Reproduce “Latent Transfer Attack: Adversarial Examples via Generative Latent Spaces” on OpenResearch

About this paper

Eitan Shaar, Ariel Shaulov, Yalcin Tur, Gal Chechik, Ravid Shwartz-Ziv

The Latent Transfer Attack (LTA) generates adversarial examples by optimizing perturbations within the latent space of a pretrained Stable Diffusion VAE. This method achieves state-of-the-art transfer attack success rates, showing average improvements of up to +19.1 points over baselines, particularly against Vision Transformers and various defense mechanisms, by producing low-frequency, spatially coherent perturbations.

Key insights

• Optimizing in a generative VAE's latent space intrinsically biases adversarial perturbations towards low-frequency, spatially coherent structures, leading to significantly enhanced cross-model transferability.
• The combination of latent space optimization with Expectation Over Transformations is critical for generating adversarial examples that are robust to common image preprocessing and effective against diverse target architectures, including Vision Transformers.
• Adversarial perturbations with predominantly low-frequency characteristics pose a greater challenge for purification-based defense mechanisms, indicating a potential vulnerability of these defenses to structured adversarial signals.

Summary by alphaXiv.