{"id":"fc863231-93b4-46cb-bf54-06b1cad7ebd2","arxiv_id":"2507.23202","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"AGD steers the final denoising steps of Stable Diffusion with CLIP-based target gradients and momentum, producing targeted MLLM attacks with high image fidelity and better survival under defenses.","lead":"This paper attacks multimodal AI models by burying the desired answer inside the noise of a diffusion model, so the photo still looks clean to people. It reports higher attack success and better resistance to common defenses than earlier diffusion attacks on several open multimodal models.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Full-spectrum robustness is asserted, not demonstrated: Eq. (11) assumes Gaussian-white adversarial noise, but sign, EMA, and CLIP-gradient terms break that, and Table 3 never applies the advertised simple low-pass filter; a spectral-concentration and LPF test can settle it.","rationale":"The reader's weakest-assumption analysis identifies the same load-bearing premise: the adversarial-guided noise of Eq. (11) is assumed to be Gaussian white noise with equal power across all frequencies, and no spectral analysis supports this. I agree with that diagnosis and make it even more concrete. The paper's headline contribution is not merely that AGD attacks MLLMs, since several baselines do that; it is that injecting targets into the noise component makes AGD inherently robust to low-pass defenses. That specific claim is argued analytically from a Gaussian-noise idealization and is never directly tested: Table 3 does not include a simple low-pass filter, and the included defenses (JPEG, R&P, SOAP, DiffPure, MimicDiffusion) involve nonlinear, learned, or randomized operations that do not isolate the frequency mechanism. The theoretical chain also has gaps: Eq. (5) treats the denoiser output as Gaussian even though it is a deterministic function of x_t for a fixed input, and the sign, EMA, and CLIP-gradient operations in the injection loop are nonlinear and would change the spectral profile even if the base noise were white. Stable Diffusion's latent-space operation further weakens the translation from 'noise spans all frequencies' to 'decoded adversarial images survive pixel-space low-pass filtering.' I do not recommend rejection because the empirical tables show consistent favorable results across multiple MLLMs and defenses, and the missing spectral evidence is directly testable with the public code. A conditional verdict requiring the spectral and low-pass-filter analysis is therefore appropriate, matching the reader's assessment.","tokens_in":14502,"tokens_out":4944,"duration_ms":64296,"concrete_test":"Compute the radially averaged power spectrum of delta = x_adv - x_clean for AGD and baselines, reporting the fraction of delta energy below cutoffs at 10%, 25%, and 50% of Nyquist, averaged over at least 100 ImageNet samples. Then run a genuine low-pass filter defense (e.g., Gaussian blur with sigma in {1,2,4}, or an ideal Fourier low-pass) on the generated adversarial images and measure ASR on UniDiffuser and BLIP-2 before and after filtering. If AGD's ASR drops comparably to AdvDiffVLM's, or its low-frequency energy fraction is not markedly higher, the full-spectrum robustness claim is falsified. The public repository makes this directly executable.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central novelty is that AGD is inherently robust to low-pass filtering because target semantics are injected into full-spectrum Gaussian noise. This rests on Eq. (5) plus Eq. (11), but the premise is not established. A well-trained denoiser's output epsilon_theta(x_t) is a deterministic nonlinear function of x_t; it is not demonstrated to be white noise for the actual inputs encountered, and the adversarial term gamma*sign(epsilon_tar) is the sign of a momentum-accumulated CLIP gradient, not a Gaussian sample. Repeated denoising, the EMA in Eq. (12), and the use of Stable Diffusion's latent space (where frequency content does not map linearly to decoded pixel frequencies) further separate the injected signal from the N(0,I) idealization. No spectral analysis is provided. Moreover, the defense experiments in Table 3 use JPEG, R&P, SOAP, DiffPure, and MimicDiffusion; none is the advertised 'simple low-pass filtering,' so the flagship robustness scenario in the abstract is untested. If AGD's adversarial signal is concentrated in bands these defenses retain, or is in fact mostly high-frequency, the inherent-robustness claim is unsupported. The shared CLIP-based similarity between the attack objective and evaluation metric is a secondary concern; the frequency claim is the load-bearing one.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Adversarial-Guided Diffusion (AGD), a gray-box targeted attack against multimodal large language models (MLLMs). The method adds noise to a clean image via forward diffusion, reconstructs it with standard reverse diffusion up to a small timestep, and then injects CLIP-computed target semantics into the noise term of the final reverse-diffusion steps using a momentum-based inner loop. The authors claim this embeds the adversarial target across the full frequency spectrum because diffusion noise is white, making the attack inherently robust to low-pass filtering and other defenses. Experiments on five MLLMs report higher CLIP scores and attack success rates than prior methods, with better image quality metrics, and an ablation studies the number of inner iterations and hyperparameters.","tokens_in":14818,"tokens_out":3478,"duration_ms":37875,"significance":"If the core claims held, AGD would be a practically interesting contribution: it would demonstrate a diffusion-based attack that achieves high targeted attack success while preserving image fidelity and resisting simple frequency-domain defenses. The paper provides fairly extensive empirical comparisons across multiple MLLMs and defenses, and the reported ASR improvements are substantial. However, the central theoretical premise—that the injected adversarial signal remains full-spectrum Gaussian noise—is asserted rather than demonstrated, and the algorithm as written contains a self-referential update that cannot be executed as stated. The paper also uses the same CLIP encoder family in the attack objective and in the main evaluation metric, which inflates the reported CLIP scores. The empirical ASR results, which are less affected by this circularity, make the work worth pursuing, but the missing spectral analysis and untested low-pass-filtering claim must be addressed before the robustness conclusion is credible.","major_comments":[{"comment":"The forward diffusion formula in Eq. (3) is incorrect: DDPM defines xt = sqrt(alpha_bar_t) x0 + sqrt(1 - alpha_bar_t) epsilon, not xt = sqrt(alpha_bar_t) x0 + (1 - sqrt(alpha_bar_t)) epsilon. This error propagates to Eq. (9) and Eq. (10), where the Gaussian noise term (1 - alpha_bar_t) is used to define epsilon_tar. Since the derivation of the adversarial injection noise rests on this formula, the derivation is invalid as written and must be corrected and re-evaluated.","section":"Section 3.2, Eq. (3)"},{"comment":"The update epsilon = epsilon + gamma * sign(epsilon) is self-referential and, with epsilon initialized to 0 on line 11, is a no-op (sign(0)=0). It cannot be the intended momentum injection. The update presumably should involve sign(epsilon_tar) or a different accumulator variable. As written, the core injection algorithm is not executable, and the method cannot be reproduced from the pseudocode.","section":"Algorithm 1, line 13"},{"comment":"The full-spectrum robustness claim is unsupported. Eq. (5) asserts that the denoiser output epsilon_theta(xt) is approximately N(0,I), but this is not generally true, especially for latent diffusion on out-of-distribution inputs; the sign operation and EMA update in Eq. (12) are nonlinear and change the spectral profile; and the CLIP-gradient-based epsilon_tar is not a Gaussian sample. The paper provides no spectral density analysis of the actual injected perturbation. The claim that low-pass filtering 'cannot' suppress the target is therefore not established by the current evidence.","section":"Section 4.2, Eq. (11) and Eq. (5)"},{"comment":"The abstract and Section 4.2 emphasize robustness to 'a simple low-pass filtering,' and the text says experimental evidence appears in Section 5.3, but Table 3 evaluates JPEG, R&P, SOAP, DiffPure, and MimicDiffusion—none of which is a low-pass filter. The paper's headline robustness scenario is never tested. The authors should add an explicit low-pass filtering defense (e.g., Gaussian blur with varying radii or FFT-based truncation) and measure ASR after that defense.","section":"Section 5.3 and Abstract"},{"comment":"The evaluation metric CLIP score is computed with CLIP text encoders from the same family used in the attack objective (Algorithm 1 lines 16-17). This makes the reported CLIP scores partly optimized by construction. Since ASR is a separate metric and also improves, this does not invalidate the main attack claim, but the CLIP scores should be reported as a secondary metric, with the dependence on the same encoder family disclosed, and ideally with a held-out encoder not used in the objective.","section":"Section 5.1, Table 1"}],"minor_comments":[{"comment":"The word 'paepr' should be 'paper' in the contributions list.","section":"Section 1"},{"comment":"'Tabel 1' and 'Tabel 2' should be 'Table 1' and 'Table 2'; 'PNSR' should be 'PSNR'; 'bashlines' should be 'baselines'.","section":"Sections 5.1 and 5.2"},{"comment":"The defense name 'JEPG' should be 'JPEG', and the table headers are inconsistently formatted (e.g., 'RP' for Randomization).","section":"Section 5.3, Table 3"},{"comment":"The CoA row lists values 0.2512 and 0.2176 in inconsistent column orders for the three MLLMs; one entry appears to be swapped between the LPIPS and PSNR columns.","section":"Section 5.2, Table 2"},{"comment":"The x-axis labels in Figure 5 appear as garbled Unicode path fragments rather than readable hyperparameter values; the figure needs to be regenerated with proper text.","section":"Figure 5"}],"recommendation":"major_revision","confidential_remarks":"The paper has a clear central idea and the empirical ASR gains may be real, but the technical presentation currently contains a wrong forward-diffusion formula, an inexecutable algorithm line, and an untested headline defense. These are fixable within the scope of a revision. The circular CLIP metric is also a concern for the reported CLIP scores, though the ASR results provide some independent support. I would recommend the editor treat the spectral analysis and low-pass-filter experiment as mandatory for the next round."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a solid incremental attack paper with consistent empirical gains and a plausible new mechanism, but the \"inherently robust because full-spectrum\" argument is asserted, not shown. I'd send it to review, but the authors need to do a spectral analysis and an actual low-pass filter test before I'd trust that part.\n\nWhat's new: AGD truncates reverse diffusion at step Δ, then injects target semantics by adding γ·sign(CLIP gradient) to the predicted noise, with a momentum EMA over inner denoising steps. That's a real variation on AdvDiffVLM and AdvDiffuser, and the reported results back it up: AGD beats the baselines on ASR across UniDiffuser, BLIP-2, LLaVA-1.5, MiniGPT-4, and Qwen2-VL, and the image-quality numbers (SSIM/LPIPS/PSNR) are markedly better. Code is linked. The ablation on N shows the momentum loop matters. Good, useful work for red-teaming MLLMs.\n\nSoft spots, in proportion. The big one is the frequency claim. Eq. (5) asserts ϵθ(xt) ≈ N(0,I), and from that the paper concludes the injected signal is full-spectrum and survives low-pass filtering. But the actual adversarial term is γ·sign(ϵtar); sign is nonlinear, the CLIP gradient is a deterministic function, and the EMA mixes in past values. None of that is Gaussian white noise. The paper never measures the spectrum of the adversarial noise, and Table 3, despite the abstract's promise, never applies a simple low-pass filter. That's a load-bearing gap. The empirical robustness to JPEG, R&P, SOAP, DiffPure, and MimicDiffusion is real, but it doesn't establish the stated mechanism. A spectral plot and an LPF experiment could settle it. There are two smaller technical problems: Eq. (3) has the wrong forward-diffusion coefficient (should be √(1−ᾱ_t)ε, not (1−√ᾱ_t)ε), and Algorithm 1 line 13 uses ϵ on both sides of the update, so the pseudocode doesn't match the EMA in Eq. (12). The evaluation also shares a CLIP encoder family between the attack objective and the CLIP-score metric; ASR improves too, so this is a partial concern, not fatal. No error bars on hyperparameters, but that's fairly normal for attack papers.\n\nBottom line: the empirical contribution is solid and worth citing as a diffusion-attack baseline. The theory needs repair. I'd accept for review with a request for spectral analysis, the LPF experiment, and corrected pseudocode. Who it's for: people working on MLLM adversarial robustness and diffusion-based attacks. It won't change the field, but it's useful.","headline":"Useful incremental diffusion attack with solid empirical gains, but the full-spectrum robustness claim is asserted, not demonstrated; needs spectral analysis and an LPF test.","tokens_in":15328,"tokens_out":3759,"would_cite":true,"duration_ms":39807,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Injecting target semantics into diffusion noise gives MLLM attacks that survive filtering defenses.","keywords":["adversarial attack","multimodal large language models","diffusion model","targeted attack","full-spectrum noise","frequency robustness","CLIP guidance","momentum-based injection"],"falsifier":"Compute the Fourier power spectrum of the difference between an AGD adversarial image and its clean counterpart, or of the injected term $\\gamma\\,\\mathrm{sign}(\\epsilon_{\\mathrm{tar}})$ at the final steps. If the energy is concentrated in a high-frequency band rather than spread across all frequencies, then a matched low-pass or band-stop filter should reduce the attack success rate toward the random baseline, which would falsify the full-spectrum robustness claim. The paper does not report such a spectrum measurement.","tokens_in":14294,"feed_emoji":"🎯","tokens_out":4843,"duration_ms":50220,"temperature":0.7,"pith_summary":"AGD targets multimodal large language models by hiding the adversarial message in the diffusion process itself. Instead of adding a small perturbation to the clean image, the method injects a target-derived signal into the noise that remains during the final reverse-diffusion steps, after first reconstructing the clean image so the final output stays close to the original. Because the injected signal rides on diffusion noise, which the paper argues spans the whole frequency spectrum, the target survives simple low-pass filtering rather than being confined to high frequencies. Experiments on several open MLLMs report higher attack success rates and CLIP scores than previous attacks, while SSIM and LPIPS indicate the adversarial images look closer to the clean ones. A sympathetic reader would take the paper to establish that injecting target semantics into the noise component, rather than into the pixel image, is a viable way to combine attack effectiveness, visual imperceptibility, and robustness to common defenses.","feed_headline":"Attack hides in diffusion noise, beating MLLM defenses","feed_subtitle":"AGD embeds target semantics across every frequency band, so low-pass filters cannot scrub the adversarial signal.","key_machinery":"The central object is the adversarial-guided noise $\\tilde{\\epsilon}$ of Eq. (11): the denoiser's predicted noise plus a scaled, sign-flipped target-injection term $\\gamma\\,\\mathrm{sign}(\\epsilon_{\\mathrm{tar}})$, where $\\epsilon_{\\mathrm{tar}}$ is derived from a CLIP-based similarity between the current image and a text-to-image rendering of the target text. This noise is accumulated through an exponential moving average in an inner loop, so the iterative denoising direction gradually aligns with the target while the image itself remains a linear combination of clean content and noise. The truncation at step $\\Delta$ is the second load-bearing piece: reverse diffusion from $T$ to $\\Delta$ reconstructs the clean image, and only the final steps carry the injection, which keeps distortion small. Together these pieces are what the paper claims make the adversarial signal full-spectrum and hence harder to filter out.","core_discovery":"The central claim is that adversarial-guided noise, defined as $\\tilde{\\epsilon} = \\epsilon_\\theta(x_t) + \\gamma\\,\\mathrm{sign}(\\epsilon_{\\mathrm{tar}})$, embeds the target semantics across all frequency bands during reverse diffusion, producing an adversarial image that is a linear combination of the clean image and this full-spectrum noise. The paper argues that because a well-trained diffusion model's noise is approximately Gaussian white noise with equal power at every frequency, the target information carried by the noise component is not confined to high frequencies and therefore cannot be removed by low-pass defenses that act per component. The method first runs standard reverse diffusion from a noised clean image down to a small time step $\\Delta$ to satisfy the visual-similarity constraint, then applies a momentum-based injection loop from $\\Delta$ to 1, using EMA of target-guided noise to steer the denoising direction toward the target while keeping the final image close to the clean input.","pith_inferences":["Beyond the paper: the robustness argument assumes the sign and EMA operations preserve the white-noise spectrum of $\\epsilon_\\theta(x_t)$, but sign is nonlinear; measuring the power spectrum of the actual injected noise would show whether the full-spectrum premise survives the pipeline.","Beyond the paper: the same noise-component injection could be tested against adaptive defenses that estimate and subtract the injected noise using a second denoiser; if such a defense removes the target, the robustness claim would be limited to the non-adaptive defenses studied.","Beyond the paper: since the injection uses CLIP similarity, the attack should transfer to other MLLMs whose vision encoders align with CLIP features; a transferability sweep across black-box models would map the boundary of the gray-box assumption."],"forward_implications":["If AGD works as claimed, targeted MLLM attacks can be generated with a diffusion model while preserving image quality, so attack success no longer requires visible perturbation.","The full-spectrum injection implies simple input defenses such as JPEG compression or low-pass filtering will not restore safe behavior, because the target signal is distributed across all frequencies.","The method's gray-box design means it can be applied to open-source MLLMs without training a separate attack model, making robustness evaluation against diffusion-based attacks more realistic.","Momentum-based inner-loop injection improves both attack success and imperceptibility, indicating that the direction-finding process, rather than the perturbation strength, is what drives performance."],"supporting_citations":[{"why":"Supplies the forward and reverse diffusion equations and the alpha-bar scheduling that Eqs. (3)-(7) build on.","marker":"[17]"},{"why":"Provides the Stable Diffusion text-to-image backbone used for noising, denoising, and generating the target image.","marker":"[31]"},{"why":"Supplies the predefined noise image e_t that makes reverse sampling deterministic and keeps the reconstructed image close to the clean image.","marker":"[19]"},{"why":"Provides the gray-box evaluation setup, including ImageNet-1K clean images, MS-COCO target texts, and the MF-it and MF-ii baselines.","marker":"[46]"},{"why":"Defines the AdvDiffVLM diffusion-based attack that AGD compares against and improves upon, especially in defense experiments.","marker":"[15]"},{"why":"Provides the CoA baseline for targeted MLLM attacks based on multimodal semantic fusion.","marker":"[43]"},{"why":"Supplies the DiffPure diffusion-purification defense used to test whether AGD's noise injection survives purification.","marker":"[27]"},{"why":"Provides the CLIP features used to measure similarity between the current image and the target image for computing the injection noise.","marker":"[30]"}],"fun_headline_variants":["Full-spectrum noise hides attacks from low-pass filters","Attack rides diffusion noise across all frequencies","AGD embeds attacks in noise, evading MLLM filters","Target semantics in noise beat filter defenses","Full-spectrum adversarial noise defeats low-pass defenses"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim that AGD resists low-pass defenses rests on the assumption that the injected adversarial-guided noise behaves like Gaussian white noise with equal power in every frequency band, so no filter can remove the target without also destroying the image.","fun_headline_variants_meta":{"raw":{"variants":["Full-spectrum noise hides attacks from low-pass filters","Attack rides diffusion noise across all frequencies","AGD embeds attacks in noise, evading MLLM filters","Target semantics in noise beat filter defenses","Full-spectrum adversarial noise defeats low-pass defenses"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000968,"raw_usage":{"total_tokens":4123,"prompt_tokens":953,"completion_tokens":3170,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":3097}},"tokens_in":569,"tokens_out":3170,"duration_ms":24154,"temperature":1.0,"reasoning_tokens":3097,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T10:57:35.248902+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the Fourier power spectrum of the difference between an AGD adversarial image and its clean counterpart, or of the injected term $\\gamma\\,\\mathrm{sign}(\\epsilon_{\\mathrm{tar}})$ at the final steps. If the energy is concentrated in a high-frequency band rather than spread across all frequencies, then a matched low-pass or band-stop filter should reduce the attack success rate toward the random baseline, which would falsify the full-spectrum robustness claim. The paper does not report such a spectrum measurement.","supporting_citations":[{"cited_title":"Denoising dif- fusion probabilistic models","cited_arxiv_id":null,"evidence_quote":"Supplies the forward and reverse diffusion equations and the alpha-bar scheduling that Eqs. (3)-(7) build on."},{"cited_title":"High-resolution image synthesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Provides the Stable Diffusion text-to-image backbone used for noising, denoising, and generating the target image."},{"cited_title":"An edit friendly DDPM noise space: Inversion and manipulations","cited_arxiv_id":null,"evidence_quote":"Supplies the predefined noise image e_t that makes reverse sampling deterministic and keeps the reconstructed image close to the clean image."},{"cited_title":"On evaluating adversarial robustness of large vision-language models","cited_arxiv_id":null,"evidence_quote":"Provides the gray-box evaluation setup, including ImageNet-1K clean images, MS-COCO target texts, and the MF-it and MF-ii baselines."},{"cited_title":"Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models","cited_arxiv_id":null,"evidence_quote":"Defines the AdvDiffVLM diffusion-based attack that AGD compares against and improves upon, especially in defense experiments."},{"cited_title":"Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks","cited_arxiv_id":null,"evidence_quote":"Provides the CoA baseline for targeted MLLM attacks based on multimodal semantic fusion."},{"cited_title":"Diffusion models for adver- sarial purification","cited_arxiv_id":null,"evidence_quote":"Supplies the DiffPure diffusion-purification defense used to test whether AGD's noise injection survives purification."},{"cited_title":"Learning transferable visual models from natural language supervision","cited_arxiv_id":null,"evidence_quote":"Provides the CLIP features used to measure similarity between the current image and the target image for computing the injection noise."}],"review_version":1}