DeDiAttack: Enhancing Transferability of Unrestricted Adversarial Examples via Deformation-Constrained Diffusion.

Area of Science:

• Computer Vision
• Artificial Intelligence
• Machine Learning

Background:

• Deep neural networks (DNNs) are vulnerable to adversarial examples (AEs).
• Traditional AEs often have unnatural artifacts, while existing unrestricted adversarial examples (UAEs) struggle with visual fidelity and black-box transferability.
• Diffusion-based attacks exhibit poor transferability to unknown black-box models, and color-based attacks introduce noticeable visual mutations.

Purpose of the Study:

• To develop a novel unrestricted adversarial attack method that balances visual fidelity and black-box transferability.
• To address the limitations of existing UAE generation techniques, particularly concerning distribution shifts and surrogate model overfitting in diffusion models.
• To enhance the robustness evaluation of vision-based sensing and imaging systems.

Main Methods:

• Proposed DeDiAttack, an unrestricted attack based on deformation-constrained diffusion.
• Utilized manifold prior knowledge of diffusion models to translate elastic deformations into smooth fluid changes.
• Incorporated elastic deformation during denoising to guide surrogate models toward highly transferable features, preventing distribution shifts and overfitting.

Main Results:

• DeDiAttack effectively eliminates unnatural artifacts, generating highly natural and transferable UAEs.
• Demonstrated superior performance over existing attacks in extensive black-box experiments.
• Achieved a 7.2% improvement in black-box transferability on the ViT-B surrogate model.

Conclusions:

• DeDiAttack successfully generates natural and transferable UAEs, overcoming limitations of prior methods.
• The proposed method offers a significant advancement in adversarial attack research for DNNs.
• DeDiAttack serves as a valuable tool for assessing the robustness of vision-based systems.