Pith. sign in

REVIEW 3 major objections 5 minor 70 references

Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Reframing unrestricted adversarial example generation as an alignment problem between two conflicting adversary preferences — visual consistency and attack effectiveness — this paper proposes a two-stage decoupled framework, APA, that…

desk verdict A solid empirical attack paper with large, believable gains over ACA, but the 'alignment' framing is a heuristic wrapper and the unvalidated Eq. 6 proxy is the main open question. read the letter →

arxiv 2506.01511 v1 pith:DZLFYG4L submitted 2025-06-02 cs.CV

Kaixun Jiang , Zhaoyu Chen , Haijing Guo , Jinglun Li , Jiyuan Fu , Pinxue Guo , Hao Tang , Bo Li
show 1 more author
Wenqiang Zhang
This is my paper · ORCID
classification cs.CV
keywords unrestrictedadversarialexamplespreferencealignmentdiffusionmodelsblack-boxtransferabilitylow-rankadaptation(LoRA)rewardhackingrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether generating unrestricted adversarial examples — images that fool classifiers while still looking like the originals — can be treated as a diffusion-model preference alignment problem, and answers yes. An adversary is posited to have two conflicting preferences, visual consistency and attack effectiveness, and the authors argue that optimizing both at once invites reward hacking, where the model learns to improve attack success by degrading image quality. Their framework, APA, decouples the two preferences into sequential stages: first fine-tune LoRA weights of the denoising model on a rule-based similarity reward so the reference image survives later perturbation, then optimize the image latent or prompt embedding against feedback from a substitute classifier using trajectory-level and step-level guidance plus diffusion augmentation. On 1,000 ImageNet images tested against ten CNN and transformer models, APA's gradient-checkpointing variant reports average black-box attack success rates of roughly 75–88% depending on the substitute model, versus 54–59% for the prior diffusion-based attack ACA, while improving visual-similarity metrics (LPIPS 0.23 and SSIM 0.69 versus 0.37 and 0.61). The authors frame this as evidence that adversarial example generation is better approached as adversarial preference alignment than as latent perturbation.

What carries the argument

The central object is a two-stage reward decoupling inside a latent diffusion model, with Low-Rank Adaptation (LoRA) — low-rank weight updates appended to the denoising U-Net — as the policy in stage one. The visual-consistency reward is the standard noise-prediction objective $\mathbb{E}_{t,\epsilon}\|\epsilon - \epsilon_{\theta+\Delta\theta}(z_t, t, c)\|^2$, adopted 'inspired by' the training loss as a differentiable proxy for the explicit similarity reward $S(\cdot)$ of Eq. (5). Stage two optimizes the DDIM-inverted latent $z_T$ (DDIM inversion deterministically maps the reference image to a noise latent that preserves its content) against a substitute classifier's loss, with a trajectory-level momentum update — Eq. (7), optionally computed through gradient checkpointing — and a step-level guidance term, Eq. (8), whose reward input is a denoised, interpolation-stabilized estimate $z_t^{\mathrm{in}}$ from Eqs. (9)–(10). A diffusion augmentation, Eq. (12), averages step-level predicted latents with the final trajectory output under random differentiable transforms so the trajectory gradient does not overfit the substitute classifier. The decoupling claim is that stage one builds a fidelity-guaranteed solution space, and stage two then searches within it, landing closer to the Pareto frontier than any joint optimization.

What would settle it

Run APA's stage one with the explicit similarity metric $S(\cdot)$ of Eq. (5) — for instance LPIPS computed on decoded outputs — replacing the noise-prediction proxy of Eq. (6), and trace the full Pareto curve of attack success versus LPIPS/SSIM at the actual attack scale $\epsilon_a = 0.4$. If the explicit-reward variant does not match or beat the published APA curve, the proxy in Eq. (6) is doing essential work and the decoupling story is incomplete; if it does, the proxy is dispensable. A second, cheaper check: decode the stage-one output under the exact adversarial perturbation recovered from a completed APA-GC run and measure LPIPS against the clean image, which would quantitatively settle whether the stage-one fidelity budget actually holds at the deployed noise scale.

Watch

Extended reading notes

Core claim

Stated on the paper's own terms: unrestricted adversarial example generation is best modeled as an alignment problem between two conflicting adversary preferences, and the conflict is resolved by decoupling rather than by weighting. Stage one treats visual consistency as a rule-based reward and encodes the reference image's structure into the diffusion model by fine-tuning LoRA parameters against the denoising loss, so that later perturbed latents still decode to recognizable images. Stage two then optimizes the DDIM-inverted latent $z_T$ (or, in a variant, the prompt embedding) against a substitute classifier's cross-entropy loss, using a trajectory-level momentum gradient computed with skip-gradient or gradient checkpointing, a step-wise guidance term per denoising step, and a diffusion augmentation that mixes step-level predictions with the final output to avoid overfitting the substitute. The paper reports that this two-stage scheme achieves the best black-box transferability among current unrestricted attacks, within CNN families, within transformer families, and across architectures, while simultaneously scoring better on LPIPS, SSIM, and CLIP-image similarity than the previous diffusion-based attack ACA.

Load-bearing premise

The load-bearing premise is that the diffusion noise-prediction objective of Eq. (6) is a faithful proxy for the visual-similarity reward of Eq. (5): if fine-tuning LoRA on that denoising loss does not actually keep the original image's structure intact under adversarial-scale latent perturbations, then stage one has not created the fidelity-guaranteed solution space on which the stage-two decoupling argument rests.

Editorial extensions

If this is right

  • If the decoupling works as claimed, unrestricted attacks no longer must trade fidelity against fooling rate: the visual-consistency stage fixes the fidelity budget before any attack-gradient optimization begins.
  • With the gradient-checkpointing variant, the reported average black-box attack success across ten CNN and transformer targets reaches 75–88% depending on the substitute model, roughly 16–33 percentage points above the ACA baseline it extends.
  • The transferability gain also carries over to defended models: average attack success of 70.2% against adversarially trained, preprocessing, and purification defenses, versus 57.5% for ACA.
  • Because stage two can update either the latent or the prompt embedding, the framework offers an explicit fidelity-versus-power dial: the prompt variant APA-GC-P keeps LPIPS at 0.09 while attacking less strongly, giving users a scenario-dependent choice.
  • Reframing attacks as alignment connects the adversarial-robustness toolbox (momentum, input diversity, surrogate models) to the preference-alignment toolbox (differentiable rewards, LoRA policies, reward hacking), so progress in either field becomes transferable to the other.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication the paper leaves untested: if two-stage decoupling is the real driver of the Pareto improvement, then any joint attack optimizing an attack loss plus a weighted perceptual-consistency term (like the one-stage APA* in Fig. 5b) should be dominated by APA's curve; a systematic sweep over the weighting coefficient would confirm or refute that dominance directly.
  • The same decoupling recipe should transfer to benign preference alignment with conflicting rewards, such as aesthetics versus text-image faithfulness: fine-tune the policy for one preference first, then optimize the other with dense guidance rather than weighting both rewards. The paper's reward-hacking analysis predicts this stabilizes training, but it reports no benign-alignment experiment.
  • The step-level guidance in Eq. (8) is mathematically a classifier-guided diffusion step, so APA inherits the known sensitivity of classifier guidance to gradient obfuscation; testing APA against a defense that perturbs the guidance gradient (for instance randomized smoothing applied to the substitute classifier) would probe whether the transferability gain survives an adversary-aware reward model.
  • Because stage one is a per-image LoRA fine-tune, its cost and its fidelity benefit both scale with the number of target images; the paper's Pareto argument implies there should be a critical perturbation scale below which the LoRA stage is unnecessary, and identifying that scale would tell practitioners when the extra fine-tuning step pays for itself.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes APA (Adversary Preferences Alignment), a two-stage framework for generating unrestricted adversarial examples with diffusion models. Stage 1 fine-tunes LoRA parameters of Stable Diffusion using a denoising loss (Eq. 6) as a proxy for a visual-consistency reward (Eq. 5), intended to make generation robust to adversarial latent perturbations. Stage 2 optimizes the inverted latent or prompt embedding using a substitute classifier, combining trajectory-level and step-level attack guidance with a diffusion augmentation that mixes intermediate decoded outputs. Experiments on ImageNet-compatible data report large black-box ASR gains over ACA (e.g., 88.02% vs. 59.49% with ResNet-50 substitute), improved LPIPS/SSIM over ACA, and strong performance against defense models. The paper frames the contribution as decoupling conflicting adversary preferences to achieve closer Pareto optimality.

Significance. If the results hold, the paper makes a useful contribution: it reframes unrestricted adversarial attacks as a preference-alignment problem, proposes a concrete two-stage decoupling that appears to mitigate reward hacking, and reports sizable transferability improvements over the current state of the art with better visual consistency than ACA. The framework is flexible (latent or prompt optimization, multiple diffusion backbones), and the promised public code would support reproducibility. The main caveats are that the central visual-consistency stage rests on an unproven reward substitution, and the empirical claims currently lack repeated-run statistics.

major comments (3)
  1. [Section 3.3, Eqs. (5)-(6)] The paper replaces the explicit visual-similarity reward Rs = S(D(zbar_0), x) in Eq. (5) with the standard noise-prediction loss Et,epsilon ||epsilon - eps_theta+Delta_theta(zt,t,c)||^2 in Eq. (6), described only as 'inspired by Eq. (2)'. This substitution is load-bearing: it is the entire justification that the LoRA stage encodes the input image's structure and creates the 'optimal solution space of visual consistency' invoked in Section 4.5. No proof or independent validation is given that minimizing Eq. (6) increases S under adversarial perturbations of zT; Eq. (6) only trains the model to predict noise on the clean forward process. The only supporting evidence is the qualitative Figure 3, which does not isolate the VCA component and reports no quantitative metric. I ask the authors to either provide a derivation or formal argument connecting Eq. (6) to perceptual similarity, or add a quantitative ablation that compares Eq. (5) (with a concrete S such as LPIPS) against Eq. (6) as the VCA reward, measuring LPIPS/SSIM and black-box ASR of final attacks with and without VCA.
  2. [Tables 1-4 and Section 4.6] All ASR numbers are reported as single point estimates, with no standard deviations or number of repeated runs. This matters because the attack pipeline includes stochastic diffusion augmentation (random padding, resizing, and brightness adjustment in Eq. 12), so repeated runs will vary. In addition, key hyperparameters (Ta, T, epsilon_a, mu, LoRA rank and learning rate) are tuned on the same benchmark, and Figure 6 shows that performance is sensitive to Ta and T. Without variance estimates and without a separate validation split for hyperparameter selection, the 'significantly better' claim is not yet fully established. Please report mean and standard deviation over multiple seeds or runs, and justify the chosen hyperparameters on a validation subset rather than the final test set.
  3. [Table 4 and Figure 3] A quantitative ablation of the visual-consistency stage (VCA) is missing. Table 4 ablates dual-path guidance and diffusion augmentation, but the contribution of the LoRA-based VCA is shown only qualitatively in Figure 3. As a result, the reader cannot determine from the tables how much of the ASR and visual-quality gain over ACA comes from VCA versus the new attack-guidance components. Please add rows to Table 4 (or a separate table) that report black-box ASR, LPIPS, and SSIM for the full APA with and without VCA, using the same substitute model and attack settings. This is necessary to support the claim that the two-stage decoupling, rather than the stage-2 guidance alone, is responsible for the reported improvements.
minor comments (5)
  1. [Section 3.3, Eq. (5)] The visual-similarity metric S is never specified. Since Eq. (6) is later used as a proxy, the reader needs to know which metric (LPIPS, SSIM, CLIP, or a combination) is meant by the 'rule-based similarity reward'.
  2. [Section 3.4, Eq. (8)] Equation (8) writes the step-level guidance as ∇zt Ra(f_phi(D(zt)), y), but the text immediately explains that D(zt) is replaced by xt_in = D(zt_in) from Eq. (10). The equation should be updated to match the actual implementation.
  3. [Section 3.4, Eq. (10)] The explanation of the interpolation weight sqrt(1-α_t) is confusing: it says this 'allows z0 to take on a higher weight at larger t values', but at t=0 the weight is 0 and at t=T it is near 1, so both endpoints are close to clean or predicted-clean latents. Please clarify the intended behavior of zt_in across the trajectory.
  4. [Section 4.3] The sentence 'We use ViT-B as the substitute model and Inc-v3ens3 as the target model for input preprocessing defenses' is unclear. The defense table (Table 2) evaluates many defenses and models; please specify which defense uses Inc-v3ens3 as the target and how the other columns are generated.
  5. [Eq. (12)] The mixing of D(zt_0) and D(zbar_0) with equal weight 1/2 is presented without justification or sensitivity analysis. A brief comment on why equal weighting was chosen, or an ablation, would help.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: APA's black-box transferability is measured on held-out models, and the Eq. (6) proxy for visual similarity is an empirical design choice, not an equation-level reduction to its own inputs.

full rationale

The load-bearing evaluation is black-box transferability on held-out CNNs and ViTs (Table 1), so the attack reward Ra = L(f_phi(x_adv), y), which is optimized on the substitute classifier, is not a fitted quantity relabeled as a prediction: transfer is measured on models that were not used for gradient computation. In the visual-consistency stage, the paper replaces the explicit similarity reward S(D(z_bar_0), x) in Eq. (5) with the denoising objective in Eq. (6), but it says only "inspired by Eq. (2)" rather than claiming Eq. (6) is mathematically identical to Eq. (5). The proxy is then checked against external metrics (LPIPS, SSIM, CLIP in Table 3 and qualitatively in Figure 3), so it is an empirically validated design assumption rather than a self-definitional construction. The main self-citation is to ACA [9], whose skip-gradient approximation is reused, but APA also implements exact gradient checkpointing, and ACA is used as a baseline that APA is compared against rather than as an authority that forces the result. No uniqueness theorem is imported, and the Pareto-optimality claim in Section 4.5 rests on the empirical comparison in Figure 5(b), not on the definition of the two-stage procedure. The derivation chain is therefore self-contained; the unproven Eq. (6)-for-Eq. (5) substitution is a correctness/validation concern, not a circularity.

Assumptions & free parameters 6 free parameters · 6 assumptions · 0 invented entities

The central method rests on six premises: two standard DDIM/transfer assumptions and four task-specific design heuristics. The ad hoc assumptions (Eqs. 6, 10, 12, and the two-stage Pareto claim) are the least externally grounded; they are supported mainly by ablations on a single benchmark. Three numeric hyperparameters plus two step counts are hand-selected or tuned on the evaluation set, which shifts some of the reported performance into the choice of constants.

free parameters (6)
  • attack scale epsilon_a = 0.4
    L_infinity bound on the latent perturbation around the inverted z_T (Section 4.1); chosen by hand and not swept in the paper's sensitivity analysis.
  • attack step size mu = 0.04
    Momentum step size for trajectory-level gradient updates (Eq. 7); hand-chosen.
  • attack iterations N = 10
    Number of attack iterations (Section 4.1); hand-chosen.
  • guidance step T_a = 10
    Number of final denoising steps with attack guidance (Section 4.6, Figure 6); tuned to balance ASR, time, and image quality.
  • inversion steps T = 50 (APA-SG), 10 (APA-GC)
    Total DDIM inversion/denoising steps; APA-GC sets T = T_a = 10 based on Figure 6(a).
  • LoRA rank and learning rate
    Values deferred to the appendix; central to stage 1 but unavailable in the reviewed text.
assumptions (6)
  • standard math DDIM inversion (Eq. 4) followed by DDIM denoising (Eq. 3) reconstructs the reference image when no perturbation is applied.
    Invoked in Section 3.2 and Figure 3; standard property of deterministic DDIM inversion.
  • domain assumption The surrogate classifier's cross-entropy loss is a differentiable reward whose optimization transfers to unknown black-box target models.
    Section 3.4 states f_phi as a differentiable substitute for inaccessible f_phi'; standard transfer attack assumption.
  • ad hoc to paper Minimizing the noise-prediction loss Eq. (6) is equivalent to maximizing the visual similarity between the generated and clean image.
    Section 3.3 replaces Eq. (5) with Eq. (6) 'inspired by Eq. (2)' with no proof or independent validation; this is the paper's key design hypothesis.
  • ad hoc to paper Interpolating the predicted latent z_t^0 with the clean latent z_0 using weight sqrt(1-alpha_t) (Eq. 10) yields classifier-friendly inputs at every step, making step-level rewards accurate.
    Section 3.4, Eq. (10); heuristic to reduce domain gap between intermediate latents and clean classifier inputs.
  • ad hoc to paper Mixing intermediate decoded outputs D(z_t^0) with the final output D(z_bar_0) via Eq. (12) serves as data augmentation that improves transferability without biasing the attack objective.
    Section 3.4 'Diffusion Augmentation'; empirically supported by Table 4 but no theoretical justification.
  • domain assumption Two-stage sequential optimization (LoRA first, latent second) achieves closer Pareto optimality than joint weighted optimization.
    Section 4.5 and Figure 5(b); the paper's justification is empirical and based on a lambda-weighted one-stage baseline.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment." pith.science (2026). https://pith.science/paper/DZLFYG4L

@misc{pith2026250601511,
  author       = {Pith},
  title        = {Pith review of: Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DZLFYG4L}},
  note         = {Machine review of arXiv:2506.01511}
}
read the original abstract

Preference alignment in diffusion models has primarily focused on benign human preferences (e.g., aesthetic). In this paper, we propose a novel perspective: framing unrestricted adversarial example generation as a problem of aligning with adversary preferences. Unlike benign alignment, adversarial alignment involves two inherently conflicting preferences: visual consistency and attack effectiveness, which often lead to unstable optimization and reward hacking (e.g., reducing visual quality to improve attack success). To address this, we propose APA (Adversary Preferences Alignment), a two-stage framework that decouples conflicting preferences and optimizes each with differentiable rewards. In the first stage, APA fine-tunes LoRA to improve visual consistency using rule-based similarity reward. In the second stage, APA updates either the image latent or prompt embedding based on feedback from a substitute classifier, guided by trajectory-level and step-wise rewards. To enhance black-box transferability, we further incorporate a diffusion augmentation strategy. Experiments demonstrate that APA achieves significantly better attack transferability while maintaining high visual consistency, inspiring further research to approach adversarial attacks from an alignment perspective. Code will be available at https://github.com/deep-kaixun/APA.

Figures

Figures reproduced from arXiv: 2506.01511 by the authors.

Figure 1
Figure 1. Comparison of Human Preference Alignment and Ad [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of our APA framework. APA first optimizes the LoRA parameters with a visual consistency reward, storing input [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Impact of adversarial and random noise on [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison of image quality. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: (a) shows the comparison with different optimization [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Hyper-parameters tuning on T and Ta. RN-50 as the substitute model. ficient guidance, while exceeding Ta also degrades attack performance due to bias introduced by overly deep gradient chains. Thus, we set T = Ta = 10. 5. Conclusion In this paper, we broaden the applic…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

70 extracted references · 59 canonical work pages

  1. [1]

    Alberti, and Tandri Gauksson

    Rima Alaifari, Giovanni S. Alberti, and Tandri Gauksson. Adef: an iterative algorithm to construct adversarial defor- mations. In ICLR, 2019. 2

    work page 2019

  2. [2]

    Li, and David A

    Anand Bhattad, Min Jin Chong, Kaizhao Liang, B. Li, and David A. Forsyth. Unrestricted adversarial examples via se- mantic manipulation. In ICLR, 2019. 5

    work page 2019

  3. [3]

    Training diffusion models with reinforce- ment learning

    Kevin Black, Michael Janner, Yilun Du, Ilya Kostrikov, and Sergey Levine. Training diffusion models with reinforce- ment learning. In ICLR, 2024. 1, 2

    work page 2024

  4. [4]

    IQA-PyTorch: Pytorch toolbox for image quality assessment

    Chaofeng Chen and Jiadi Mo. IQA-PyTorch: Pytorch toolbox for image quality assessment. [Online]. Avail- able: https : / / github . com / chaofengc / IQA - PyTorch, 2022. 7

    work page 2022

  5. [5]

    Enhancing diffusion models with text-encoder reinforcement learning

    Chaofeng Chen, Annan Wang, Haoning Wu, Liang Liao, Wenxiu Sun, Qiong Yan, and Weisi Lin. Enhancing diffusion models with text-encoder reinforcement learning. In ECCV,

  6. [6]

    Diffusion models for impercepti- ble and transferable adversarial attack

    Jianqi Chen, Hao Chen, Keyan Chen, Yilan Zhang, Zhengxia Zou, and Zhenwei Shi. Diffusion models for impercepti- ble and transferable adversarial attack. arXiv e-prints, pages arXiv–2305, 2023. 2

    work page 2023

  7. [7]

    Training deep nets with sublinear memory cost

    Tianqi Chen, Bing Xu, Chiyuan Zhang, and Carlos Guestrin. Training deep nets with sublinear memory cost. arXiv preprint arXiv:1604.06174, 2016. 5

    arXiv 2016

  8. [8]

    Advdiffuser: Natural adversarial example synthesis with diffusion models

    Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. Advdiffuser: Natural adversarial example synthesis with diffusion models. In ICCV, 2023. 2

    work page 2023

Show all 70 references
  1. [9]

    Content-based unrestricted ad- versarial attack

    Zhaoyu Chen, Bo Li, Shuang Wu, Kaixun Jiang, Shouhong Ding, and Wenqiang Zhang. Content-based unrestricted ad- versarial attack. NeurIPS, 2024. 1, 2, 3, 4, 5

    2024

  2. [10]

    Directly fine-tuning diffusion models on differentiable re- wards

    Kevin Clark, Paul Vicol, Kevin Swersky, and David J Fleet. Directly fine-tuning diffusion models on differentiable re- wards. In ICLR, 2024. 1, 2, 4

    2024

  3. [11]

    Advdiff: Generating unrestricted adversarial examples using diffusion models

    Xuelong Dai, Kaisheng Liang, and Bin Xiao. Advdiff: Generating unrestricted adversarial examples using diffusion models. In ECCV, 2024. 2

    2024

  4. [12]

    Imagenet large scale visual recognition competition 2012 (ilsvrc2012)

    Jia Deng, Alex Berg, Sanjeev Satheesh, H Su, Aditya Khosla, and Li Fei-Fei. Imagenet large scale visual recognition competition 2012 (ilsvrc2012). See net. org/challenges/LSVRC, 41, 2012. 5

    2012

  5. [13]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. NeurIPS, 2021. 5, 7

    2021

  6. [14]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In CVPR, 2018. 1, 2, 3, 4

    2018

  7. [15]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In CVPR, 2019. 4

    2019

  8. [16]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  9. [17]

    Re- inforcement learning for fine-tuning text-to-image diffusion models

    Ying Fan, Olivia Watkins, Yuqing Du, Hao Liu, Moonkyung Ryu, Craig Boutilier, Pieter Abbeel, Moham- mad Ghavamzadeh, Kangwook Lee, and Kimin Lee. Re- inforcement learning for fine-tuning text-to-image diffusion models. In NeurIPS, 2023. 1, 2

    2023

  10. [18]

    Wichmann, and Wieland Brendel

    Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. InICLR, 2019. 7

    2019

  11. [19]

    Shortcut learning in deep neural networks

    Robert Geirhos, J ¨orn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Fe- lix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2020. 2, 4

    2020

  12. [20]

    Mix-of-show: Decentralized low- rank adaptation for multi-concept customization of diffusion models

    Yuchao Gu, Xintao Wang, Jay Zhangjie Wu, Yujun Shi, Yun- peng Chen, Zihan Fan, Wuyou Xiao, Rui Zhao, Shuning Chang, Weijia Wu, et al. Mix-of-show: Decentralized low- rank adaptation for multi-concept customization of diffusion models. NeurIPS, 2024. 3

    2024

  13. [21]

    Countering adversarial images using input transformations

    Chuan Guo, Mayank Rana, Moustapha Ciss ´e, and Laurens van der Maaten. Countering adversarial images using input transformations. In ICLR, 2018. 6

    2018

  14. [22]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR,

  15. [23]

    Denoising diffu- sion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffu- sion probabilistic models. NeurIPS, 2020. 3

    2020

  16. [24]

    Semantic adver- sarial examples

    Hossein Hosseini and Radha Poovendran. Semantic adver- sarial examples. In CVPRW, 2018. 2, 5

    2018

  17. [25]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In ICLR, 2022. 2, 3

    2022

  18. [26]

    Weinberger

    Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kil- ian Q. Weinberger. Densely connected convolutional net- works. In CVPR, pages 2261–2269. IEEE Computer Society,

  19. [27]

    Efficient decision-based black-box patch attacks on video recognition

    Kaixun Jiang, Zhaoyu Chen, Hao Huang, Jiafeng Wang, Dingkang Yang, Bo Li, Yan Wang, and Wenqiang Zhang. Efficient decision-based black-box patch attacks on video recognition. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023. 1

    2023

  20. [28]

    Towards decision-based sparse attacks on video recognition

    Kaixun Jiang, Zhaoyu Chen, Xinyu Zhou, Jingyu Zhang, Lingyi Hong, JiaFeng Wang, Bo Li, Yan Wang, and Wen- qiang Zhang. Towards decision-based sparse attacks on video recognition. In Proceedings of the 31st ACM Inter- national Conference on Multimedia, 2023

    2023

  21. [29]

    Exploring the 9 adversarial robustness of video object segmentation via one- shot adversarial attacks

    Kaixun Jiang, Lingyi Hong, Zhaoyu Chen, Pinxue Guo, Zeng Tao, Yan Wang, and Wenqiang Zhang. Exploring the 9 adversarial robustness of video object segmentation via one- shot adversarial attacks. In Proceedings of the 31st ACM International Conference on Multimedia, 2023. 1

    2023

  22. [30]

    Perceptual losses for real-time style transfer and super-resolution

    Justin Johnson, Alexandre Alahi, and Li Fei-Fei. Perceptual losses for real-time style transfer and super-resolution. In ECCV, 2016. 2

    2016

  23. [31]

    Ad- versarial examples in the physical world

    Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. In Artificial in- telligence safety and security , pages 99–112. Chapman and Hall/CRC, 2018. 5

    2018

  24. [32]

    Functional adversarial attacks

    Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. In NeurIPS, 2019. 2

    2019

  25. [33]

    Perceptual adversarial robustness: Defense against unseen threat mod- els

    Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat mod- els. In ICLR, 2021. 2

    2021

  26. [34]

    Parrot: Pareto-optimal multi-reward reinforce- ment learning framework for text-to-image generation

    Seung Hyun Lee, Yinxiao Li, Junjie Ke, Innfarn Yoo, Han Zhang, Jiahui Yu, Qifei Wang, Fei Deng, Glenn Entis, Jun- feng He, et al. Parrot: Pareto-optimal multi-reward reinforce- ment learning framework for text-to-image generation. In ECCV, 2024. 2

    2024

  27. [35]

    Controlnet++: Improving conditional controls with efficient consistency feedback

    Ming Li, Taojiannan Yang, Huafeng Kuang, Jie Wu, Zhaon- ing Wang, Xuefeng Xiao, and Chen Chen. Controlnet++: Improving conditional controls with efficient consistency feedback. In ECCV, 2024. 8

    2024

  28. [36]

    Upainting: Unified text-to-image diffu- sion generation with cross-modal guidance

    Wei Li, Xue Xu, Xinyan Xiao, Jiachen Liu, Hu Yang, Guo- hao Li, Zhanpeng Wang, Zhifan Feng, Qiaoqiao She, Ya- juan Lyu, et al. Upainting: Unified text-to-image diffu- sion generation with cross-modal guidance. arXiv preprint arXiv:2210.16031, 2022. 7

    arXiv

  29. [37]

    Yuille, and Cihang Xie

    Yingwei Li, Qihang Yu, Mingxing Tan, Jieru Mei, Peng Tang, Wei Shen, Alan L. Yuille, and Cihang Xie. Shape- texture debiased neural network training. In ICLR, 2021. 7

    2021

  30. [38]

    Textcraftor: Your text encoder can be image quality controller

    Yanyu Li, Xian Liu, Anil Kag, Ju Hu, Yerlan Idelbayev, Dhritiman Sagar, Yanzhi Wang, Sergey Tulyakov, and Jian Ren. Textcraftor: Your text encoder can be image quality controller. In CVPR, 2024. 1, 2

    2024

  31. [39]

    Step-aware prefer- ence optimization: Aligning preference with denoising per- formance at each step

    Zhanhao Liang, Yuhui Yuan, Shuyang Gu, Bohan Chen, Tiankai Hang, Ji Li, and Liang Zheng. Step-aware prefer- ence optimization: Aligning preference with denoising per- formance at each step. arXiv preprint arXiv:2406.04314 ,

    arXiv

  32. [40]

    Defense against adversarial attacks using high-level representation guided denoiser

    Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In CVPR,

  33. [41]

    Alignment of dif- fusion models: Fundamentals, challenges, and future

    Buhua Liu, Shitong Shao, Bao Li, Lichen Bai, Haoyi Xiong, James Kwok, Sumi Helal, and Zeke Xie. Alignment of dif- fusion models: Fundamentals, challenges, and future. arXiv preprint arXiv:2409.07253, 2024. 5

    2024

  34. [42]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV, 2021. 6

    2021

  35. [43]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. 2, 3

    2018

  36. [44]

    Mobilevit: Light- weight, general-purpose, and mobile-friendly vision trans- former

    Sachin Mehta and Mohammad Rastegari. Mobilevit: Light- weight, general-purpose, and mobile-friendly vision trans- former. In ICLR, 2022. 6

    2022

  37. [45]

    Ava: A large-scale database for aesthetic visual analysis

    Naila Murray, Luca Marchesotti, and Florent Perronnin. Ava: A large-scale database for aesthetic visual analysis. In CVPR, 2012. 7

    2012

  38. [46]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In ICML, 2022. 2, 6

    2022

  39. [47]

    Sca: Highly efficient semantic-consistent unrestricted adversarial attack

    Zihao Pan, Weibin Wu, Yuhang Cao, and Zibin Zheng. Sca: Highly efficient semantic-consistent unrestricted adversarial attack. arXiv preprint arXiv:2410.02240, 2024. 2

    2024 arXiv

  40. [48]

    Aligning text-to-image diffusion models with reward backpropagation

    Mihir Prabhudesai, Anirudh Goyal, Deepak Pathak, and Katerina Fragkiadaki. Aligning text-to-image diffusion models with reward backpropagation. arXiv preprint arXiv:2310.03739, 2023. 1, 2, 4

    2023 arXiv

  41. [49]

    Semanticadv: Generating adver- sarial examples via attribute-conditioned image editing

    Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. Semanticadv: Generating adver- sarial examples via attribute-conditioned image editing. In ECCV, 2020. 2

    2020

  42. [50]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In ICML, 2021. 7

    2021

  43. [51]

    High-resolution image syn- thesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image syn- thesis with latent diffusion models. In CVPR, 2022. 1, 3, 5

    2022

  44. [52]

    Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen

    Mark Sandler, Andrew G. Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018. 6

    2018

  45. [53]

    Proximal policy optimization algo- rithms

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Rad- ford, and Oleg Klimov. Proximal policy optimization algo- rithms. arXiv preprint arXiv:1707.06347, 2017. 2

    2017 arXiv

  46. [54]

    Colorfool: Semantic adversarial coloriza- tion

    Ali Shahin Shamsabadi, Ricardo S ´anchez-Matilla, and An- drea Cavallaro. Colorfool: Semantic adversarial coloriza- tion. In CVPR, pages 1148–1157, 2020. 5

    2020

  47. [55]

    Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models

    Naman Deep Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for imagenet: Architectures, training and generalization across threat models. InNeurIPS,

  48. [56]

    Denois- ing diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denois- ing diffusion implicit models. In ICLR, 2021. 3

    2021

  49. [57]

    Rethinking the in- ception architecture for computer vision

    Christian Szegedy, Vincent Vanhoucke, Sergey Ioffe, Jonathon Shlens, and Zbigniew Wojna. Rethinking the in- ception architecture for computer vision. In CVPR, 2016. 6

    2016

  50. [58]

    Mingxing Tan and Quoc V . Le. Efficientnet: Rethinking model scaling for convolutional neural networks. In ICML,

  51. [59]

    Goodfellow, Dan Boneh, and Patrick D

    Florian Tram `er, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensem- ble adversarial training: Attacks and defenses. In ICLR,

  52. [60]

    Diffusion model align- ment using direct preference optimization

    Bram Wallace, Meihua Dang, Rafael Rafailov, Linqi Zhou, Aaron Lou, Senthil Purushwalkam, Stefano Ermon, Caiming 10 Xiong, Shafiq Joty, and Nikhil Naik. Diffusion model align- ment using direct preference optimization. In CVPR, 2024. 1, 2

    2024

  53. [61]

    PVT v2: Improved baselines with pyramid vision transformer

    Wenhai Wang, Enze Xie, Xiang Li, Deng-Ping Fan, Kaitao Song, Ding Liang, Tong Lu, Ping Luo, and Ling Shao. PVT v2: Improved baselines with pyramid vision transformer. Comput. Vis. Media, 2022. 6

    2022

  54. [62]

    Struc- ture invariant transformation for better adversarial transfer- ability

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. Struc- ture invariant transformation for better adversarial transfer- ability. In ICCV, 2023. 5

    2023

  55. [63]

    Spatially transformed adversarial ex- amples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial ex- amples. In ICLR, 2018. 2

    2018

  56. [64]

    Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through ran- domization. In ICLR, 2018. 6

    2018

  57. [65]

    Improving transferabil- ity of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferabil- ity of adversarial examples with input diversity. In CVPR,

  58. [66]

    Feature squeezing: Detecting adversarial examples in deep neural networks

    Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Sym- posium, 2018. 6

    2018

  59. [67]

    Diffusion-based adversarial sample generation for improved stealthiness and controllability

    Haotian Xue, Alexandre Araujo, Bin Hu, and Yongxin Chen. Diffusion-based adversarial sample generation for improved stealthiness and controllability. In NeurIPS, 2023. 2, 5

    2023

  60. [68]

    Natural color fool: Towards boosting black-box unrestricted attacks

    Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting black-box unrestricted attacks. In NeurIPS, 2022. 5

    2022

  61. [69]

    Diffmorpher: Unleashing the capability of diffu- sion models for image morphing

    Kaiwen Zhang, Yifan Zhou, Xudong Xu, Bo Dai, and Xin- gang Pan. Diffmorpher: Unleashing the capability of diffu- sion models for image morphing. In CVPR, 2024. 3

    2024

  62. [70]

    Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Ad- versarial color enhancement: Generating unrestricted adver- sarial images by optimizing a color filter. In BMVC, 2020. 2 11

    2020

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.