ComfyUI AdversarialAttack

A ComfyUI custom node set that generates adversarial examples using a pretrained ResNet18 classifier. Given an input image, the nodes produce a visually similar output image that is misclassified as a different ImageNet class.

Example: A tabby cat image is fed into the node. After FGSM perturbation (ε = 0.03), ResNet18 classifies the output as bald eagle while the image remains visually identical to the original.

Nodes

1. Load ResNet18

Loads a ResNet18 model with optional ImageNet pretrained weights.

Parameter	Type	Description
pretrained	Enum	pretrained — ImageNet weights; random — randomly initialized

Output: RESNET_MODEL

---

2. Adversarial Attack (FGSM/PGD)

Applies an adversarial perturbation to the input image so that ResNet18 predicts a class different from the original.

Parameter	Type	Default	Description
model	RESNET_MODEL	—	ResNet18 from Load ResNet18
image	IMAGE	—	Input image
attack_method	Enum	FGSM	FGSM or PGD
epsilon	Float	0.03	Maximum perturbation magnitude (L∞ norm, pixel space)
iterations	Int	40	Number of PGD steps (ignored for FGSM)
alpha	Float	0.007	Per-step size for PGD
target_class	Int	-1	-1 = untargeted; 0–999 = force prediction toward this ImageNet class
resize_to_224	Bool	True	Resize image to 224×224 before inference

Outputs:

Name	Type	Description
adversarial_image	IMAGE	Perturbed image (same spatial size as input)
original_class_name	STRING	Predicted class of the original image
adversarial_class_name	STRING	Predicted class of the adversarial image
original_class_idx	INT	ImageNet index of original prediction
adversarial_class_idx	INT	ImageNet index of adversarial prediction

---

3. Classify Image (ResNet18)

Runs ResNet18 inference and returns the Top-K predictions. Useful for verifying results before and after an attack.

Parameter	Type	Default	Description
model	RESNET_MODEL	—	ResNet18 from Load ResNet18
image	IMAGE	—	Image to classify
top_k	Int	5	Number of top predictions to return
resize_to_224	Bool	True	Resize image to 224×224 before inference

Output: STRING — ranked list of class names and confidence scores.

---

Attack Methods

FGSM (Fast Gradient Sign Method)

Single-step attack (Goodfellow et al., 2014):

x_adv = x + ε · sign(∇ₓ L(f(x), y))

Fast but relatively weak. Good for quick experiments.

PGD (Projected Gradient Descent)

Iterative attack (Madry et al., 2017):

x⁰   = x + Uniform(−ε, ε)
xᵗ⁺¹ = Proj_{B(x,ε)} [ xᵗ + α · sign(∇ₓ L(f(xᵗ), y)) ]

Stronger than FGSM. Increase iterations and tune alpha for harder attacks.

---

Suggested Workflow

[Load Image] ──────────────────────────────────────────┐
                                                        ▼
[Load ResNet18] ──► [Adversarial Attack] ──► [Preview Image]
                            │
                            ├──► original_class_name
                            └──► adversarial_class_name

Add Classify Image nodes on both the original and adversarial images to compare predictions side by side.

---

Installation

1. Copy (or symlink) this folder into your ComfyUI custom_nodes/ directory:

   cp -r ComfyUI_AdversarialAttack /path/to/ComfyUI/custom_nodes/
   

2. Install dependencies:

   pip install torch torchvision
   

3. Restart ComfyUI. The three nodes will appear under the AdversarialAttack category.

---

Requirements

Package	Version
Python	≥ 3.9
PyTorch	≥ 2.0
torchvision	≥ 0.15

---

Tips

• Attack failed (same class)? Increase epsilon (e.g. 0.1) or switch from FGSM to PGD with more iterations.
• Targeted attack: Set target_class to any ImageNet class index (0–999) to steer the prediction toward a specific class.
• Perturbation visibility: Larger epsilon values produce stronger attacks but more visible noise. Values around 0.01–0.05 are typically imperceptible.
• GPU support: The attack runs on whatever device the model is on. Move the model to GPU before connecting it to the attack node for faster PGD.

---

References

• Goodfellow et al. (2014) — Explaining and Harnessing Adversarial Examples
• Madry et al. (2017) — Towards Deep Learning Models Resistant to Adversarial Attacks