{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/boosting-black-box-attack-to-deep-neural","title":"Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Models","arxiv_id":"2310.07492","date":"2023-10-11","proceeding":null,"authors":["Renyang Liu","Wei Zhou","Tianwei Zhang","Kangjie Chen","Jun Zhao","Kwok-Yan Lam"],"abstract":"Existing black-box attacks have demonstrated promising potential in creating adversarial examples (AE) to deceive deep learning models. Most of these attacks need to handle a vast optimization space and require a large number of queries, hence exhibiting limited practical impacts in real-world scenarios. In this paper, we propose a novel black-box attack strategy, Conditional Diffusion Model Attack (CDMA), to improve the query efficiency of generating AEs under query-limited situations. The key insight of CDMA is to formulate the task of AE synthesis as a distribution transformation problem, i.e., benign examples and their corresponding AEs can be regarded as coming from two distinctive distributions and can transform from each other with a particular converter. Unlike the conventional \\textit{query-and-optimization} approach, we generate eligible AEs with direct conditional transform using the aforementioned data converter, which can significantly reduce the number of queries needed. CDMA adopts the conditional Denoising Diffusion Probabilistic Model as the converter, which can learn the transformation from clean samples to AEs, and ensure the smooth development of perturbed noise resistant to various defense strategies. We demonstrate the effectiveness and efficiency of CDMA by comparing it with nine state-of-the-art black-box attacks across three benchmark datasets. On average, CDMA can reduce the query count to a handful of times; in most cases, the query count is only ONE. We also show that CDMA can obtain $>99\\%$ attack success rate for untarget attacks over all datasets and targeted attack over CIFAR-10 with the noise budget of $\\epsilon=16$.","url_abs":"https://arxiv.org/abs/2310.07492v1","url_pdf":"https://arxiv.org/pdf/2310.07492v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"boosting-black-box-attack-to-deep-neural","repo_url":"https://github.com/ryliu68/CDMA","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"denoising","task_name":"Denoising"}],"methods":[{"method_slug":"ae","method_name":"AE"},{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2310.07492","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2310.07492"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ryliu68/CDMA","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_violates":3,"ran":10,"ran_honours":1,"unverified":3},"by_repo_kind":{"official":{"samples":17,"ran":14,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"fbf9ec7be545688e","entry":"default","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/network.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/network.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fbf9ec7be545688e"}},{"code_sha256_prefix":"4752f3a132bde7b3","entry":"denorm","repo":"ryliu68/CDMA","repo_kind":"official","path":"sample_adv_batch.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/sample_adv_batch.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4752f3a132bde7b3"}},{"code_sha256_prefix":"60fc13986769e4c7","entry":"dict2str","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/praser.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/praser.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"60fc13986769e4c7"}},{"code_sha256_prefix":"38e77ca35f1f8bcb","entry":"dict_to_nonedict","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/praser.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/praser.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"38e77ca35f1f8bcb"}},{"code_sha256_prefix":"608e364a9d2376a3","entry":"exists","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/network.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/network.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"608e364a9d2376a3"}},{"code_sha256_prefix":"ab4109634b75ef8b","entry":"is_image_file","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/base_dataset.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/base_dataset.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ab4109634b75ef8b"}},{"code_sha256_prefix":"0570fbc1e2582ae7","entry":"mae","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/metric.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/metric.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"0570fbc1e2582ae7"}},{"code_sha256_prefix":"fd901efe5f883205","entry":"make_dataset","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/base_dataset.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/base_dataset.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"fd901efe5f883205"}},{"code_sha256_prefix":"632959a67ae7fdac","entry":"mse_loss","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/loss.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/loss.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"632959a67ae7fdac"}},{"code_sha256_prefix":"534e80dab769ec2f","entry":"pil_loader","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/base_dataset.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/base_dataset.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"534e80dab769ec2f"}},{"code_sha256_prefix":"1037e66345303a97","entry":"postprocess","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/util.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/util.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1037e66345303a97"}},{"code_sha256_prefix":"cb4d5720ab772114","entry":"sample_adv","repo":"ryliu68/CDMA","repo_kind":"official","path":"sample_adv_batch.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/sample_adv_batch.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cb4d5720ab772114"}},{"code_sha256_prefix":"24ef4b46c563b220","entry":"set_gpu","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/util.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/util.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"24ef4b46c563b220"}},{"code_sha256_prefix":"8aa242823600422d","entry":"tensor2img","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/util.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/util.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8aa242823600422d"}},{"code_sha256_prefix":"e894fcce48231d2f","entry":"extract","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/network.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/network.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e894fcce48231d2f"}},{"code_sha256_prefix":"6d3c813b7561493d","entry":"inception_score","repo":"ryliu68/CDMA","repo_kind":"official","path":"models/metric.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/models/metric.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6d3c813b7561493d"}},{"code_sha256_prefix":"89ecc1cd0adb6951","entry":"init_obj","repo":"ryliu68/CDMA","repo_kind":"official","path":"core/praser.py","file_url":"https://github.com/ryliu68/CDMA/blob/HEAD/core/praser.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"89ecc1cd0adb6951"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}