Research map / Adversarial robustness and security / Black-box and transfer attacks
Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use realistic semantic-class color distributions with neighborhood search and initialization reset | NCF · ImageNet-compatible Dataset; VGG-19, Res-18 substitute | attack success rate (%): 46.9 -> 72.1 | Helped |
| add neighborhood search (ablation) | NCF without neighborhood search · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%): 66.1* -> 83.8* | Helped |
| add initialization reset (ablation) | NCF without initialization reset · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%): 70.5* -> 83.8* | Helped |
| add both neighborhood search and initialization reset (ablation) | NCF without either technique · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%): 51.6* -> 83.8* | Helped |
| add the class-rich color distribution library (M=150 rather than M=0) (ablation) | NCF · ImageNet-compatible Dataset; Res-18, Inc-v3 substitute | attack success rate (%): 24.6% -> 57.7% | Helped |
| increase the number of initialization resets up to K=10 (ablation) | NCF · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%) | Helped |
| increase initialization resets beyond K=10 (ablation) | NCF · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%) | No clear effect |
| replace Swin-T segmentation with OCRNet (ablation) | NCF · ImageNet-compatible Dataset; VGG-19, Inc-v3 substitute | attack success rate (%): 72.1 -> 69.1 | Hurt |
| replace Swin-T segmentation with Deeplabv3+ (ablation) | NCF · ImageNet-compatible Dataset; VGG-19, Inc-v3 substitute | attack success rate (%): 72.1 -> 68.0 | Hurt |
| use an ensemble of Res-18, VGG-19, and Mobile-v2 substitutes | NCF · ImageNet-compatible Dataset; Dense-121 | attack success rate (%): 55.3 -> 63.5 | Helped |
| select color distributions using substitute-model loss instead of choosing random colors (ablation) | NCF-IR-NS · ImageNet-compatible Dataset; Inc-v3 white-box | attack success rate (%): 27.3 -> 51.6 | Helped |
| use neighborhood search (ablation) | NCF-IR · ImageNet-compatible Dataset; human perception | perceptual image quality | No clear effect |
Closest papers by meaning
- ColorFool: Semantic Adversarial Colorization (CVPR 2020 · similarity 0.91)
- Content-based Unrestricted Adversarial Attack (NeurIPS 2023 · similarity 0.86)
- Color Backdoor: A Robust Poisoning Attack in Color Space (CVPR 2023 · similarity 0.86)
- Simple Black-box Adversarial Attacks (ICML 2019 · similarity 0.86)
- Secret Lies in Color: Enhancing AI-Generated Images Detection with Color Distribution Analysis (CVPR 2025 · similarity 0.84)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.