Adversarial attacks involve adding perturbations to the source image to cause
misclassification by the target model, which demonstrates the potential of
attacking face recognition models. Existing adversarial face image generation
methods still can't achieve satisfactory performance because of low
transferability and high detectability. In this paper, we propose a unified
framework Adv-Diffusion that can generate imperceptible adversarial identity
perturbations in the latent space but not the raw pixel space, which utilizes
strong inpainting capabilities of the latent diffusion model to generate
realistic adversarial images. Specifically, we propose the identity-sensitive
conditioned diffusion generative model to generate semantic perturbations in
the surroundings. The designed adaptive strength-based adversarial perturbation
algorithm can ensure both attack transferability and stealthiness. Extensive
qualitative and quantitative experiments on the public FFHQ and CelebA-HQ
datasets prove the proposed method achieves superior performance compared with
the state-of-the-art methods without an extra generative model training
process. The source code is available at
this https URL

该研究论文提出了一种统一的框架 Adv-Diffusion，可以在潜在空间而不是原始像素空间中生成不可感知的对抗性身份扰动，利用潜在扩散模型的强大修补能力生成逼真的对抗性图像。通过在周围环境中生成语义扰动的身份敏感条件扩散生成模型，设计了自适应强度的对抗性扰动算法，既能确保攻击的可传递性又能保持隐秘性。在公开的 FFHQ 和 CelebA-HQ 数据集上进行了广泛的定性和定量实验，证明该方法在没有额外的生成模型训练过程的情况下取得了卓越的性能。源代码可在此链接中获取。