# Latent Magic: An Investigation into Adversarial Examples Crafted in the Semantic Latent Space

arXiv: https://arxiv.org/abs/2305.12906 · HTML: https://mlsanity.com/paper/2305.12906/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 22 of its 29 references that are in the map.
- First posted on arXiv 22 May 2023.

## Builds on (most cited first, 22 of 22)

- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Generative Adversarial Networks](https://mlsanity.com/paper/2203.00667/) (2022)
- [Going Deeper with Convolutions](https://mlsanity.com/paper/1409.4842/) (2014)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [Adversarial examples in the physical world](https://mlsanity.com/paper/1607.02533/) (2016)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Generating Natural Adversarial Examples](https://mlsanity.com/paper/1710.11342/) (2017)
- [Generative Adversarial Perturbations](https://mlsanity.com/paper/1712.02328/) (2017)
- [Diffusion Models for Imperceptible and Transferable Adversarial Attack](https://mlsanity.com/paper/2305.08192/) (2023)
- [Cross-Domain Transferability of Adversarial Perturbations](https://mlsanity.com/paper/1905.11736/) (2019)
- [Reveal of Vision Transformers Robustness against Adversarial Attacks](https://mlsanity.com/paper/2106.03734/) (2021)
- [AdvGAN++ : Harnessing latent layers for adversary generation](https://mlsanity.com/paper/1908.00706/) (2019)
- [AT-GAN: An Adversarial Generator Model for Non-constrained Adversarial Examples](https://mlsanity.com/paper/1904.07793/) (2019)
- [LatentPoison - Adversarial Attacks On The Latent Space](https://mlsanity.com/paper/1711.02879/) (2017)
- [Generating Adversarial Attacks in the Latent Space](https://mlsanity.com/paper/2304.04386/) (2023)
- [AVAE: Adversarial Variational Auto Encoder](https://mlsanity.com/paper/2012.11551/) (2020)
- [Generating Out of Distribution Adversarial Attack using Latent Space Poisoning](https://mlsanity.com/paper/2012.05027/) (2020)

## Built on by (most cited first, 1 of 1)

- [Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systems](https://mlsanity.com/paper/2508.01845/) (2025)

## Abstract (arXiv)

Adversarial attacks against Deep Neural Networks(DNN) have been a crutial topic ever since citegoodfellow purposed the vulnerability of DNNs. However, most prior works craft adversarial examples in the pixel space, following the lp norm constraint. In this paper, we give intuitional explain about why crafting adversarial examples in the latent space is equally efficient and important. We purpose a framework for crafting adversarial examples in semantic latent space based on an pre-trained Variational Auto Encoder from state-of-art Stable Diffusion ModelciteSDM. We also show that adversarial examples crafted in the latent space can also achieve a high level of fool rate. However, examples crafted from latent space are often hard to evaluated, as they doesn't follow a certain lp norm constraint, which is a big challenge for existing researches. To efficiently and accurately evaluate the adversarial examples crafted in the latent space, we purpose a novel evaluation matric based on SSIMciteSSIM loss and fool rate.Additionally, we explain why FIDciteFID is not suitable for measuring such adversarial examples. To the best of our knowledge, it's the first evaluation metrics that is specifically designed to evaluate the quality of a adversarial attack. We also investigate the transferability of adversarial examples crafted in the latent space and show that they have superiority over adversarial examples crafted in the pixel space.