mlsanityData to 7 Oct 2026

Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks

arXiv 2210.02041 ↗First posted 5 Oct 2022cs.CV cs.AIcited by 38

Not on the map. Why?

Abstract (arXiv)

Unrestricted color attacks, which manipulate semantically meaningful color of an image, have shown their stealthiness and success in fooling both human eyes and deep neural networks. However, current works usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples. As a result, the black-box attack performance of these methods is limited. To boost transferability of adversarial examples without damaging image quality, we propose a novel Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset. By conducting extensive experiments and visualizations, we convincingly demonstrate the effectiveness of our proposed method. Notably, on average, results show that our NCF can outperform state-of-the-art approaches by 15.0%~32.9% for fooling normally trained models and 10.0%~25.3% for evading defense methods. Our code is available at https://github.com/ylhz/Natural-Color-Fool.

Key facts. Cited by 38 papers in the map (data through 7 Oct 2026). Builds on 52 of its 74 references that are in the map. First posted on arXiv 5 Oct 2022.

Builds on

52 of 74 references.

References · 52

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,082
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2016Densely Connected Convolutional Networkscited by 6,691
  7. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  8. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  9. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
  12. 2020Training data-efficient image transformers & distillation through attentioncited by 4,560
38 more
  1. 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
  2. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  3. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  4. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  5. 2021Going deeper with Image Transformerscited by 759
  6. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  7. 2019Segmentation Transformer: Object-Contextual Representations for Semantic Segmentationcited by 573
  8. 2017Countering Adversarial Images using Input Transformationscited by 517
  9. 2020ResNeSt: Split-Attention Networkscited by 445
  10. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  11. 2017NIMA: Neural Image Assessmentcited by 387
  12. 2017Mitigating Adversarial Effects Through Randomizationcited by 382
  13. 2021Rethinking Spatial Dimensions of Vision Transformerscited by 361
  14. 2021XCiT: Cross-Covariance Image Transformerscited by 335
  15. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  16. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  17. 2022How Do Vision Transformers Work?cited by 305
  18. 2017DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Carscited by 249
  19. 2020A Self-supervised Approach for Adversarial Robustnesscited by 180
  20. 2018Constructing Unrestricted Adversarial Examples with Generative Modelscited by 135
  21. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
  22. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  23. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  24. 2018ComDefend: An Efficient Image Compression Model to Defend Adversarial Examplescited by 104
  25. 2019ColorFool: Semantic Adversarial Colorizationcited by 89
  26. 2018Semantic Adversarial Examplescited by 86
  27. 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
  28. 2019Functional Adversarial Attackscited by 82
  29. 2020Patch-wise Attack for Fooling Deep Neural Networkcited by 78
  30. 2019Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distancecited by 72
  31. 2021On Improving Adversarial Transferability of Vision Transformerscited by 70
  32. 2022Understanding and Improving Graph Injection Attack by Promoting Unnoticeabilitycited by 62
  33. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  34. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  35. 2021Self-Paced Contrastive Learning for Semi-supervised Medical Image Segmentation with Meta-labelscited by 32
  36. 2021Feature Space Targeted Attacks by Statistic Alignmentcited by 21
  37. 2020Patch-wise++ Perturbation for Adversarial Targeted Attackscited by 19
  38. 2021Staircase Sign Method for Boosting Adversarial Attackscited by 12

50 most cited of 52 All 52 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 8; 2024: 14; 2025: 14; 2026: 2.

38 papers.

Sort:

By area:

  1. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 93
  2. 2023Content-based Unrestricted Adversarial Attackcited by 73
  3. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  4. 2023CLIP2Protect: Protecting Facial Privacy using Text-Guided Makeup via Adversarial Latent Searchcited by 42
  5. 2024Alleviating Hallucinations in Large Vision-Language Models through Hallucination-Induced Optimizationcited by 34
  6. 2024Transferable Adversarial Facial Images for Privacy Protectioncited by 26
  7. 2024ADBM: Adversarial diffusion bridge model for reliable adversarial purificationcited by 24
  8. 2023Practical Deep Dispersed Watermarking with Synchronization and Fusioncited by 15
  9. 2024ASAM: Boosting Segment Anything Model with Adversarial Tuningcited by 12
  10. 2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
  11. 2024Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Sizecited by 7
  12. 2024Makeup-Guided Facial Privacy Protection via Untrained Neural Network Priorscited by 7
26 more
  1. 2025AdvAD: Exploring Non-Parametric Diffusion for Imperceptible Adversarial Attackscited by 7
  2. 2025NatADiff: Adversarial Boundary Guidance for Natural Adversarial Diffusioncited by 5
  3. 2024Adversarial Attacks on Both Face Recognition and Face Anti-spoofing Modelscited by 4
  4. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  5. 2023Constructing Semantics-Aware Adversarial Examples with a Probabilistic Perspectivecited by 3
  6. 2024Any Target Can be Offense: Adversarial Example Generation via Generalized Latent Infectioncited by 3
  7. 2024ReToMe-VA: Recursive Token Merging for Video Diffusion-based Unrestricted Adversarial Attackcited by 3
  8. 2024Improving the Transferability of Adversarial Attacks on Face Recognition with Diverse Parameters Augmentationcited by 3
  9. 2025Enhancing Diffusion-based Unrestricted Adversarial Attacks via Adversary Preferences Alignmentcited by 3
  10. 2025Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generationcited by 3
  11. 2025ScoreAdv: Score-based Targeted Generation of Natural Adversarial Examples via Diffusion Modelscited by 3
  12. 2025Adversarial-Guided Diffusion for Multimodal LLM Attackscited by 3
  13. 2024Rethinking the Threat and Accessibility of Adversarial Attacks against Face Recognition Systemscited by 2
  14. 2024SCA: Improve Semantic Consistent in Unrestricted Adversarial Attacks via DDPM Inversioncited by 2
  15. 2025Concept-based Adversarial Attack: a Probabilistic Perspectivecited by 2
  16. 2025CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coveragecited by 2
  17. 2023Spatial-Frequency Discriminability for Revealing Adversarial Perturbationscited by 1
  18. 2023Latent Code Augmentation Based on Stable Diffusion for Data-free Substitute Attackscited by 1
  19. 2025Enhancing Adversarial Transferability via Component-Wise Transformationcited by 1
  20. 2025SCOOTER: A Human Evaluation Framework for Unrestricted Adversarial Examplescited by 1
  21. 2024Attacks on multimodal modelscited by 0
  22. 2025Adversarial Wear and Tear: Exploiting Natural Damage for Generating Physical-World Adversarial Examplescited by 0
  23. 2025TRAIL: Transferable Robust Adversarial Images via Latent diffusioncited by 0
  24. 2025Optimizing the Adversarial Perturbation with a Momentum-based Adaptive Matrixcited by 0
  25. 2026Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Drivingcited by 0
  26. 2026Discovering Natural Transformation Vulnerabilities in Black-Box Vision Modelscited by 0