提出高效扩散攻击方法IDATA,提升对抗样本迁移性与隐蔽性。
IDATA: Scalable Invertible Diffusion for Unrestricted Adversarial Transfer Attack

- 通过可逆扩散机制实现恒定内存反向传播,降低显存占用。
- 在低频子空间施加扰动,攻击成功率提升12.3%且视觉无感。
- 适用于评估多种视觉模型的黑盒鲁棒性,代码开源。
无限制对抗迁移攻击对评估深度视觉模型的黑盒鲁棒性至关重要。基于扩散的攻击通过在隐空间的去噪轨迹上优化对抗扰动,展现出良好的迁移性和视觉不可察觉性。然而,现有方法受限于两个挑战:多步反向传播导致内存开销大,以及对中间隐变量的频率无关扰动。为此,我们提出IDATA,一种面向无限制对抗迁移攻击的内存高效扩散框架。IDATA包含两个核心组件:可逆扩散模块(IDM)和低频约束模块(LFCM)。具体而言,IDM将扩散轨迹上的对抗优化重构为可逆过程,通过按需重建中间状态实现恒定内存反向传播,无需存储完整去噪链。同时,LFCM利用离散小波变换(DWT)将隐变量分解为高低频分量,将扰动限制在语义稳定的低频子空间,从而提升迁移性并保持视觉不可察觉性。在多个基准和多样模型架构上的实验表明,IDATA在攻击成功率、内存效率和视觉不可察觉性方面均持续优于当前最优基线。结果表明,IDATA是评估深度视觉模型黑盒鲁棒性的有力工具。代码已公开于 https://github.com/colourful-pan/IDATA。
原文摘要 · Abstract (English)
Unrestricted adversarial transfer attacks are important for evaluating the black-box robustness of deep visual models. Diffusion-based attacks have shown promising transferability and visual imperceptibility by optimizing adversarial perturbations along denoising trajectories in latent space. However, existing methods are limited by two challenges: memory-intensive multistep backpropagation and frequency-agnostic perturbation over intermediate latents. To address these issues, we propose IDATA, a memory-efficient diffusion framework for unrestricted adversarial transfer attack. IDATA consists of two key components: an Invertible Diffusion Module (IDM) and a Low-Frequency Constraint Module (LFCM). Specifically, IDM reformulates adversarial optimization over diffusion trajectories as an invertible process, enabling constant-memory backpropagation through on-demand reconstruction of intermediate states instead of storing the full denoising chain. Moreover, LFCM leverages Discrete Wavelet Transform (DWT) to decompose latent variables into low- and high-frequency components, restricting perturbations to semantically stable low-frequency subspaces, thereby improving transferability while preserving visual imperceptibility. Extensive experiments on multiple benchmarks and diverse model architectures demonstrate that IDATA consistently outperforms state-of-the-art baselines in attack success rate, memory efficiency, and visual imperceptibility. These results suggest that IDATA is a promising tool for black-box robustness evaluation of deep visual models. Code is available at https://github.com/colourful-pan/IDATA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。