# Towards Feature Space Adversarial Attack

arXiv: https://arxiv.org/abs/2004.12385 · HTML: https://mlsanity.com/paper/2004.12385/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Apr 2020.

## Built on by (most cited first, 11 of 11)

- [Robustness and Generalization via Generative Adversarial Training](https://mlsanity.com/paper/2109.02765/) (2021)
- [Defending Multimodal Fusion Models against Single-Source Adversaries](https://mlsanity.com/paper/2206.12714/) (2022)
- [Semantic Adversarial Attacks via Diffusion Models](https://mlsanity.com/paper/2309.07398/) (2023)
- [Adversarially Robust Learning with Tolerance](https://mlsanity.com/paper/2203.00849/) (2022)
- [BruSLeAttack: A Query-Efficient Score-Based Black-Box Sparse Adversarial Attack](https://mlsanity.com/paper/2404.05311/) (2024)
- [So Different Yet So Alike! Constrained Unsupervised Text Style Transfer](https://mlsanity.com/paper/2205.04093/) (2022)
- [Human Imperceptible Attacks and Applications to Improve Fairness](https://mlsanity.com/paper/2111.15603/) (2021)
- [Style-Agnostic Reinforcement Learning](https://mlsanity.com/paper/2208.14863/) (2022)
- [Assessing Neural Network Robustness via Adversarial Pivotal Tuning](https://mlsanity.com/paper/2211.09782/) (2022)
- [MaMaDroid2.0 -- The Holes of Control Flow Graphs](https://mlsanity.com/paper/2202.13922/) (2022)
- [Testing the Channels of Convolutional Neural Networks](https://mlsanity.com/paper/2303.03400/) (2023)

## Abstract (arXiv)

We propose a new adversarial attack to Deep Neural Networks for image classification. Different from most existing attacks that directly perturb input pixels, our attack focuses on perturbing abstract features, more specifically, features that denote styles, including interpretable styles such as vivid colors and sharp outlines, and uninterpretable ones. It induces model misclassfication by injecting imperceptible style changes through an optimization procedure. We show that our attack can generate adversarial samples that are more natural-looking than the state-of-the-art unbounded attacks. The experiment also supports that existing pixel-space adversarial attack detection and defense techniques can hardly ensure robustness in the style related feature space.