标题： 通过对抗偏好对齐增强基于扩散的无约束对抗攻击 显示英文标题

标题： Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment

摘要： 扩散模型中的偏好对齐主要集中在良性人类偏好（例如，美学）上。 在本文中，我们提出了一种新的视角：将无约束对抗样本生成问题视为与对手偏好对齐的问题。 与良性对齐不同，对抗性对齐涉及两种本质上相互冲突的偏好：视觉一致性与攻击有效性，这通常会导致优化不稳定和奖励窃取（例如，降低视觉质量以提高攻击成功率）。 为了解决这个问题，我们提出了APA（对抗者偏好对齐），这是一种两阶段框架，可以分解冲突的偏好，并使用可微分奖励分别优化它们。 在第一阶段，APA通过基于规则的相似性奖励微调LoRA来改善视觉一致性。 在第二阶段，APA根据替代分类器的反馈更新图像潜在表示或提示嵌入，这由轨迹级和逐步奖励指导。 为了增强黑盒传输能力，我们进一步结合了扩散增强策略。 实验表明，APA在保持高视觉一致性的前提下实现了显著更好的攻击传输能力，启发了从对齐的角度进一步研究对抗性攻击。 代码将在https://github.com/deep-kaixun/APA上提供。 显示英文摘要

摘要： Preference alignment in diffusion models has primarily focused on benign human preferences (e.g., aesthetic). In this paper, we propose a novel perspective: framing unrestricted adversarial example generation as a problem of aligning with adversary preferences. Unlike benign alignment, adversarial alignment involves two inherently conflicting preferences: visual consistency and attack effectiveness, which often lead to unstable optimization and reward hacking (e.g., reducing visual quality to improve attack success). To address this, we propose APA (Adversary Preferences Alignment), a two-stage framework that decouples conflicting preferences and optimizes each with differentiable rewards. In the first stage, APA fine-tunes LoRA to improve visual consistency using rule-based similarity reward. In the second stage, APA updates either the image latent or prompt embedding based on feedback from a substitute classifier, guided by trajectory-level and step-wise rewards. To enhance black-box transferability, we further incorporate a diffusion augmentation strategy. Experiments demonstrate that APA achieves significantly better attack transferability while maintaining high visual consistency, inspiring further research to approach adversarial attacks from an alignment perspective. Code will be available at https://github.com/deep-kaixun/APA.