Pith. sign in

REVIEW 3 major objections 5 minor 56 references

TRAIL: Transferable Robust Adversarial Images via Latent diffusion

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TRAIL: adapting a latent diffusion model on the fly makes adversarial images transfer across unseen models.

desk verdict Genuinely new test-time adaptation idea for diffusion-based attacks with striking reported gains, but the missing code, omitted hyperparameters, and an unvalidated one-step gradient shortcut keep it from being fully convincing. read the letter →

arxiv 2505.16166 v1 pith:XQ5OBC7K submitted 2025-05-22 cs.CV

Yuhao Xue , Zhifei Zhang , Xinyang Jiang , Yifei Shen , Junyao Gao , Wentao Gu , Jiale Zhao , Miaojing Shi
show 1 more author
Cairong Zhao
This is my paper · ORCID
classification cs.CV
keywords transferableadversarialattackunrestrictedlatentdiffusionmodeltest-timeadaptationblack-boxvision-languagedefensebypassrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to remove a persistent weakness of unrestricted adversarial attacks: an image crafted to fool one classifier often stops fooling a different one because the perturbation lives in the artificial distribution of a generator instead of in the distribution of natural images carrying adversarial features. TRAIL's proposed fix is to adapt a pretrained latent diffusion model to each target image at attack time, updating the denoising network so that the images it generates are simultaneously realistic and misclassified by a surrogate model. The authors report that this test-time adaptation plus adversarial-gradient-guided denoising beats existing unrestricted attacks on cross-model transfer, including against vision-language models, and also holds up under strong purification defenses. If the claim is right, transferability depends less on the perturbation budget than on aligning the generator's output distribution with the adversarial objective.

What carries the argument

The load-bearing mechanism is test-time adaptation of the diffusion model itself: TRAIL treats Stable Diffusion's U-Net as a trainable generator and updates its weights on each target image so that the generator's output distribution shifts toward images with adversarial features that closely resemble the target. The update is driven by the paired adversarial and distance losses, and the final image is produced by noising the input and denoising with adversarial-gradient guidance. A one-step backpropagation shortcut, which predicts clean latents from a randomly selected noisy timestep without tracing the full sampling path, makes this adaptation computationally feasible, at the cost of assuming the single-step gradient represents the full-chain gradient.

What would settle it

Train TRAIL twice on the same benchmark, once with the one-step shortcut and once with backpropagation through the full denoising chain on a smaller diffusion model, and compare transfer success rates; if the full-chain version does not perform at least as well, or if the one-step and full-chain gradients have near-zero cosine similarity on a sample of images, then the advertised adaptation mechanism is not what produces the transferability.

Watch

Extended reading notes

Core claim

The central claim is that the failure of diffusion-based adversarial attacks to transfer stems from a distribution shift: the frozen generator produces images from the natural-image distribution, whereas an effective adversarial image must come from a distribution that mixes natural appearance with dense adversarial features. TRAIL closes that gap by fine-tuning the diffusion U-Net on the target image during the attack, minimizing a loss that combines negative cross-entropy against a surrogate classifier with a mean-squared distance to the original image. The adapted model then synthesizes the adversarial image by adding noise to the target and denoising under classifier-gradient guidance. To keep adaptation tractable, gradients are computed from a one-step denoising prediction at a random timestep instead of through the full sampling chain. In the authors' experiments, this yields an average black-box transfer success rate of 75.3% from MobileNet-v2 versus 62.3% for DiffAttack, and 77.4% success against the DiffPure defense.

Load-bearing premise

Everything depends on the assumption that the gradient obtained from a one-step denoising prediction at a randomly selected timestep points in essentially the same direction as the gradient through the entire multi-step sampling process; if that proxy is poor, the adapted generator may not actually become adversarial, and the reported transfer gains could be driven by the guidance step rather than by the test-time adaptation.

Editorial extensions

If this is right

  • A single small surrogate CNN such as MobileNet-v2 can produce adversarial images that transfer to unseen CNNs, Vision Transformers, CLIP, and LLaVA, according to the reported results.
  • Because the generated images stay close to the natural-image distribution, they slip past input-transformation and purification defenses such as JPEG, NRP, and DiffPure at higher success rates than prior unrestricted attacks.
  • Transferability becomes a distribution-alignment problem: future attacks can be compared by how well they align the generator's output distribution with the adversarial objective rather than by perturbation budget alone.
  • Test-time adaptation is opened as a new axis for attack design, letting an attacker spend compute on adapting the generator to one image instead of ensembling many surrogate models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is ensemble adaptation: adapting the U-Net against several surrogate classifiers at once could push transferability further, since the paper's theoretical framing ties transfer to robust features shared across models.
  • The one-step gradient shortcut is directly testable: if it is a poor proxy, a full-backprop variant on a small model should outperform it, and an ablation of this choice would separate the adaptation's contribution from the guidance's contribution.
  • The t* knob suggests an attacker can dial between stealth and strength; a natural next test is whether human perceptual judgments or learned perceptual metrics track the same trade-off as SSIM.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The manuscript proposes TRAIL, a test-time adaptation framework for unrestricted adversarial image generation. Given a target image and a surrogate classifier, TRAIL updates a pre-trained latent diffusion U-Net by optimizing a weighted sum of an adversarial cross-entropy loss and a perceptual distance loss (Eq. 7), using a one-step denoising backpropagation shortcut (Section 3.4). The adapted model then generates the adversarial image by partially noising the input latent for t* steps and performing guided denoising (Eqs. 12-13). Experiments on an ImageNet-compatible dataset report large cross-model transfer gains over existing unrestricted attacks (e.g., 75.3% vs. 62.3% Transfer Avg for MobileNet-v2 surrogate in Table 1), improved success against defenses including DiffPure (77.4% in Table 2), and black-box attacks on CLIP and LLaVA (Table 3).

Significance. If the empirical results hold, TRAIL is a meaningful advance: it is, to my knowledge, the first test-time adaptation method for diffusion-based adversarial attacks, and the reported margins over DiffAttack and ACA are large and consistent across CNN and ViT surrogates, defenses, and VLM targets. The paper also makes an honest attempt at a theoretical justification via the Proposition in Section 3.3 and the supplementary proof. However, the central mechanism is supported only by an unvalidated one-step gradient shortcut, key hyperparameters are missing, and the proposition's proof has internal inconsistencies. As a result, the current evidence does not yet establish that the adaptation component is the cause of the reported gains.

major comments (3)
  1. [3.4] The one-step gradient shortcut is load-bearing but unvalidated. During adaptation, a random timestep t_r is chosen, the latent is denoised for a single step via Eq. 12, and the loss Eq. 7 is backpropagated through that one prediction to update theta. The final adversarial image, however, is generated by the full multi-step guided reverse process of Eq. 13. Nothing in the paper shows that the one-step gradient direction is aligned with the loss of the final generated image. The randomness of t_r and the use of a single denoising prediction make this an uncontrolled proxy. To support the central claim that test-time adaptation drives TRAIL's transferability, the authors should add at least (i) an ablation with adaptation disabled, (ii) a comparison with full backpropagation through all sampling steps, and (iii) a comparison using more than one denoising step in the adaptation gradient. Without such ablations, the large gains in Tables 1-3 could be attributed to the adversarial guidance in Eq. 13 or to the unrestricted perturbation budget rather than to the proposed adaptation.
  2. [4.1] The loss weights alpha and beta in Eq. 7 are never specified. Section 4.1 lists N=100, T=80, t*=8, and learning rate 1e-5, but it does not report alpha, beta, or the scaling of the adversarial guidance term used in Eq. 13. These values are essential for reproducibility and for interpreting the trade-off experiments. The paper also provides no sensitivity analysis with respect to alpha and beta, so the reader cannot tell whether the reported margins depend on finely tuned weights or are robust to reasonable variation.
  3. [3.3 and Appendix 6] The Proposition's proof has internal inconsistencies that undermine its stated conclusion. The proposition states a bound on ||z - z0(t*)||^2 (Eq. 16), but the proof's final step bounds ||z0(t*) - z_t*||^2 (Eq. 26); these are different quantities because z_t* is the noised version of z, not z itself. In addition, the proof treats the normalized noise prediction bound C as a uniform constant for all t in [0,1], but the normalization 1/sqrt(1-alpha_bar_t) diverges as t approaches 0, so such a constant is not justified. The derivation of the deterministic-term bound in Eq. 19 also reuses C in a way that is not dimensionally consistent. The claim that 'as t* increases, the distance becomes larger' is only supported by monotonicity of an upper bound, not by monotonicity of the actual distance. I recommend either repairing the proposition and proof or removing the proposition and stating the t* trade-off purely as an empirical observation.
minor comments (5)
  1. [2.1] The sentence beginning 'Bhattad et al.' is incomplete and should be finished or merged with the preceding sentence.
  2. [3.3] Equation (10) uses x_t in the U-Net prediction, while the surrounding notation consistently uses z_t for the latent; please correct this inconsistency.
  3. [4.4] The axis labels and legend of Figure 3 appear as garbled unicode escape sequences in the provided text; the published figure should be checked for legibility.
  4. [Throughout] There are several typos and grammatical slips, e.g., 'aderverial loss' in Section 3.3, 'simpling steps' in Section 3.4, and 'selcet' in Section 4.1, which should be corrected.
  5. [4.1] The paper does not provide the code or random seeds, and the reported ASR values are point estimates. Given the stochastic nature of diffusion sampling, reporting standard deviations or confidence intervals across multiple runs would strengthen the empirical claims.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TRAIL's transferability claims are evaluated against external baselines and defenses, and its theoretical motivation rests on an external feature-purification result rather than a self-referential loop.

full rationale

No circular reasoning is evident in the paper's claimed derivation chain. The method's components—test-time adaptation of the diffusion U-Net via the combined adversarial and distance loss in Eq. 7, the one-step backpropagation shortcut in Section 3.4 motivated by the external reference [51], and the adversarial-gradient-guided sampling in Eq. 13—are engineering approximations whose success is assessed by held-out black-box transfer to models not used during optimization. The transferability motivation is drawn from an independent theoretical study (Allen-Zhu and Li, reference [1]), not from the authors' own prior work, and no load-bearing claim is justified by a self-citation. The supplementary Proposition (Eq. 16) bounds the reconstruction distance between the VAE-encoded latent and the denoised result under explicit assumptions—bounded normalized noise prediction error, Gaussian latent alignment, and Lipschitz decoding—and the bound does not encode the measured attack success rates; it is used only to motivate the trade-off between attack strength and stealthiness as t* varies. The one-step gradient approximation in Section 3.4 is a possible validity concern because the paper does not demonstrate that this gradient aligns with the objective of the full multi-step sampling chain, but that is a correctness or support issue, not circularity: no predicted quantity is defined in terms of the target quantity it claims to predict, and no fitted parameter is renamed as a prediction. The empirical claims in Tables 1-3 are comparisons against external baselines and defenses, so the central transferability result is not forced by construction. Accordingly, the appropriate finding is no significant circularity.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

No new entities are introduced; the method uses existing Stable Diffusion, a standard classifier, and standard losses. The central claim rests on several unstated hyperparameters and on the validity of the one-step gradient approximation.

free parameters (7)
  • alpha (adversarial loss weight) = not reported
    Eq. 7 defines the total loss as α L_adv + β L_dis; α is never given in the implementation details, and no sensitivity analysis is provided.
  • beta (distance loss weight) = not reported
    β balances the perceptual constraint against the adversarial objective; without a value the exact method is underspecified.
  • t* (noise injection steps) = 8
    Set to 8 in Section 4.1; Section 4.4 shows a trade-off with SSIM and ASR, but the corresponding figure is corrupted.
  • N (adaptation iterations) = 100
    Reported in Section 4.1 with no sensitivity analysis.
  • learning rate = 1e-5
    Reported in Section 4.1 with no sensitivity analysis.
  • diffusion steps T = 80
    Reported in Section 4.1; standard but unoptimized.
  • guidance weight for adversarial gradient = implicitly 1
    Eq. 13 adds the gradient G_t with unit scale; no guidance weight is mentioned, and this may be an important hidden tuning choice.
assumptions (5)
  • domain assumption The classifier gradient computed through a one-step denoising prediction is a sufficient training signal for the full denoising process.
    Section 3.4 justifies the one-step backpropagation with this premise; if false, the adaptation might not optimize the actual generated image.
  • domain assumption A dense mixture of robust features is necessary and sufficient for transferable adversarial perturbations.
    Section 3.1 builds the motivation entirely on Allen-Zhu and Li [1]; the paper does not re-derive or verify this external result.
  • domain assumption The normalized noise prediction error is bounded by a constant C (∥ε_θ/√(1-ᾱ)∥² ≤ C).
    Used in Proposition (Eq. 11) and its proof; the text conflates 'prediction error' with the score norm, and C is never identified.
  • domain assumption The VAE encoder maps images to a standard Gaussian latent and the decoder is Lipschitz continuous.
    Appendix Section 6 lists these conditions for the proposition; they are assumed rather than checked for Stable Diffusion v2.0.
  • domain assumption The surrogate model's decision boundary is representative enough that gradients from it transfer to unseen target models.
    This underlies the entire transfer attack evaluation; standard in the field but never stated as a caveat.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TRAIL: Transferable Robust Adversarial Images via Latent diffusion." pith.science (2026). https://pith.science/paper/XQ5OBC7K

@misc{pith2026250516166,
  author       = {Pith},
  title        = {Pith review of: TRAIL: Transferable Robust Adversarial Images via Latent diffusion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XQ5OBC7K}},
  note         = {Machine review of arXiv:2505.16166}
}
read the original abstract

Adversarial attacks exploiting unrestricted natural perturbations present severe security risks to deep learning systems, yet their transferability across models remains limited due to distribution mismatches between generated adversarial features and real-world data. While recent works utilize pre-trained diffusion models as adversarial priors, they still encounter challenges due to the distribution shift between the distribution of ideal adversarial samples and the natural image distribution learned by the diffusion model. To address the challenge, we propose Transferable Robust Adversarial Images via Latent Diffusion (TRAIL), a test-time adaptation framework that enables the model to generate images from a distribution of images with adversarial features and closely resembles the target images. To mitigate the distribution shift, during attacks, TRAIL updates the diffusion U-Net's weights by combining adversarial objectives (to mislead victim models) and perceptual constraints (to preserve image realism). The adapted model then generates adversarial samples through iterative noise injection and denoising guided by these objectives. Experiments demonstrate that TRAIL significantly outperforms state-of-the-art methods in cross-model attack transferability, validating that distribution-aligned adversarial feature synthesis is critical for practical black-box attacks.

Figures

Figures reproduced from arXiv: 2505.16166 by the authors.

Figure 1
Figure 1. Overview of our approach. (a) We adapt the diffusion model with the optimization goal of generating more effective adversarial [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Compared to other methods, our approach produces more effective adversarial images with minimal alterations to the original [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Trade-off between attack performance and stealthiness [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: The evaluation process on LLaVA. In the left column, [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: We visualize adversarial examples generated under the [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 29 canonical work pages

  1. [1]

    Feature purification: How adversarial training performs robust deep learning

    Zeyuan Allen-Zhu and Yuanzhi Li. Feature purification: How adversarial training performs robust deep learning. In 2021 IEEE 62nd Annual Symposium on Foundations of Com- puter Science (FOCS), pages 977–988. IEEE, 2022. 1, 3

    work page 2021

  2. [2]

    Unrestricted adversarial examples via semantic manipulation.arXiv preprint arXiv:1904.06347,

    Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A Forsyth. Unrestricted adversarial examples via semantic manipulation.arXiv preprint arXiv:1904.06347,

    arXiv 1904

  3. [3]

    Diffusion models are certifiably robust classifiers.Advances in Neural Information Processing Systems, 37:50062–50097, 2025

    Huanran Chen, Yinpeng Dong, Shitong Shao, Hao Zhongkai, Xiao Yang, Hang Su, and Jun Zhu. Diffusion models are certifiably robust classifiers.Advances in Neural Information Processing Systems, 37:50062–50097, 2025. 4

    work page 2025

  4. [4]

    Diffusion models for imperceptible and transferable adversarial attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for imperceptible and transferable adversarial attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024. 1, 2, 7

    work page 2024

  5. [5]

    Content-based unrestricted ad- versarial attack.Advances in Neural Information Processing Systems, 36, 2024

    Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted ad- versarial attack.Advances in Neural Information Processing Systems, 36, 2024. 1, 2, 7

    work page 2024

  6. [6]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. InProceedings of the IEEE con- ference on computer vision and pattern recognition, pages 9185–9193, 2018. 2, 6

    work page 2018

  7. [7]

    An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020. 6

    arXiv 2010

  8. [8]

    Patch-wise attack for fooling deep neu- ral network

    Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neu- ral network. InComputer Vision–ECCV 2020: 16th Euro- pean Conference, Glasgow, UK, August 23–28, 2020, Pro- ceedings, Part XXVIII 16, pages 307–322. Springer, 2020. 6

    work page 2020

Show all 56 references
  1. [9]

    Boosting adversarial transferability by achieving flat local maxima.Advances in Neural Informa- tion Processing Systems, 36:70141–70161, 2023

    Zhijin Ge, Hongying Liu, Wang Xiaosen, Fanhua Shang, and Yuanyuan Liu. Boosting adversarial transferability by achieving flat local maxima.Advances in Neural Informa- tion Processing Systems, 36:70141–70161, 2023. 2

    2023

  2. [10]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014. 2

    2014 arXiv

  3. [11]

    Countering adversarial images using input transformations.arXiv preprint arXiv:1711.00117, 2017

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations.arXiv preprint arXiv:1711.00117, 2017. 7

    2017 arXiv

  4. [12]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 6

    2016

  5. [13]

    Denoising dif- fusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models.Advances in neural information processing systems, 33:6840–6851, 2020. 1

    2020

  6. [14]

    Semantic adver- sarial examples

    Hossein Hosseini and Radha Poovendran. Semantic adver- sarial examples. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition Workshops, pages 1614–1619, 2018. 1, 2, 7

    2018

  7. [15]

    A new defense against adversarial images: Turning a weakness into a strength.Advances in neural in- formation processing systems, 32, 2019

    Shengyuan Hu, Tao Yu, Chuan Guo, Wei-Lun Chao, and Kil- ian Q Weinberger. A new defense against adversarial images: Turning a weakness into a strength.Advances in neural in- formation processing systems, 32, 2019. 7

    2019

  8. [16]

    Densely connected convolutional net- works

    Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kil- ian Q Weinberger. Densely connected convolutional net- works. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 4700–4708, 2017. 6

    2017

  9. [17]

    Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition.Advances in Neural Information Processing Systems, 35:34136–34147, 2022

    Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chun- hua Shen, Xiaokang Yang, and Chao Ma. Adv-attribute: Inconspicuous and transferable adversarial attack on face recognition.Advances in Neural Information Processing Systems, 35:34136–34147, 2022. 2

    2022

  10. [18]

    Functional adversarial attacks, 2019

    Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks, 2019. 1, 2, 7

    2019

  11. [19]

    Adaptive estimation of a quadratic functional by model selection.Annals of statis- tics, pages 1302–1338, 2000

    Beatrice Laurent and Pascal Massart. Adaptive estimation of a quadratic functional by model selection.Annals of statis- tics, pages 1302–1338, 2000. 1

    2000

  12. [20]

    Adaptive training meets progressive scaling: El- evating efficiency in diffusion models.arXiv e-prints, pages arXiv–2312, 2023

    Wenhao Li, Xiu Su, Yu Han, Shan You, Tao Huang, and Chang Xu. Adaptive training meets progressive scaling: El- evating efficiency in diffusion models.arXiv e-prints, pages arXiv–2312, 2023. 4

    2023

  13. [21]

    Transferable adversarial face attack with text con- trolled attribute.arXiv preprint arXiv:2412.11735, 2024

    Wenyun Li, Zheng Zhang, Xiangyuan Lan, and Dongmei Jiang. Transferable adversarial face attack with text con- trolled attribute.arXiv preprint arXiv:2412.11735, 2024. 2

    2024 arXiv

  14. [22]

    A comprehensive sur- vey on test-time adaptation under distribution shifts.Inter- national Journal of Computer Vision, 133(1):31–64, 2025

    Jian Liang, Ran He, and Tieniu Tan. A comprehensive sur- vey on test-time adaptation under distribution shifts.Inter- national Journal of Computer Vision, 133(1):31–64, 2025. 3

    2025

  15. [23]

    Visual instruction tuning, 2023

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning, 2023. 8

    2023

  16. [24]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 6

    2021

  17. [25]

    Fre- quency domain model augmentation for adversarial attack

    Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Fre- quency domain model augmentation for adversarial attack. InEuropean conference on computer vision, pages 549–566. Springer, 2022. 2

    2022

  18. [26]

    Towards deep learning models resis- tant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks.arXiv preprint arXiv:1706.06083,

    arXiv

  19. [27]

    A self-supervised approach for adversarial robustness

    Muzammal Naseer, Salman Khan, Munawar Hayat, Fa- had Shahbaz Khan, and Fatih Porikli. A self-supervised approach for adversarial robustness. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 262–271, 2020. 7

    2020

  20. [28]

    Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741, 2021

    Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models.arXiv preprint arXiv:2112.10741, 2021. 1 9

    2021 arXiv

  21. [29]

    Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460,

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460,

    arXiv

  22. [30]

    Maxime Oquab, Timoth ´ee Darcet, Theo Moutakanni, Huy V . V o, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, Rus- sell Howes, Po-Yao Huang, Hu Xu, Vasu Sharma, Shang- Wen Li, Wojciech Galuba, Mike Rabbat, Mido Assran, Ni...

    2023

  23. [31]

    Scalable diffusion models with transformers

    William Peebles and Saining Xie. Scalable diffusion models with transformers. InProceedings of the IEEE/CVF Inter- national Conference on Computer Vision, pages 4195–4205,

  24. [32]

    Semanticadv: Generating adver- sarial examples via attribute-conditioned image editing

    Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. Semanticadv: Generating adver- sarial examples via attribute-conditioned image editing. In Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIV 16, p...

    2020

  25. [33]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. InInternational conference on machine learning, p...

    2021

  26. [34]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 2, 6

    2022

  27. [35]

    Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information processing systems, 35:36479–36494, 2022

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding.Advances in neural information ...

    2022

  28. [36]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zh- moginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. InProceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 4510–4520, 2018. 6

    2018

  29. [37]

    Colorfool: Semantic adversarial coloriza- tion

    Ali Shahin Shamsabadi, Ricardo Sanchez-Matilla, and An- drea Cavallaro. Colorfool: Semantic adversarial coloriza- tion. InProceedings of the IEEE/CVF conference on com- puter vision and pattern recognition, pages 1151–1160,

  30. [38]

    Generative modeling by esti- mating gradients of the data distribution.Advances in neural information processing systems, 32, 2019

    Yang Song and Stefano Ermon. Generative modeling by esti- mating gradients of the data distribution.Advances in neural information processing systems, 32, 2019. 1

    2019

  31. [39]

    Score-based generative modeling through stochastic differential equa- tions.arXiv preprint arXiv:2011.13456, 2020

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Ab- hishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equa- tions.arXiv preprint arXiv:2011.13456, 2020. 1

    2011 arXiv

  32. [40]

    Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013

    C Szegedy. Intriguing properties of neural networks.arXiv preprint arXiv:1312.6199, 2013. 2

    2013 arXiv

  33. [41]

    Rethinking the inception archi- tecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jon Shlens, and Zbigniew Wojna. Rethinking the inception archi- tecture for computer vision. InProceedings of the IEEE con- ference on computer vision and pattern recognition, pages 2818–2826, 2016. 6

    2016

  34. [42]

    Efficientnet: Rethinking model scaling for convolutional neural networks

    Mingxing Tan and Quoc Le. Efficientnet: Rethinking model scaling for convolutional neural networks. InInternational conference on machine learning, pages 6105–6114. PMLR,

  35. [43]

    Detect- ing adversarial examples from sensitivity inconsistency of spatial-transform domain

    Jinyu Tian, Jiantao Zhou, Yuanman Li, and Jia Duan. Detect- ing adversarial examples from sensitivity inconsistency of spatial-transform domain. InProceedings of the AAAI con- ference on artificial intelligence, pages 9877–9885, 2021. 7

    2021

  36. [44]

    Enhancing the transferability of adversarial attacks through variance tuning

    Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924–1933, 2021. 2

    1924

  37. [45]

    Admix: Enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021. 2

    2021

  38. [46]

    Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Si- moncelli. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004. 8

    2004

  39. [47]

    Generating adversarial examples with adversarial networks.arXiv preprint arXiv:1801.02610,

    Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks.arXiv preprint arXiv:1801.02610,

    arXiv

  40. [48]

    Spatially transformed adversarial ex- amples.arXiv preprint arXiv:1801.02612, 2018

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial ex- amples.arXiv preprint arXiv:1801.02612, 2018. 1

    2018 arXiv

  41. [49]

    Mitigating adversarial effects through random- ization.arXiv preprint arXiv:1711.01991, 2017

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan Yuille. Mitigating adversarial effects through random- ization.arXiv preprint arXiv:1711.01991, 2017. 7

    2017 arXiv

  42. [50]

    Stochastic variance reduced ensemble adver- sarial attack for boosting the adversarial transferability

    Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adver- sarial attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 14983–14992, 2022. 2

    2022

  43. [51]

    Imagere- ward: Learning and evaluating human preferences for text- to-image generation.Advances in Neural Information Pro- cessing Systems, 36:15903–15935, 2023

    Jiazheng Xu, Xiao Liu, Yuchen Wu, Yuxuan Tong, Qinkai Li, Ming Ding, Jie Tang, and Yuxiao Dong. Imagere- ward: Learning and evaluating human preferences for text- to-image generation.Advances in Neural Information Pro- cessing Systems, 36:15903–15935, 2023. 5

    2023

  44. [52]

    Quantization aware attack: Enhancing transferable ad- versarial attacks by model quantization.IEEE Transactions on Information Forensics and Security, 19:3265–3278, 2024

    Yulong Yang, Chenhao Lin, Qian Li, Zhengyu Zhao, Haoran Fan, Dawei Zhou, Nannan Wang, Tongliang Liu, and Chao Shen. Quantization aware attack: Enhancing transferable ad- versarial attacks by model quantization.IEEE Transactions on Information Forensics and Security, 19:3265–32...

    2024

  45. [53]

    Natural color fool: Towards boosting black-box unrestricted attacks.Advances in Neural Informa- tion Processing Systems, 35:7546–7560, 2022

    Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting black-box unrestricted attacks.Advances in Neural Informa- tion Processing Systems, 35:7546–7560, 2022. 1, 7 10

    2022

  46. [54]

    Adver- sarial color enhancement: Generating unrestricted adver- sarial images by optimizing a color filter.arXiv preprint arXiv:2002.01008, 2020

    Zhengyu Zhao, Zhuoran Liu, and Martha Larson. Adver- sarial color enhancement: Generating unrestricted adver- sarial images by optimizing a color filter.arXiv preprint arXiv:2002.01008, 2020. 1 11 TRAIL: Transferable Robust Adversarial Images via Latent diffusion Supplementary...

    2002 arXiv

  47. [55]

    [39] estab- lished a connection between the DDPM [13] process and stochastic differential equations (SDEs [38]), showing that DDPM can be expressed as a specific form of SDE

    Proof for Proposition The denoising steps in the Diffusion Model are discrete, making theoretical analysis highly challenging. [39] estab- lished a connection between the DDPM [13] process and stochastic differential equations (SDEs [38]), showing that DDPM can be expressed as...

  48. [56]

    In the experiments of Section 4.2, we also used Swin-B as the surrogate model, as shown in Table 4

    More Experiments More Comparisons. In the experiments of Section 4.2, we also used Swin-B as the surrogate model, as shown in Table 4. More Trade-off Showcase. In Section 4.4, we demon- strated that selectingt ∗ requires balancing attack transfer- ability and the similarity be...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.