mlsanityData to 14 Oct 2026

SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Models

arXiv 2504.11923 ↗First posted 16 Apr 2025cs.LG cs.CVcited by 3

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Unrestricted adversarial examples (UAEs), allow the attacker to create non-constrained adversarial examples without given clean samples, posing a severe threat to the safety of deep learning models. Recent works utilize diffusion models to generate UAEs. However, these UAEs often lack naturalness and imperceptibility due to simply optimizing in intermediate latent noises. In light of this, we propose SemDiff, a novel unrestricted adversarial attack that explores the semantic latent space of diffusion models for meaningful attributes, and devises a multi-attributes optimization approach to ensure attack success while maintaining the naturalness and imperceptibility of generated UAEs. We perform extensive experiments on four tasks on three high-resolution datasets, including CelebA-HQ, AFHQ and ImageNet. The results demonstrate that SemDiff outperforms state-of-the-art methods in terms of attack success rate and imperceptibility. The generated UAEs are natural and exhibit semantically meaningful changes, in accord with the attributes' weights. In addition, SemDiff is found capable of evading different defenses, which further validates its effectiveness and threatening.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 39 of its 54 references that are in the map. First posted on arXiv 16 Apr 2025.

Builds on

39 of 54 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion Models24 Jul

Other references · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2020Denoising Diffusion Probabilistic Modelscited by 21,076
  5. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  6. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  7. 2020Denoising Diffusion Implicit Modelscited by 9,781
  8. 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
  9. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  10. 2015Deep Unsupervised Learning using Nonequilibrium Thermodynamicscited by 7,058
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  12. 2013Intriguing properties of neural networkscited by 5,155
26 more
  1. 2014Neural Machine Translation by Jointly Learning to Align and Translatecited by 4,548
  2. 2017Progressive Growing of GANs for Improved Quality, Stability, and Variationcited by 2,988
  3. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,877
  4. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,626
  5. 2021SDEdit: Guided Image Synthesis and Editing with Stochastic Differential Equationscited by 1,937
  6. 2020Training Generative Adversarial Networks with Limited Datacited by 1,186
  7. 2019StarGAN v2: Diverse Image Synthesis for Multiple Domainscited by 1,098
  8. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  9. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
  10. 2021DiffusionCLIP: Text-Guided Diffusion Models for Robust Image Manipulationcited by 642
  11. 2016Conditional Image Synthesis With Auxiliary Classifier GANscited by 565
  12. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
  13. 2021Diffusion Autoencoders: Toward a Meaningful and Decodable Representationcited by 449
  14. 2022Diffusion Models already have a Semantic Latent Spacecited by 328
  15. 2022Perception Prioritized Training of Diffusion Modelscited by 303
  16. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  17. 2022Uncovering the Disentanglement Capability in Text-to-Image Diffusion Modelscited by 116
  18. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 99
  19. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  20. 2022Disentangled Contrastive Learning for Social Recommendationcited by 27
  21. 2019AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examplescited by 17
  22. 2021Efficient Combinatorial Optimization for Word-level Adversarial Textual Attackcited by 17
  23. 2022Saliency Attack: Towards Imperceptible Black-box Adversarial Attackcited by 12
  24. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  25. 2024Backdoor Graph Condensationcited by 5
  26. 2024Joint Universal Adversarial Perturbations with Interpretationscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  2. 2026IDATA: Scalable Invertible Diffusion for Unrestricted Adversarial Transfer Attackcited by 0
  3. 2026Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Semantic Adversarial Attacks via Diffusion Models
  2. 2025Embedding Hidden Adversarial Capabilities in Pre-Trained Diffusion Models
  3. 2023Latent Magic: An Investigation into Adversarial Examples Crafted in the Semantic Latent Space
  4. 2025VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models
  5. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
  6. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models
  7. 2023Adv-Diffusion: Imperceptible Adversarial Face Identity Attack via Latent Diffusion Model
  8. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purification