Research map / Adversarial robustness and security / Attacks on text and graphs
Unrestricted Adversarial Examples via Semantic Manipulation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use semantic colorization perturbations instead of small norm-bounded perturbations | ImageNet classifiers · ImageNet, white-box target attack | target attack success rate: 99.78 | Helped |
| transfer colorization perturbations across models | Color attack (k=4) · ImageNet transfer to VGG19 | target attack success rate: 31.00 | Mixed |
| add texture transfer from a target-class image | Texture attack · ImageNet, JPEG75 | misclassification rate: 32.89 | Helped |
| increase texture-transfer iterations from one to three (ablation) | Texture attack (α=250) · ImageNet, JPEG75 | misclassification rate: 32.89 -> 36.33 | Helped |
| increase texture-transfer iterations from one to three (ablation) | Texture attack (α=250) · ImageNet, adversarially trained ResNet152 | misclassification rate: 2.10 -> 4.6 | Helped |
| remove the adversarial cross-entropy loss (ablation) | Texture attack (α=250) · ImageNet, white-box target attack | target attack success rate: 25.00 | Hurt |
| use a random texture source rather than a nearest target-class source (ablation) | Texture attack · ImageNet, white-box target attack | target attack success rate: 99.67; 97.99 | No clear effect |
| use a nearest target-class texture source rather than a random source (ablation) | Texture attack · ImageNet, visual realism | photorealism | Helped |
| increase color hints from 25 to 50 (ablation) | Color attack (k=4) · ImageNet, white-box target attack | target attack success rate: 99.78; 99.78 | No clear effect |
| increase color hints from 50 to 100 (ablation) | Color attack (k=4) · ImageNet, white-box target attack | target attack success rate: 99.78 -> 99.44 | Hurt |
| increase the number of color clusters represented by hints (ablation) | Color attack · ImageNet, defense robustness | misclassification rate: 52.33; 46.61; 42.61; 38.22 | Hurt |
| increase texture weight α (ablation) | Texture attack · ImageNet, defense robustness | misclassification rate: 32.89; 31.49 | Mixed |
Closest papers by meaning
- Content-based Unrestricted Adversarial Attack (NeurIPS 2023 · similarity 0.89)
- ColorFool: Semantic Adversarial Colorization (CVPR 2020 · similarity 0.88)
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · similarity 0.88)
- Generative Adversarial Perturbations (CVPR 2018 · similarity 0.88)
- Connecting the Digital and Physical World: Improving the Robustness of Adversarial Attacks (AAAI 2019 · similarity 0.88)
- Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.