Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attacks
On the map: Diffusion models → Robustness, privacy and adversarial aspects
Abstract (arXiv)
Since the training data of the target model is not available in the black-box substitute attack, most recent schemes utilize GANs to generate data for training the substitute model. However, these GANs-based schemes suffer from low training efficiency as the generator needs to be retrained for each target model during the substitute training process, as well as low generation quality. To overcome these limitations, we consider utilizing the diffusion model to generate data, and propose a novel data-free substitute attack scheme based on the Stable Diffusion (SD) to improve the efficiency and accuracy of substitute training. Despite the data generated by the SD exhibiting high quality, it presents a different distribution of domains and a large variation of positive and negative samples for the target model. For this problem, we propose Latent Code Augmentation (LCA) to facilitate SD in generating data that aligns with the data distribution of the target model. Specifically, we augment the latent codes of the inferred member data with LCA and use them as guidance for SD. With the guidance of LCA, the data generated by the SD not only meets the discriminative criteria of the target model but also exhibits high diversity. By utilizing this data, it is possible to train the substitute model that closely resembles the target model more efficiently. Extensive experiments demonstrate that our LCA achieves higher attack success rates and requires fewer query budgets compared to GANs-based schemes for different target models. Our codes are available at urlhttps://github.com/LzhMeng/LCA.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 40 of its 64 references that are in the map. First posted on arXiv 24 Jul 2023.
Builds on
40 of 64 references.
References · 40
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020Denoising Diffusion Probabilistic Modelscited by 20,851
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
- 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
- 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
- 2016Adversarial examples in the physical worldcited by 1,762
28 more
- 2022Diffusion Models: A Comprehensive Survey of Methods and Applicationscited by 1,107
- 2016Universal adversarial perturbationscited by 774
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2020Label-Only Membership Inference Attackscited by 371
- 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
- 2016Harmonic Networks: Deep Translation and Rotation Equivariancecited by 293
- 2019f-VAEGAN-D2: A Feature Generating Framework for Any-Shot Learningcited by 164
- 2020Data-Free Model Extractioncited by 121
- 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
- 2018Data Augmentation using Random Image Cropping and Patching for Deep CNNscited by 87
- 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
- 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
- 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
- 2021Triangle Attack: A Query-efficient Decision-based Adversarial Attackcited by 48
- 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
- 2022Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspectivecited by 36
- 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 34
- 2023Sibling-Attack: Rethinking Transferable Adversarial Attacks against Face Recognitioncited by 32
- 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
- 2021Delving into Data: Effectively Substitute Training for Black-box Attackcited by 27
- 2023Ensemble-based Blackbox Attacks on Dense Predictioncited by 16
- 2022On the Robustness of Bayesian Neural Networks to Adversarial Attackscited by 12
- 2022Unsupervised Object Representation Learning using Translation and Rotation Group Equivariant VAEcited by 8
- 2022DST: Dynamic Substitute Training for Data-free Black-box Attackcited by 7
- 2020Adversarial Eigen Attack on Black-Box Modelscited by 6
- 2021Implicit Equivariance in Convolutional Networkscited by 5
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2023Improving Adversarial Transferability by Stable Diffusion
- 2024Model Inversion Attacks Through Target-Specific Conditional Diffusion Models
- 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?
- 2023White-box Membership Inference Attacks against Diffusion Models
- 2025CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models
- 2023Membership Inference Attacks against Diffusion Models
- 2023On the Robustness of Latent Diffusion Models
- 2024Distilling Diffusion Models into Conditional GANs