Why your attacking algoritm utilizes the label with 0 tensor?

[Zhujx-zjjx]

Hi, dear author,

I want to ask for you about some details in your code. Your paper aims to attack diffusion model using loss function L_DM. I think this idea is very novel, but when I check this technique in your code, I have a confusing question. Why your attacking code utilize the labels with 0 tensor as follow:

label = torch.zeros(data_source.shape).to(device)
print(net(data_source, components=True))

# Targeted PGD attack is applied.
attack = LinfPGDAttack(net, fn, epsilon, steps, eps_iter=alpha, clip_min=-1.0, targeted=True)
attack_output = attack.perturb(data_source, label, mask=mask)
print(net(attack_output, components=True))

I guess this process should be your core attacking technique, but this code might be a little different from the algorithm in your paper.

Could you help me with an explanation? I am looking forward to your reply and thanks a lot.

[Nicholas0228]

Hi zjjx,

The output of the 'target_model' class represents the diffusion loss directly. Consequently, the disparity between a 0 tensor and the output of 'net' (which falls within the 'target_model' class) is also indicative of the diffusion loss. While this might seem perplexing, it is necessary for compatibility with the advertorch framework, which mandates a function as an input.

[Zhujx-zjjx]

Thanks for your replying. I have discussed this problem with my cooperators, and they have resolved my confusing, so I think I have understood your experimental settings.