Many existing adversarial attacks generate $L_p$-norm perturbations on image
RGB space. Despite some achievements in transferability and attack success
rate, the crafted adversarial examples are easily perceived by human eyes.
Towards visual imperceptibility, some recent works explore unrestricted attacks
without $L_p$-norm constraints, yet lacking transferability of attacking
black-box models. In this work, we propose a novel imperceptible and
transferable attack by leveraging both the generative and discriminative power
of diffusion models. Specifically, instead of direct manipulation in pixel
space, we craft perturbations in latent space of diffusion models. Combined
with well-designed content-preserving structures, we can generate
human-insensitive perturbations embedded with semantic clues. For better
transferability, we further "deceive" the diffusion model which can be viewed
as an additional recognition surrogate, by distracting its attention away from
the target regions. To our knowledge, our proposed method, DiffAttack, is the
first that introduces diffusion models into adversarial attack field. Extensive
experiments on various model structures (including CNNs, Transformers, MLPs)
and defense methods have demonstrated our superiority over other attack
methods.

论文介绍一种新型的对抗攻击方法 DiffAttack，该方法利用扩散模型的生成和判别能力，在隐空间中生成人类感知不到的、带有语义线索的扰动，并采用内容保持结构。考虑到攻击的传递性，DiffAttack 进一步 “欺骗” 扩散模型，以分散其注意力，达到更好的转移性能，实验结果表明，DiffAttack 在各种模型结构和防御方法下具有更高的攻击成功率。