Unrestricted adversarial attacks present a serious threat to deep learning models and adversarial defense techniques. They pose severe security problems for deep learning applications because they can effectively bypass defense mechanisms. However, previous attack methods often utilize Generative Adversarial Networks (GANs), which are not theoretically provable and thus generate unrealistic examples by incorporating adversarial objectives, especially for large-scale datasets like ImageNet. In this paper, we propose a new method, called AdvDiff, to generate unrestricted adversarial examples with diffusion models. We design two novel adversarial guidance techniques to conduct adversarial sampling in the reverse generation process of diffusion models. These two techniques are effective and stable to generate high-quality, realistic adversarial examples by integrating gradients of the target classifier interpretably. Experimental results on MNIST and ImageNet datasets demonstrate that AdvDiff is effective to generate unrestricted adversarial examples, which outperforms GAN-based methods in terms of attack performance and generation quality.

翻译：无限制对抗攻击对深度学习模型及对抗防御技术构成严重威胁。由于能够有效绕过防御机制，此类攻击对深度学习应用带来了严峻的安全问题。然而，以往的攻击方法通常采用生成对抗网络（GANs），这类方法缺乏理论可证明性，因此在融入对抗目标时容易生成不真实的样本，尤其对于ImageNet等大规模数据集。本文提出一种名为AdvDiff的新方法，利用扩散模型生成无限制对抗样本。我们设计了两种新颖的对抗引导技术，在扩散模型的逆向生成过程中执行对抗采样。这两种技术通过可解释地整合目标分类器的梯度，能够有效且稳定地生成高质量、逼真的对抗样本。在MNIST和ImageNet数据集上的实验结果表明，AdvDiff能有效生成无限制对抗样本，在攻击性能和生成质量方面均优于基于GAN的方法。