Generate Unrestricted Adversarial Examples by Diffusion Model Based on Labels

The conventional method in adversarial examples research involves setting a fixed limit on the magnitude of perturbations, which fails to consider how humans perceive these perturbations in reality. Recent research has been directed towards creating natural unrestricted adversarial examples (UAEs) that surpass $L_{p}$ perturbation bounds while still preserving semantic plausibility. However, earlier attack methods often depend on Generative Adversarial Networks (GANs), which lack theoretical provability and thus generate unrealistic examples, especially when applied to large-scale datasets like ImageNet. Lately, there has been a shift towards employing diffusion models for generating UAEs. Although diffusion models generate highquality adversarial examples, many of them still show notable deviations from the original samples. This paper presents a novel method called Conditional Sampling Optimization (CSO), which utilizes diffusion models to craft unrestricted adversarial examples targeted at specific class labels. In the process of generating UAEs, the class labels are iteratively used to adjust the prediction noise, guiding the UAEs towards misclassification by the target models. Extensive experiments conducted on ImageNet demonstrate the effectiveness and efficiency of our method in generating UAEs. Our approach delivers enhanced attack performance while preserving exceptional generation quality.