Unrestricted Adversarial Samples Based on Non-semantic Feature Clusters Substitution
Not on the map. Why?
Abstract (arXiv)
Most current methods generate adversarial examples with the Lp norm specification. As a result, many defense methods utilize this property to eliminate the impact of such attacking algorithms. In this paper,we instead introduce "unrestricted" perturbations that create adversarial samples by using spurious relations which were learned by model training. Specifically, we find feature clusters in non-semantic features that are strongly correlated with model judgment results, and treat them as spurious relations learned by the model. Then we create adversarial samples by using them to replace the corresponding feature clusters in the target image. Experimental evaluations show that in both black-box and white-box situations. Our adversarial examples do not change the semantics of images, while still being effective at fooling an adversarially trained DNN image classifier.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 34 of its 41 references that are in the map. First posted on arXiv 31 Aug 2022.
Builds on
34 of 41 references.
References · 34
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2022Generative Adversarial Networkscited by 5,603
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
- 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
- 2017Improved Training of Wasserstein GANscited by 2,223
- 2016Adversarial examples in the physical worldcited by 1,762
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
22 more
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2016Adversarial Machine Learning at Scalecited by 934
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2017One pixel attack for fooling deep neural networkscited by 579
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2016Conditional Image Synthesis With Auxiliary Classifier GANscited by 562
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 288
- 2018Generating Adversarial Examples with Adversarial Networkscited by 256
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
- 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
- 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
- 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
- 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
- 2019Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifierscited by 56
- 2019Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracycited by 49
- 2018Unrestricted Adversarial Examplescited by 40
- 2020Composite Adversarial Attackscited by 29
- 2016Style-Transfer via Texture-Synthesiscited by 17
Built on by
Not cited yet.