Unrestricted Adversarial Examples via Semantic Manipulation

2019/04/12 by Anand Bhattad, Min Jin Chong, Bhattad, Anand +8 · 73 citations
Computer Science · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Adversarial system #Anomaly Detection Techniques and Applications #Artificial intelligence #Artificial neural network #Bounding overwatch #Closed captioning #Computer Vision and Pattern Recognition (cs.CV) #Computer science #Deep neural networks #Exploit #FOS: Computer and information sciences #Image (mathematics) #Machine learning #Norm (philosophy) #Pattern recognition (psychology) #Property (philosophy) #Theoretical computer science #cs.CV

paper · pdf · doi:10.48550/arxiv.1904.06347

published in arXiv (Cornell University) (Cornell University) · Accepted to ICLR 2020. First two authors contributed equally. Code: https://github.com/aisecure/Big-but-Invisible-Adversarial-Attack and Openreview: https://openreview.net/forum?id=Sye_OgHFwH

openalex publication_date 2019/04/12 · arxiv created 2020/03/20 · arxiv updated 2020/03/23 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Machine learning models, especially deep neural networks (DNNs), have been shown to be vulnerable against adversarial examples which are carefully crafted samples with a small magnitude of the perturbation. Such adversarial perturbations are usually restricted by bounding their L_p norm such that they are imperceptible, and thus many current defenses can exploit this property to reduce their adversarial impact. In this paper, we instead introduce "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors - color and texture - in order to generate effective and photorealistic adversarial examples. We show that these semantically aware perturbations are effective against JPEG compression, feature squeezing and adversarially trained model. We also show that the proposed methods can effectively be applied to both image classification and image captioning tasks on complex datasets such as ImageNet and MSCOCO. In addition, we conduct comprehensive user studies to show that our generated semantic adversarial examples are photorealistic to humans despite large magnitude perturbations when compared to other attacks.

Citations

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Auto-Encoding Variational Bayes
• On the limited memory BFGS method for large scale optimization
• Long Short-Term Memory
• Deep Neural Networks for Acoustic Modeling in Speech Recognition: The Shared Views of Four Research Groups
• ImageNet classification with deep convolutional neural networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Generating Adversarial Examples with Adversarial Networks
• Spatially Transformed Adversarial Examples
• Quantitative Evaluation of Style Transfer
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• Constructing Unrestricted Adversarial Examples with Generative Models
• Large Scale GAN Training for High Fidelity Natural Image Synthesis

Cited by

• AUV-Fusion: Cross-Modal Adversarial Fusion of User Interactions and Visual Perturbations Against VARS
• SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examples
• ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Models
• Concept-based Adversarial Attack: a Probabilistic Perspective
• Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation
• Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignment
• Towards Feature Space Adversarial Attack
• NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusion
• TRAIL: Transferable Robust Adversarial Images via Latent diffusion
• Towards Verifying Robustness of Neural Networks Against Semantic Perturbations
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protection
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• Defending Against Frequency-Based Attacks with Diffusion Models

Related

• Semantic Adversarial Examples
• Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity
• Generating Semantic Adversarial Examples via Feature Manipulation
• Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers
• ColorFool: Semantic Adversarial Colorization