mlsanityData to 14 Oct 2026

Content-based Unrestricted Adversarial Attack

arXiv 2305.10665 ↗First posted 18 May 2023cs.CV cs.AI cs.CRcited by 73

Not on the map. Why?

Cited by 21 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Unrestricted adversarial attacks typically manipulate the semantic content of an image (e.g., color or texture) to create adversarial examples that are both effective and photorealistic, demonstrating their ability to deceive human perception and deep neural networks with stealth and success. However, current works usually sacrifice unrestricted degrees and subjectively select some image content to guarantee the photorealism of unrestricted adversarial examples, which limits its attack performance. To ensure the photorealism of adversarial examples and boost attack performance, we propose a novel unrestricted attack framework called Content-based Unrestricted Adversarial Attack. By leveraging a low-dimensional manifold that represents natural images, we map the images onto the manifold and optimize them along its adversarial direction. Therefore, within this framework, we implement Adversarial Content Attack based on Stable Diffusion and can generate high transferable unrestricted adversarial examples with various adversarial contents. Extensive experimentation and visualization demonstrate the efficacy of ACA, particularly in surpassing state-of-the-art attacks by an average of 13.3-50.4% and 16.8-48.0% in normally trained models and defense methods, respectively.

Key facts. Cited by 73 papers in the map (data through 14 Oct 2026). Builds on 53 of its 67 references that are in the map. First posted on arXiv 18 May 2023.

Builds on

53 of 67 references.

References · 53

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  5. 2020Denoising Diffusion Implicit Modelscited by 9,781
  6. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  7. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  8. 2016Densely Connected Convolutional Networkscited by 6,720
  9. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  10. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
  11. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  12. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
38 more
  1. 2022Classifier-Free Diffusion Guidancecited by 5,847
  2. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  3. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  4. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,527
  5. 2022DreamBooth: Fine Tuning Text-to-Image Diffusion Models for Subject-Driven Generationcited by 3,300
  6. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,694
  7. 2022An Image is Worth One Word: Personalizing Text-to-Image Generation using Textual Inversioncited by 2,245
  8. 2016Adversarial examples in the physical worldcited by 1,769
  9. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,432
  10. 2022Null-text Inversion for Editing Real Images using Guided Diffusion Modelscited by 1,179
  11. 2022Imagic: Text-Based Real Image Editing with Diffusion Modelscited by 1,178
  12. 2021MUSIQ: Multi-scale Image Quality Transformercited by 1,081
  13. 2016Semantic Understanding of Scenes through the ADE20K Datasetcited by 1,069
  14. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  15. 2021PVT v2: Improved Baselines with Pyramid Vision Transformercited by 751
  16. 2022On Distillation of Guided Diffusion Modelscited by 725
  17. 2021MobileViT: Light-weight, General-purpose, and Mobile-friendly Vision Transformercited by 642
  18. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  19. 2017Countering Adversarial Images using Input Transformationscited by 520
  20. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  21. 2022Diffusion Models for Adversarial Purificationcited by 476
  22. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  23. 2017NIMA: Neural Image Assessmentcited by 389
  24. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  25. 2019KonIQ-10k: An ecologically valid database for deep learning of blind image quality assessmentcited by 355
  26. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  27. 2018Spatially Transformed Adversarial Examplescited by 195
  28. 2021No-Reference Image Quality Assessment via Transformers, Relative Ranking, and Self-Consistencycited by 166
  29. 2023Raising the Cost of Malicious AI-Powered Image Editingcited by 163
  30. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  31. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  32. 2018Semantic Adversarial Examplescited by 86
  33. 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
  34. 2019Functional Adversarial Attackscited by 82
  35. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  36. 2020Shape-Texture Debiased Neural Network Trainingcited by 76
  37. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 73
  38. 2022Towards Practical Certifiable Patch Defense with Vision Transformercited by 44

50 most cited of 53 All 53 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 13; 2024: 24; 2025: 31; 2026: 5.

73 papers.

Sort:

By area:

  1. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  2. 2023Toward effective protection against diffusion based mimicry through score distillationcited by 65
  3. 2023Learning from models beyond fine-tuningcited by 48
  4. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Modelscited by 46
  5. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 44
  6. 2023AIDE: A Vision-Driven Multi-View, Multi-Modal, Multi-Tasking Dataset for Assistive Driving Perceptioncited by 39
  7. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
  8. 2024ConGeo: Robust Cross-view Geo-localization across Ground View Variationscited by 27
  9. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  10. 2023Improving Generalization in Visual Reinforcement Learning via Conflict-aware Gradient Agreement Augmentationcited by 14
  11. 2024ASAM: Boosting Segment Anything Model with Adversarial Tuningcited by 12
  12. 2024On the Robustness of Kolmogorov-Arnold Networks: An Adversarial Perspectivecited by 11
38 more
  1. 2024Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Pathcited by 10
  2. 2023Sampling to Distill: Knowledge Transfer from Open-World Datacited by 8
  3. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 8
  4. 2024Thinking Racial Bias in Fair Forgery Detection: Models, Datasets and Evaluationscited by 8
  5. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 8
  6. 2025State-Aware Perturbation Optimization for Robust Deep Reinforcement Learningcited by 8
  7. 2025Silence is Golden: Leveraging Adversarial Examples to Nullify Audio Control in LDM-based Talking-Head Generationcited by 8
  8. 2024Improving Adversarial Transferability of Vision-Language Pre-training Models through Collaborative Multimodal Interactioncited by 7
  9. 2025Robust Deep Reinforcement Learning in Robotics via Adaptive Gradient-Masked Adversarial Attackscited by 7
  10. 2023Assessing Robustness via Score-Based Adversarial Image Generationcited by 6
  11. 2024Trustworthy Text-to-Image Diffusion Models: A Timely and Focused Surveycited by 6
  12. 2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusioncited by 6
  13. 2024PG-Attack: A Precision-Guided Adversarial Attack Framework Against Vision Foundation Models for Autonomous Drivingcited by 5
  14. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Modelscited by 5
  15. 2025Pruning for Sparse Diffusion Models based on Gradient Flowcited by 5
  16. 2025VideoPure: Diffusion-based Adversarial Purification for Video Recognitioncited by 5
  17. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 4
  18. 2024Fortify the Guardian, Not the Treasure: Resilient Adversarial Detectorscited by 4
  19. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  20. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 4
  21. 2024BadPatch: Diffusion-Based Generation of Physical Adversarial Patchescited by 4
  22. 2025GHOST: Hallucination-Inducing Image Generation for Multimodal LLMscited by 4
  23. 2024ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attackcited by 3
  24. 2024Attack Anything: Blind DNNs via Universal Background Adversarial Attackcited by 3
  25. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 3
  26. 2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
  27. 2025Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generationcited by 3
  28. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Modelscited by 3
  29. 2025Synthesizing Near-Boundary OOD Samples for Out-of-Distribution Detectioncited by 3
  30. 2025Adversarial-Guided Diffusion for Multimodal LLM Attackscited by 3
  31. 2025Active Learning Inspired ControlNet Guidance for Augmenting Semantic Segmentation Datasetscited by 2
  32. 2025Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreakingcited by 2
  33. 2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
  34. 2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
  35. 2024Sparse and Transferable Universal Singular Vectors Attackcited by 1
  36. 2024Delving into Decision-based Black-box Attacks on Semantic Segmentationcited by 1
  37. 2024Learning to Learn Transferable Generative Attack for Person Re-Identificationcited by 1
  38. 2024Prompt-Guided Environmentally Consistent Adversarial Patchcited by 1

50 most cited of 73 All 73 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Diffusion Attack: Leveraging Stable Diffusion for Naturalistic Image Attacking
  2. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attack
  3. 2025VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models
  4. 2024AdvI2I: Adversarial Image Attack on Image-to-Image Diffusion models
  5. 2024Adversarial Attacks and Defenses on Text-to-Image Diffusion Models: A Survey
  6. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks
  7. 2024Revealing Vulnerabilities in Stable Diffusion via Targeted Attacks
  8. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds