Improving adversarial transferability and imperceptibility with loss landscape and diffusion model

Abstract

Deep neural networks (DNNs) are vulnerable to adversarial examples, which introduce imperceptible perturbations on benign samples to mislead the prediction of DNNs. Transferability is a key property of adversarial examples, which enables adversarial examples crafted for one network to deceive other networks with high probability. However, the adversarial perturbations introduced by transferable attacks are perceptible to human observers. Although there are unrestricted attacks which can achieve good visual imperceptibility, the adversarial transferability of these attacks remains relatively low. In this paper, we propose to improve adversarial transferability and imperceptibility of adversarial examples via flat loss landscape and diffusion models. Specifically, we utilize denoising diffusion implicit model (DDIM) inversion operation to map the input image back to the diffusion latent space. Then we add perturbations on the diffusion latent space to achieve successful attacks on the surrogate model and flat input loss landscape, resulting in high adversarial transferability and imperceptible perturbations to human observers. Extensive experiments demonstrate that our proposed method enhances adversarial transferability while preserving the imperceptibility of the generated adversarial examples.