mlsanityData to 7 Oct 2026

Diffusion to Confusion: Naturalistic Adversarial Patch Generation Based on Diffusion Model for Object Detector

arXiv 2307.08076 ↗First posted 16 Jul 2023cs.CVcited by 10

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Many physical adversarial patch generation methods are widely proposed to protect personal privacy from malicious monitoring using object detectors. However, they usually fail to generate satisfactory patch images in terms of both stealthiness and attack performance without making huge efforts on careful hyperparameter tuning. To address this issue, we propose a novel naturalistic adversarial patch generation method based on the diffusion models (DM). Through sampling the optimal image from the DM model pretrained upon natural images, it allows us to stably craft high-quality and naturalistic physical adversarial patches to humans without suffering from serious mode collapse problems as other deep generative models. To the best of our knowledge, we are the first to propose DM-based naturalistic adversarial patch generation for object detectors. With extensive quantitative, qualitative, and subjective experiments, the results demonstrate the effectiveness of the proposed approach to generate better-quality and more naturalistic adversarial patches while achieving acceptable attack performance than other state-of-the-art patch generation methods. We also show various generation trade-offs under different conditions.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 43 of its 56 references that are in the map. First posted on arXiv 16 Jul 2023.

Builds on

43 of 56 references.

Closest ancestors · 1

Same direction, newest first

  1. 2022Diffusion Models for Adversarial Purification16 May

Other references · 42

  1. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  6. 2020Denoising Diffusion Implicit Modelscited by 9,655
  7. 2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  9. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,005
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2022Classifier-Free Diffusion Guidancecited by 5,717
  12. 2023Adding Conditional Control to Text-to-Image Diffusion Modelscited by 5,466
30 more
  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2018Neural Ordinary Differential Equationscited by 3,733
  3. 2020Deformable DETR: Deformable Transformers for End-to-End Object Detectioncited by 3,410
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2018YOLOv3: An Incremental Improvementcited by 2,652
  6. 2016Adversarial examples in the physical worldcited by 1,762
  7. 2020YOLOv4: Optimal Speed and Accuracy of Object Detectioncited by 1,624
  8. 2016YOLO9000: Better, Faster, Strongercited by 1,429
  9. 2021Variational Diffusion Modelscited by 1,145
  10. 2022YOLOv7: Trainable bag-of-freebies sets new state-of-the-art for real-time object detectorscited by 978
  11. 2017Adversarial Patchcited by 514
  12. 2017Adversarial Examples for Semantic Segmentation and Object Detectioncited by 275
  13. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  14. 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 229
  15. 2018Physical Adversarial Examples for Object Detectorscited by 163
  16. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
  17. 2018ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detectorcited by 159
  18. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  19. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  20. 2017Medical Image Analysis using Convolutional Neural Networks: A Reviewcited by 99
  21. 2019Universal Physical Camouflage Attacks on Object Detectorscited by 91
  22. 2019Adversarial camera stickers: A physical camera-based attack on deep learning systemscited by 69
  23. 2021Segment and Complete: Defending Object Detectors against Adversarial Patch Attacks with Robust Patch Detectioncited by 67
  24. 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
  25. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  26. 2018DARTS: Deceiving Autonomous Cars with Toxic Signscited by 53
  27. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  28. 2019On adversarial patches: real-world attack on ArcFace-100 face recognition systemcited by 35
  29. 2018Robust Adversarial Perturbation on Deep Proposal-based Modelscited by 26
  30. 2023RFLA: A Stealthy Reflected Light Adversarial Attack in the Physical Worldcited by 23

Built on by

Cited by year

Citing papers per year: 2024: 5; 2025: 5.

10 papers.

  1. 2025UV-Attack: Physical-World Adversarial Attacks for Person Detection via Dynamic-NeRF-based UV Mappingcited by 8
  2. 2024Flexible Physical Camouflage Generation Based on a Differential Approachcited by 7
  3. 2025Don't Lag, RAG: Training-Free Adversarial Detection Using RAGcited by 5
  4. 2024BadPatch: Diffusion-Based Generation of Physical Adversarial Patchescited by 4
  5. 2024Enhancing Object Detection Robustness: Detecting and Restoring Confidence in the Presence of Adversarial Patch Attackscited by 2
  6. 2025Revisiting Adversarial Patch Defenses on Object Detectors: Unified Evaluation, Large-Scale Dataset, and New Insightscited by 2
  7. 2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
  8. 2024Generalizable Targeted Data Poisoning against Varying Physical Objectscited by 1
  9. 2025AngleRoCL: Angle-Robust Concept Learning for Physically View-Invariant T2I Adversarial Patchescited by 0
  10. 2025SpaNN: Detecting Multiple Adversarial Patches on CNNs by Spanning Saliency Thresholdscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Natural Adversarial Patch Generation Method Based on Latent Diffusion Model
  2. 2024AdvLogo: Adversarial Patch Attack against Object Detectors based on Diffusion Models
  3. 2025DisPatch: Disarming Adversarial Patches in Object Detection with Diffusion Models
  4. 2024Attacks and Defenses for Generative Diffusion Models: A Comprehensive Survey
  5. 2024Deceptive Diffusion: Generating Synthetic Adversarial Examples
  6. 2026Diffusion-Driven Deceptive Patches: Adversarial Manipulation and Forensic Detection in Facial Identity Verification
  7. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection
  8. 2024Diffusion Attack: Leveraging Stable Diffusion for Naturalistic Image Attacking