{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/diffusion-models-for-imperceptible-and","title":"Diffusion Models for Imperceptible and Transferable Adversarial Attack","arxiv_id":"2305.08192","date":"2023-05-14","proceeding":null,"authors":["Jianqi Chen","Hao Chen","Keyan Chen","Yilan Zhang","Zhengxia Zou","Zhenwei Shi"],"abstract":"Many existing adversarial attacks generate $L_p$-norm perturbations on image RGB space. Despite some achievements in transferability and attack success rate, the crafted adversarial examples are easily perceived by human eyes. Towards visual imperceptibility, some recent works explore unrestricted attacks without $L_p$-norm constraints, yet lacking transferability of attacking black-box models. In this work, we propose a novel imperceptible and transferable attack by leveraging both the generative and discriminative power of diffusion models. Specifically, instead of direct manipulation in pixel space, we craft perturbations in the latent space of diffusion models. Combined with well-designed content-preserving structures, we can generate human-insensitive perturbations embedded with semantic clues. For better transferability, we further \"deceive\" the diffusion model which can be viewed as an implicit recognition surrogate, by distracting its attention away from the target regions. To our knowledge, our proposed method, DiffAttack, is the first that introduces diffusion models into the adversarial attack field. Extensive experiments on various model structures, datasets, and defense methods have demonstrated the superiority of our attack over the existing attack methods.","url_abs":"https://arxiv.org/abs/2305.08192v2","url_pdf":"https://arxiv.org/pdf/2305.08192v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"diffusion-models-for-imperceptible-and","repo_url":"https://github.com/windvchen/diffattack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2305.08192","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2305.08192"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/windvchen/diffattack","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_draft_wrong":2,"unverified":5},"by_repo_kind":{"official":{"samples":7,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ecfdcb7de66cc30f","entry":"encoder","repo":"windvchen/diffattack","repo_kind":"official","path":"diff_latent_attack-0.9.0.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/diff_latent_attack-0.9.0.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ecfdcb7de66cc30f"}},{"code_sha256_prefix":"fa609ac1c290e653","entry":"preprocess","repo":"windvchen/diffattack","repo_kind":"official","path":"diff_latent_attack-0.9.0.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/diff_latent_attack-0.9.0.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"fa609ac1c290e653"}},{"code_sha256_prefix":"345bd2bbf8bcb9b0","entry":"calculate_activation_statistics","repo":"windvchen/diffattack","repo_kind":"official","path":"pytorch_fid/fid_score.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/pytorch_fid/fid_score.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"345bd2bbf8bcb9b0"}},{"code_sha256_prefix":"0def50a351111624","entry":"calculate_frechet_distance","repo":"windvchen/diffattack","repo_kind":"official","path":"pytorch_fid/fid_score.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/pytorch_fid/fid_score.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0def50a351111624"}},{"code_sha256_prefix":"f2778069fba3bee4","entry":"ddim_reverse_sample","repo":"windvchen/diffattack","repo_kind":"official","path":"diff_latent_attack-0.9.0.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/diff_latent_attack-0.9.0.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f2778069fba3bee4"}},{"code_sha256_prefix":"594c40690017a276","entry":"get_activations","repo":"windvchen/diffattack","repo_kind":"official","path":"pytorch_fid/fid_score.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/pytorch_fid/fid_score.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"594c40690017a276"}},{"code_sha256_prefix":"3db00532c993361c","entry":"load_weights","repo":"windvchen/diffattack","repo_kind":"official","path":"torch_nets/tf2torch_adv_inception_v3.py","file_url":"https://github.com/windvchen/diffattack/blob/HEAD/torch_nets/tf2torch_adv_inception_v3.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3db00532c993361c"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}