Unrestricted adversarial attacks present a serious threat to deep learning models and adversarial defense techniques. They pose severe security problems for deep learning applications because they can effectively bypass defense mechanisms. However, previous attack methods often utilize Generative Adversarial Networks (GANs), which are not theoretically provable and thus generate unrealistic examples by incorporating adversarial objectives, especially for large-scale datasets like ImageNet. In this paper, we propose a new method, called AdvDiff, to generate unrestricted adversarial examples with diffusion models. We design two novel adversarial guidance techniques to conduct adversarial sampling in the reverse generation process of diffusion models. These two techniques are effective and stable to generate high-quality, realistic adversarial examples by integrating gradients of the target classifier interpretably. Experimental results on MNIST and ImageNet datasets demonstrate that AdvDiff is effective to generate unrestricted adversarial examples, which outperforms GAN-based methods in terms of attack performance and generation quality.

翻译：无限制对抗攻击对深度学习模型及对抗防御技术构成了严重威胁。由于能有效绕过防御机制，此类攻击给深度学习应用带来了严峻的安全问题。然而，现有攻击方法多采用生成对抗网络（GANs），但这类方法缺乏理论可证明性，尤其在ImageNet等大规模数据集上，因融入对抗目标而易产生非真实样本。本文提出一种名为AdvDiff的新方法，利用扩散模型生成无限制对抗样本。我们设计了两种新颖的对抗引导技术，在扩散模型反向生成过程中执行对抗采样。这两种技术能通过可解释地整合目标分类器梯度，稳定高效地生成高质量、逼真的对抗样本。在MNIST和ImageNet数据集上的实验结果表明，AdvDiff能有效生成无限制对抗样本，在攻击性能与生成质量两方面均优于基于GAN的方法。