Research map / Adversarial robustness and security / Attacks on text and graphs
Exploring Semantic-constrained Adversarial Example with Instruction Uncertainty Reduction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes InsUR, a multi-dimensional instruction-uncertainty-reduction framework (ResAdv-DDIM sampler, context-encoded scenario constraints, label-taxonomy evaluation) for generating transferable semantically constrained 2D and 3D adversarial examples from natural language.
Problem
Generating semantically constrained adversarial examples directly from natural language instructions is hard because instructions carry referring diversity, descriptive incompleteness, and boundary ambiguity, which hurt transferability and make generator evaluation unclear.
Approach
A ResAdv-DDIM sampler that predicts a coarse future x0 via a few DDIM steps so adversarial gradients are estimated at the current latent more accurately, combined with guidance masking, Gaussian-splatting renderer integration for 3D, and a WordNet-based abstracted-label evasion benchmark with a relative ASR metric.
Key results
- Under the ResNet50 surrogate on the abstracted label task, InSUR reaches 47.9% average ASR versus 34.9% for the best baseline (VENOM) at eps=2.5.
- The 3D SemanticAE generator reaches 92.2% ASR versus 45.1% without ResAdv, with accuracy dropping from 17.9% to 2.8%.
- Adding ResAdv-DDIM (K=3) raises relative ASR on VQA/CLIP transfer targets, e.g., LLaVA-1.5-7B from 11.11% to 22.22%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use InSUR instead of MI-FGSM | ImageNet Label SemanticAE Generation Task with ResNet50 surrogate · ImageNet Label SemanticAE Generation Task | average ASR: 58.8% -> 62.0% | Helped |
| Use InSUR instead of MI-FGSM | Coarse Label Evasion Task with ResNet50 surrogate · Coarse Label Evasion Task | average ASR: 34.9% -> 47.9% | Helped |
| Add ResAdv-DDIM to the 3D generator (ablation) | 3D SemanticAE generation · 3D SemanticAE generation | ASR: 45.1% -> 92.2% | Helped |
| Add residual approximation (K = 3) (ablation) | CLIP RN50 VQA transfer attack · VQA transfer attack, target LLaVa1.5-7B | ASR relative: 11.11 -> 22.22 | Helped |
| Increase residual approximation upper bound from K = 0 to K = 4 (ablation) | ViT-B surrogate on Coarse Label Evasion Task · Coarse Label Evasion Task | average ASR: 43.3% -> 60.1% | Helped |
| Increase residual approximation upper bound from K = 0 to K = 4 (ablation) | ResNet50+DeCoWa surrogate on Coarse Label Evasion Task · Coarse Label Evasion Task | average ASR: 47.1% -> 54.2% | Helped |
| Increase residual approximation upper bound from K = 0 to K = 4 (ablation) | 3D SemanticAE generation · 3D SemanticAE generation | ASR: 45.1% -> 92.2% | Helped |
| Apply guidance masking (M_edge/M_mid = 0.0) instead of no masking (1.0) (ablation) | Coarse Label Evasion Task with ε=2 · Coarse Label Evasion Task, ε=2 | average ASR: 48.3% -> 52.3% | Helped |
| Apply guidance masking (M_edge/M_mid = 0.0) instead of no masking (1.0) (ablation) | Coarse Label Evasion Task with ε=4 · Coarse Label Evasion Task, ε=4 | average ASR: 75.9% -> 75.9% | No clear effect |
Surprising findings
- Generated 3D adversarial examples retain clean-accuracy degradation only partly; the paper notes that low clean accuracy on generated 3D samples limits the setting.
- Reducing the guidance mask edge value increases background diversity but gives only marginal gains at large epsilon.
Limitations
- Generation quality and naturalness leave room for improvement.
- Evaluation is limited to comparatively small target models and not larger frontier systems.
- Real-world applicability of the attacks is not established.
Experimental setup
Datasets: ImageNet WordNet
Benchmarks: ImageNet 1000-class label evasion abstracted label evasion task
Metrics: ASR_Relative accuracy LPIPS MS-SSIM CLIP-IQA
Baselines: MI-FGSM DeCoWA AdvDiff SD-NAE VENOM
Builds on: DDIM MI-FGSM AdvDiff SD-NAE Trellis
Closest papers by meaning
- Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspective (NeurIPS 2024 · similarity 0.87)
- Semantic Representation Attack against Aligned Large Language Models (NeurIPS 2025 · similarity 0.87)
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (NeurIPS 2025 · similarity 0.86)
- REINFORCE Adversarial Attacks on Large Language Models: An Adaptive, Distributional, and Semantic Objective (ICML 2025 · similarity 0.86)
- Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · similarity 0.85)
- Mutual-Modality Adversarial Attack with Semantic Perturbation (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.