Adversarial attacks involve adding perturbations to the source image to cause misclassification by the target model, which demonstrates the potential of attacking face recognition models. Existing adversarial face image generation methods still can't achieve satisfactory performance because of low transferability and high detectability. In this paper, we propose a unified framework Adv-Diffusion that can generate imperceptible adversarial identity perturbations in the latent space but not the raw pixel space, which utilizes strong inpainting capabilities of the latent diffusion model to generate realistic adversarial images. Specifically, we propose the identity-sensitive conditioned diffusion generative model to generate semantic perturbations in the surroundings. The designed adaptive strength-based adversarial perturbation algorithm can ensure both attack transferability and stealthiness. Extensive qualitative and quantitative experiments on the public FFHQ and CelebA-HQ datasets prove the proposed method achieves superior performance compared with the state-of-the-art methods without an extra generative model training process. The source code is available at https://github.com/kopper-xdu/Adv-Diffusion.

翻译：对抗攻击通过向源图像添加扰动导致目标模型误分类，展现了攻击人脸识别模型的潜力。现有对抗人脸图像生成方法因迁移性低、可检测性高而难以取得令人满意的性能。本文提出统一框架Adv-Diffusion，可在潜在空间而非原始像素空间生成不可感知的对抗身份扰动，利用潜在扩散模型的强修复能力生成逼真的对抗图像。具体而言，我们提出身份敏感条件扩散生成模型以生成语义扰动，并设计基于自适应强度的对抗扰动算法，确保攻击的迁移性与隐蔽性。在公开的FFHQ和CelebA-HQ数据集上进行的大量定性与定量实验证明，与无需额外生成模型训练过程的最优方法相比，所提方法具有更优性能。源码开源地址：https://github.com/kopper-xdu/Adv-Diffusion。