SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Input: a input image  $z_0$  with the label  $y$ , a text embedding  $\mathcal{C} = \psi(\mathcal{P})$ , a classifier  $\mathcal{F}_{\theta}(\cdot)$ , DDIM steps  $T$ , image mapping iteration  $N_i$ , attack iterations  $N_a$ , and momentum factor  $\mu$   
1: Calculate latents  $\{z_0^*, \dots, z_T^*\}$  using Equation 5 over  $z_0$  with  $w = 1$   
2: Initialize  $w = 7.5$ ,  $\bar{z}_T \gets z_T^*$ ,  $\varnothing \gets \psi("")$ ,  $\delta_0 \gets 0$ ,  $g_0 \gets 0$   
3: // Image Latent Mapping  
4: for  $t = T, T - 1, \dots, 1$  do  
5: for  $j = 1, \dots, N_i$  do  
6:  $\emptyset_t \gets \emptyset_t - \zeta \nabla_{\emptyset_t} \| z_{t-1}^* - z_{t-1}(\bar{z}_t, t, \mathcal{C}, \emptyset_t) \|_2^2$   
7: end for  
8:  $z_{t-1}^- \gets z_{t-1}(\bar{z}_t, t, \mathcal{C}, \emptyset_t)$ ,  $\emptyset_{t-1} \gets \emptyset_t$   
9: end for  
10: // Adversarial Latent Optimization  
11: for  $k = 1, \dots, N_a$  do  
12:  $\bar{z}_0 \gets \Omega(z_T + \delta_{k-1}, T, \mathcal{C}, \{\emptyset_t\}_{t=1}^T)$   
13:  $g_k \gets \mu \cdot g_{k-1} + \frac{\nabla_{z_T} \mathcal{L}(\mathcal{F}_{\theta}(\varrho(\bar{z}_0), y))}{||\nabla_{z_T} \mathcal{L}(\mathcal{F}_{\theta}(\varrho(\bar{z}_0), y))||_1}$   
14:  $\delta_k \gets \Pi_\kappa(\delta_{k-1} + \eta \cdot \mathrm{sign}(g_k))$   
15: end for  
16:  $\bar{z}_0 \gets \varrho(\Omega(\bar{z}_T + \delta_{N_a}, T, \mathcal{C}, \{\emptyset_t\}_{t=1}^T))$   
Output: The unrestricted adversarial example  $\bar{z}_0$ .
differentiable boundary processing  $\varrho(\cdot)$  to solve this problem.  $\varrho(\cdot)$  constrains the values outside  $[0,1]$  to the range of  $[0,1]$ . The mathematical expression of DPB is as follows:
$$
\varrho (x) = \left\{ \begin{array}{l l} \tanh  (1 0 0 0 x) / 1 0 0 0 0, & x <   0, \\ x, & 0 \leq x \leq 1, \\ \tanh  (1 0 0 0 (x - 1)) / 1 0 0 0 1, & x > 1. \end{array} \right. \tag {11}
$$
Next, we define  $\Pi_{\kappa}$  as the projection of the adversarial perturbation  $\delta$  onto  $\kappa$ -ball. We introduce momentum  $g$  and express the optimization adversarial latents as:
$$
g _ {k} \leftarrow \mu \cdot g _ {k - 1} + \frac {\nabla_ {z _ {T}} \mathcal {L} \left(\mathcal {F} _ {\theta} \left(\left(\varrho \left(\bar {z} _ {0}\right), y\right)\right) \right.}{\left| \left| \nabla_ {z _ {T}} \mathcal {L} \left(\mathcal {F} _ {\theta} \left(\varrho \left(\bar {z} _ {0}\right), y\right)\right) \right| \right| _ {1}}, \tag {12}
$$
$$
\delta_ {k} \leftarrow \Pi_ {\kappa} \left(\delta_ {k - 1} + \eta \cdot \operatorname {s i g n} \left(g _ {k}\right)\right). \tag {13}
$$
In general, Adversarial Latent Optimization (ALO) employs skip gradient to determine the gradient of the denoising process, and integrates differentiable boundary processing to regulate the value range of adversarial examples, and finally performs iterative optimization according to the gradient. Combined with Image Latent Mapping, Adversarial Content Attack is illustrated in Algorithm 1.
Datasets. Our experiments are conducted on the ImageNet-compatible Dataset [29]. The dataset consists of 1,000 images from ImageNet's validation set [8], and is widely used in [10, 13, 58, 60].
Attack Evaluation. We choose SAE [20], ADer [1], ReColorAdv [30], cAdv [2], tAdv [2], ACE [61], ColorFool [47], NCF [60] as comparison methods of Adversarial Content Attack (ACA). The parameters for these unrestricted attacks follow the corresponding default settings. Our attack evaluation metric is the attack success rate (ASR, %), which is the percentage of misclassified images.
Models. To evaluate the adversarial robustness of network architectures, we select convolutional neural networks (CNNs) and vision transformers (ViTs) as the attacked models, respectively. For CNNs, we choose normally trained MoblieNet-V2 (MN-v2) [46], Inception-v3 (Inc-v3) [50], ResNet-50 (RN-50) and ResNet-152 (RN-152) [18], Densenet-161 (Dense-161) [22], and EfficientNet-b7 (EF-b7) [52]. For ViTs, we consider normally trained MoblieViT (MobViT-s) [35], Vision Transformer (ViT-B) [11], Swin Transformer (Swin-B) [34], and Pyramid Vision Transformer (PVT-v2) [55].
Table 1: Performance comparison of adversarial transferability on normally trained CNNs and ViTs. We report attack success rates (\%) of each method ("* means white-box attack results).
Surrogate Model	Attack	Models	Avg. ASR (%)
CNNs	Transformers
MN-v2	Inc-v3	RN-50	Dense-161	RN-152	EF-b7	MobViT-s	ViT-B	Swin-B	PVT-v2
-	Clean	12.1	4.8	7.0	6.3	5.6	8.7	7.8	8.9	3.5	3.6	6.83
ILM	13.5	5.5	8.0	6.3	5.9	8.3	8.3	9.0	4.8	4.0	7.36
MobViT-s	SAE	60.2	21.2	54.6	42.7	44.9	30.2	82.5*	38.6	21.1	20.2	37.08
ADef	14.5	6.6	9.0	8.0	7.1	9.8	80.8*	9.7	5.1	4.6	8.27
ReColorAdv	37.4	14.7	26.7	22.4	21.0	20.8	96.1*	21.5	16.3	16.7	21.94
cAdv	41.9	25.4	33.2	31.2	28.2	34.7	84.3*	32.6	22.7	22.0	30.21
tAdv	33.6	18.8	22.1	18.7	18.7	15.8	97.4*	15.3	11.2	13.7	18.66
ACE	30.7	9.7	20.3	16.3	14.4	13.8	99.2*	16.5	6.8	5.8	14.92
ColorFool	47.1	12.0	40.0	28.1	30.7	19.3	81.7*	24.3	9.7	10.0	24.58
NCF	67.7	31.2	60.3	41.8	52.2	32.2	74.5*	39.1	20.8	23.1	40.93
ACA (Ours)	66.2	56.6	60.6	58.1	55.9	55.5	89.8*	51.4	52.7	55.1	56.90
MN-v2	SAE	90.8*	22.5	53.2	38.0	41.9	26.9	44.6	33.6	16.8	18.3	32.87
ADer	56.6*	7.6	8.4	7.7	7.1	10.9	11.7	9.5	4.5	4.5	7.99
ReColorAdv	97.7*	18.6	33.7	24.7	26.4	20.7	31.8	17.7	12.2	12.6	22.04
cAdv	96.6*	26.8	39.6	33.9	29.9	32.7	41.9	33.1	20.6	19.7	30.91
tAdv	99.9*	27.2	31.5	24.3	24.5	22.4	40.5	16.1	15.9	15.1	24.17
ACE	99.1*	9.5	17.9	12.4	12.6	11.7	16.3	12.1	5.4	5.6	11.50
ColorFool	93.3*	9.5	25.7	15.3	15.4	13.4	15.7	14.2	5.9	6.4	13.50
NCF	93.2*	33.6	65.9	43.5	56.3	33.0	52.6	35.8	21.2	20.6	40.28
ACA (Ours)	93.1*	56.8	62.6	55.7	56.0	51.0	59.6	48.7	48.6	50.4	54.38
RN-50	SAE	63.2	25.9	88.0*	41.9	46.5	28.8	45.9	35.3	20.3	19.6	36.38
ADer	15.5	7.7	55.7*	8.4	7.8	11.4	12.3	9.2	4.6	4.9	9.09
ReColorAdv	40.6	17.7	96.4*	28.3	33.3	19.2	29.3	18.8	12.9	13.4	23.72
cAdv	44.2	25.3	97.2*	36.8	37.0	34.9	40.1	30.6	19.3	20.2	32.04
tAdv	43.4	27.0	99.0*	28.8	30.2	21.6	35.9	16.5	15.2	15.1	25.97
ACE	32.8	9.4	99.1*	16.1	15.2	12.7	20.5	13.1	6.1	5.3	14.58
ColorFool	41.6	9.8	90.1*	18.6	21.0	15.4	20.4	15.4	5.9	6.8	17.21
NCF	71.2	33.6	91.4*	48.5	60.5	32.4	52.6	36.8	19.8	21.7	41.90
ACA (Ours)	69.3	61.6	88.3*	61.9	61.7	60.3	62.6	52.9	51.9	53.2	59.49
ViT-B	SAE	54.5	26.9	49.7	38.4	41.4	30.4	46.1	78.4*	19.9	18.1	36.16
ADer	15.3	8.3	9.9	8.4	7.6	12.0	12.4	81.5*	5.3	5.5	9.41
ReColorAdv	25.5	12.1	17.5	13.9	14.4	15.4	22.9	97.7*	10.9	8.6	15.69
cAdv	31.4	27.0	26.1	22.5	19.9	26.1	32.9	96.5*	18.4	16.9	24.58
tAdv	39.5	22.8	25.8	23.2	22.3	20.8	34.1	93.5*	16.3	15.3	24.46
ACE	30.9	11.4	22.0	15.5	15.2	13.0	17.0	98.6*	6.5	6.3	15.31
ColorFool	45.3	13.9	35.7	24.3	28.8	19.8	27.0	83.1*	8.9	9.3	23.67
NCF	55.9	25.3	50.6	34.8	42.3	29.9	40.6	81.0*	20.0	19.1	35.39
ACA (Ours)	64.6	58.8	60.2	58.1	58.1	57.1	60.8	87.7*	55.5	54.9	58.68
Implementation Details. Our experiments are run on an NVIDIA Tesla A100 with Pytorch. DDIM steps  $T = 50$ , image mapping iteration  $N_{i} = 10$ , attack iterations  $N_{a} = 10$ ,  $\beta = 0.1$ ,  $\zeta = 0.01$ ,  $\eta = 0.04$ ,  $\kappa = 0.1$ , and  $\mu = 1$ . The version of Stable Diffusion [42] is v1.4. Prompts for images are automatically generated using BLIP v2 [31].
4.2 Attacks on Normally Trained Models
In this section, we assess the adversarial transferability of normally trained convolutional neural networks (CNNs) and vision transformers (ViTs), including methods such as SAE [20], ADer [1], ReColorAdv [30], cAdv [2], tAdv [2], ACE [61], ColorFool [47], NCF [60], and our ACA. Adversarial examples are crafted via MobViT-s, MN-v2, RN-50, and ViT-B, respectively. Avg. ASR (\%) refers to the average attack success rate on non-substitute models.
Table 1 illustrates the performance comparison of adversarial transferability on normally trained CNNs and ViTs. It can be observed that adversarial examples by ours generally exhibit superior transferability compared to those generated by state-of-the-art competitors and the impact of ILM on ASR is exceedingly marginal. When CNNs (RN-50 and MN-v2) are used as surrogate models, our ACA exhibits minimal differences with state-of-the-art NCF in MN-v2, RN-50, and RN-152. However, in Inc-v3, Dense-161, and EF-b7, such as when RN-50 is used as the surrogate model, we significantly outperform NCF by  $28.0\%$ ,  $13.4\%$ , and  $27.9\%$ , respectively. This indicates that our ACA has higher transferability in heterogeneous CNNs. Furthermore, our ACA demonstrates state-of-the-art transferability in current unconstrained attacks under the more challenging cross-architecture
Table 2: Performance comparison of adversarial transferability on adversarial defense methods.
Attack	HGD	R&P	NIPS-r3	JPEG	Bit-Red	DiffPure	Inc-v3ens3	Inc-v3ens4	IncRes-v2ens	Res-De	Shape-Res	Avg. ASR (%)
Clean	1.2	1.8	3.2	6.2	17.6	15.4	6.8	8.9	2.6	4.1	6.7	6.77
ILM	1.5	1.9	3.5	7.1	18.5	16.1	6.8	9.8	3.0	5.1	8.1	7.40
SAE	21.4	19.0	25.2	25.7	43.5	39.8	25.7	29.6	20.0	35.1	49.6	30.42
ADer	2.9	3.6	6.9	10.4	27.5	18.1	10.1	12.1	5.6	6.0	9.7	10.26
ReColorAdv	5.1	7.0	10.0	20.0	24.3	20.0	11.1	15.5	7.4	11.6	18.4	13.67
cAdv	12.2	14.0	17.7	11.1	33.9	32.9	19.9	23.2	14.6	16.2	25.3	20.09
tAdv	10.9	12.4	14.4	17.8	29.6	21.2	17.7	19.0	12.5	16.4	25.4	17.94
ACE	4.9	5.9	11.1	12.6	28.1	24.9	12.4	15.4	7.6	11.6	21.0	14.14
ColorFool	9.1	9.6	15.3	18.0	37.9	33.8	17.8	21.3	10.5	20.3	35.0	20.78
NCF	22.8	21.1	25.8	26.8	43.9	39.6	27.4	31.9	21.8	34.4	47.5	31.18
ACA (Ours)	52.2	53.6	53.9	59.7	63.4	63.7	59.8	62.2	53.6	55.6	60.8	58.05
setting. Specifically, when the surrogate model is RN-50, we surpass NCF by significant margins of  $10.0\%$ ,  $16.1\%$ ,  $32.1\%$ , and  $32.5\%$  in MobViT-s, ViT-B, Swin-B, and PVT-v2, respectively. There are two primary reasons for this phenomenon: i) our ACA utilizes a low-dimensional manifold search of natural images for adversarial examples, with the manifold itself determining the transferability of the adversarial examples, independent of the model's architecture; ii) the diffusion model incorporates the self-attention structure, exhibiting a certain degree of architectural similarity.
Overall, the deformation-based attack (ADer) exhibits lower attack performance in both white-box and black-box settings. Texture-based attacks (tAdv) show better white-box attack performance, but are less transferable than existing color-based attacks (NCF and SAE). Our ACA leverages the low-dimensional manifold of natural images to adaptively combine image attributes and generate unrestricted adversarial examples, resulting in a significant outperformance of state-of-the-art methods by  $13.3\% \sim 50.4\%$  on average. These results convincingly demonstrate the effectiveness of our method in fooling normally trained models.
4.3 Attacks on Adversarial Defense Methods
The situation in that adversarial defense methods can effectively protect against current adversarial attacks exhibits the Dunning-Kruger effect [28]. Actually, such defense methods demonstrate efficacy in defending against adversarial examples within the  $l_{p}$  norm, yet their robustness falters in the face of novel and unseen attacks [25]. Therefore, we investigate whether unrestricted attacks can break through existing defenses. Here, we choose input pre-process defenses (HGD [33], R&P [57], NIPS-r3 $^3$ , JPEG [17], Bit-Red [59], and DiffPure [39]) and adversarial training models (Inc-v3 $_{ens3}$ , Inc-v3 $_{ens4}$ , and Inc-v2 $_{ens}$  [53]). Considering that some unrestricted attacks are carried out from the perspective of shape and texture, we also choose shape-texture debained models (ResNet50-Debained (Res-De) [32] and Shape-ResNet (Shape-Res) [14]).
The results of black-box transferability in adversarial defense methods are demonstrated in Table 2. the surrogate model is ViT-B, and the target model is Inc-v3<sub>ens3</sub> for input pre-process defenses. Our method displays persistent superiority over other advanced attacks by a significant margin. Our ACA surpasses NCF, SAE, ColorFool by  $27.13\%$ ,  $27.63\%$ , and  $37.27\%$  on average ASR. In robust models, based on  $l_p$  adversarial training and shape-texture debiased models are not particularly effective and can still be easily broken by unrestricted adversarial examples. Our approach can adaptively generate various combinations of adversarial examples based on the manifold, thus exhibiting high transferability to different defense methods. Additionally, Bit-Red and Diffpure reduce the ground-truth class's confidence and increase the adversarial examples' transferability. These findings further reveal the incompleteness and vulnerability of existing adversarial defense methods.
Quantitative Comparison. Following [47] and [60], we quantitatively assess the image quality using the non-reference perceptual image quality measure. Therefore, we choose NIMA [51], HyperIQA [49], MUSIQ [27], and TReS [15]. NIMA-AVA and MUSIQ-AVA are trained on AVA [38], and MUSIQ-KonIQ is trained on KonIQ-10K [21], following PyIQA [3]. As illustrated in Table 3, our ILM maintains the same image quality as clean images, and ACA achieves the best results in
<sup>3</sup>https://github.com/anthms/nips-2017/tree/master/mmd
(a) Visualization of state-of-the-art unrestricted attacks
(b) Adversarial examples of Adversarial Content Attack (ACA)
(c) Case Study
Figure 3: (a) Compared with other attacks, ACA generates the most natural adversarial examples; (b) ACA can generate images with various adversarial content, which can combine shape, texture, and color changes; (c) In some cases, ACA may slightly modify the semantic subject.
image quality assessment. ColorFool obtains equal or higher image quality than the clean images because it requires manually selecting several human-sensitive semantic classes and adds uncontrolled perturbations on human-insensitive semantic classes. In other words, ColorFool is bound by human intuition, so do not deteriorate the perceived image quality (our results are similar to [47]). ACA even surpasses ColorFool, mainly because: i) Our adversarial examples are generated based on the low-dimensional manifold of natural images, which can adaptively combine the adversarial content and ensure photorealism; ii) Stable Diffusion itself is an extremely powerful generation model, which produces images with very high image quality; iii) These no-reference image metrics are often trained on aesthetic datasets, such as AVA [38] or KonIQ-10K [21]. Some of the images in these datasets are post-processed (such as Photoshop), which is more in line with human aesthetics. Because ACA adaptively generates adversarial examples on a low-dimensional manifold, this kind of minor image editing is similar to post-processing, which is more in line with human aesthetic perception and better image quality.
Qualitative Comparison. We visualize unrestricted attacks of Top-5 black-box transferability, including SAE, cAdv, tAdv, ColorFool, and NCF. In Figure 3(a), we visualize adversarial examples generated by different unrestricted attacks. In night scenes and food, color and texture changes are easily perceptible, while our method still keeps image photorealism. Next, we give more adversarial examples generated by ACA. It is clearly observed that our method can adaptively combine content to generate adversarial examples, as shown in Figure 3(b). For example, the hot air balloon in the lower left corner modifies both the color of the sky and the texture of the hot air balloon. The straw
Table 3: Image quality assessment.
Attack	NIMA -AVA↑	HyperIQA↑	MUSIQ -AVA↑	MUSIQ -KonIQ↑	TReS↑
Clean	5.15	0.667	4.07	52.66	82.01
ILM	5.15	0.672	4.08	52.55	81.80
SAE	5.05	0.597	3.79	47.24	71.88
ADer	4.89	0.608	3.89	47.39	72.10
ReColorAdv	5.07	0.668	3.97	51.08	80.32
cAdv	4.97	0.623	3.87	48.32	75.12
tAdv	4.83	0.525	3.78	44.71	67.07
ACE	5.12	0.648	3.96	50.49	77.25
ColorFool	5.24	0.662	4.05	52.27	78.54
NCF	4.96	0.634	3.87	50.33	74.10
ACA (Ours)	5.54	0.691	4.37	56.08	85.11
berry in the lower right corner has some changes in shape and color while keeping the semantics unchanged. However, in some cases, the body of semantics changes, as shown in Figure 3(c). It may be because the prompts generated by BLIP v2 cannot describe the content of the image well.
4.5 Time Analysis
In this section, we illustrate the attack speed of various unrestricted attacks. We choose MN-v2 [46] as the surrogate model and evaluate the inference time on an NVIDIA Tesla A100. Table 4 shows the
Table 4: Attack speed of unrestricted attacks. We choose MN-v2 as the surrogate model and evaluate the inference time on an NVIDIA Tesla A100.
Attack	SAE	ADer	ReColorAdv	cAdv	tAdv	ACE	ColorFool	NCF	ACA (Ours)
Time (sec)	8.80	0.41	3.86	18.67	4.88	6.64	12.18	10.45	60.0+65.33=125.33
average time (in seconds) required to generate an adversarial example per image. ACA does have a significant time cost compared to other attacks. Further, we analyze the time cost and find that Image Latent Mapping (ILM) and Adversarial Latent Optimization (ALO) each accounted for  $50\%$  of the time cost. However, most of the time cost of ILM and ALO lies in the sampling process of the diffusion model. In this paper, our main contribution is to propose a new unrestricted attack paradigm. Therefore, we focus on the improvement of the attack framework, rather than the optimization of time cost. Since the time cost is mainly focused on the sampling of the diffusion model, we have noticed that many recent works have accelerated or distilled the diffusion model, which can greatly reduce the time of the sampling process. For example, [36] can reduce the total number of sampling steps by at least 20 times. If these acceleration technologies are applied to our ACA, ACA can theoretically achieve an attack speed of close to 6 seconds and we think this is a valuable optimization direction.
The ablation studies of momentum (MO) and differentiable boundary processing (DBP) are shown in Figure 4 and the surrogate model is ViT-B [11]. Origin stands for ACA without MO and DBP.  $MO$  is Origin with momentum, and it can be observed that the adversarial transferability is significantly improved after the introduction of momentum.  $MO + DBP$  is Origin with momentum and DBP. Since DBP further optimizes the effectiveness of the adversarial examples and constrains the image within the range of values, it can still
Figure 4: Ablation studies of momentum (MO) and differentiable boundary processing (DBP).
improve the adversarial transferability. Although the above strategies are not the main contribution of this paper, the above experiments illustrate that they can boost adversarial transferability.
In this paper, we propose a novel unrestricted attack framework called Content-based Unrestricted Adversarial Attack. We map the image onto a low-dimensional manifold of natural images. When images are moved along the adversarial gradient on the manifold, unrestricted adversarial examples with diverse adversarial content and photorealistic can be adaptively generated. Based on the diffusion model, we implement Adversarial Content Attack. Experiments show that the existing defense methods are not very effective against unrestricted content-based attacks. We propose a new form of unrestricted attack, hoping to draw attention to the threat posed by unrestricted attacks.
Limitations. Due to the inherent limitations of diffusion models, a considerable number of sampling steps are required in the inference process, resulting in a relatively longer runtime, taking  $\sim 2.5$  minutes using a single A100 GPU. Additionally, the current adaptive generation of unrestricted adversarial examples does not allow for fine-grained image editing. These issues are expected to be resolved in the future with further advancements in diffusion models.
Negative Social Impacts. Adversarial examples from our method exhibit a high photorealism and strong black-box transferability, which raises concerns about the robustness of DNNs, as malicious adversaries may exploit this technique to mount attacks against security-sensitive applications.
Acknowledgements. This work was supported by National Natural Science Foundation of China (No.62072112), Scientific and Technological innovation action plan of Shanghai Science and Technology Committee (No.22511102202).
[57] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through randomization. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. 8
[58] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2730-2739, 2019. 6
[59] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018. The Internet Society, 2018. 8
[60] Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song. Natural color fool: Towards boosting black-box unrestricted attacks. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 7546-7560. Curran Associates, Inc., 2022. 2, 3, 6, 7, 8
[61] Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Adversarial color enhancement: Generating unrestricted adversarial images by optimizing a color filter. In 31st British Machine Vision Conference 2020, BMVC 2020, Virtual Event, UK, September 7-10, 2020. BMVA Press, 2020. 2, 6, 7
[62] Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pages 1036-1045. Computer Vision Foundation / IEEE, 2020. 1
[63] Bolei Zhou, Hang Zhao, Xavier Puig, Tete Xiao, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Semantic understanding of scenes through the ADE20K dataset. Int. J. Comput. Vis., 127(3):302-321, 2019. 3
[64] Yao Zhu, Yuefeng Chen, Xiaodan Li, Kejiang Chen, Yuan He, Xiang Tian, Bolun Zheng, Yaowu Chen, and Qingming Huang. Toward understanding and boosting adversarial transferability from a distribution perspective. IEEE Trans. Image Process., 31:6487-6501, 2022. 1