NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion
This addresses the issue of constrained adversarial samples not accurately reflecting real-world errors for improving model robustness, though it is incremental as it builds on existing diffusion and adversarial attack methods.
The paper tackles the problem of generating adversarial samples that reflect real-world test-time errors by proposing NatADiff, a method using denoising diffusion to create natural adversarial samples, achieving comparable attack success rates to state-of-the-art techniques with higher transferability and better alignment with natural errors as measured by FID.
Adversarial samples exploit irregularities in the manifold ``learned'' by deep learning models to cause misclassifications. The study of these adversarial samples provides insight into the features a model uses to classify inputs, which can be leveraged to improve robustness against future attacks. However, much of the existing literature focuses on constrained adversarial samples, which do not accurately reflect test-time errors encountered in real-world settings. To address this, we propose `NatADiff', an adversarial sampling scheme that leverages denoising diffusion to generate natural adversarial samples. Our approach is based on the observation that natural adversarial samples frequently contain structural elements from the adversarial class. Deep learning models can exploit these structural elements to shortcut the classification process, rather than learning to genuinely distinguish between classes. To leverage this behavior, we guide the diffusion trajectory towards the intersection of the true and adversarial classes, combining time-travel sampling with augmented classifier guidance to enhance attack transferability while preserving image fidelity. Our method achieves comparable attack success rates to current state-of-the-art techniques, while exhibiting significantly higher transferability across model architectures and better alignment with natural test-time errors as measured by FID. These results demonstrate that NatADiff produces adversarial samples that not only transfer more effectively across models, but more faithfully resemble naturally occurring test-time errors.