Share us a ⭐ if this repo does help

This repository is the official implementation of DiffAttack. The newest version of the paper can be accessed in IEEE, the previous version of the paper can be accessed in arXiv. (Accepted by TPAMI 2024)

If you encounter any question, please feel free to contact us. You can create an issue or just send email to me windvchen@gmail.com. Also welcome for any idea exchange and discussion.

Updates

[10/20/2024] This paper is finally accepted by TPAMI. 👋 You can find the newest version of paper here (with additional new results and experiments). For the previous version, please refer to here. Please note that the attack methods compared in both versions differ slightly; for instance, the TPAMI version includes more recent methods, while some older ones were omitted. We recommend reviewing both versions to gain a comprehensive understanding of the comparisons with existing approaches.

[10/14/2024] Thanks for the contributions from @AndPuQing and @yuangan, DiffAttack currently supports the newest version of diffusers (0.30.3). Please note that due to differences in package versions, the final evaluated results may vary slightly. To reproduce the results from our paper, we recommend installing diffusers==0.9.0 and using the backed-up script diff_latent_attack-0.9.0.py.

[11/30/2023] Access the latest version, v2, of our paper on Arxiv. 👋👋 In this updated release, we have enriched the content with additional discussions and experiments. Noteworthy additions include comprehensive experiments on diverse datasets (refer to Appendix I), exploration of various model structures (refer to Appendix H), and insightful comparisons with ensemble attacks (refer to Appendix G & K) as well as GAN-based methods (refer to Appendix J). Furthermore, we provide expanded details on the current limitations and propose potential directions for future research on diffusion-based methods (refer to Section 5).

[09/07/2023] Besides ImageNet-Compatible, the code now also supports generating adversarial attacks on CUB_200_2011 and Standford Cars datasets. 🚀🚀 Please refer to Requirements for more details.

[05/16/2023] Code is public.

[05/14/2023] Paper is publicly accessible on ArXiv now.

[04/30/2023] Code cleanup done. Waiting to be made public.

Table of Contents

• Abstract
• Requirements
• Crafting Adversarial Examples
• Evaluation
  • Robustness on other normally trained models
  • Robustness on defensive approaches
• Results
• Citation & Acknowledgments
• License

Abstract

Many existing adversarial attacks generate