TRAIL: Transferable Robust Adversarial Images via Latent diffusion
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2025
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866913851984838656 |
|---|---|
| author | Xue, Yuhao Zhang, Zhifei Jiang, Xinyang Shen, Yifei Gao, Junyao Gu, Wentao Zhao, Jiale Shi, Miaojing Zhao, Cairong |
| author_facet | Xue, Yuhao Zhang, Zhifei Jiang, Xinyang Shen, Yifei Gao, Junyao Gu, Wentao Zhao, Jiale Shi, Miaojing Zhao, Cairong |
| contents | Adversarial attacks exploiting unrestricted natural perturbations present severe security risks to deep learning systems, yet their transferability across models remains limited due to distribution mismatches between generated adversarial features and real-world data. While recent works utilize pre-trained diffusion models as adversarial priors, they still encounter challenges due to the distribution shift between the distribution of ideal adversarial samples and the natural image distribution learned by the diffusion model. To address the challenge, we propose Transferable Robust Adversarial Images via Latent Diffusion (TRAIL), a test-time adaptation framework that enables the model to generate images from a distribution of images with adversarial features and closely resembles the target images. To mitigate the distribution shift, during attacks, TRAIL updates the diffusion U-Net's weights by combining adversarial objectives (to mislead victim models) and perceptual constraints (to preserve image realism). The adapted model then generates adversarial samples through iterative noise injection and denoising guided by these objectives. Experiments demonstrate that TRAIL significantly outperforms state-of-the-art methods in cross-model attack transferability, validating that distribution-aligned adversarial feature synthesis is critical for practical black-box attacks. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2505_16166 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | TRAIL: Transferable Robust Adversarial Images via Latent diffusion Xue, Yuhao Zhang, Zhifei Jiang, Xinyang Shen, Yifei Gao, Junyao Gu, Wentao Zhao, Jiale Shi, Miaojing Zhao, Cairong Computer Vision and Pattern Recognition Adversarial attacks exploiting unrestricted natural perturbations present severe security risks to deep learning systems, yet their transferability across models remains limited due to distribution mismatches between generated adversarial features and real-world data. While recent works utilize pre-trained diffusion models as adversarial priors, they still encounter challenges due to the distribution shift between the distribution of ideal adversarial samples and the natural image distribution learned by the diffusion model. To address the challenge, we propose Transferable Robust Adversarial Images via Latent Diffusion (TRAIL), a test-time adaptation framework that enables the model to generate images from a distribution of images with adversarial features and closely resembles the target images. To mitigate the distribution shift, during attacks, TRAIL updates the diffusion U-Net's weights by combining adversarial objectives (to mislead victim models) and perceptual constraints (to preserve image realism). The adapted model then generates adversarial samples through iterative noise injection and denoising guided by these objectives. Experiments demonstrate that TRAIL significantly outperforms state-of-the-art methods in cross-model attack transferability, validating that distribution-aligned adversarial feature synthesis is critical for practical black-box attacks. |
| title | TRAIL: Transferable Robust Adversarial Images via Latent diffusion |
| topic | Computer Vision and Pattern Recognition |
| url | https://arxiv.org/abs/2505.16166 |