Robust and Stealthy Traffic Sign Adversarial Attacks via Diffusion-Augmented I-FGSM

Conventional adversarial perturbations on traffic sign images often induce noticeable color shifts and abnormal contrast compared to natural images, rendering them susceptible to detection, particularly by Vision Transformers (ViTs). To address this, we propose the diffusion-augmented iterative fast gradient sign method (Diff-I-FGSM). Our method leverages diffusion priors to constrain perturbations within the inherent traffic sign manifold, thereby significantly enhancing both stealth and robustness. As a flexible framework, Diff-I-FGSM is inherently compatible with the family of Fast Gradient Sign Methods(FGSM). Beyond the vanilla version, we have further developed and validated extended variants incorporating momentum-based updates and diverse input strategies. Extensive evaluations on the TSRD dataset across various CNN and ViT architectures demonstrate that Diff-I-FGSM, along with its momentum-based and diverse-input variants, consistently achieves superior performance over five baseline attacks. Under white-box settings, our methods reach near-perfect attack success rates while significantly outperforming baselines in perceptual invisibility and structural similarity. Crucially, while ensuring high visual imperceptibility, our method demonstrates exceptional robustness against a spectrum of adversarial defenses, including JPEG compression, bit-depth reduction, and adversarial training. This indicates that diffusion-driven perturbations are not only stealthy but also highly robust to image processing and defensive transformations. Furthermore, our framework exhibits inherent transferability and, more importantly, provides consistent performance gains across the FGSM-family of attacks.