  Unrestricted adversarial attacks typically manipulate the semantic content of
an image (e.g., color or texture) to create adversarial examples that are both
effective and photorealistic, demonstrating their ability to deceive human
perception and deep neural networks with stealth and success. However, current
works usually sacrifice unrestricted degrees and subjectively select some image
content to guarantee the photorealism of unrestricted adversarial examples,
which limits its attack performance. To ensure the photorealism of adversarial
examples and boost attack performance, we propose a novel unrestricted attack
framework called Content-based Unrestricted Adversarial Attack. By leveraging a
low-dimensional manifold that represents natural images, we map the images onto
the manifold and optimize them along its adversarial direction. Therefore,
within this framework, we implement Adversarial Content Attack based on Stable
Diffusion and can generate high transferable unrestricted adversarial examples
with various adversarial contents. Extensive experimentation and visualization
demonstrate the efficacy of ACA, particularly in surpassing state-of-the-art
attacks by an average of 13.3-50.4% and 16.8-48.0% in normally trained models
and defense methods, respectively.
