Constructing Unrestricted Adversarial Examples with Generative Models

2018/05/21 by Yang Song, Song, Yang, Rui Shu +5 · 1 voice · 126 citations
Computer Science · Mathematics · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Adversarial system #Artificial intelligence #Computer science #Generative grammar #Physical Unclonable Functions (PUFs) and Hardware Security #cs.AI #cs.CR #cs.CV #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1805.07894

published in arXiv (Cornell University) (Cornell University) · Neural Information Processing Systems (NeurIPS 2018)

openalex publication_date 2018/05/21 · arxiv created 2018/12/02 · arxiv updated 2018/12/04 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Adversarial examples are typically constructed by perturbing an existing data point within a small matrix norm, and current defense methods are focused on guarding against this type of attack. In this paper, we propose unrestricted adversarial examples, a new threat model where the attackers are not restricted to small norm-bounded perturbations. Different from perturbation-based attacks, we propose to synthesize unrestricted adversarial examples entirely from scratch using conditional generative models. Specifically, we first train an Auxiliary Classifier Generative Adversarial Network (AC-GAN) to model the class-conditional distribution over data samples. Then, conditioned on a desired class, we search over the AC-GAN latent space to find images that are likely under the generative model and are misclassified by a target classifier. We demonstrate through human evaluation that unrestricted adversarial examples generated this way are legitimate and belong to the desired class. Our empirical results on the MNIST, SVHN, and CelebA datasets show that unrestricted adversarial examples can bypass strong adversarial training and certified defense methods designed for traditional adversarial attacks.

Citations

• Conditional Image Synthesis With Auxiliary Classifier GANs
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certifying Some Distributional Robustness with Principled Adversarial Training

Cited by

• Worst-case generation via minimax optimization in Wasserstein space
• DPAC: Distribution-Preserving Adversarial Control for Diffusion Sampling
• Rigorous Agent Evaluation: An Adversarial Approach to Uncover Catastrophic Failures
• Universal Adversarial Attacks with Natural Triggers for Text Classification
• Natural Adversarial Examples
• On Evaluating Adversarial Robustness
• Rethinking Inter-LoRA Orthogonality in Adapter Merging: Insights from Orthogonal Monte Carlo Dropout
• PolyJuice Makes It Real: Black-Box, Universal Red Teaming for Synthetic Image Detectors
• Deep Verifier Networks: Verification of Deep Discriminative Models with Deep Generative Models
• TAIGen: Training-Free Adversarial Image Generation via Diffusion Models
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Evading Data Provenance in Deep Neural Networks
• Variational Autoencoder-Based Black-Box Adversarial Attack on Collaborative DNN Inference
• Stovepiping and Malicious Software: A Critical Review of AGI Containment
• The Limitations of Adversarial Training and the Blind-Spot Attack
• GAP++: Learning to generate target-conditioned adversarial examples
• SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples
• ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
• A Systematical Solution for Face De-identification
• Concept-based Adversarial Attack: a Probabilistic Perspective
• Boosting Generative Adversarial Transferability with Self-supervised Vision Transformer Features
• Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Unrestricted Adversarial Examples via Semantic Manipulation
• Poisoning Behavioral-based Worker Selection in Mobile Crowdsensing using Generative Adversarial Networks
• Testing Robustness Against Unforeseen Adversaries
• NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion
• Transferable Sparse Adversarial Attack
• Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection
• SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Models

Discussions

• Generative Adversarial Examples [pdf] [hn, 79 points, 1 comments]

Related

• Customizing an Adversarial Example Generator with Class-Conditional GANs
• AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examples
• Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Generating Unrestricted Adversarial Examples via Three Parameters