Hi, dear author,

I want to ask for you about some details in your code. Your paper aims to attack diffusion model using loss function L_DM. I think this idea is very novel, but when I check this technique in your code, I have a confusing question. Why your attacking code utilize the labels with 0 tensor as follow:

label = torch.zeros(data_source.shape).to(device)
print(net(data_source, components=True))

# Targeted PGD attack is applied.
attack = LinfPGDAttack(net, fn, epsilon, steps, eps_iter=alpha, clip_min=-1.0, targeted=True)
attack_output = attack.perturb(data_source, label, mask=mask)
print(net(attack_output, components=True))

I guess this process should be your core attacking technique, but this code might be a little different from the algorithm in your paper.

Could you help me with an explanation? I am looking forward to your reply and thanks a lot.