DAPGen: Efficient Diffusion-based Adversarial Patch Generation with Discrete Wavelet Transform

Deep neural networks (DNNs) are currently widely applied across multiple fields. However, they still exhibit significant Security vulnerabilities—adversarial attacks can induce erroneous outputs through meticulously engineered perturbations, thereby posing a direct threat to the reliability of AI in security-sensitive contexts. Research on adversarial attacks serves as a crucial means to assess the robustness of deep neural networks (DNNs). However, existing studies, particularly in the domain of natural adversarial patch generation, encounter two fundamental limitations. On one hand, achieving a balance between attack effectiveness and visual naturalness proves challenging: current methods either prioritize high attack success rates, resulting in patches that exhibit conspicuous artificial noise or semantic conflicts easily recognizable by human observers or defense systems; or they overly emphasize naturalness, which significantly diminishes the patches’ capacity to disrupt target models and ultimately fails to effectively circumvent model defenses. On the other hand, computational and temporal costs remain excessively high: most advanced generation techniques rely on complex deep learning architectures or extensive iterative optimization processes that demand substantial computing power and time. This makes them ill-suited for meeting the requirements of rapid attack testing in practical scenarios. To address these challenges, we propose a customizable adversarial patch generation method that integrates discrete wavelet transform (DWT) constraints with a lightweight diffusion model. Our approach first employs a lightweight diffusion model enhanced by block pruning and feature distillation as its foundation for image reconstruction. By optimizing intermediate latent representations within this framework, we reduce computational demands while enhancing generation efficiency. Simultaneously, we introduce discrete wavelet transform as a naturalness constraint to strike an optimal balance between the patch’s attack effectiveness and visual authenticity within the frequency domain. Experimental results on the INRIA dataset demonstrate that, compared with the existing DiffPatch method on the YOLOv5s model, the proposed method achieves a 6.2% increase in attack success rate, a 9% decrease in average precision (AP), and nearly identical structural similarity (SSIM) metrics. These results verify that the proposed method maintains naturalness while achieving superior attack performance and generation efficiency.