mlsanityData to 14 Oct 2026

Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllability

arXiv 2305.16494 ↗First posted 25 May 2023cs.CV cs.AIcited by 66

Not on the map. Why?

Cited by 27 in Diffusion models, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Neural networks are known to be susceptible to adversarial samples: small variations of natural examples crafted to deliberately mislead the models. While they can be easily generated using gradient-based techniques in digital and physical scenarios, they often differ greatly from the actual data distribution of natural images, resulting in a trade-off between strength and stealthiness. In this paper, we propose a novel framework dubbed Diffusion-Based Projected Gradient Descent (Diff-PGD) for generating realistic adversarial samples. By exploiting a gradient guided by a diffusion model, Diff-PGD ensures that adversarial samples remain close to the original data distribution while maintaining their effectiveness. Moreover, our framework can be easily customized for specific tasks such as digital attacks, physical-world attacks, and style-based attacks. Compared with existing methods for generating natural-style adversarial samples, our framework enables the separation of optimizing adversarial loss from other surrogate losses (e.g., content/smoothness/style loss), making it more stable and controllable. Finally, we demonstrate that the samples generated using Diff-PGD have better transferability and anti-purification power than traditional gradient-based methods. Code will be released in https://github.com/xavihart/Diff-PGD

Key facts. Cited by 66 papers in the map (data through 14 Oct 2026). Builds on 43 of its 55 references that are in the map. First posted on arXiv 25 May 2023.

Builds on

43 of 55 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  5. 2020Denoising Diffusion Implicit Modelscited by 9,781
  6. 2020Score-Based Generative Modeling through Stochastic Differential Equationscited by 9,122
  7. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  10. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  11. 2016Wide Residual Networkscited by 3,070
  12. 2022DreamFusion: Text-to-3D using 2D Diffusioncited by 3,025
31 more
  1. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  2. 2021BEiT: BERT Pre-Training of Image Transformerscited by 2,375
  3. 2022Video Diffusion Modelscited by 2,305
  4. 2021SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equationscited by 1,937
  5. 2022Imagen Video: High Definition Video Generation with Diffusion Modelscited by 1,778
  6. 2016Adversarial examples in the physical worldcited by 1,769
  7. 2022RePaint: Inpainting using Denoising Diffusion Probabilistic Modelscited by 1,430
  8. 2022Magic3D: High-Resolution Text-to-3D Content Creationcited by 1,290
  9. 2022eDiff-I: Text-to-Image Diffusion Models with an Ensemble of Expert Denoiserscited by 931
  10. 2022Fast Sampling of Diffusion Models with Exponential Integratorcited by 532
  11. 2017Adversarial Patchcited by 517
  12. 2022Diffusion Models for Adversarial Purificationcited by 476
  13. 2020Do Adversarially Robust ImageNet Models Transfer Better?cited by 316
  14. 2017Generating Natural Adversarial Examplescited by 183
  15. 2021Adversarial purification with Score-based generative modelscited by 134
  16. 2022(Certified!!) Adversarial Robustness for Free!cited by 132
  17. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  18. 2022Adversarial Texture for Fooling Person Detectors in the Physical Worldcited by 96
  19. 2022Guided Diffusion Model for Adversarial Purificationcited by 92
  20. 2018Semantic Adversarial Examplescited by 86
  21. 2017Exploring the Landscape of Spatial Robustnesscited by 81
  22. 2023Content-based Unrestricted Adversarial Attackcited by 73
  23. 2022Synthesizing Coherent Story with Auto-Regressive Latent Diffusion Modelscited by 70
  24. 2017Adversarial Attacks Beyond the Image Spacecited by 67
  25. 2023Robust Evaluation of Diffusion-Based Adversarial Purificationcited by 65
  26. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  27. 2022Guided Diffusion Model for Adversarial Purification from Random Noisecited by 35
  28. 2022Isometric 3D Adversarial Examples in the Physical Worldcited by 25
  29. 2023AdvART: Adversarial Art for Camouflaged Object Detection Attackscited by 12
  30. 2022Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusioncited by 8
  31. 2017Fooling Vision and Language Models Despite Localization and Attention Mechanismcited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 11; 2024: 22; 2025: 23; 2026: 10.

66 papers.

Sort:

By area:

  1. 2023Toward effective protection against diffusion based mimicry through score distillationcited by 65
  2. 2023On the Design Fundamentals of Diffusion Models: A Surveycited by 60
  3. 2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39
  4. 2023Can Protective Perturbation Safeguard Personal Data from Being Exploited by Stable Diffusion?cited by 38
  5. 2023DiffAttack: Evasion Attacks Against Diffusion-Based Adversarial Purificationcited by 36
  6. 2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
  7. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  8. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 18
  9. 2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
  10. 2024Instant Adversarial Purification with Adversarial Consistency Distillationcited by 14
  11. 2024Environmental Matching Attack Against Unmanned Aerial Vehicles Object Detectioncited by 11
  12. 2023Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detectorcited by 10
38 more
  1. 2024Pixel is a Barrier: Diffusion Models Are More Adversarially Robust Than We Thinkcited by 10
  2. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  3. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  4. 2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 9
  5. 2025V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMscited by 9
  6. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 8
  7. 2023Extraction and Recovery of Spatio-Temporal Structure in Latent Dynamics Alignment with Diffusion Modelscited by 7
  8. 2025Worst-case generation via minimax optimization in Wasserstein spacecited by 7
  9. 2023Assessing Robustness via Score-Based Adversarial Image Generationcited by 6
  10. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Modelscited by 5
  11. 2025My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swappingcited by 5
  12. 2025BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editingcited by 5
  13. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 4
  14. 2023MVPatch: More Vivid Patch for Adversarial Camouflaged Attacks on Object Detectors in the Physical Worldcited by 4
  15. 2024BadPatch: Diffusion-Based Generation of Physical Adversarial Patchescited by 4
  16. 2024DynamicPAE: Generating Scene-Aware Physical Adversarial Examples in Real-Timecited by 4
  17. 2024Prompt2Perturb (P2P): Text-Guided Diffusion-Based Adversarial Attacks on Breast Ultrasound Imagescited by 4
  18. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 3
  19. 2024HairDiffusion: Vivid Multi-Colored Hair Editing via Latent Diffusioncited by 3
  20. 2024Stealing Training Graphs from Graph Neural Networkscited by 3
  21. 2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
  22. 2025Towards more transferable adversarial attack in black-box mannercited by 2
  23. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  24. 2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
  25. 2025An h-space Based Adversarial Attack for Protection Against Few-shot Personalizationcited by 2
  26. 2025DASH: A Meta-Attack Framework for Synthesizing Effective and Stealthy Adversarial Examplescited by 2
  27. 2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
  28. 2026A Physics-Informed Fourier-Wavelet Transformer for Multiscale Computational Fluid Dynamics Surrogate Modelingcited by 2
  29. 2024Detecting Adversarial Data using Perturbation Forgerycited by 1
  30. 2024How to beat a Bayesian adversarycited by 1
  31. 2024MMAD-Purify: A Precision-Optimized Framework for Efficient and Scalable Multi-Modal Attackscited by 1
  32. 2024Gradient-Guided Conditional Diffusion Models for Private Image Reconstruction: Analyzing Adversarial Impacts of Differential Privacy and Denoisingcited by 1
  33. 2024MAGIC: Mastering Physical Adversarial Generation in Context through Collaborative LLM Agentscited by 1
  34. 2025Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimizationcited by 1
  35. 2025SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examplescited by 1
  36. 2025DBLP: Noise Bridge Consistency Distillation For Efficient And Reliable Adversarial Purificationcited by 1
  37. 2025PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectorscited by 1
  38. 2026Flux-Guard: Facial Identity Protection using diffusion modelscited by 1

50 most cited of 66 All 66 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Deceptive Diffusion: Generating Synthetic Adversarial Examples
  2. 2023DiffDefense: Defending against Adversarial Attacks via Diffusion Models
  3. 2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion
  4. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Models
  5. 2025Beyond Classification: Evaluating Diffusion Denoised Smoothing for Security-Utility Trade off
  6. 2023MimicDiffusion: Purifying Adversarial Perturbation via Mimicking Clean Diffusion Model
  7. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
  8. 2026A Low-Rank Defense Method for Adversarial Attack on Diffusion Models