Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SD-NAE: Generating Natural Adversarial Examples with Stable Diffusion

Yueqian Lin, Jingyang Zhang, Yiran Chen, Hai Li

TL;DR

SD-NAE tackles the challenge of generating natural adversarial examples by actively synthesizing NAEs with a class-conditioned diffusion model. It optimizes only the class-related token embedding to minimize $L(F(G(z; e_text)), y) + lambda * R(...)$ while keeping the ground-truth label intact, enabling misclassification with preserved realism. In experiments on a subset of ImageNet, SD-NAE achieves a non-trivial fooling rate (43.5%) and yields diverse, natural-looking NAEs, outperforming prior GAN-based approaches in realism and robustness testing. The method provides a flexible tool for robustness evaluation, including potential applications to OOD/ID misclassification analysis, with practical compute-time trade-offs that can be mitigated by newer diffusion techniques.

Abstract

Natural Adversarial Examples (NAEs), images arising naturally from the environment and capable of deceiving classifiers, are instrumental in robustly evaluating and identifying vulnerabilities in trained models. In this work, unlike prior works that passively collect NAEs from real images, we propose to actively synthesize NAEs using the state-of-the-art Stable Diffusion. Specifically, our method formulates a controlled optimization process, where we perturb the token embedding that corresponds to a specified class to generate NAEs. This generation process is guided by the gradient of loss from the target classifier, ensuring that the created image closely mimics the ground-truth class yet fools the classifier. Named SD-NAE (Stable Diffusion for Natural Adversarial Examples), our innovative method is effective in producing valid and useful NAEs, which is demonstrated through a meticulously designed experiment. Code is available at https://github.com/linyueqian/SD-NAE.

SD-NAE: Generating Natural Adversarial Examples with Stable Diffusion

TL;DR

SD-NAE tackles the challenge of generating natural adversarial examples by actively synthesizing NAEs with a class-conditioned diffusion model. It optimizes only the class-related token embedding to minimize while keeping the ground-truth label intact, enabling misclassification with preserved realism. In experiments on a subset of ImageNet, SD-NAE achieves a non-trivial fooling rate (43.5%) and yields diverse, natural-looking NAEs, outperforming prior GAN-based approaches in realism and robustness testing. The method provides a flexible tool for robustness evaluation, including potential applications to OOD/ID misclassification analysis, with practical compute-time trade-offs that can be mitigated by newer diffusion techniques.

Abstract

Natural Adversarial Examples (NAEs), images arising naturally from the environment and capable of deceiving classifiers, are instrumental in robustly evaluating and identifying vulnerabilities in trained models. In this work, unlike prior works that passively collect NAEs from real images, we propose to actively synthesize NAEs using the state-of-the-art Stable Diffusion. Specifically, our method formulates a controlled optimization process, where we perturb the token embedding that corresponds to a specified class to generate NAEs. This generation process is guided by the gradient of loss from the target classifier, ensuring that the created image closely mimics the ground-truth class yet fools the classifier. Named SD-NAE (Stable Diffusion for Natural Adversarial Examples), our innovative method is effective in producing valid and useful NAEs, which is demonstrated through a meticulously designed experiment. Code is available at https://github.com/linyueqian/SD-NAE.
Paper Structure (12 sections, 4 equations, 5 figures)

This paper contains 12 sections, 4 equations, 5 figures.

Table of Contents

  1. Introduction
  2. Methodology
  3. Experiment
  4. Conclusion
  5. Background and Related Work
  6. Natural Adversarial Examples
  7. Generating NAEs
  8. Stable Diffusion
  9. Expanded Discussion on SD-NAE
  10. Experiment Details
  11. Comparison with Prior Work
  12. Limitations

Figures (5)

  • Figure 1: Guided by the loss gradient backpropagated from the classifier, SD-NAE generates NAEs by optimizing only the class-related token embedding, while keeping all models frozen. The letters in the parentheses are notations used in \ref{['eq:sd-nae']}.
  • Figure 2: NAEs generated by SD-NAE. In each pair, the left initialization image is correctly classified by the model, yet the right one optimized by our method gets misclassified with the wrong prediction marked in red. See more samples in \ref{['fig:results']}.
  • Figure 3: Empirical evidence that constraining the magnitude of token embedding perturbation can help preserve the image ground-truth. From left to right of each row, we move the initialized class token embedding along a random yet fixed Rademacher vector (i.e., each element has equal probability of being +1 or --1) with increasing magnitude. The bottom axis denotes the relative magnitude of the perturbation, and the real magnitude has a factor of 1e-3. It can be noticed that the image semantic is well-preserved when the perturbation is small.
  • Figure 4: Examples generated by SD-NAE. From top to bottom, the ground-truth is broccoli, candle, forklift, fountain, gorilla, strawberry, hamster, jellyfish, lion, and microphone, respectively. In each pair, the left one is generated with the initialized token embedding. Importantly, we make sure that all left images are correctly classified by the ImageNet ResNet-50 model in the first place. The right ones are the result of SD-NAE optimization when using the corresponding left one as initialization, and we mark the classifier's prediction in red above the image.
  • Figure 5: Examples generated by uae using GAN. Following our experiment setup, each initialized image is correctly classified by the target ResNet-50 classifier. The first row shows examples that we count as successfully generated NAEs, whereas the second row shows failure cases where the optimized images exhibit unnatural looking. Note that some successful NAEs here actually do not look that natural, and the quality in general lags behind those generated by SD-NAE (\ref{['fig:results']}). Still, despite counting them as success, we observe a mere 14.0% success rate compared with 43.5% achieved by SD-NAE.