VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models
This work addresses the challenge of creating realistic adversarial examples for machine learning models, which is crucial for understanding vulnerabilities and improving defenses, though it is incremental as it builds on existing diffusion-based approaches.
The paper tackled the problem of generating unrestricted adversarial examples (UAEs) with diffusion models, which previously struggled with producing natural-looking examples from random noise, and introduced VENOM, a text-driven framework that unifies content generation and adversarial synthesis to achieve high attack success rates and image quality, outperforming prior methods in experiments.
Adversarial attacks have proven effective in deceiving machine learning models by subtly altering input images, motivating extensive research in recent years. Traditional methods constrain perturbations within $l_p$-norm bounds, but advancements in Unrestricted Adversarial Examples (UAEs) allow for more complex, generative-model-based manipulations. Diffusion models now lead UAE generation due to superior stability and image quality over GANs. However, existing diffusion-based UAE methods are limited to using reference images and face challenges in generating Natural Adversarial Examples (NAEs) directly from random noise, often producing uncontrolled or distorted outputs. In this work, we introduce VENOM, the first text-driven framework for high-quality unrestricted adversarial examples generation through diffusion models. VENOM unifies image content generation and adversarial synthesis into a single reverse diffusion process, enabling high-fidelity adversarial examples without sacrificing attack success rate (ASR). To stabilize this process, we incorporate an adaptive adversarial guidance strategy with momentum, ensuring that the generated adversarial examples $x^*$ align with the distribution $p(x)$ of natural images. Extensive experiments demonstrate that VENOM achieves superior ASR and image quality compared to prior methods, marking a significant advancement in adversarial example generation and providing insights into model vulnerabilities for improved defense development.