mlsanityData to 7 Oct 2026

DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection

arXiv 2305.13625 ↗First posted 23 May 2023cs.CV cs.CRcited by 34

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

The increasingly pervasive facial recognition (FR) systems raise serious concerns about personal privacy, especially for billions of users who have publicly shared their photos on social media. Several attempts have been made to protect individuals from being identified by unauthorized FR systems utilizing adversarial attacks to generate encrypted face images. However, existing methods suffer from poor visual quality or low attack success rates, which limit their utility. Recently, diffusion models have achieved tremendous success in image generation. In this work, we ask: can diffusion models be used to generate adversarial examples to improve both visual quality and attack performance? We propose DiffProtect, which utilizes a diffusion autoencoder to generate semantically meaningful perturbations on FR systems. Extensive experiments demonstrate that DiffProtect produces more natural-looking encrypted images than state-of-the-art methods while achieving significantly higher attack success rates, e.g., 24.5% and 25.1% absolute improvements on the CelebA-HQ and FFHQ datasets.

Key facts. Cited by 34 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 48 of its 77 references that are in the map. First posted on arXiv 23 May 2023.

Builds on

48 of 77 references.

Closest ancestors · 4

Same direction, newest first

  1. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attack14 May
  2. 2023Better Diffusion Models Further Improve Adversarial Training9 Feb
  3. 2022(Certified!!) Adversarial Robustness for Free!21 Jun
  4. 2022Diffusion Models for Adversarial Purification16 May

Other references · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 8,964
  8. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
  9. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  10. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  12. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
32 more
  1. 2017Squeeze-and-Excitation Networkscited by 4,763
  2. 2021Improved Denoising Diffusion Probabilistic Modelscited by 3,736
  3. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  6. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  7. 2017StarGAN: Unified Generative Adversarial Networks for Multi-Domain Image-to-Image Translationcited by 1,036
  8. 2018BiSeNet: Bilateral Segmentation Network for Real-time Semantic Segmentationcited by 645
  9. 2019MaskGAN: Towards Diverse and Interactive Facial Image Manipulationcited by 624
  10. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  11. 2021Diffusion Autoencoders: Toward a Meaningful and Decodable Representationcited by 447
  12. 2018Generating Adversarial Examples with Adversarial Networkscited by 256
  13. 2021Improving Robustness using Generated Datacited by 233
  14. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  15. 2021High-Fidelity GAN Inversion for Image Attribute Editingcited by 197
  16. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  17. 2018Disentangling Adversarial Robustness and Generalizationcited by 171
  18. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  19. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  20. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  21. 2021LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognitioncited by 92
  22. 2017A General Framework for Adversarial Examples with Objectivescited by 82
  23. 2020Towards Transferable Adversarial Attack against Deep Face Recognitioncited by 79
  24. 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
  25. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  26. 2020Towards Face Encryption by Generating Adversarial Identity Maskscited by 62
  27. 2020Learning perturbation sets for robust machine learningcited by 48
  28. 2020Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attackscited by 45
  29. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42
  30. 2017The Robust Manifold Defense: Adversarial Training using Generative Modelscited by 35
  31. 2023Controllable Inversion of Black-Box Face Recognition Models via Diffusioncited by 22
  32. 2019LFFD: A Light and Fast Face Detector for Edge Devicescited by 21

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 10; 2025: 10; 2026: 10.

34 papers.

Sort:

By area:

  1. 2023Toward effective protection against diffusion based mimicry through score distillationcited by 64
  2. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 59
  3. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 26
  4. 2024Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Modelscited by 14
  5. 2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
  6. 2024A Gray-box Attack against Latent Diffusion Model-based Image Editing by Posterior Collapsecited by 13
  7. 2025Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attackscited by 13
  8. 2023A Survey of Emerging Applications of Diffusion Probabilistic Models in MRIcited by 9
  9. 2025Enhancing Facial Privacy Protection via Weakening Diffusion Purificationcited by 7
  10. 2025DCT-Shield: A Robust Frequency Domain Defense against Malicious Image Editingcited by 7
  11. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Modelscited by 5
  12. 2024Natural Language Induced Adversarial Imagescited by 4
22 more
  1. 2025Concept-as-Tree: A Controllable Synthetic Data Framework Makes Stronger Personalized VLMscited by 4
  2. 2024DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermarkcited by 2
  3. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 2
  4. 2024MMAD-Purify: A Precision-Optimized Framework for Efficient and Scalable Multi-Modal Attackscited by 1
  5. 2024ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Modelscited by 1
  6. 2026Machine Pareidolia: Protecting Facial Image with Emotional Editingcited by 1
  7. 2026Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attackscited by 1
  8. 2023From text to multimodal: a survey of adversarial example generation in question answering systemscited by 0
  9. 2024DataCook: Crafting Anti-Adversarial Examples for Healthcare Data Copyright Protectioncited by 0
  10. 2025Controllable Adversarial Makeup for Privacy via Text-Guided Diffusioncited by 0
  11. 2025Computation-Efficient and Recognition-Friendly 3D Point Cloud Privacy Protectioncited by 0
  12. 2025DP-TRAE: A Dual-Phase Merging Transferable Reversible Adversarial Example for Image Privacy Protectioncited by 0
  13. 2025Unmasking Synthetic Realities in Generative AI: A Comprehensive Review of Adversarially Robust Deepfake Detection Systemscited by 0
  14. 2025Diffusion Guided Adversarial State Perturbations in Reinforcement Learningcited by 0
  15. 2026SIDeR: Semantic Identity Decoupling for Unrestricted Face Privacycited by 0
  16. 2026DiffInf: Influence-Guided Diffusion for Supervision Alignment in Facial Attribute Learningcited by 0
  17. 2026Personalized Face Privacy Protection From a Single Imagecited by 0
  18. 2026Face De-Identification: A Domain-Centric Survey from Capture to Processingcited by 0
  19. 2026DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Modelscited by 0
  20. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0
  21. 2026Semantic Privacy Protection with Utility Preservation for 3D Point Cloudscited by 0
  22. 2026Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection
  2. 2024DiffAM: Diffusion-based Adversarial Makeup Transfer for Facial Privacy Protection
  3. 2024Privacy Protection in Personalized Diffusion Models via Targeted Cross-Attention Adversarial Attack
  4. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models
  5. 2023Towards Prompt-robust Face Privacy Protection via Adversarial Decoupling Augmentation Framework
  6. 2025DLADiff: A Dual-Layer Defense Framework against Fine-Tuning and Zero-Shot Customization of Diffusion Models
  7. 2025Perturb a Model, Not an Image: Towards Robust Privacy Protection via Anti-Personalized Diffusion Models
  8. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model