mlsanityData to 7 Oct 2026

Unrestricted Adversarial Examples via Semantic Manipulation

arXiv 1904.06347 ↗First posted 12 Apr 2019cs.CVcited by 84

Not on the map. Why?

Abstract (arXiv)

Machine learning models, especially deep neural networks (DNNs), have been shown to be vulnerable against adversarial examples which are carefully crafted samples with a small magnitude of the perturbation. Such adversarial perturbations are usually restricted by bounding their Lp norm such that they are imperceptible, and thus many current defenses can exploit this property to reduce their adversarial impact. In this paper, we instead introduce "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors - color and texture - in order to generate effective and photorealistic adversarial examples. We show that these semantically aware perturbations are effective against JPEG compression, feature squeezing and adversarially trained model. We also show that the proposed methods can effectively be applied to both image classification and image captioning tasks on complex datasets such as ImageNet and MSCOCO. In addition, we conduct comprehensive user studies to show that our generated semantic adversarial examples are photorealistic to humans despite large magnitude perturbations when compared to other attacks.

Key facts. Cited by 84 papers in the map (data through 7 Oct 2026). First posted on arXiv 12 Apr 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 24; 2022: 18; 2023: 18; 2024: 12; 2025: 9; 2026: 3.

84 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  3. 2023Content-based Unrestricted Adversarial Attackcited by 73
  4. 2022Adversarial Style Augmentation for Domain Generalized Urban-Scene Segmentationcited by 69
  5. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  6. 2021Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Drivingcited by 45
  7. 2021Optical Adversarial Attackcited by 43
  8. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 42
  9. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  10. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  11. 2021TnT Attacks! Universal Naturalistic Adversarial Patches Against Deep Neural Network Systemscited by 36
  12. 2021AdvHaze: Adversarial Haze Attackcited by 31
38 more
  1. 2021AVA: Adversarial Vignetting Attack against Visual Recognitioncited by 29
  2. 2021Robust Feature-Level Adversaries are Interpretability Toolscited by 27
  3. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  4. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 26
  5. 2021Knowledge Enhanced Machine Learning Pipeline against Diverse Adversarial Attackscited by 24
  6. 2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
  7. 2021Robustness and Generalization via Generative Adversarial Trainingcited by 20
  8. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  9. 2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 18
  10. 2022Unrestricted Black-box Adversarial Attack Using GAN with Limited Queriescited by 18
  11. 2021Adversarial Relighting Against Face Recognitioncited by 16
  12. 2023Instruct2Attack: Language-Guided Semantic Adversarial Attackscited by 16
  13. 2023AdvST: Revisiting Data Augmentations for Single Domain Generalizationcited by 16
  14. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 14
  15. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
  16. 2022GAMA: Generative Adversarial Multi-Object Scene Attackscited by 13
  17. 2023Semantic Adversarial Attacks via Diffusion Modelscited by 12
  18. 2024Verification of Neural Networks' Global Robustnesscited by 10
  19. 2023Attacking Perceptual Similarity Metricscited by 8
  20. 2021Imperceptible Adversarial Examples by Spatial Chroma-Shiftcited by 7
  21. 2024Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priorscited by 7
  22. 2022How Robust are Discriminatively Trained Zero-Shot Learning Models?cited by 6
  23. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  24. 2021Adversarial Examples Detection beyond Image Spacecited by 5
  25. 2021Generating Unrestricted Adversarial Examples via Three Parameterscited by 5
  26. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  27. 2024Guardians of Image Quality: Benchmarking Defenses Against Adversarial Attacks on Image Quality Metricscited by 5
  28. 2024Ask, Attend, Attack: A Effective Decision-Based Black-Box Targeted Attack for Image-to-Text Modelscited by 5
  29. 2025Diffusion-based Adversarial Identity Manipulation for Facial Privacy Protectioncited by 5
  30. 2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusioncited by 5
  31. 2021Effective Universal Unrestricted Adversarial Attacks using a MOE Approachcited by 4
  32. 2021Patch Shortcuts: Interpretable Proxy Models Efficiently Find Black-Box Vulnerabilitiescited by 4
  33. 2021Natural & Adversarial Bokeh Rendering via Circle-of-Confusion Predictive Networkcited by 4
  34. 2022Boosting Robustness Verification of Semantic Feature Neighborhoodscited by 4
  35. 2021Fashion-Guided Adversarial Attack on Person Segmentationcited by 3
  36. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 3
  37. 2023Where and How to Attack? A Causality-Inspired Recipe for Generating Counterfactual Adversarial Examplescited by 3
  38. 2024ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attackcited by 3

50 most cited of 84 All 84 (JSON)