Research map / Adversarial robustness and security / Attacks on text and graphs
Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a probabilistic view of adversarial examples as the product of a victim distribution and a data-driven distance distribution (EBM or fine-tuned diffusion model), yielding semantics-aware adversarial examples that evade adversarial defenses and remain hard for humans to detect.
Problem
Generating adversarial examples that preserve semantics while making large pixel-level changes, so they transfer to black-box models and evade adversarial defenses, with a principled way to encode semantic similarity instead of L_p distances.
Approach
Treat adversarial examples as samples from a product of a victim distribution exp(-c f) and a distance distribution p_dis learned by a probabilistic generative model (EBM trained on transformed copies of the image, or a diffusion model fine-tuned on the single original image), and sample with Langevin dynamics or a victim-guided diffusion sampler.
Key results
- On MNIST against adversarially trained MadryNet (white-box), the method reaches 100.0% success versus 25.3% for PGD, and 39.2% vs 10.7% against the certified defense.
- On ImageNet, the method's average success across transferability and defense lines is 51.6% (c=5), 55.9% (c=10), 59.6% (c=20), versus 66.2% for NCF, which is the highest but is easily detected by humans.
- Human annotators identify the original class in MNIST examples only 92.6% of the time for the proposed method (highest among methods), and the ImageNet human-annotation success rate is 31.2% (c=5) versus 2.6% for NCF.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace geometric-distance distribution with a semantics-aware EBM trained on image transformations | MNIST attacks · MNIST MadryNet Adv white-box | success rate (%): 30.2 -> 100.0 | Helped |
| replace geometric-distance distribution with a semantics-aware EBM trained on image transformations | MNIST attacks · MNIST MadryNet noAdv transferability | success rate (%): 17.4 -> 61.4 | Helped |
| replace geometric-distance distribution with a semantics-aware EBM trained on image transformations | MNIST attacks · MNIST Certified Def defense | success rate (%): 20.8 -> 39.2 | Helped |
| replace geometric-distance distribution with a semantics-aware EBM trained on image transformations | MNIST attacks · MNIST Human Anno. | success rate (%): 90.1 -> 92.6 | Helped |
| increase the ImageNet guidance parameter from c=5 to c=10 (ablation) | OURS · ImageNet transferability and defense average | success rate (%): 51.6 -> 55.9 | Helped |
| increase the ImageNet guidance parameter from c=10 to c=20 (ablation) | OURS · ImageNet transferability and defense average | success rate (%): 55.9 -> 59.6 | Helped |
| increase the ImageNet guidance parameter from c=5 to c=20 (ablation) | OURS · ImageNet Human Anno. | success rate (%): 31.2 -> 25.4 | Hurt |
| increase the ImageNet guidance parameter from c=5 to c=20 (ablation) | OURS · ImageNet ResNet50 white-box | success rate (%): 84.5 -> 91.3 | Helped |
| increase the ImageNet guidance parameter from c=5 to c=20 (ablation) | OURS · ImageNet overall attack success and human detectability | success rate (%): Average 51.6 -> 59.6; Human Anno. 31.2 -> 25.4 | Mixed |
| use semantics-aware fine-tuned diffusion attacks instead of NCF | ImageNet attacks · ImageNet transferability and defense average | success rate (%): 66.2 -> 59.6 | Hurt |
| use semantics-aware fine-tuned diffusion attacks instead of NCF | ImageNet attacks · ImageNet Human Anno. | success rate (%): 2.6 -> 31.2 | Helped |
Surprising findings
- On ImageNet, NCF achieves the highest attack and transferability success rates but is the most easily detected by humans (2.6% human-annotation success), so the proposed method trades some attack strength for stealth.
Limitations
- Requires training or fine-tuning a generative model for each original image, which is time-consuming.
- On ImageNet, the attack success rate is lower than NCF and several baselines in white-box and transfer settings.
- Uses rejection sampling and manual-like sample refinement, so white-box success of 100% on MNIST is partly due to selection.
Experimental setup
Datasets: MNIST ImageNet
Benchmarks: MNIST ImageNet
Metrics: attack success rate human annotation success rate transferability success rate
Baselines: PGD ProbCW stAdv NCF cAdv ACE ColorFool
Builds on: Carlini-Wagner attack PSGLA Improved DDPM Tweedie's formula ACE
Closest papers by meaning
- Concept-based Adversarial Attack: a Probabilistic Perspective (ICLR 2026 · similarity 0.90)
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · similarity 0.89)
- One Man's Trash Is Another Man's Treasure: Resisting Adversarial Examples by Adversarial Examples (CVPR 2020 · similarity 0.88)
- Unrestricted Adversarial Examples via Semantic Manipulation (ICLR 2020 · similarity 0.88)
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (ICML 2018 · similarity 0.88)
- Exploring Semantic-constrained Adversarial Example with Instruction Uncertainty Reduction (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.