VENOM: Text-driven Unrestricted Adversarial Example Generation with Diffusion Models

TL;DR

VENOM introduces a novel text-driven diffusion model framework for generating high-quality unrestricted adversarial examples, improving attack success rates and image naturalness without relying on reference images.

Contribution

It is the first to unify image content and adversarial synthesis in a single diffusion process driven by text, enabling stable, high-fidelity adversarial example generation from random noise.

Findings

VENOM achieves higher attack success rates than prior methods.

Generated adversarial examples maintain high image quality and naturalness.

The adaptive guidance strategy stabilizes the generation process.

Abstract

Adversarial attacks have proven effective in deceiving machine learning models by subtly altering input images, motivating extensive research in recent years. Traditional methods constrain perturbations within $l_p$-norm bounds, but advancements in Unrestricted Adversarial Examples (UAEs) allow for more complex, generative-model-based manipulations. Diffusion models now lead UAE generation due to superior stability and image quality over GANs. However, existing diffusion-based UAE methods are limited to using reference images and face challenges in generating Natural Adversarial Examples (NAEs) directly from random noise, often producing uncontrolled or distorted outputs. In this work, we introduce VENOM, the first text-driven framework for high-quality unrestricted adversarial examples generation through diffusion models. VENOM unifies image content generation and adversarial synthesis into a single reverse diffusion process, enabling high-fidelity adversarial examples without sacrificing attack success rate (ASR). To stabilize this process, we incorporate an adaptive adversarial guidance strategy with momentum, ensuring that the generated adversarial examples $x^*$ align with the distribution $p(x)$ of natural images. Extensive experiments demonstrate that VENOM achieves superior ASR and image quality compared to prior methods, marking a significant advancement in adversarial example generation and providing insights into model vulnerabilities for improved defense development.