Data to 7 Oct 2026

AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Models

arXiv 2307.12499 ↗First posted 24 Jul 2023cs.LG cs.CVcited by 46

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Unrestricted adversarial attacks present a serious threat to deep learning models and adversarial defense techniques. They pose severe security problems for deep learning applications because they can effectively bypass defense mechanisms. However, previous attack methods often directly inject Projected Gradient Descent (PGD) gradients into the sampling of generative models, which are not theoretically provable and thus generate unrealistic examples by incorporating adversarial objectives, especially for GAN-based methods on large-scale datasets like ImageNet. In this paper, we propose a new method, called AdvDiff, to generate unrestricted adversarial examples with diffusion models. We design two novel adversarial guidance techniques to conduct adversarial sampling in the reverse generation process of diffusion models. These two techniques are effective and stable in generating high-quality, realistic adversarial examples by integrating gradients of the target classifier interpretably. Experimental results on MNIST and ImageNet datasets demonstrate that AdvDiff is effective in generating unrestricted adversarial examples, which outperforms state-of-the-art unrestricted adversarial attack methods in terms of attack performance and generation quality.

Key facts. Cited by 46 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 53 of its 63 references that are in the map. First posted on arXiv 24 Jul 2023.

Builds on

53 of 63 references.

Closest ancestors · 2

Same direction, newest first

2023Diffusion Models for Imperceptible and Transferable Adversarial Attack14 May
2022Diffusion Models for Adversarial Purification16 May

Other references · 51

2015Deep Residual Learning for Image Recognitioncited by 51,809
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
2020Denoising Diffusion Probabilistic Modelscited by 20,851
2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
2020Denoising Diffusion Implicit Modelscited by 9,655
2021Diffusion Models Beat GANs on Image Synthesiscited by 8,185
2016Densely Connected Convolutional Networkscited by 6,691
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2022Classifier-Free Diffusion Guidancecited by 5,717
2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
2013Intriguing properties of neural networkscited by 5,114

38 more

2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
2017Squeeze-and-Excitation Networkscited by 4,763
2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
2016Wide Residual Networkscited by 3,057
2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
2016Improved Techniques for Training GANscited by 2,938
2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
2021BEiT: BERT Pre-Training of Image Transformerscited by 2,360
2016Adversarial examples in the physical worldcited by 1,762
2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
2022RePaint: Inpainting using Denoising Diffusion Probabilistic Modelscited by 1,419
2015LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loopcited by 1,350
2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
2020Training Generative Adversarial Networks with Limited Datacited by 1,184
2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,059
2018MnasNet: Platform-Aware Neural Architecture Search for Mobilecited by 937
2018Self-Attention Generative Adversarial Networkscited by 809
2019Interpreting the Latent Space of GANs for Semantic Face Editingcited by 691
2021DiffusionCLIP: Text-Guided Diffusion Models for Robust Image Manipulationcited by 640
2016Conditional Image Synthesis With Auxiliary Classifier GANscited by 562
2022Make-A-Scene: Scene-Based Text-to-Image Generation with Human Priorscited by 487
2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
2017Progressive Neural Architecture Searchcited by 483
2017Mitigating Adversarial Effects Through Randomizationcited by 382
2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
2019Adversarial Examples Improve Image Recognitioncited by 283
2018Generating Adversarial Examples with Adversarial Networkscited by 256
2020A Self-supervised Approach for Adversarial Robustnesscited by 180
2017Generative Adversarial Perturbationscited by 153
2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
2023Content-based Unrestricted Adversarial Attackcited by 73
2019AdvFaces: Adversarial Face Synthesiscited by 59
2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
2022Physical-World Optical Adversarial Attacks on 3D Face Recognitioncited by 23
2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
2023StyLess: Boosting the Transferability of Adversarial Examplescited by 11
2019Fine-grained Synthesis of Unrestricted Adversarial Examplescited by 8

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 10; 2025: 24; 2026: 11.

46 papers.

Sort:

By area:

2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
2025Generative Diffusion Models for Wireless Networks: Fundamental, Architecture, and State-of-the-Artcited by 13
2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 11
2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
2025PLA: Prompt Learning Attack against Text-to-Image Generative Modelscited by 8
2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
2023SD-NAE: Generating Natural Adversarial Examples with Stable Diffusioncited by 5
2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusioncited by 5
2025My Face Is Mine, Not Yours: Facial Protection Against Diffusion Model Face Swappingcited by 4
2025TRAP: Targeted Redirecting of Agentic Preferencescited by 4
2025Distributionally Robust Optimization via Diffusion Ambiguity Modelingcited by 4

34 more

2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
2025Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generationcited by 3
2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Modelscited by 3
2026Unsupervised Decomposition and Recombination with Discriminator-Driven Diffusion Modelscited by 3
2026Distributionally Robust Optimization via Generative Ambiguity Modelingcited by 3
2024Large Generative Graph Modelscited by 2
2024White Matter Geometry-Guided Score-Based Diffusion Model for Tissue Microstructure Imputation in Tractography Imagingcited by 2
2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 2
2025Active Learning Inspired ControlNet Guidance for Augmenting Semantic Segmentation Datasetscited by 2
2025Mind the Trojan Horse: Image Prompt Adapter Enabling Scalable and Deceptive Jailbreakingcited by 2
2025SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Modelscited by 2
2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
2025On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbationscited by 2
2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
2024SoK: Analyzing Adversarial Examples: A Framework to Study Adversary Knowledgecited by 1
2025Gradient-Free Adversarial Purification with Diffusion Modelscited by 1
2025Dual-Flow: Transferable Multi-Target, Instance-Agnostic Attacks via In-the-wild Cascading Flow Optimizationcited by 1
2025SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examplescited by 1
2025PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectorscited by 1
2024Transferable 3D Adversarial Shape Completion using Diffusion Modelscited by 0
2024Patch is Enough: Naturalistic Adversarial Patch against Vision-Language Pre-training Modelscited by 0
2025Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Modelscited by 0
2025Rethinking Target Label Conditioning in Adversarial Attacks: A 2D Tensor-Guided Generative Approachcited by 0
2025Improving Black-Box Generative Attacks via Generator Semantic Consistencycited by 0
2025Diffusion Guided Adversarial State Perturbations in Reinforcement Learningcited by 0
2025DPAC: Distribution-Preserving Adversarial Control for Diffusion Samplingcited by 0
2026In-the-Wild Camouflage Attack on Vehicle Detectors through Controllable Image Editingcited by 0
2026DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defensecited by 0
2026FoeGlass: Simple In-Context Learning Is Enough for Red Teaming Audio Deepfake Detectorscited by 0
2026Not All Prediction Targets Keep Training-Free Diffusion Guidance on the Manifoldcited by 0
2026Adversarially Guided Diffusion for LiDAR Range Image Synthesiscited by 0
2026Perspective-Invariant Attack with Enhanced Transferability of Adversarial Examplescited by 0
2026Discovering Natural Transformation Vulnerabilities in Black-Box Vision Modelscited by 0
2026Let the Carrier Carry the Attack: Preserving the Subject in Adversarial Image Generationcited by 0

Similar, not cited

Close in wording, no citation either way