Data to 7 Oct 2026

Diffusion Models for Imperceptible and Transferable Adversarial Attack

arXiv 2305.08192 ↗First posted 14 May 2023cs.CVcited by 93

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Many existing adversarial attacks generate Lp-norm perturbations on image RGB space. Despite some achievements in transferability and attack success rate, the crafted adversarial examples are easily perceived by human eyes. Towards visual imperceptibility, some recent works explore unrestricted attacks without Lp-norm constraints, yet lacking transferability of attacking black-box models. In this work, we propose a novel imperceptible and transferable attack by leveraging both the generative and discriminative power of diffusion models. Specifically, instead of direct manipulation in pixel space, we craft perturbations in the latent space of diffusion models. Combined with well-designed content-preserving structures, we can generate human-insensitive perturbations embedded with semantic clues. For better transferability, we further "deceive" the diffusion model which can be viewed as an implicit recognition surrogate, by distracting its attention away from the target regions. To our knowledge, our proposed method, DiffAttack, is the first that introduces diffusion models into the adversarial attack field. Extensive experiments on various model structures, datasets, and defense methods have demonstrated the superiority of our attack over the existing attack methods.

Key facts. Cited by 93 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 82 of its 104 references that are in the map. First posted on arXiv 14 May 2023.

Builds on

82 of 104 references.

Closest ancestors · 1

Same direction, newest first

2022Diffusion Models for Adversarial Purification16 May

Other references · 81

2015Deep Residual Learning for Image Recognitioncited by 51,809
2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
2020Denoising Diffusion Probabilistic Modelscited by 20,851
2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
2020Denoising Diffusion Implicit Modelscited by 9,655
2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
2014Explaining and Harnessing Adversarial Examplescited by 7,287

38 more

2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,322
2022Generative Adversarial Networkscited by 5,603
2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
2013Intriguing properties of neural networkscited by 5,114
2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
2017Squeeze-and-Excitation Networkscited by 4,763
2020Training data-efficient image transformers & distillation through attentioncited by 4,560
2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
2022FlashAttention: Fast and Memory-Efficient Exact Attention with IO-Awarenesscited by 3,611
2022A ConvNet for the 2020scited by 3,545
2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
2022Prompt-to-Prompt Image Editing with Cross Attention Controlcited by 2,409
2021SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equationscited by 1,903
2021Image Super-Resolution via Iterative Refinementcited by 1,506
2021MLP-Mixer: An all-MLP Architecture for Visioncited by 1,441
2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
2022Null-text Inversion for Editing Real Images using Guided Diffusion Modelscited by 1,168
2022Diffusion Models in Vision: A Surveycited by 1,008
2016Adversarial Machine Learning at Scalecited by 934
2017Ensemble Adversarial Training: Attacks and Defensescited by 833
2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
2022DiffEdit: Diffusion-based semantic image editing with mask guidancecited by 643
2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
2023Zero-shot Image-to-Image Translationcited by 503
2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
2017Mitigating Adversarial Effects Through Randomizationcited by 382
2023Open-Vocabulary Panoptic Segmentation with Text-to-Image Diffusion Modelscited by 371
2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
2022SmartBrush: Text and Shape Guided Object Inpainting with Diffusion Modelcited by 276
2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242

50 most cited of 81 All 81 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 14; 2024: 19; 2025: 41; 2026: 19.

93 papers.

Sort:

By area:

2023Toward effective protection against diffusion based mimicry through score distillationcited by 64
2023On the Design Fundamentals of Diffusion Models: A Surveycited by 59
2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protectioncited by 34
2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
2023A Systematic Survey of Prompt Engineering on Vision-Language Foundation Modelscited by 12
2024StealthDiffusion: Towards Evading Diffusion Forensic Detection through Diffusion Modelcited by 12
2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
2023Zero-Shot Image Harmonization with Generative Model Priorcited by 8
2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 8

38 more

2025Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustnesscited by 8
2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 7
2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7
2025State-Aware Perturbation Optimization for Robust Deep Reinforcement Learningcited by 7
2025Robust Deep Reinforcement Learning in Robotics via Adaptive Gradient-Masked Adversarial Attackscited by 7
2025Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generationcited by 7
2023Assessing Robustness via Score-Based Adversarial Image Generationcited by 6
2023Beyond Boundaries: A Comprehensive Survey of Transferable Attacks on AI Systemscited by 6
2024Boosting Adversarial Transferability with Low-Cost Optimization via Maximin Expected Flatnesscited by 6
2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
2025SITA: Structurally Imperceptible and Transferable Adversarial Attacks for Stylized Image Generationcited by 6
2023DiffAug: A Diffuse-and-Denoise Augmentation for Training Robust Classifierscited by 5
2024ObjectCompose: Evaluating Resilience of Vision-Based Models on Object-to-Background Compositional Changescited by 5
2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Modelscited by 5
2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protectioncited by 5
2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusioncited by 5
2025BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editingcited by 5
2023Intriguing Properties of Diffusion Models: An Empirical Study of the Natural Attack Capability in Text-to-Image Generative Modelscited by 4
2024ToDA: Target-oriented Diffusion Attacker against Recommendation Systemcited by 4
2024Natural Language Induced Adversarial Imagescited by 4
2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Modelscited by 4
2024Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Imagescited by 4
2025My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swappingcited by 4
2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 3
2024ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attackcited by 3
2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Modelscited by 3
2025Active Learning Inspired ControlNet Guidance for Augmenting Semantic Segmentation Datasetscited by 2
2025Towards more transferable adversarial attack in black-box mannercited by 2
2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
2025DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examplescited by 2
2023Latent Magic: An Investigation into Adversarial Examples Crafted in the Semantic Latent Spacecited by 1
2024Adversarial Examples are Misaligned in Diffusion Model Manifoldscited by 1
2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
2024Detecting Adversarial Data using Perturbation Forgerycited by 1
2024Learning to Learn Transferable Generative Attack for Person Re-Identificationcited by 1
2024Prompt-Guided Environmentally Consistent Adversarial Patchcited by 1

50 most cited of 93 All 93 (JSON)

Similar, not cited

Close in wording, no citation either way