NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion

TL;DR

NatADiff introduces a novel diffusion-based method for generating natural adversarial samples that better mimic real-world errors, improving transferability and fidelity compared to existing techniques.

Contribution

The paper presents NatADiff, a diffusion-guided adversarial sampling scheme that enhances attack transferability and realism of adversarial examples in deep learning.

Findings

Achieves comparable attack success rates to state-of-the-art methods.

Produces adversarial samples with higher transferability across models.

Generates samples that better resemble natural test-time errors as measured by FID.

Abstract

Adversarial samples exploit irregularities in the manifold `learned' by deep learning models to cause misclassifications. The study of these adversarial samples provides insight into the features a model uses to classify inputs, which can be leveraged to improve robustness against future attacks. However, much of the existing literature focuses on constrained adversarial samples, which do not accurately reflect test-time errors encountered in real-world settings. To address this, we propose `NatADiff', an adversarial sampling scheme that leverages denoising diffusion to generate natural adversarial samples. Our approach is based on the observation that natural adversarial samples frequently contain structural elements from the adversarial class. Deep learning models can exploit these structural elements to shortcut the classification process, rather than learning to genuinely distinguish between classes. To leverage this behavior, we guide the diffusion trajectory towards the intersection of the true and adversarial classes, combining time-travel sampling with augmented classifier guidance to enhance attack transferability while preserving image fidelity. Our method achieves comparable attack success rates to current state-of-the-art techniques, while exhibiting significantly higher transferability across model architectures and better alignment with natural test-time errors as measured by FID. These results demonstrate that NatADiff produces adversarial samples that not only transfer more effectively across models, but more faithfully resemble naturally occurring test-time errors.