Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks

arXiv 2509.19044 ↗First posted 23 Sep 2025cs.LG cs.CVcited by 0

On the map: Diffusion models → Robustness, privacy and adversarial aspects

Abstract (arXiv)

Black-box adversarial attacks remain challenging due to limited access to model internals. Existing methods often depend on specific network architectures or require numerous queries, resulting in limited cross-architecture transferability and high query costs. To address these limitations, we propose JAD, a latent diffusion model framework for black-box adversarial attacks. JAD generates adversarial examples by leveraging a latent diffusion model guided by attention maps distilled from both a convolutional neural network (CNN) and a Vision Transformer (ViT) models. By focusing on image regions that are commonly sensitive across architectures, this approach crafts adversarial perturbations that transfer effectively between different model types. This joint attention distillation strategy enables JAD to be architecture-agnostic, achieving superior attack generalization across diverse models. Moreover, the generative nature of the diffusion framework yields high adversarial sample generation efficiency by reducing reliance on iterative queries. Experiments demonstrate that JAD offers improved attack generalization, generation efficiency, and cross-architecture transferability compared to existing methods, providing a promising and effective paradigm for black-box adversarial attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Robustness, privacy and adversarial aspects, one of 14 directions in Diffusion models. Builds on 45 of its 61 references that are in the map. First posted on arXiv 23 Sep 2025.

Builds on

45 of 61 references.

Closest ancestors · 3

Same direction, newest first

Other references · 42

2015Deep Residual Learning for Image Recognitioncited by 52,096
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
2020Denoising Diffusion Probabilistic Modelscited by 21,076
2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,713
2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,639
2020End-to-End Object Detection with Transformerscited by 7,414
2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,968
2016Densely Connected Convolutional Networkscited by 6,720
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415

30 more

2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
2020Training data-efficient image transformers & distillation through attentioncited by 4,586
2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
2022A ConvNet for the 2020scited by 3,579
2016Paying More Attention to Attention: Improving the Performance of Convolutional Neural Networks via Attention Transfercited by 1,077
2021Do Vision Transformers See Like Convolutional Neural Networks?cited by 675
2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 536
2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 486
2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
2021XCiT: Cross-Covariance Image Transformerscited by 338
2018Generating Adversarial Examples with Adversarial Networkscited by 258
2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
2020A Self-supervised Approach for Adversarial Robustnesscited by 180
2017Generative Adversarial Perturbationscited by 153
2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
2023An Adaptive Model Ensemble Adversarial Attack for Boosting Adversarial Transferabilitycited by 42
2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
2017Boosting Adversarial Attacks with Momentumcited by 24
2024Learning to Transform Dynamically for Better Adversarial Transferabilitycited by 23
2018Improved robustness to adversarial examples using Lipschitz regularization of the losscited by 13
2024Improving Integrated Gradient-based Transferable Adversarial Examples by Refining the Integration Pathcited by 10
2024ADBA:Approximation Decision Boundary Approach for Black-Box Adversarial Attackscited by 8
2023DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generationcited by 5
2025Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiencycited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way