TDBA: Towards Transferable Data-free Black-box Attack with Stable Diffusion

Existing data-free black-box attacks leverage generative adversarial networks (GANs) to synthesize images for substitute model distillation. However, these studies suffer from inefficiency due to the additional training required for the generator and produce poor-quality images. Additionally, they do not investigate advanced attack methods capable of generating highly transferable adversarial examples, resulting in a low attack success rate (ASR). In this paper, we propose a transferable data-free black-box attack (TDBA) scheme based on fine-tuning Stable Diffusion using Low-Rank Adaptation (LoRA) to obtain a substitute model with improved accuracy. To achieve a higher ASR, we integrate attention loss and relax the greedy search to enhance the gradient-based attack method, thereby improving the transferability of adversarial examples. Comprehensive experiments conducted on three benchmark datasets demonstrate the effectiveness of TDBA, which outperforms state-of-the-art GAN-based strategies in terms of the ASR under the same query budget. Furthermore, when combined with the improved gradient-based attacks, our approach further boosts the ASR and achieves a trade-off between ASR and attack cost.