Adversarial-Guided Diffusion (AGD) Methods

• AGD is a framework that integrates adversarial objectives with diffusion model sampling to steer output generation, editing, or purification.
• It spans diverse tasks such as adversarial example generation, guided optimization, and defensive purification, leveraging reverse diffusion adjustments.
• AGD methods offer improved stealth and transferability compared to traditional attacks while incurring higher computational costs and requiring careful parameter tuning.

Adversarial-Guided Diffusion (AGD) denotes a family of methods in which an adversarial objective is coupled to a diffusion model’s sampling or denoising trajectory so that generated, edited, purified, or perturbed outputs satisfy both a task-specific adversarial criterion and a diffusion prior. Across the literature, AGD appears in two principal operational directions: adversarially guiding diffusion sampling, and diffusion-guided adversarial optimization around the natural image manifold (Xue et al., 2023). Later work makes the distinction explicit by separating “adversarial-guided diffusion” from “diffusion-guided adversarial,” while also showing that a single system can combine both behaviors (Li et al., 2 Apr 2026).

1. Scope, terminology, and conceptual boundaries

AGD is not a single algorithm. It is an umbrella concept spanning unrestricted adversarial example generation, diffusion-guided perturbation injection, adversarial purification, targeted false-positive synthesis, recommender-system manipulation, multimodal LLM attacks, safety-critical scenario generation, reinforcement-learning state attacks, and physically deployable attacks on monocular depth estimation. What remains constant is the use of diffusion as the generative prior or optimization geometry, and an adversarial signal as the steering mechanism.

A central distinction in the literature separates two operational forms. In the first, diffusion sampling itself is steered by an adversarial objective; the reverse trajectory is altered so that the denoised sample becomes adversarial. In the second, the diffusion model is kept fixed and instead constrains an outer adversarial optimization procedure, typically by evaluating losses on denoised or manifold-projected samples rather than directly in pixel space (Xue et al., 2023). AEGIS makes this duality explicit by defining “diffusion-guided adversarial” as perturbation formation regulated by the DDIM prior, and “adversarial-guided diffusion” as sampling whose direction is chosen by an adversarial objective (Li et al., 2 Apr 2026).

The acronym itself is not stable across the broader diffusion literature. “Advantage-Guided Diffusion for MBRL” uses AGD to mean “Advantage-Guided Diffusion,” and explicitly states that it is not adversarial-guided diffusion (Foffano et al., 10 Apr 2026). This naming ambiguity is consequential because some papers treat AGD as a general adversarial-diffusion paradigm, whereas others use the same acronym for unrelated guidance signals.

2. Core algorithmic patterns

Across implementations, AGD repeatedly takes the form of a reverse-step modification, a latent-trajectory perturbation, a denoiser-through-optimization loop, or an internal-module perturbation.

In reverse-sampling AGD, the denoiser’s transition is shifted by an adversarial gradient. AdvDiff performs a standard reverse step,

$x_{t-1} = \mu_\theta(x_t, t) + \sigma_t \epsilon,$

and then applies

$x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$

with

$$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$

so that classifier gradients alter each reverse transition while preserving the Gaussian mean-shift structure of diffusion sampling (Dai et al., 2023). NatADiff generalizes this idea by combining true-class guidance, intersection guidance toward the region shared by the true and adversarial classes, and an adversarial classifier gradient through the modified noise prediction

$$\hat{\epsilon}(z_t, t) = \epsilon_{\theta^*}(z_t, t) + (\omega - \mu \omega) v_y + \mu \rho v_{y \cap y_{adv}} - s \beta(t) \tilde{g}(z_t),$$

thereby steering the trajectory toward decision-boundary regions that better resemble natural test-time errors (Collins et al., 27 May 2025).

In purification-oriented AGD, the adversarial signal is used to preserve semantics while denoising away perturbations. AGDM modifies the reverse process of a pretrained diffusion model with guidance from an adversarially trained classifier:

$$x_{t-1} \sim \mathcal{N}\!\left(\mu_\theta(x_t,t) + s \Sigma_t \left[\nabla_{x_t}\log p_\phi(y \mid x_t) - \nabla_{x_t} \mathcal{D}(f_\phi(x'), f_\phi(x_t))\right], \Sigma_t\right),$$

so that label consistency and robust latent-space similarity jointly guide purification (Lin et al., 2024). GDMP uses a closely related mean-shift view, but conditions the reverse process on the adversarial input itself through a distance-based potential over the forward-diffused adversarial image (Wang et al., 2022).

In diffusion-guided adversarial optimization, the denoiser is not modified; instead, gradients are backpropagated through a denoising operator. Diff-PGD replaces the PGD loss evaluation point by a denoised sample,

$$x_0^t = \mathrm{SDEdit}(x^t, K), \qquad g^t = \nabla_{x^t} L_{adv}(f_\theta(x_0^t), y), \qquad x^{t+1} = \Pi_{B_\infty(x,\epsilon)}[x^t + \alpha \cdot \mathrm{sign}(g^t)],$$

so that adversarial updates are implicitly regularized by the diffusion prior rather than driven purely in pixel space (Xue et al., 2023).

A different variant injects adversariality directly into latent trajectories. In AEGIS, the deterministic DDIM step is perturbed as

$x^*_{t-1} = x_{t-1} + \delta_t,$

with $\delta_t = \alpha G(g_1,g_2)$ in white-box settings, where $g_1$ comes from a manipulation-disruption loss and $g_2$ from a fidelity term, or from an NES estimate in black-box settings (Li et al., 2 Apr 2026). The physically deployable monocular-depth attack extends this idea with Jacobian Vector Product Guidance, replacing a raw adversarial direction $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$0 by $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$1, thereby aligning updates with directions supported by the pretrained diffusion score field (Chen et al., 30 Dec 2025).

Finally, AGD can target internal modules rather than latents or pixels. ASAG constructs an adversarially weakened denoiser $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$2 by replacing selected self-attention maps with Sinkhorn transport plans derived from the adversarial cost $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$3, and then guides sampling via

$x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$4

using the contrast between the original and degraded denoiser as the guidance signal (Kim, 10 Nov 2025).

3. Representative instantiations across domains

Domain	Representative method	Core mechanism
Digital and physical natural adversarial images	Diff-PGD (Xue et al., 2023)	PGD through SDEdit-denoised samples
Unrestricted adversarial example generation	AdvDiff (Dai et al., 2023)	Per-step and noise-prior classifier guidance in reverse diffusion
Adversarial purification	GDMP (Wang et al., 2022), AGDM (Lin et al., 2024)	Guided denoising to preserve semantics while removing perturbations
Visually-aware recommenders	IPDGI (Chen et al., 2023)	Feature-alignment perturbation fused with diffusion noise and content-guided denoising
Clinical detector hard negatives	DADA (Zhou et al., 22 Jun 2025)	Detector-guided perturbations during negative-centric diffusion sampling
Deepfake and identity protection	AEGIS (Li et al., 2 Apr 2026), Adv-TGD (Ahmadieh et al., 10 Jun 2026)	Latent-space DDIM injection or per-pair LoRA optimization under identity losses
Multimodal LLM attacks	AGD for MLLMs (Xia et al., 31 Jul 2025)	Target semantics injected into the noise component of reverse diffusion
Safety-critical environments and RL	AdvDiffuser (Xie et al., 2024), SHIFT (Sun et al., 10 Nov 2025)	Reward/Q-guided scenario or state generation under diffusion priors
Reliable diffusion sampling	ASAG (Kim, 10 Nov 2025)	Adversarial Sinkhorn attention as an undesirable path for contrastive guidance
Physical monocular depth attacks	Guided adversarial objects (Chen et al., 30 Dec 2025)	Inpainting diffusion with saliency-based placement and JVP-guided adversarial updates

These instantiations show that AGD is not confined to image classification. In recommender systems, IPDGI manipulates visual features so that long-tail items are promoted while remaining close to the benign item-image manifold (Chen et al., 2023). In medical detection, DADA trains a background-only diffusion model and then perturbs the denoising trajectory to synthesize hard false positives that improve robustness of polyp detectors (Zhou et al., 22 Jun 2025). In autonomous-driving simulation, AdvDiffuser combines an offline diffusion prior over multi-agent behavior with a lightweight reward/Q guide to generate safety-critical but plausible traffic scenarios (Xie et al., 2024). In vision-based reinforcement learning, SHIFT uses a history-conditioned diffusion model, Q-guidance, and an autoencoder realism term to generate semantically altered yet history-aligned observations that bypass strong defenses (Sun et al., 10 Nov 2025).

4. Empirical behavior and performance

A recurring empirical pattern is that diffusion priors improve stealthiness and transferability relative to direct gradient attacks. Diff-PGD reports that its perturbations are smoother, local-structure-aware, and visually natural; on 250 ImageNet images it reaches high success with modest iterations, improves transfer from ResNet-50 to ResNet-18/101 and WRN-50/101, and yields substantially stronger post-purification success than PGD, including $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$5ResNet-50 success rates of PGD 0.35 versus $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$6 0.88 versus $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$7 0.72 at $x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$8. A survey with 87 participants judged Diff-PGD adversarial images more realistic than PGD’s (Xue et al., 2023).

In purification, guided diffusion defenses show that adversarially informed denoising can materially increase robustness. GDMP reports 90.1% robust accuracy under PGD attack on CIFAR-10 (Wang et al., 2022). The related guided purification-from-random-noise formulation reports 89.62% robust accuracy under PGD-$x^*_{t-1} = x_{t-1} + \sigma_t^2 s g_{t-1},$9 attack on CIFAR-10 and outperforms randomized smoothing by 5% when the certified $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$0 radius $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$1 is larger than 0.5 (Wu et al., 2022). AGDM further reports that robust latent guidance improves average robust accuracy by up to 7.30% on CIFAR-10 (Lin et al., 2024).

In applied domains, AGD is frequently used to create hard, realistic, high-value adversarial content rather than merely increase attack success on a fixed victim. DADA improves detector F1-score by at least 2.6% on Kvasir and 2.7% on the in-house dataset over baselines, while the ablation shows that BG-De plus DADA outperforms either component alone (Zhou et al., 22 Jun 2025). IPDGI achieves large fidelity gains over a prior recommender attack, reducing FID on Amazon Beauty from 114.55 to 14.25 and on Amazon Baby from 265.48 to 22.54, while also improving long-tail exposure rates such as VBPR Beauty ER@5 from 0.0095 to 0.0149 (Chen et al., 2023).

For proactive defense and multimodal attacks, the literature emphasizes both efficacy and robustness to post-processing. In white-box and black-box deepfake defense, AEGIS reports Arc2Face black-box results of DSR 100%, ID sim 0.070, L1 0.266, PSNR 32.0 dB, and SSIM 0.831, alongside strong performance against GAN editors and face swapping (Li et al., 2 Apr 2026). In multimodal LLM attacks, AGD reports targeted ASR values of 95.4% on UniDiffuser, 89.4% on BLIP-2, 41.8% on LLaVA-1.5, 88.0% on MiniGPT-4, and 30.5% on Qwen2-VL, while maintaining better robustness under defenses such as JPEG, SOAP, DiffPure, and MimicDiffusion than the stated baselines (Xia et al., 31 Jul 2025).

Physical deployment results further distinguish AGD from purely digital perturbation methods. The monocular-depth attack based on guided diffusion reports digital and physical MRSR values of 0.21 and 0.18 for the cyclist case, 0.55 and 0.42 for the pedestrian case, and 0.14 and 0.11 for the vehicle case, showing that object-level generative attacks can remain effective after printing and deployment (Chen et al., 30 Dec 2025).

5. Relation to neighboring paradigms and common misconceptions

A common misconception is that AGD always means classifier-guided diffusion. Diff-PGD is explicit that it is not modifying the denoiser $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$2 or injecting classifier gradients into the reverse sampler; it evaluates adversarial loss at a denoised point and backpropagates through the fixed denoiser, which places it in the “diffusion-guided adversarial optimization” category rather than in classifier-guided diffusion sampling (Xue et al., 2023). AEGIS is explicit in the opposite direction: it states that it combines both diffusion-guided adversarial and adversarial-guided diffusion, since perturbations are formed along the DDIM trajectory while the direction of the trajectory is chosen by adversarial gradients or NES estimates (Li et al., 2 Apr 2026).

A second misconception is that AGD is only an offensive attack framework. Purification systems such as GDMP and the guided-diffusion-from-random-noise purifier also use adversarially informed guidance, but for defense: they submerge perturbations with diffusion noise and then guide denoising so that semantic content is retained while adversarial artifacts are discarded (Wang et al., 2022, Wu et al., 2022). Operationally, this is different from generating a new adversarial sample, even though both settings employ mean-shifted reverse transitions.

NatADiff introduces a third distinction by arguing that many real-world failures resemble natural adversarial examples containing structural elements from the adversarial class. Its adversarial boundary guidance therefore targets the intersection between the true and adversarial classes, rather than simply maximizing the score of a target class, and reports higher transferability and better alignment with natural test-time errors as measured by FID-A (Collins et al., 27 May 2025). This suggests a boundary-centered variant of AGD that is neither standard targeted generation nor purification.

Finally, the acronym itself remains contested. In AGD-MBRL, AGD means “Advantage-Guided Diffusion,” not adversarial-guided diffusion, even though the formal mechanism again modifies reverse diffusion with an auxiliary guidance signal (Foffano et al., 10 Apr 2026). The shared acronym should therefore not be read as a guarantee of shared adversarial semantics.

6. Limitations, ambiguity, and open problems

Computational overhead is the most persistent limitation. Diff-PGD reports that naive backpropagation through $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$3 reverse denoising steps takes approximately 7–10 sec/sample on a single RTX A6000 for $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$4 and $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$5–3, while a Jacobian approximation halves runtime and reduces VRAM by about 75% to about 4 GB (Xue et al., 2023). AEGIS notes that black-box NES guidance costs $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$6 queries per step and scales as $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$7 queries, making offline protection plausible but query-efficient deployment still nontrivial (Li et al., 2 Apr 2026). The monocular-depth object attack adds both a backward pass for $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$8 and a JVP for each diffusion step, making JVPG materially more expensive than plain conditional sampling (Chen et al., 30 Dec 2025).

AGD methods are also highly dependent on surrogate models, priors, and schedules. Diff-PGD states that a mismatched denoiser weakens realism guidance and that poorly chosen $$g_{t-1} = \nabla_x \log p_f(y_a \mid x)\big|_{x=x_{t-1}},$$9 or DDIM schedules can under- or over-smooth (Xue et al., 2023). NatADiff reports that excessively large $$\hat{\epsilon}(z_t, t) = \epsilon_{\theta^*}(z_t, t) + (\omega - \mu \omega) v_y + \mu \rho v_{y \cap y_{adv}} - s \beta(t) \tilde{g}(z_t),$$0 can produce dual-class or flipped-class samples, while overly strong $$\hat{\epsilon}(z_t, t) = \epsilon_{\theta^*}(z_t, t) + (\omega - \mu \omega) v_y + \mu \rho v_{y \cap y_{adv}} - s \beta(t) \tilde{g}(z_t),$$1 can harm fidelity (Collins et al., 27 May 2025). ASAG notes that very small $$\hat{\epsilon}(z_t, t) = \epsilon_{\theta^*}(z_t, t) + (\omega - \mu \omega) v_y + \mu \rho v_{y \cap y_{adv}} - s \beta(t) \tilde{g}(z_t),$$2 or overly large guidance scale $$\hat{\epsilon}(z_t, t) = \epsilon_{\theta^*}(z_t, t) + (\omega - \mu \omega) v_y + \mu \rho v_{y \cap y_{adv}} - s \beta(t) \tilde{g}(z_t),$$3 can over-flatten attention and reduce diversity (Kim, 10 Nov 2025).

Several works also expose structural trade-offs rather than merely implementation difficulty. SHIFT formulates a trilemma in which an attack can optimize at most two of semantic change, history alignment, and trajectory faithfulness; SHIFT-O prioritizes semantic change and trajectory faithfulness, whereas SHIFT-I prioritizes semantic change and history alignment (Sun et al., 10 Nov 2025). DADA warns that synthesized false positives can overfit to the guiding detector and that label integrity still requires quality assurance, even with background-only diffusion training and inpainting (Zhou et al., 22 Jun 2025).

The literature also raises unresolved theoretical questions. AEGIS identifies efficient zeroth-order estimators with lower query complexity and cross-model consistency as open research directions (Li et al., 2 Apr 2026). The depth-estimation attack suggests that geometry-aware JVP guidance can align adversarial directions with score-supported directions, but the paper does not provide a formal robustness characterization for that alignment (Chen et al., 30 Dec 2025). More broadly, the coexistence of offensive, defensive, and reliability-oriented AGD variants suggests that future work will likely continue to move away from a narrow “attack generator” view and toward a more general interpretation of adversarial objectives as one class of sampling-time controls over diffusion dynamics.