mlsanityData to 14 Oct 2026

ColorFool: Semantic Adversarial Colorization

arXiv 1911.10891 ↗First posted 25 Nov 2019cs.CVcited by 89

Not on the map. Why?

Abstract (arXiv)

Adversarial attacks that generate small L_p-norm perturbations to mislead classifiers have limited success in black-box settings and with unseen classifiers. These attacks are also not robust to defenses that use denoising filters and to adversarial training procedures. Instead, adversarial attacks that generate unrestricted perturbations are more robust to defenses, are generally more successful in black-box settings and are more transferable to unseen classifiers. However, unrestricted perturbations may be noticeable to humans. In this paper, we propose a content-based black-box adversarial attack that generates unrestricted perturbations by exploiting image semantics to selectively modify colors within chosen ranges that are perceived as natural by humans. We show that the proposed approach, ColorFool, outperforms in terms of success rate, robustness to defense frameworks and transferability, five state-of-the-art adversarial attacks on two different tasks, scene and object classification, when attacking three state-of-the-art deep neural networks using three standard datasets. The source code is available at https://github.com/smartcameras/ColorFool.

Key facts. Cited by 89 papers in the map (data through 14 Oct 2026). First posted on arXiv 25 Nov 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 18; 2022: 19; 2023: 18; 2024: 20; 2025: 11; 2026: 3.

89 papers.

Sort:

By area:

  1. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  2. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  3. 2023Content-based Unrestricted Adversarial Attackcited by 73
  4. 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 56
  5. 2022Natural Color Fool: Towards Boosting Black-box Unrestricted Attackscited by 38
  6. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 38
  7. 2021GRNN: Generative Regression Neural Network -- A Data Leakage Attack for Federated Learningcited by 36
  8. 2022Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbationscited by 26
  9. 2022Restricted Black-box Adversarial Attack Against DeepFake Face Swappingcited by 25
  10. 2021Unrestricted Adversarial Attacks on ImageNet Competitioncited by 23
  11. 2022Enhance the Visual Representation via Discrete Adversarial Trainingcited by 23
  12. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 23
38 more
  1. 2022StyleFool: Fooling Video Classification Systems via Style Transfercited by 20
  2. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  3. 2021Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similaritycited by 18
  4. 2021Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attackscited by 16
  5. 2022Towards Good Practices in Evaluating Transfer Adversarial Attackscited by 15
  6. 2022Towards Transferable Unrestricted Adversarial Examples with Minimum Changescited by 13
  7. 2023Semantic Adversarial Attacks via Diffusion Modelscited by 12
  8. 2024ASAM: Boosting Segment Anything Model with Adversarial Tuningcited by 12
  9. 2022ALA: Naturalness-aware Adversarial Lightness Attackcited by 11
  10. 2022Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNscited by 11
  11. 2022Adversarial Color Film: Effective Physical-World Attack to DNNscited by 11
  12. 2023Adversarial Infrared Blocks: A Multi-view Black-box Attack to Thermal Infrared Detectors in Physical Worldcited by 11
  13. 2023Attacking Perceptual Similarity Metricscited by 10
  14. 2023Distilling Out-of-Distribution Robustness from Vision-Language Foundation Modelscited by 9
  15. 2024Imperceptible Protection against Style Imitation from Diffusion Modelscited by 9
  16. 2021Semantically Stealthy Adversarial Attacks against Segmentation Modelscited by 7
  17. 2021Imperceptible Adversarial Examples by Spatial Chroma-Shiftcited by 7
  18. 2024A Survey and Evaluation of Adversarial Attacks for Object Detectioncited by 7
  19. 2024Nearly Zero-Cost Protection Against Mimicry by Personalized Diffusion Modelscited by 7
  20. 2021Selection of Source Images Heavily Influences the Effectiveness of Adversarial Attackscited by 6
  21. 2022Adversarial Neon Beam: A Light-based Physical Attack to DNNscited by 6
  22. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  23. 2022Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generatorcited by 5
  24. 2021Effective Universal Unrestricted Adversarial Attacks using a MOE Approachcited by 4
  25. 2021Natural & Adversarial Bokeh Rendering via Circle-of-Confusion Predictive Networkcited by 4
  26. 2022Adversarial Zoom Lens: A Novel Physical-World Attack to DNNscited by 4
  27. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 4
  28. 2024Transcending Adversarial Perturbations: Manifold-Aided Adversarial Examples with Legitimate Semanticscited by 4
  29. 2021Fashion-Guided Adversarial Attack on Person Segmentationcited by 3
  30. 2021In-distribution adversarial attacks on object recognition models using gradient-free searchcited by 3
  31. 2021Improving Visual Quality of Unrestricted Adversarial Examples with Wavelet-VAEcited by 3
  32. 2021Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classescited by 3
  33. 2021Amicable Aid: Perturbing Images to Improve Classification Performancecited by 3
  34. 2023Turn Fake into Real: Adversarial Head Turn Attacks Against Deepfake Detectioncited by 3
  35. 2024Benchmarking Out-of-Distribution Generalization Capabilities of DNN-based Encoding Models for the Ventral Visual Cortexcited by 3
  36. 2024ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attackcited by 3
  37. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 3
  38. 2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3

50 most cited of 89 All 89 (JSON)