Abstract
Adversarial attacks from generative models often produce low-quality images and require substantial computational resources. Diffusion models, though capable of high-quality generation, typically need hundreds of sampling steps for adversarial generation. This paper introduces TAIGen, a training-free black-box method for efficient adversarial image generation. TAIGen produces adversarial examples using only 3-20 sampling steps from unconditional diffusion models. Our key finding is that perturbations injected during the mixing step interval achieve comparable attack effectiveness without processing all timesteps. We develop a selective RGB channel strategy that applies attention maps to the red channel while using GradCAM-guided perturbations on green and blue channels. This design preserves image structure while maximizing misclassification in target models. TAIGen maintains visual quality with PSNR above 30 dB across all tested datasets. On ImageNet with VGGNet as source, TAIGen achieves 70.6% success against ResNet, 80.8% against MNASNet, and 97.8% against ShuffleNet. The method generates adversarial examples 10x faster than existing diffusion-based attacks. Our method achieves the lowest robust accuracy, indicating it is the most impactful attack as the defense mechanism is least successful in purifying the images generated by TAIGen.
Abstract (translated)
来自生成模型的对抗性攻击通常会产生质量低下的图像，并且需要大量的计算资源。扩散模型虽然能够生成高质量的图片，但在进行对抗性生成时通常需要几百个采样步骤。本文介绍了TAIGen，一种无需训练的黑盒方法，用于高效的对抗性图像生成。TAIGen仅使用3到20步无条件扩散模型中的采样步骤就能产生对抗样本。 我们的主要发现是，在混合步骤间隔期间注入扰动可以实现相当有效的攻击效果，而不需要处理所有时间步长。我们开发了一种选择性的RGB通道策略，该策略在红色通道上应用注意力图，同时在绿色通道和蓝色通道使用GradCAM引导的扰动。这种设计保留了图像结构的同时最大化目标模型中的分类错误。 TAIGen在所有测试数据集上保持视觉质量，PSNR值超过30dB。在以ImageNet为基准、VGGNet作为源的情况下，TAIGen对ResNet的成功率为70.6%，对MNASNet的成功率为80.8%，对ShuffleNet的成功率则高达97.8%。 该方法生成对抗样本的速度是现有基于扩散的攻击方法的10倍。我们的方法实现了最低的鲁棒准确性，表明它是最具影响力的攻击方式，因为防御机制在净化由TAIGen产生的图像方面最不成功。
URL
https://arxiv.org/abs/2508.15020
