# Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers

arXiv: https://arxiv.org/abs/1904.08489 · HTML: https://mlsanity.com/paper/1904.08489/

## Key facts

- Cited by 57 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Apr 2019.

## Built on by (most cited first, 30 of 57)

- [Advances in adversarial attacks and defenses in computer vision: A survey](https://mlsanity.com/paper/2108.00401/) (2021)
- [Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving](https://mlsanity.com/paper/2101.06784/) (2021)
- [Robust Feature-Level Adversaries are Interpretability Tools](https://mlsanity.com/paper/2110.03605/) (2021)
- [Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations](https://mlsanity.com/paper/2202.04235/) (2022)
- [Zero-shot Model Diagnosis](https://mlsanity.com/paper/2303.15441/) (2023)
- [CC-Cert: A Probabilistic Approach to Certify General Robustness of Neural Networks](https://mlsanity.com/paper/2109.10696/) (2021)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Distributionally Robust Policy Learning via Adversarial Environment Generation](https://mlsanity.com/paper/2107.06353/) (2021)
- [Automatic Data Augmentation via Invariance-Constrained Learning](https://mlsanity.com/paper/2209.15031/) (2022)
- [Instruct2Attack: Language-Guided Semantic Adversarial Attacks](https://mlsanity.com/paper/2311.15551/) (2023)
- [Semantic Adversarial Attacks via Diffusion Models](https://mlsanity.com/paper/2309.07398/) (2023)
- [Exposing Previously Undetectable Faults in Deep Neural Networks](https://mlsanity.com/paper/2106.00576/) (2021)
- [Adversarial Token Attacks on Vision Transformers](https://mlsanity.com/paper/2110.04337/) (2021)
- [ALA: Naturalness-aware Adversarial Lightness Attack](https://mlsanity.com/paper/2201.06070/) (2022)
- [Semantically Stealthy Adversarial Attacks against Segmentation Models](https://mlsanity.com/paper/2104.01732/) (2021)
- [Adaptive Perturbation for Adversarial Attack](https://mlsanity.com/paper/2111.13841/) (2021)
- [Diagnostics for Deep Neural Networks with Automated Copy/Paste Attacks](https://mlsanity.com/paper/2211.10024/) (2022)
- [Towards Robust Image Stitching: An Adaptive Resistance Learning against Compatible Attacks](https://mlsanity.com/paper/2402.15959/) (2024)
- [Boosting Robustness Verification of Semantic Feature Neighborhoods](https://mlsanity.com/paper/2209.05446/) (2022)
- [General Adversarial Defense Against Black-box Attacks via Pixel Level and Feature Level Distribution Alignments](https://mlsanity.com/paper/2212.05387/) (2022)
- [Fast Certification of Vision-Language Models Using Incremental Randomized Smoothing](https://mlsanity.com/paper/2311.09024/) (2023)
- [Unsupervised Model Diagnosis](https://mlsanity.com/paper/2410.06243/) (2024)
- [Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems](https://mlsanity.com/paper/2508.01845/) (2025)
- [Diverse Gaussian Noise Consistency Regularization for Robustness and Uncertainty Calibration](https://mlsanity.com/paper/2104.01231/) (2021)
- [In-distribution adversarial attacks on object recognition models using gradient-free search](https://mlsanity.com/paper/2106.16198/) (2021)
- [Measuring CLEVRness: Blackbox testing of Visual Reasoning Models](https://mlsanity.com/paper/2202.12162/) (2022)
- [GENESIS-RL: GEnerating Natural Edge-cases with Systematic Integration of Safety considerations and Reinforcement Learning](https://mlsanity.com/paper/2403.19062/) (2024)
- [Benchmarking Out-of-Distribution Generalization Capabilities of DNN-based Encoding Models for the Ventral Visual Cortex](https://mlsanity.com/paper/2406.16935/) (2024)
- [AdvSwap: Covert Adversarial Perturbation with High Frequency Info-swapping for Autonomous Driving Perception](https://mlsanity.com/paper/2502.08374/) (2025)
- [Learning to See Through a Baby's Eyes: Early Visual Diets Enable Robust Visual Intelligence in Humans and Machines](https://mlsanity.com/paper/2511.14440/) (2025)

## Abstract (arXiv)

Deep neural networks have been shown to exhibit an intriguing vulnerability to adversarial input images corrupted with imperceptible perturbations. However, the majority of adversarial attacks assume global, fine-grained control over the image pixel space. In this paper, we consider a different setting: what happens if the adversary could only alter specific attributes of the input image? These would generate inputs that might be perceptibly different, but still natural-looking and enough to fool a classifier. We propose a novel approach to generate such `semantic' adversarial examples by optimizing a particular adversarial loss over the range-space of a parametric conditional generative model. We demonstrate implementations of our attacks on binary classifiers trained on face images, and show that such natural-looking semantic adversarial examples exist. We evaluate the effectiveness of our attack on synthetic and real data, and present detailed comparisons with existing attack methods. We supplement our empirical results with theoretical bounds that demonstrate the existence of such parametric adversarial examples.