or semantic attributes of images in an image edition-like way rather than inject typical adversarial noises. In contrast, the proposed AdvAD aims to address the fundamental challenge of imperceptible attacks, that is, performing attack with inherently minimal perturbation strength from a modeling perspective.

2. Theory of Attack. Although diffusion models are introduced in the existing diffusion-based attacks, their theoretical foundations still adhere to prior attack paradigms, either by integrating the optimization of adversarial loss functions (e.g., cross-entropy) or classical attack methods (e.g., PGD) with nested loops of forward and backward diffusion steps. In comparison, we propose a novel non-parametric diffusion process for performing attacks as a new paradigm. The modeling of AdvAD is theoretically derived from conditional sampling of diffusion models, supporting its attack performance and imperceptibility, and does not require any loss functions, optimizers, or additional neural networks.

3. Methodology. Among the existing diffusion-based attacks, DiffAttack and ACA combine the optimization of adversarial losses with the Stable Diffusion to generate unrestricted adversarial examples, while Diff-PGD and AdvDiffuser incorporate the classic PGD attack into the normal diffusion process. Furthermore, as typical diffusion models, these attacks require using pre-trained neural networks to estimate the noise term at each diffusion step. For our AdvAD, the adversarial example is crafted via an uni-directional non-parametric diffusion process from an initialized and fixed diffusion noise to final sample. At each step, a much subtler (for imperceptibility) yet more effective (for attack performance) adversarial guidance is calculated via the proposed AMG and PC modules without additional networks, then injected by manipulating the diffusion noise.

4. Effectiveness. Due to the uncertainty of generative models and the unrestricted attack setting, existing diffusion-based attacks inevitably cause unnatural and unreasonable artifacts in the crafted adversarial examples, especially for images with complex content. Benefiting from our modeling approach, the proposed AdvAD is able to apply precise control over the perturbations and accomplish imperceptible attacks with inherently low perturbation strength. Extensive experimental results have also demonstrated the superiority of AdvAD.

Based on AdvAD, we further propose an enhanced version AdvAD-X to explore the extreme performance in an ideal scenario for the first time, which also possesses theoretical significance and provides new insights for revealing the robustness of DNNs.

Weakness 2 & Question 3: Computational complexity.
Re: We respect and concur with your point of view. One of the important roles of adversarial attacks is to promote corresponding defense methods and enhance the robustness of DNNs, and algorithm efficiency is a key factor to consider in practice of adversarial training.

In column 3 of Table 1, we have reported the total time cost of each attack for processing 1000 natural images. Thanks to our novel non-parametric and uni-directional diffusion process, which does not require additional networks or nested loops of forward and backward diffusion steps, the computational complexity of AdvAD is mainly concentrated in taking partial derivatives to obtain adversarial guidance (note that this is not the gradient of loss function) at each step. Thus the cost of AdvAD is significantly lower than ACA and DiffAttack, which contain Stable Diffusion within loops of optimization. For Diff-PGD, it is more time-consuming than AdvAD when attacking small models (ResNet-50, 1.5x) but slightly faster for larger models (Swin-Base, 0.8x). Additionally, for non-diffusion optimization-based attacks, the computational complexity of AdvAD is lower than PerC-AL and comparable to the others, while the performance of AdvAD is much better.

Question 2: Potential defensive measures against AdvAD.
Re: In our research, we have considered the robustness of AdvAD against defense methods and presented the experimental results in Section 4.3. It can be observed that due to the inherently low perturbation strength of AdvAD, it is relatively more susceptible to defense methods based on purification, which is similar to other state-of-the-art restricted imperceptible attack methods. However, the results indicate that AdvAD can relatively easily bypass robust models. We hypothesize that this is because these robust models typically use previous attack algorithms based on adversarial losses or gradient ascent for adversarial training, whereas AdvAD, as a new attack paradigm, is not included. Thus, we also anticipate that AdvAD will further advance the development of related defense fields.

Dear Reviewer jCt2,

We sincerely thank you for your valuable feedback and the time you have taken to process our submission. As the discussion phase is nearing its end, we respectfully ask for your help once again to review our responses and let us know if they address your concerns.

In brief, we have provided a detailed point-by-point comparison with other diffusion-based methods from various perspectives to further complement and highlight the significant innovations and contributions of our paper, in addition to those you kindly recognized in the Strengths section. Moreover, we have elaborated on the computational complexity and potential defense methods following your constructive suggestions. It is our pleasure to receive your feedback.

Please also let us know if you have any further questions about this paper. We have made every effort to enhance our work based on your insightful comments, and we would deeply appreciate it if you could further support us!

Best regards,
The authors

Thanks for your time in processing our manuscript and the valuable feedback. Our point-by-point responses are as follows.
 
Weakness 1 & Question 1: Details of AdvAD-X: exact step with DGI strategy, definition of non-critical image regions.
Re: Due to the page limitation of the main paper, we placed the ablation study results of AdvAD-X in Appendix C.3, including the number of iterations of AdvAD-X (column 2, Table 6). For your convenience, we transcribes it here as follows:

From AdvAD to AdvAD-X, the effect of the two strategies of CA and DGI are shown in this table. It can be observed that adding CA in each step of AdvAD slightly improves impercepbility while maintaining the attack success rate of 100%. However, the DGI strategy significantly reduces the iterations of performing AMG and PC from 1000 to 3.97, which indicates that our framework theoretically only requires very little injected adversarial guidance to successfully perform attacks, proving the performance of our modeling method as well as the effectiveness of the adversarial guidance. In AdvAD-X, which finally uses both CA and DGI, the guidance strength in each step is further suppressed, resulting in a slight increase in the total number of iterations required adaptively, but the final perturbation strength continues to decrease to a more extreme level.

For the CA strategy, we adopt the GradCAM (Gradient-weighted Class Activation Mapping) to obtain mask about non-critical image regions for each image separately (as mentioned in lines 201-204 of the main paper). GradCAM is a widely used technique to indicate important regions of the input image that a classification model focuses on when making decisions about a particular category. Specifically, we calculate the heatmap via GradCAM as a mask $\\boldsymbol{m}$ with the same resolution of image. In this mask , each pixel value ranges from 0 to 1 with lower score representing lower importance, thus the non-critical regions are defined. Consequently, AdvAD-X suppresses the intensity of injected adversarial guidance at each step by performing element-wise multiplication with the mask $\\boldsymbol{m}$, which can be expressed as:
$\\boldsymbol{\\hat{\\epsilon}}_t = \\boldsymbol{\\epsilon} _0 - \\boldsymbol{m} \\cdot \\sqrt{1-\\alpha_t} \\nabla _{\\boldsymbol{\\hat{x}}_t}\\text{log}(1-p _f(y _{gt}|\\boldsymbol{\\hat{x}} _{t}^{0}))$ Additionally, we have provided the pseudo code for the AdvAD and AdvAD-X algorithms in the PDF file of the global author rebuttal for better understanding. We also hope the discovery that AdvAD-X can successfully attack with extremely low perturbation strength with floating-point raw data can bring new inspiration to reveal the robustness and interpretability (e.g., decision boundaries) of DNNs.

Weakness 2 & Question 2: Other attack methods (NCF, ACA, Diff-Attack, Diff-PGD) are not considered in Table 3.
Re:

1. Rather than only focusing on transferability, the purpose of Table 3 is to show that although one of the main advantages of the proposed method is the imperceptibility achieved by the novel modeling approach with inherently low perturbation strength, our AdvAD also surpasses other state-of-the-art restricted imperceptible attack methods in transferability, even at much smaller perturbation cost. This is despite the evident positive correlation between transferability and perturbation strength as described in line 292-295. Additionally, more than a comparison of transferability, Table 3 also serves as an ablation study to illustrate the effect of step $T$, demonstrating AdvAD could be flexibly adjusted through $T$ as a novel and general attack framework.
2. The NCF, ACA, and other methods you mentioned are unrestricted attacks, which dose not impose objective limitation on perturbation strength, resulting in significant alterations to the images (as shown in Table 1, their $l _2$ distances are x10-x75 greater than AdvAD) and inevitably producing unnatural artifacts or unreasonable semantic modifications sometimes (as visualizations in Figure 2 and 5). Given this substantial difference in perturbation cost, comparing the transferability of unrestricted and restricted methods is inappropriate. Therefore, we did not include these methods in Table 3. Instead, as aforementioned, we compared our method with other state-of-the-art restricted imperceptible attacks and demonstrated that our approach surpasses them in both imperceptibility and transferability, simultaneously.

Weakness 3 & Question 3: Similar performance to PGD using Mob-V2 as a surrogate model, and the optimal value of $T$.
Re: In the global author rebuttal, we have further discussed transferability of the proposed AdvAD and provide more experimental results to demonstrate its effectiveness, including more values of $T$, the optimal value selection, more comprehensive comparisons with other attacks, etc. Please kindly refer to the corresponding section for more details.

Weakness 4: Experimental settings of Table 4.
Re: We apologize for this omission. The attacked model adopted in Table 4 is the classic ResNet50, and the total step $T$ is consistently set to 1000 for all $\\xi$. We have added the above description of the experimental setting in the revised manuscript.

Thanks for your time in processing our manuscript and the valuable feedback. Our point-by-point responses are as follows.
 
Weakness 1: Defense of random smoothing.
Re: In Table 3 of the paper, we have evaluated the robustness of proposed AdvAD using numerous advanced defense methods, including three post-processing purification methods and six adversarial training robust models to defense attacks. Random smoothing is indeed another strong defense method, and we have conducted experiments to test the performance of our attack on it following your suggestion.
Since random smoothing is not a truly end-to-end model but a method that uses the base model to make multiple predictions on noise-augmented images, we adpot a semi-white-box setup to fully test the attack performance. Specifically, we craft adversarial examples using only the base model without smoothing process, then apply an additional 100 rounds (n=100) of random smoothing voting on the generated adversarial examples and tested the final attack success rate. The results are as follows:

It can be seen that for all random smoothing defenses using base models pre-trained with different variances ($\\sigma$), the proposed AdvAD achieves a higher attack success rate with smaller $l_2$-norm perturbations compared to other state-of-the-art imperceptible attacks (attack ), which further demonstrates the effectiveness of the proposed AdvAD. In the revised version, we will include the relevant references and results.

Weakness 2: Transferability and limitation.
Re: Sure. The proposed AdvAD achieves the best imperceptibility with inherently minimal perturbation strength through a novel non-parametric modeling approach, while also surpassing other state-of-the-art restricted imperceptible attacks in transferability at the same time. The transferability of AdvAD is directly related to the step $T$, that is, the imperceptibility is positively correlated with the size of $T$, while transferability is negatively correlated with it. In Table 3 of the original manuscript, we have reported the relevant experimental results, and we have further discussed transferability in more detail in the global author rebuttal section. In Table R1, we provided results corresponding to additional values of $T$, and in Figure R1, we plotted the relationship curve between transferability and imperceptibility to find the optimal trade-off, conducting a more comprehensive evaluation. All experimental results demonstrate the superiority of AdvAD. Please refer to that section for more details.

Regarding limitations, although AdvAD achieves better transferability at lower perturbation strength, its primary focus remains on the imperceptibility of the attack. Consequently, its transferability is inevitably weaker than other black-box attack methods that operate in larger perturbation spaces and are specifically optimized for transferability. However, the proposed AdvAD is essentially a general attack paradigm with a novel modeling approach and a solid theoretical foundation. Therefore, by relaxing the constraint of perturbation strength and incorporating enhanced designs for the transferability, AdvAD also has significant potential in the direction of black-box attacks. We leave this aspect for future work.