mlsanityData to 7 Oct 2026

Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model

arXiv 2312.11285 ↗First posted 18 Dec 2023cs.CV cs.AIcited by 21

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Adversarial attacks involve adding perturbations to the source image to cause misclassification by the target model, which demonstrates the potential of attacking face recognition models. Existing adversarial face image generation methods still can't achieve satisfactory performance because of low transferability and high detectability. In this paper, we propose a unified framework Adv-Diffusion that can generate imperceptible adversarial identity perturbations in the latent space but not the raw pixel space, which utilizes strong inpainting capabilities of the latent diffusion model to generate realistic adversarial images. Specifically, we propose the identity-sensitive conditioned diffusion generative model to generate semantic perturbations in the surroundings. The designed adaptive strength-based adversarial perturbation algorithm can ensure both attack transferability and stealthiness. Extensive qualitative and quantitative experiments on the public FFHQ and CelebA-HQ datasets prove the proposed method achieves superior performance compared with the state-of-the-art methods without an extra generative model training process. The source code is available at https://github.com/kopper-xdu/Adv-Diffusion.

Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 17 of its 26 references that are in the map. First posted on arXiv 18 Dec 2023.

Builds on

17 of 26 references.

References · 17

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  7. 2017Squeeze-and-Excitation Networkscited by 4,763
  8. 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,067
  9. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,967
  10. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  11. 2018Spatially Transformed Adversarial Examplescited by 195
  12. 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
5 more
  1. 2021Adv-Makeup: A New Imperceptible and Transferable Attack on Face Recognitioncited by 95
  2. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  3. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  4. 2022Protecting Facial Privacy: Generating Adversarial Identity Masks via Style-robust Makeup Transfercited by 77
  5. 2022Adv-Attribute: Inconspicuous and Transferable Adversarial Attack on Face Recognitioncited by 42

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 6; 2025: 6; 2026: 9.

21 papers.

Sort:

By area:

  1. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 26
  2. 2024Prompt-Agnostic Adversarial Perturbation for Customized Diffusion Modelscited by 14
  3. 2025Adv-CPG: A Customized Portrait Generation Framework with Facial Adversarial Attackscited by 13
  4. 2024Deepfake Media Generation and Detection in the Generative AI Era: A Survey and Outlookcited by 10
  5. 2024Transferable Adversarial Face Attack with Text Controlled Attributecited by 5
  6. 2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protectioncited by 5
  7. 2024A Survey on Physical Adversarial Attacks against Face Recognition Systemscited by 4
  8. 2025Responsible Diffusion: A Comprehensive Survey on Safety, Ethics, and Trust in Diffusion Modelscited by 3
  9. 2025TAIGen: Training-Free Adversarial Image Generation via Diffusion Modelscited by 2
  10. 2024ErasableMask: A Robust and Erasable Privacy Protection Scheme against Black-box Face Recognition Modelscited by 1
  11. 2026DeepInv: A Novel Self-supervised Learning Approach for Fast and Accurate Diffusion Inversioncited by 1
  12. 2026Adv-TGD: Adversarial Text-Guided Diffusion for Face Recognition Impersonation Attackscited by 1
9 more
  1. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  2. 2025Controllable Adversarial Makeup for Privacy via Text-Guided Diffusioncited by 0
  3. 2025FLUID: Training-Free Face De-identification via Latent Identity Substitutioncited by 0
  4. 2026SIDeR: Semantic Identity Decoupling for Unrestricted Face Privacycited by 0
  5. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  6. 2026Personalized Face Privacy Protection From a Single Imagecited by 0
  7. 2026ISPCloak: Weaponizing ISP for Optimization-Free Physical Camouflage against Deepfake Detectorscited by 0
  8. 2026DiffAttack: Evasion Attacks Against Face Recognition via Latent Diffusion Modelscited by 0
  9. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attack
  2. 2025SAP-DIFF: Semantic Adversarial Patch Generation for Black-Box Face Recognition Models via Diffusion Models
  3. 2023DiffProtect: Generate Adversarial Examples with Diffusion Models for Facial Privacy Protection
  4. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attacks
  5. 2024Deceptive Diffusion: Generating Synthetic Adversarial Examples
  6. 2026Diffusion-Guided Adversarial Perturbation Injection for Generalizable Defense Against Facial Manipulations
  7. 2025CAT: Contrastive Adversarial Training for Evaluating the Robustness of Protective Perturbations in Latent Diffusion Models
  8. 2024Adversarial Examples are Misaligned in Diffusion Model Manifolds