DeDiAttack: Enhancing Transferability of Unrestricted Adversarial Examples via Deformation-Constrained Diffusion

DNNs are highly vulnerable to adversarial examples (AEs). To achieve high transferability, traditional AEs often introduce unnatural artifacts that are easily perceptible to the human eye. Unrestricted attacks have emerged as a promising paradigm to generate more natural unrestricted adversarial examples (UAEs). However, existing UAEs struggle to balance visual fidelity and black-box transferability. Color-based attacks produce noticeable unnatural visual mutations, and diffusion-based attacks transfer poorly to unknown black-box models. We observe that directly injecting unconstrained random perturbations into the diffusion latent space destroys the normal distribution of data, thereby causing a distribution shift. Distribution shifts degrade adversarial perturbations into invalid noise and cause surrogate model overfitting. Furthermore, introducing elastic deformation during the denoising process forces surrogate models to focus on highly transferable features. As a result, we propose an unrestricted attack based on deformation-constrained diffusion, called DeDiAttack. Our method utilizes the manifold prior knowledge of diffusion models to translate elastic deformations into smooth fluid changes. The mechanism effectively eliminates unnatural artifacts and generates highly natural and transferable UAEs. Extensive black-box experiments demonstrate that DeDiAttack outperforms existing attacks and improves the black-box transferability of generated UAEs by 7.2% on the ViT-B surrogate model. The proposed method also provides a useful robustness evaluation tool for vision-based sensing and imaging systems.