{"id":"4f712244-fb26-49fe-8bf9-39d40d1f04d6","arxiv_id":"2501.07922","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A text-to-image diffusion attack that interleaves denoising with momentum-based adversarial gradients and an adaptive on/off switch to generate natural-looking unrestricted adversarial examples.","lead":"VENOM generates adversarial images from text prompts by injecting attacker momentum into the reverse diffusion process of Stable Diffusion, with an adaptive switch that turns the attack off once the image fools the victim. It reports near 100% white-box attack success while keeping generated images close to clean ones, but black-box transfer is weak and the evaluation relies on a curated label subset.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Core adversarial update in Eq. (8)-(9) and Algorithm 1 is dimensionally inconsistent: a pixel-space gradient is added to a latent variable, so the method as described cannot be the one that produced the reported results.","rationale":"I read the central claim as: text-prompt-conditioned reverse diffusion with adaptive adversarial guidance and momentum produces near-100% white-box ASR and high image fidelity. For this to be true, the update in Eq. (9) must be a valid operation in the latent space where the reverse diffusion runs. As written, it is not: the gradient is computed with respect to the decoded pixel-space image and then added to the latent variable. These are different spaces with incompatible dimensions, so the described algorithm is internally inconsistent. This is not a matter of benchmark selection or external validity; it is a correctness issue in the core construction. The reader's weakest assumption about the 466-label filtering is legitimate and could affect the generality of the reported ASR, but it does not address whether the method as described is even executable. My proposed test would settle the concern by checking the literal implementation and, if needed, comparing against the corrected latent-space gradient. Unless the authors can show that their implementation actually uses the correct gradient, the central claim and experimental tables cannot be attributed to VENOM as described. Therefore, as written, I would reject the paper, while acknowledging that a corrected and code-backed resubmission could be viable.","tokens_in":12216,"tokens_out":8478,"duration_ms":91239,"concrete_test":"Implement Algorithm 1 strictly as written: decode z_{t-1} to x_{t-1}, compute g = ∇_{x_{t-1}} log p_f(y_a | x_{t-1}), and set z_{t-1} = z_{t-1} + s·g. Check whether tensor shapes are compatible; if reshaping is required, verify whether the reported 99.18% white-box ASR survives. Then ask the authors to release the exact gradient computation or rerun with the corrected latent-space gradient ∇_{z_{t-1}} log p_f(y_a | D(z_{t-1})) and compare Table 2. If the corrected implementation reproduces the results, the concern is resolved; if not, the central claim fails.","verdict_should_be":"REJECT","load_bearing_attack":"Section 3.2/Eq. (8)-(9) and Algorithm 1 compute the adversarial gradient as g(t) = ∇_{x_{t-1}} log p_f(y_a | x_{t-1}) on the VAE-decoded image x_{t-1}, then update the latent variable as z_{t-1} ← z_{t-1} + s·v_t. In Stable Diffusion, x is a 3×512×512 pixel image while z is a 4×64×64 latent; these are different spaces with different dimensions. Adding a pixel-space gradient to a latent variable is not a valid optimization step and cannot be executed as written. The correct latent-space gradient would be ∇_{z_{t-1}} log p_f(y_a | D(z_{t-1})) = J_D^T ∇_{x_{t-1}} log p_f(y_a | x_{t-1}), where D is the VAE decoder. Unless the implementation backpropagates through the decoder, the described VENOM update is undefined; if it does backpropagate, the equations misdescribe the method. Because this update is the core of the claimed unified reverse-diffusion attack, the central claim and the results in Tables 2-4 are not attributable to the algorithm as written. The reader's benchmark-filtering concern is real but secondary; this gradient-space mismatch is more load-bearing.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces VENOM, a text-driven framework for generating unrestricted adversarial examples (UAEs) and natural adversarial examples (NAEs) using Stable Diffusion. The method injects adversarial guidance with momentum into the reverse diffusion process and uses an adaptive control strategy to toggle guidance on and off. The authors claim that VENOM is the first text-driven UAE/NAE method, achieves near 100% white-box attack success rate (ASR), and produces higher-fidelity images than prior diffusion-based attacks. Experiments compare VENOM against SD-NAE, AdvDiff, and AdvDiffuser on NAE generation, and against DiffAttack and AdvDiff on UAE generation, reporting ASR against white-box, black-box, and defended models, along with FID, SSIM, LPIPS, IS, TReS, and CLIP scores.","tokens_in":12523,"tokens_out":2746,"duration_ms":28864,"significance":"If the claims are substantiated, VENOM would be a notable advance in unrestricted adversarial example generation, offering flexible text-controlled synthesis directly from noise. The paper provides a new combination of momentum-based adversarial guidance, adaptive control, and Stable Diffusion, and it includes comparisons with several prior methods. The work is potentially useful for studying model vulnerabilities. However, the reported results depend critically on the correctness of the optimization update and on the fairness of the evaluation protocol. The paper's own Section 4.5 acknowledges low black-box transferability, which tempers the broad superiority claim. The availability of code would be valuable, but the manuscript as written does not include it, and the internal inconsistency in the core update prevents attributing the results to the described algorithm.","major_comments":[{"comment":"The adversarial gradient is computed on the pixel-space image x_{t-1} (Eq. (8): g(t) = ∇_{x_{t-1}} log p_f(y_a | x_{t-1})), after the VAE decoder produces x_{t-1} from the latent z_{t-1}, but the update in Eq. (9) adds this gradient to the latent variable: z*_{t-1} = z_{t-1} + s v_t. In Stable Diffusion, x is a 3×512×512 image while z is a 4×64×64 latent; these are different vector spaces. Adding a pixel-space gradient to a latent variable is not a valid optimization step and, as written, cannot be executed. The correct update would require the Jacobian of the VAE decoder, J_D^T ∇_x log p_f(y_a | D(z)), or a gradient computed directly in latent space. Unless the implementation backpropagates through the decoder, the equations misdescribe the method; if it does backpropagate, then Eq. (8)-(9) omit the Jacobian and the described VENOM algorithm is inconsistent with the reported experiments. This is load-bearing because the update is the core of the proposed attack, and Tables 2-4 cannot be attributed to the algorithm as written.","section":"Section 3.2, Eqs. (8)-(9), and Algorithm 1"},{"comment":"The label filtering protocol uses the victim model itself (a pretrained ResNet50) to select the 466 ImageNet labels: labels are discarded when stable diffusion images prompted by those labels are not correctly classified by ResNet50. The authors report that clean classification accuracy is 72% on the filtered subset versus 40% without filtering. Consequently, the white-box ASR of 99.18% in Table 2 is measured on a self-selected, easier benchmark where the victim model already recognizes the generated content well. This does not invalidate the method, but it directly affects the central attack metric and makes the reported ASR non-comparable to prior work that evaluates on the full ImageNet label set. The paper should report ASR on the unfiltered label set or, at minimum, provide per-label results and analyze how the filtering affects the comparison.","section":"Section 4.1, NAE mode setup"},{"comment":"The paper claims 'superior ASR' overall, but the black-box ASR results in Table 2 show VENOM (Inc-V3 50.39, ViT 34.98, Mix-B 50.80) is lower than SD-NAE (57.33, 50.86, 61.51) and AdvDiff (60.65, 42.45, 58.20) on all three black-box models. The authors dismiss these baselines as producing 'invalid NAEs' and say that white-box performance is the only reliable metric, but they do not provide a quantitative measure of validity or a human-study protocol. Section 4.5 acknowledges this issue. A fair comparison requires either a validity filter applied equally to all methods, with the filter disclosed and justified, or a different evaluation protocol. As presented, the claim of broad superiority is not supported by the table.","section":"Table 2 and Section 4.5"},{"comment":"None of the reported ASR or image-quality metrics include error bars, confidence intervals, or multiple-seed variance. For example, Table 5 shows FID differences as small as 0.6 (36.11 vs 36.11 and 15.09 vs 14.49) that may not be statistically significant, and Figure 5 selects β = 0.5 based on a single FID curve. Given the stochastic nature of diffusion sampling, the paper should report means and standard deviations over at least three independent runs, and state whether the comparisons in Tables 1-4 are statistically significant.","section":"Tables 1-5 and Figure 5"},{"comment":"The adaptive control strategy is described as a set of heuristic switching conditions (ON by default; OFF if x_t is adversarial; ON if x_t later becomes non-adversarial; forced ON after two failures). This introduces several free parameters (t_start, N, the detection criterion using argmax f(x_{t-1})) and can interact with the momentum update in ways that are not analyzed. The paper should provide a systematic ablation of these switching rules, particularly the 'forcefully kept ON' condition, and clarify whether the reported results are sensitive to the choice of t_start and to the number of attack iterations N. Without this, the mechanism remains a heuristic that is not fully characterized.","section":"Section 3.3 and Algorithm 1"}],"minor_comments":[{"comment":"The forward noising formula is written as q(z_t | z_0) = N(z_t; √¯α_t, (1 - ¯α_t)I), but the mean is missing a multiplication by z_0; it should be √¯α_t z_0.","section":"Equation (4)"},{"comment":"The paper uses both lowercase x and uppercase X for images (e.g., 'x_T ← DDIM inversion(x)' in Algorithm 1 and 'X_T' in Figure 2). Please standardize notation, and in Eq. (6)-(7) clarify whether ϵ_θ denotes ϵ_θ(z_t, t).","section":"Notation throughout"},{"comment":"The claim that SD-NAE and AdvDiffuser yield 'invalid NAEs in nearly half of the cases' is not supported by any quantitative validity metric. Consider adding a human-study or a detection-based validity measure, or explicitly describe the manual filtering procedure.","section":"Figure 3 and Table 2 discussion"},{"comment":"The text says 'All images are generated from identical random noise inputs,' but the implementation of AdvDiff and AdvDiffuser was re-implemented on Stable Diffusion. Please specify the exact noise seeds and the re-implementation details (including any hyperparameter tuning) in the supplementary material, so that the comparison is reproducible.","section":"Section 4.2"},{"comment":"The reference list has formatting issues (e.g., references [8], [11], [16] mix conference and journal styles) and the conclusion refers to supplementary material but the manuscript does not include it. Please ensure the supplementary is available and referenced consistently.","section":"References and supplementary"}],"recommendation":"major_revision","confidential_remarks":"The core gradient-space inconsistency in Section 3.2 is serious and should be resolved before the paper can be considered for publication. If the implementation actually backpropagates through the VAE decoder, the equations need to be corrected and the paper should report the Jacobian-based update. The label filtering issue and the lack of error bars further weaken the empirical claims, but these are addressable with additional experiments and analysis. I recommend major revision rather than rejection because the conceptual framework (text-driven adversarial guidance in diffusion reverse processes) may be viable and the limitations are fixable in principle. The paper should also clarify the relation to the concurrent work cited as [7] and ensure fair comparisons on the full ImageNet label set or a disclosed subset."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First, what's actually new: VENOM combines per-step adversarial guidance with an adaptive on/off switch and momentum inside a single Stable Diffusion reverse process, supporting both random-noise (NAE) and reference-image (UAE) modes. The ablation study does show both modules help—adaptive control improves FID, momentum partially recovers attack success. That is a legitimate incremental contribution.\n\nNow the soft spots, and one of them is big. The stress-test note is correct: Eq. (8) computes the gradient on the pixel-space image x_{t-1} after VAE decoding, but Eq. (9) adds that gradient to the latent variable z_{t-1}. These live in different spaces (3×512×512 vs 4×64×64). As written, the update is undefined. You cannot execute it. The paper does not state that they backpropagate through the decoder, and the notation suggests they don't. If they do, the equations are still misdescribed. This is not a minor typo; it is the core mechanism of the attack. So the reported results in Tables 2–4 are not attributable to the algorithm as written.\n\nThere are secondary issues. The 466-label filter removes labels where Stable Diffusion doesn't align with the victim model; clean accuracy goes from 72% to 40% without filtering, so the white-box ASR is measured on an easier self-selected benchmark. Black-box ASR is notably lower than SD-NAE on some models, and the paper's argument that those numbers are inflated by invalid NAEs is plausible but not quantified. There are no error bars, and no code or data are released. The 'first text-driven' framing is also not new—SD-NAE already does text-driven NAE generation.\n\nTo give credit where it's due: the limitation section is honest about black-box transferability, and the adaptive control strategy is a reasonable heuristic that the ablation supports. The paper is clearly written.\n\nMy overall take: the idea has merit, but as submitted the central optimization step is dimensionally inconsistent. That is a load-bearing flaw. I would still send it to peer review because the issue is fixable and a careful reviewer could catch it, but I would not accept it in anything close to current form. The authors need to either rewrite the update as a proper latent-space gradient (backprop through the decoder) or present a pixel-space perturbation followed by re-encoding, then re-run experiments accordingly. A detailed supplemental with the actual update would also settle reproducibility.\n\nIf you are looking for a paper to build on, hold off until the description is corrected.","headline":"Sensible incremental idea, but the core update is dimensionally inconsistent as written and the empirical claims sit on a self-selected benchmark.","tokens_in":13022,"tokens_out":3179,"would_cite":false,"duration_ms":30731,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"VENOM: a text prompt becomes a natural-looking image that a classifier labels as your chosen class.","keywords":["unrestricted adversarial examples","natural adversarial examples","diffusion models","text-to-image generation","adversarial attacks","Stable Diffusion","adaptive adversarial guidance","momentum"],"falsifier":"Run VENOM on all 1,000 ImageNet classes without the label filter and count white-box attack success only on images that human raters judge to match the text prompt; if the attack rate drops substantially below the reported 99% or visual validity collapses, the central claim is tied to the curated subset rather than to the method itself.","tokens_in":1919,"feed_emoji":"🎯","tokens_out":9258,"duration_ms":143733,"temperature":0.7,"pith_summary":"VENOM is a text-driven method for producing unrestricted adversarial examples: images generated from scratch, or from a reference photo, that look natural but are classified by a victim model as a target class chosen by the attacker. The paper claims this is the first framework to combine image content generation and adversarial synthesis in the same reverse diffusion process, using an adaptive control switch and momentum-based gradient guidance to keep images high-fidelity while attacking. If correct, this means a user can type a prompt such as “a cheeseburger” and obtain an image that a pretrained classifier confidently labels as “giant panda,” with near-100% white-box attack success and image quality scores that beat prior diffusion-based attack methods. Existing diffusion-based UAE methods are limited to reference images or produce distorted outputs, and VENOM argues it addresses both limitations.","feed_headline":"Text prompts forge images classifiers misread as chosen targets","feed_subtitle":"VENOM folds image generation and adversarial attack into one diffusion pass, near 100% white-box success.","key_machinery":"The load-bearing mechanism is the adaptive adversarial guidance with momentum, applied after each reverse diffusion step. Concretely, after each DDIM denoising step $z_t \\to z_{t-1}$, VENOM computes $g(t) = \\nabla_{x_{t-1}} \\log p_f(y_a \\mid x_{t-1})$ on the VAE-decoded image, maintains an exponentially weighted moving average $v_t = \\beta v_t + (1-\\beta) g(t)$, and updates $z_{t-1} \\leftarrow z_{t-1} + s v_t$. The adaptive control module switches guidance OFF when the decoded image already satisfies the target class, switches it back ON if later denoising steps lose the attack, and forcefully keeps it ON after two consecutive failures. This mechanism is what lets one pipeline generate content and attack at the same time while staying near the natural-image distribution.","core_discovery":"The central discovery is that the reverse diffusion process of Stable Diffusion can be adversarially steered at every denoising step by adding a scaled, momentum-smoothed gradient of $\\log p_f(y_a \\mid x_{t-1})$ to the latent $z_{t-1}$, and that an adaptive controller can turn this guidance on and off depending on whether the current decoded image is already adversarial. This yields Natural Adversarial Examples from pure Gaussian noise and Unrestricted Adversarial Examples from DDIM-inverted reference images. In experiments, VENOM reports a white-box attack success rate of $99.18\\%$ on its curated NAE benchmark, an FID of $14.49$, SSIM of $0.8771$, and LPIPS of $0.0583$, the best among the compared methods on those quality metrics. The paper also argues that some prior methods’ high black-box transferability is inflated by corrupted or invalid generated images, so white-box attack success is the reliable comparison.","pith_inferences":["Editorial inference: re-running VENOM on all 1,000 ImageNet labels without the filtering step would likely lower the reported attack rate, because the paper itself states that clean classification accuracy drops from 72% to 40% when ambiguous labels are kept.","Editorial inference: the adaptive ON/OFF switch relies on the victim model’s prediction on VAE-decoded latents, so a testable extension is measuring whether intermediate decoded latents faithfully match the final image that humans see; if they do not, the switch may toggle at the wrong times.","Editorial inference: because the attack is text-driven, a natural next test is attacking multimodal classifiers that condition on both text and image, where the adversarial image could conflict with the textual semantics of the prompt.","Editorial inference: a human perceptual validity study comparing VENOM against prior NAE methods, with visual validity as a controlled variable, would clarify whether VENOM’s lower black-box transferability is a genuine limitation or a side effect of refusing to generate corrupted images."],"forward_implications":["If the central claim holds, text-to-image pipelines become a practical tool for auditing classifiers: a prompt and a target label suffice to produce a high-confidence misclassification without needing any source image.","The same framework supports both NAE mode, starting from random Gaussian noise, and UAE mode, starting from a reference image via DDIM inversion, so one set of controls covers both attack settings.","The adversarial examples remain close to clean generated images on standard quality metrics, implying the attacks can be visually hard to distinguish from normal text-to-image outputs.","The reported white-box ASRs are much higher than the black-box ASRs, so the paper’s own numbers imply that transferable attacks from this pipeline remain an open challenge.","Against purification-style defenses, VENOM with both modules retains a moderate attack success rate, indicating that the adaptive control strategy does not fully sacrifice attack efficacy for image quality."],"supporting_citations":[{"why":"Supplies the pretrained Stable Diffusion model whose reverse process VENOM steers; all attacks are built on it.","marker":"[27]"},{"why":"Provides the DDIM scheduler that enables fast deterministic reverse sampling and the inversion used to encode reference images in UAE mode.","marker":"[29]"},{"why":"Supplies the FGSM-style gradient update that VENOM adapts into per-step unrestricted adversarial guidance without norm constraints.","marker":"[14]"},{"why":"Defines the DDPM forward and reverse diffusion processes that underlie the noise-prediction objective and the denoising steps.","marker":"[19]"},{"why":"Prior method AdvDiff that injects adversarial perturbations at each reverse step; VENOM re-implements and compares against it as a baseline.","marker":"[7]"},{"why":"Prior method AdvDiffuser that integrates PGD into the reverse diffusion process; a key baseline for NAE image quality and attack success.","marker":"[4]"},{"why":"Prior text-driven method SD-NAE that perturbs text embeddings; the main text-driven baseline for NAE generation.","marker":"[21]"},{"why":"Prior method DiffAttack that optimizes latent representations for transferable attacks; the main reference-image baseline in UAE experiments.","marker":"[3]"},{"why":"DiffPure defense used to measure attack success against adversarial purification; a core robustness benchmark in the evaluation.","marker":"[26]"}],"fun_headline_variants":["Diffusion + text = adversarial images on demand","VENOM: text-driven diffusion attacks hit 99% white-box","One denoising pass turns text into targeted misreads","Natural adversarial examples from text via diffusion"],"cache_read_input_tokens":15104,"weakest_assumption_plain":"The reported near-100% white-box attack success rate is measured on a curated set of 466 ImageNet labels, keeping only classes for which clean Stable Diffusion images are already correctly classified by ResNet-50; if that selection is not representative of general text prompts, the headline numbers may not hold on unfiltered inputs.","fun_headline_variants_meta":{"raw":{"variants":["Diffusion + text = adversarial images on demand","VENOM: text-driven diffusion attacks hit 99% white-box","One denoising pass turns text into targeted misreads","Natural adversarial examples from text via diffusion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000367,"raw_usage":{"total_tokens":1984,"prompt_tokens":973,"completion_tokens":1011,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":589,"completion_tokens_details":{"reasoning_tokens":948}},"tokens_in":589,"tokens_out":1011,"duration_ms":9188,"temperature":1.0,"reasoning_tokens":948,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:30:54.448540+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run VENOM on all 1,000 ImageNet classes without the label filter and count white-box attack success only on images that human raters judge to match the text prompt; if the attack rate drops substantially below the reported 99% or visual validity collapses, the central claim is tied to the curated subset rather than to the method itself.","supporting_citations":[{"cited_title":"Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer","cited_arxiv_id":null,"evidence_quote":"Supplies the pretrained Stable Diffusion model whose reverse process VENOM steers; all attacks are built on it."},{"cited_title":"De- noising diffusion implicit models","cited_arxiv_id":null,"evidence_quote":"Provides the DDIM scheduler that enables fast deterministic reverse sampling and the inversion used to encode reference images in UAE mode."},{"cited_title":"Goodfellow, Jonathon Shlens, and Christian Szegedy","cited_arxiv_id":null,"evidence_quote":"Supplies the FGSM-style gradient update that VENOM adapts into per-step unrestricted adversarial guidance without norm constraints."},{"cited_title":"Denois- ing diffusion probabilistic models","cited_arxiv_id":null,"evidence_quote":"Defines the DDPM forward and reverse diffusion processes that underlie the noise-prediction objective and the denoising steps."},{"cited_title":"Advdiff: Generating unrestricted adversarial examples using dif- fusion models","cited_arxiv_id":null,"evidence_quote":"Prior method AdvDiff that injects adversarial perturbations at each reverse step; VENOM re-implements and compares against it as a baseline."},{"cited_title":"Advdiffuser: Natural adversarial example synthesis with diffusion models","cited_arxiv_id":null,"evidence_quote":"Prior method AdvDiffuser that integrates PGD into the reverse diffusion process; a key baseline for NAE image quality and attack success."},{"cited_title":"SD-NAE: Generating natural adversarial examples with stable diffusion","cited_arxiv_id":null,"evidence_quote":"Prior text-driven method SD-NAE that perturbs text embeddings; the main text-driven baseline for NAE generation."},{"cited_title":"Diffusion models for imperceptible and transferable adversarial attack","cited_arxiv_id":null,"evidence_quote":"Prior method DiffAttack that optimizes latent representations for transferable attacks; the main reference-image baseline in UAE experiments."},{"cited_title":"Diffusion mod- els for adversarial purification","cited_arxiv_id":null,"evidence_quote":"DiffPure defense used to measure attack success against adversarial purification; a core robustness benchmark in the evaluation."}],"review_version":1}