Most adversarial attacks and defenses focus on perturbations within small
$\ell_p$-norm constraints. However, $\ell_p$ threat models cannot capture all
relevant semantic-preserving perturbations, and hence, the scope of robustness
evaluations is limited. In this work, we introduce Score-Based Adversarial
Generation (ScoreAG), a novel framework that leverages the advancements in
score-based generative models to generate adversarial examples beyond
$\ell_p$-norm constraints, so-called unrestricted adversarial examples,
overcoming their limitations. Unlike traditional methods, ScoreAG maintains the
core semantics of images while generating realistic adversarial examples,
either by transforming existing images or synthesizing new ones entirely from
scratch. We further exploit the generative capability of ScoreAG to purify
images, empirically enhancing the robustness of classifiers. Our extensive
empirical evaluation demonstrates that ScoreAG matches the performance of
state-of-the-art attacks and defenses across multiple benchmarks. This work
highlights the importance of investigating adversarial examples bounded by
semantics rather than $\ell_p$-norm constraints. ScoreAG represents an
important step towards more encompassing robustness assessments.

此研究介绍了基于评分的对抗生成（ScoreAG）框架，利用评分模型生成超越 $p$ 范数约束的对抗样本，既能保持图像的核心语义，又能生成逼真的对抗样本，进一步提高分类器的鲁棒性。通过广泛的实证评估，ScoreAG 在多个基准测试上与当前最先进的攻击和防御方法表现相当，强调了对抗样本在语义边界上的研究的重要性。

通过基于分数的对抗图像生成评估鲁棒性

Assessing Robustness via Score-Based Adversarial Image Generation

Unrestricted adversarial attacks present a serious threat to deep learning
models and adversarial defense techniques. They pose severe security problems
for deep learning applications because they can effectively bypass defense
mechanisms. However, previous attack methods often utilize Generative
Adversarial Networks (GANs), which are not theoretically provable and thus
generate unrealistic examples by incorporating adversarial objectives,
especially for large-scale datasets like ImageNet. In this paper, we propose a
new method, called AdvDiff, to generate unrestricted adversarial examples with
diffusion models. We design two novel adversarial guidance techniques to
conduct adversarial sampling in the reverse generation process of diffusion
models. These two techniques are effective and stable to generate high-quality,
realistic adversarial examples by integrating gradients of the target
classifier interpretably. Experimental results on MNIST and ImageNet datasets
demonstrate that AdvDiff is effective to generate unrestricted adversarial
examples, which outperforms GAN-based methods in terms of attack performance
and generation quality.

提出了一种新方法 AdvDiff，使用扩散模型生成无限制的对抗样本，并通过两种新的对抗引导技术在扩散模型的逆生成过程中进行对抗采样，实现了高质量、逼真的对抗样本生成。实验证明，AdvDiff 在攻击性能和生成质量方面优于基于 GAN 的方法。

AdvDiff：使用扩散模型生成无限制的对抗样本

AdvDiff: Generating Unrestricted Adversarial Examples using Diffusion  Models

Many works have investigated the adversarial attacks or defenses under the
settings where a bounded and imperceptible perturbation can be added to the
input. However in the real-world, the attacker does not need to comply with
this restriction. In fact, more threats to the deep model come from
unrestricted adversarial examples, that is, the attacker makes large and
visible modifications on the image, which causes the model classifying
mistakenly, but does not affect the normal observation in human perspective.
Unrestricted adversarial attack is a popular and practical direction but has
not been studied thoroughly. We organize this competition with the purpose of
exploring more effective unrestricted adversarial attack algorithm, so as to
accelerate the academical research on the model robustness under stronger
unbounded attacks. The competition is held on the TianChi platform
(https://tianchi.aliyun.com/competition/entrance/531853/introduction) as
one of the series of AI Security Challengers Program.

该研究旨在探索更有效的无限制对抗性攻击算法，以加快在更强的无边界攻击下的模型稳健性的学术研究，并组织了一项比赛来促进此领域的发展。