GAMA: Generative Adversarial Multi-Object Scene Attacks
Authors: Abhishek Aich
Calvin-Khang Ta
Akash A Gupta
Chengyu Song
Srikanth Krishnamurthy
M. Salman Asif
Amit Roy-Chowdhury
Venue: NeurIPS 2022 Accept (2022)
Keywords: adversarial machine learning
image classification
generative adversarial attack

Abstract: The majority of methods for crafting adversarial attacks have focused on scenes with a single dominant object (e.g., images from ImageNet). On the other hand, natural scenes include multiple dominant objects that are semantically related. Thus, it is crucial to explore designing attack strategies that look beyond learning on single-object scenes or attack single-object victim classifiers. Due to their inherent property of strong transferability of perturbations to unknown models, this paper presents the first approach of using generative models for adversarial attacks on multi-object scenes. In order to represent the relationships between different objects in the input scene, we leverage upon the open-sourced pre-trained vision-language model CLIP (Contrastive Language-Image Pre-training), with the motivation to exploit the encoded semantics in the language space along with the visual space. We call this attack approach Generative Adversarial Multi-object Attacks (GAMA). GAMA demonstrates the utility of the CLIP model as an attacker's tool to train formidable perturbation generators for multi-object scenes. Using the joint image-text features to train the generator, we show that GAMA can craft potent transferable perturbations in order to fool victim classifiers in various attack settings. For example, GAMA triggers ~16% more misclassification than state-of-the-art generative approaches in black-box settings where both the classifier architecture and data distribution of the attacker are different from the victim. Our code is available here: https://abhishekaich27.github.io/gama.html

GAMA:
Generative Adversarial Multi-Object Scene Attacks
Abhishek Aich; Calvin-Khang Ta", Akash Gupta, Chengyu Song, Srikanth V. Krishnamurthy, M. Salman Asif, Amit K. Roy- Koy-Chowdhury University of California, Riverside, CA. USA
Abstract
The majority of methods for crafting adversarial attacks have focused on scenes with single dominant object (e.g., images from ImageNet). On the other hand, natural scenes include multiple dominant objects that are semantically related. Thus, it is crucial to explore designing attack strategies that look beyond learning on single-object scenes or attack single-object victim classifiers. Due to their inherent property of strong transferability of perturbations unknown models, this paper presents the first approach of using generative models for adversarial attacks multi-object scenes. In order represent the relationships between different objects in the input scene, we leverage upon the open-sourced pre-trained vision-language model CLIP (Contrastive Language-Image Pre-training), with the motivation to exploit the encoded semantics in the language space along with the visual space. We call this attack approach Generative Adversarial Multi-object Attacks (GAMA). GAMA demonstrates the utility of the CLIP model as an attacker's tool train formidable perturbation generators for multi-object scenes. Using the joint image-text features to train the generator, we show that GAMA can craft potent transferable perturbations order fool victim classifiers various attack settings. For example, GAMA triggers ~ 166% more misclassification than state-of-thee -hrt generative approaches in black-box settings where both the classifier architecture and data distribution of the attacker are different from the victim. Our code is available here: https : h/abhishheeee ch27. gi titb....... io/ ///mmmm.. html
Introduction
Despite attaining significant results, decision-makee maaiing deep neural network models brittle and can be surprisingly manipulated with adversarial attacks that add highly imperceptible perturbations to the system inputs [1, 2]. This has led to dedicated research in designing diverse types of adversarial attacks that lead to highly incorrect decisions on diverse state-of-the-an classifiers [2-13]. The majority of such adversarial attacks [2, 8-18] has focused on scenes with a single dominant object (e.g., images from ImageNet [19]). However, natural scenes consist of multiple dominant objects that are semantically associated [20-25]. This calls for attack methods that are effective in such multi-object scenes.
recent body of work in adversarial attacks [26-30] has shown the importance exploring attack methodologies for real-world scenes (although designed for attacking object detectors). However, such methods are image-specific approaches that are known to have poor time complexity when perturbing large batches of images, as well as poor transferability to unknown models (more details in Section 2) due to their inherent property of perturbing images independently from one another.
"Equal contribution. Corresponding author: AA (aaichh01@ucr.edd AG is currently with Vimaan AI, USA.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

Different from such approaches, our interest lies in the generative model-based approaches [10-13] which are distribution-driver -riven and craft perturbations by learning to fool a surrogate classifier for a large number of images. These generative adversarial attacks show stronger transferability of perturbations to unknown victim models and can perturb large batches of images in one forward pass through the generator demonstrating better time complexity [1], However, these generative attack methods have focused on learning from single-object scenes (e.g., ImageNet in [11-13], CUB-200-2011 [32] in [13]) against single-object surrogate classifiers (e.g., ImageNet classifiers [33] in [10-13]). When trained against multi-object (also known as multi-label) classifiers to learn perturbations
multi-object scenes, such methods perform poorly they do not explicitly incorporate object semantics in the generator training (see Table 2 and Table 3). As real-world scenes usually consist of multi-object images, designing such attacks is of importance to victim model users that analyze complex scenes for making reliable decisions e.g. self-driving cars [34]. To this end, we propose the first generative attack approach, called Generative Adversarial Multi-object scene Attacks or GAMA, that focuses on adversarial attacks on multi-objer scenes.
Progress in recent vision-and- lnd-lanuuggeee (VL) models [35-39] that allow joint modelling of image and text have garnered interest in recent times due to their versatile applicability in various image downstream tasks like inpainting, editing, etc. [40-51]. For the first time in literature, we introduce the utility of a pre-trained open-source framework of the popular VL model named CLIP (Contrastive Language-Image Pre-training) [36] in generating adversarial attacks, Trained on 400 million image-text pairs collected from the internet, CLIP has been shown to provide robust joint representations of VL semantics [40, 46] and strong gero-shot image classification on diverse datasets [36, 44]. This allows us to access diverse VL features cheaply without any training as end-user. Our proposed GAMA attack employs the CLIP model to exploit the natural language semantics encoded in text features along with the vision features (due to its joint image-text alignment property). Different from prior works, GAMA utilizes CLIP model's 's extracted knowledge from <400 million images to maximize the feature differences of perturbed image Zp against two different types of features computed from clean image Ce; (J) features of x, computed from surrogate models, and (2) features of x. computed from CLIP's image encoder. Additionally, GAMA also guides Ep to contain different features compared to I. by using features from CLIP's text encoder via contrastive loss function. For example in Figure 1, consider a clean image x, with objects "sofa and bottle". Using CLIP's image-text aligning property, we estimate that æ. (with text features p.)) is least similar to the text prompt "car and bicycle" (text features Pp) among some randomly chosen candidates (indicated by dotted circles). GAMA uses Pp. created from contextually consistent classes, contrast and move the perturhed x, away from &e in feature space. Hence, the perturbed image features are comparably robust to data distribution changes in victim models as Go(-) is optimized create perturbations that differ in features from two different image features. This allows GAMA to launch highly transferable attacks on unseen victim models (see Section 4). To summarize, we make the following contributions this paper.
siaaiiitt w.LL candonlly campled
and potted plant
'sofs and borrle
O
C 'horse and person'
least ainilar
'chair and bottle'
A
'bottle and chair
'car and cat'
"bicycle and chair
'cot and bicyde'
Figure 1: Using CLIP's image-text aligning prop- crty, we compute the features of the least similar text description w.r.t. to clean image.
1. Multi-object scene based generative attack aided by VL models. We propose the first multi- object scene based generative attack, GAMA, that is designed to consider object semantics through vision-and- and--anguggleeeeeeeeeee models.
2. Pre-trained CLIP model as an attacker's tool. We propose the first generative attack on classifiers that utilizes the open-source pre-trained CLIP model as an attacker's tool to train perturbation generators.
3. Extensive Attack Evaluations. Our extensive experiments on various black-box settings (where victims are multi-label/singl--beelll classifiers and object detectors) show GAMA's 's state-of-the-an transferability of perturbations (Table 2, 2, 5, 4, 6, and 7). Additionally, we also show that GAMA outperforms its baselines in terms of attack robustness when the victim deploys state-of-the defenses (Table 8).
2

---

Table 1: Characteristic comparison. Here, f()) denotes the surrogate classifier. and aa denote a clean and perturbed image. & denotes oulput from a specific pre-defined layer of f()) (different for each method). Better than prior generative attacks [10-13], GAMA leverages multi-modal (text and image) features put and pre extracted from pre-trained CLIP [36] model for train the perturbation generator. Its learning objective aims to pull (xxx ) closer a dissimilar text embedding Pix (W.rt. æ) while pushing away from fa(()) and Ping- Further, GAMA analyzes attack scenarios where the surrogate model is multi-label classifier with input scenes that usually contain multiple objects.
Attack
Venue
Generator training strategy
Analyzed input scene?
GAP [10]
CVPR2018
maximize difference of f(x,) und f(x)
single object
CDA [11]
NeurIPS2019
maximize difference of f(r))- - far) and f(x
single object
TAP [12]
NeurIPS2021
maximize difference of fi( and fm)
single object
BIA [13]
ICLR2022
maximize difference of fa and fa(x))
single object
GAMA
Ours
contrast fa,(;,)) W.r.t. p.... Ping and (x)
single/ multiple objects
2
Related works
Adversarial attacks on classifiers. Several state-of-the-art adversarial attacks 12, 6, 8-17, 52- 60] have been designed to disturb the predictions of classifiers. Broadly these approaches can be categorized into two strategies: instance (or image) specific attacks and generative model-based attacks. Instance specific attacks [2. 6, 8, 9, 14-17, 52-60] create perturbations for every image exclusively. Specifically, these perturbations are computed by querying the victim model for multiple iterations in order to eventually alter the image imperceptibly (e.g. texture level changes to image [60]) to cause its misclassification. Due to this "specific to image" strategy, their time-complexity to alter the decision of a large set of images has been shown to be extremely poor [11, 13, 31]. Furthermore, learning perturbations based on single-image generally restrict their success of misclassification only on the known models [1 13].
To alleviate these drawbacks, a new category of attack strategies has been explored in [10-13, 61] where a generative model is adversarially trained against a surrogate victim model (in other words, treated a discriminator) to craft perturbations whole data distribution. This attack strategy particularly allows one to perturb multiple images simultancously once the generative model is optimized,
well enhances the transfcrability of perturbations to unseen black-box models [10, 11]. For example, Generative Adversarial Perturbations or GAP [10] and
Attack or CDA [11] presented distribution-drive attack that trains generative model for creating adversarial examples by utilizing the cross-entropy loss and relativistic cross-entropy loss [62] objective, respectively. Different from these, Transferable Adversarial Perturbations or TAP [12] and Beyond ImageNet Attack or BIA [13] presented an attack methodology to further enhance transferability of perturbations using feature separation loss functions (e.g. mean square error loss) at mid-level layers of the surrogate model. Most of these methods focused on creating transferable perturbations assuming that the surrogate model is trained in the same domain as the target victim model [13]. Further, a mid-level layer is manually selected for each architecture and is also sensitive to the dataset (shown later in Section 4). Similarly, [61] proposes to change image attributes to create semantic manipulations using their disentangled representations via generative models. Most of these generative attacks employed classifiers that operate under the regime that input images include single dominant objects. Some recent attacks [26-30] have focused on analyzing complex images which contain multiple objects, however, they are instance-driven attacks that introduce aforesaid drawbacks of transferability and time complexity. In contrast to these aforementioned works, GAMA is a generative model-based attack designed to craft imperceptible adversarial perturbations that can strongly disrupt both multi-label and single-label classifiers. Morcover, GAMA uses novel perturbation generation strategy that employs a pre-trained CLIP model [36] based framework to craft highly effectual and transferable perturbations by leveraging multi-modal (image and text) embeddings. We summarize the differences between prior generative attacks and GAMA in Table 1.
Applications of Vision-and- Language (VL) representations. Due to their robust zero-shot per- formance, joint aantoo--nd-aanggaan pre-trained models [35-39] have allowed new language-driven solutions for various downstream tasks [40-51, 63]. The differentiating attribute of using VI. models [36), when compared to existing conventional image-based pre-trained models [33], is that they provide high-quality aligned visual and textual representations learnt from large-scale image-text
3

---

Proposed generator training
fum Pua
perturbed imuge
surrogate model
module
perturbation projection
generator
PO
CLIP feature extractor
Pung
Go(-)
bc)
Ling
image
CLIP feature extractor
pre-trained CLIIP model
2
clean image features
perturbed imuge features
amilarity
car
"eprefho car and a stop sign'
dog
Pest
Punk CLIP image features
"eprefixs dog and cat'
T(-)
Z(-)
CLIP text
bike 'ppeefxc person bike'
Pext
Ping
features
class list
generate prompts
text encoder
lesst simillrr
image encoder
imaae
clean
attract
Lung loss functions
repel
Figure 2: Overview of GAMA. The perturbation generator Go crafts perturhed image (fae-budger con- strained by projection operator P())) from the clean image as input. Next, embeddings from clean image and from perturbed image are extracted from the surrogate model. A pre-trained CI.IP model extracts the image embedding Pire from the clean image and the text embedding pee that is least similar to pig (see details in Section 3.1) Finally, the loss functions Lire and L... utilize these embeddings to optimize the generator weights 0. Loss solely based surrogate model not shown here for simplicity. We prefix='s photo depicts' in all the text prompts following [67].
pairs. In this work, we leverage one such powerful VL framework named CLIP [36] to adversary's ss advantage and show utility in preparing a perturbation generator for formidable attacks across multiple distributions. Employing freely available pre-trained models for tasks other than what they were trained for has been common practice (e.g. VGG [64] models [65, 66], CLIP for domain adaptation of generators in [46]). To the best of knowledge, the proposed attack is the first to introduce such VL model usage to subvert classifier decisions.
3 Proposed Attack Methodology: GAMA
Problem Statement. Our goal is to train a generative model Go(-) (weights 0) from training
distribution of images with multiple-objects. Once @ is optimized, G- can create perturbations on diverse types (multi-object or otherwise) of input images that can lead to misclassification on an unknown victim classifier. Suppose we have access source dataset D consisting of N training samples from C' number of classes, with each sample/image possibly consisting of multiple object labels, i.e., multi-label images. Each ith sample in D is represented as ( E IR BB x1' (with height H, width W, and channels 7) containing labels (5) = [y]*
5 E V C (0. More
indicates the existence of an object from class e (+) Further, we have access to a surrogate multi-label classifier trained on denoted as f(-) which is employed optimize the perturbation generator Go(-)'s weight O. For ease of exposition, we drop the superscript further discussion.
specifically, if sample (+) is associated with class ye
3.1 Adversary Equipped with Pre-Trained CLIP
We aim to train a generator Go(-) that learns to create perturbations from its observations by fooling surrogate classifier f-) during its training phase. Now, Go(.) learns to create perturbations 5 in accordance f-),, is bounded by the features extracted from f(-) in order contrast and æ; (e.g. final-layer logits in [10, 11] or mid-level features [12, 13]). In this work, we explore case where we have access to a pre-trained vision-and- -annagugg- model like CLIP that can utilized as a loss network to train (.(.). Our motivation for using CLIP is to exploit its joint text and image matching property and compute two embeddings: clean image embedding extracted from the image encoder and a dissimilar text embedding extracted from the text encoder. Specifically, aim to encode

---

the contextual relationships between multiple objects in the natural scene via language derivatives. We next describe GAMA's 's method and present novel strategy to use CLIP's model to train G-(-). Note that we assume each image contains two co-occurring classes for creating text prompts, mainly restricted due to computation of co-occurrence matrices of dimension C' x C available for multi-label datasets. As we will see later, co-occurrence matrices allow us to discard pairs of classes that would not occur in real-world scenarios.
GAMA Overview. Before training Go(-), we first compute a text embedding matrix A... = (pt, P2,..., pN] E RRN with Pa E IR (explained in detail later) using the CLIP text encoder T()). Here, K is the embedding size of output from T(.). During training Go(.), we start by feeding the clean image æ to the CLIP image encoder I(.) and computing an image embedding Pirs I(x) E _K Next, a particular vector P... E E from A... is retrieved that is least similar to Puce' Then, we feed x to (.))) and create Vg while ensuring it to be under given perturbation lo budget using the perturbation projection operator P(.). These clean and perturbed images are then fed to the surrogate classifier f(.) to extract K --dimensional embeddings at specific kth layer, denoted by fi( and fx, respectively. Finally, the aforementioned quadruplet embeddings (per, fx(x)), fk (ax))) )) are used to compute a contrastive learning based CLIP text embedding- guided loss (Prn: fi((2)) fa.)))) and regression learning based CLIP image embedding-guine loss (Pre: f<((t)) to compute the final objective L. We also include a loss function that further maximizes the difference between fu (x) and fx (a,) solely from the surrogate classifier's perspective. This loss L is minimized to update the weights of the generator 0. The whole GAMA paradigm is illustrated in Figure 2 and summarized in Algorithm The details of loss objectives Live and L... (with text embedding matrix A...) are discussed next.
CLIP text embedding- loss (C.... Let = = fi. (z)) and 2 fz.)). The CLIP framework inherently learns the text and vision embedding association via contrastive learning regime [36, 68), constraining the feature embeddings of the input image and its counterpart language description to be as similar as possible. Different from CLIP's image embedding Pug. CLIP's text embedding Pur. allows us to look beyond the pixel-based features. More specifically, CLIP's vision-and-languu aligning ability allows us to utilize text features to craft transferable image perturbations. Hence, we can optimize Go(-) to create perturbed images F, that do not follow the same text embedding alignment as their clean image counterpart æ. In order to cause this text misalignment, we create triplet of embeddings where the anchor 2 is pushed away from while pulling it closer to a text embedding Pu.. that is least associated or similar to a clean image x. To compute this triplet, the following two steps performed.
Before training, compute A... The goal is create a dictionary or matrix of text embeddings which can be utilized to retrieve P... during optimization of Go(.). Firstly, we generate language derivatives or text prompts using classes of source distribution. This means we only need to know all the available C' classes in D but not their specific association with æ. Secondly, with assumption that each clean image x is associated with two classes, we can generate C2 text prompts and create a matrix A.. of size C x K. For example, if classes "cat', 'dog'. 'person' and "boat' exist in D. then one can create text prompts such as "a photo depicts cat and dog" or "a photo depicts person and boat" (see Figure 1 for 10 random examples extracted from CLIP's 'VIT-B/I6' model using Pascal- VOC's classes). Here, the part of the text prompt underlined is recommended 'prefix' common to all text prompts as suggested in [67]. However, such A. can contain embeddings from prompts that are generated from classes that do not exist in real life. To circumvent this, we utilize object co-occurrence matrix O E CxC (a binary matrix) to estimate the co-occurrence relationships between classes. Computed from the training data set containing C' classes, O is first initialized with matrix containing only zeros. Then, an element Oi (ith row and jth column of O) is set to if objects from classes yi and yj appear together at least in one image. Computing such co-occurrence information a common practice in multi-object downstream problems [26, 27, 69- 72]. We use O provided by [69]. Using such a co-occurrence matrix, we only create text prompts from a pair of classes that occur together according O. This leads to a text embedding matrix of size A.. of size OOlo X K where |/Olo denotes total non-zero elements.
During training, compute P... CLIP's training objective allows it to push the embeddings of associated image-text pairs closer compared to non-matched pairs. We leverage this property to compute the least similar text embedding P... w.r.t. image embedding P... During each training
5

---

epoch, we randomly sample B candidates [pi, P2, ... .PB] from A... and estimate Peu as follows:
Puu min[cs(p.... Pi). ps(p P2), , PB)]
(1)
Here, cs(.) denotes cosine similarity. Next, we force 2 to align with a.. while misaligning with z. This is implemented contrastive learning [73, 74] objective follows.
L. min
1/x (1 Pen 12
1 2 =|21,)
0
where a > 0 is the desired margin between clean and perturbed image embedding, and [+] max(0, v). L... pulls away embeddings a and æ; by making them keep a margin a while pushing dissimilar embeddings E and P.... closer than the given margin.
CLIP image embedding-guided loss (Crn)). Due to CLIP's learning on ~400 million internet retrieved images from diverse categories and its consequential strong zero-shot image recognition performance over different distributions [36, 41], we argue that its image encoder Z(-) outputs an embedding that has captured attributes of input image with distinct generalized visual features. GAMA leverages this to our advantage, and maximizes the difference between 2 and CLIP's image encoder's embedding for clean image Ping: The aim of such an objective is to increase the transferability strength of Go(+) perturbations using the generalized features computed from I(-). This is envisioned using a regression learning based loss described as follows:
L min e
(1/KlIP.. -212)
Final Learning Objective (C). Loss functions Li and L... are finally added surrogate model loss fum that minimizes the cosine similarity of z and & [13]. Choice of layer & dependent on feature outputs of the CLIP model employed. All embeddings are normalized before computing the loss functions.
== min (C... Lun Ce))
(4)
Overall, Lun maximizes the difference between and æs from surrogate f(')'s perspective, while fun and L... enhance its transferability using CLIP's perspective.
Attack evaluation. We assume that the attacker has no knowledge of victim classifier g(-) and its data distribution D,. Further, there is perturbation budget of e defined by an foo norm. To launch an attack, input clean image æ, from target dataset D. to optimized Go(-) and craft imperceptible perturbations 5, in order to alter the decision space the target victim classifier g(.) (pre-trained on D:). Mathematically, this can be represented as y/: + Úr where, y: ((x:) and ÿt = g(xx ( + 8t) with ||6, loo I <. We can cause following attack scenarios after training Go(-) against f()) on D:
Scenario I: an attack termed white-box if f(-)= g() = and D = Dr
Scenario 2: attack termed black-box if either f()) A g()) DD
real-world attack is generally modeled by Scenario as an adversary would not have the knowledge of victim model g(-)'s architecture, its training data distribution D, and the task it performs e.g. single-label classification, multi-label classification, or object detection, etc. The perturbations that make attack successful in Scenario 2 should be highly transferable.
4 Experiments
In this section, we analyze the strength GAMA under diverse practical attack settings. We also perform an ablation analysis of GAMA, test the attack robustness against various defenses (176, 77], median blurring, context-consistert designs. Note that provide more black-box attack results in the supplementary material.
check), as well performance of attacks on different architecture
Baselines. As there no prior works for generative attacks that learn multi-object scenes using lulti-label classifiers, we define our baselines by adapting existing state-of- offe--ofthh sate-off-heeart generative attacks summarized in Table 1. Specifically, the cross-entropy loss in GAP [10] and CDA [11] is replaced with binary cross-entropy loss to handle the prediction of multiple labels during training.
Training Details. We use the multi-label datasets PASCAL-VOC [78] and MS-COCO [79] to train

---

Algorithm 1: GAMA pseudo-code
Input distribbtion D, batch size B, perturbation &s bound é
Input surrogate classifier f()). CLIP-encoders for text T(-) and image I())
Output optimized perturbation generator (o(-)'s weights
Randomly initialize 0. Load (as well freeze) f()). T-) and Z(+) with respective pre-trained weights
2 Create text embeddings matrix A. from T()) as described in Section 3.1
3 repeat
Input æ: to I(-) and get Pux
Randomly sample B vectors from Ars and get least similar text embedding Pox.. w.r.t. Pine
Input clean image æ (from D) to f(.) and compute mid-level embedding fx(
7 Input ær to Go (o()) and project it within bound using P(.) to obtain st
Input to f( f() and compute mid-level embedding (a(s))
Compute loss C by Equation (4) and minimize it update @ using Adam [75]
10 until convergence
generators for the baselines and our method. Unless otherwise stated, perturbation budget is set to
2 I 10 for all experiments. We chose the following surrogate models f(-) (Pascal- or MS-
COCO pre-trained multi-label classifiers): R5sNet152 (Res [80], DenseNet169 (Den169) [81],
and VGG19 [64]. For the CLIP model, we use the 'ViT-B/16' framework [36]. See supplementary material for more training details.
Inference Metries. We measure attack performances on multi-label classifiers using hamming score (%) defined in [82, 83]. For evaluations single-label classifiers and object detectors, we use top-1 accuracy (%) and bbox _as______oa [0, 1] metric, respectively. A lower score indicates better attack. Best results are in bold. For reference, accuracy on clean images is provided as 'No Attack'.
4.1 Results and Analysis
All trained perturbation generators (trained only on multi-label datasets) are extensively evaluated under following victim model settings.
White-box and black-bor box (multi-label classification, different model than f())): We evaluate the attacks in white-box and black-box settings six victim multi-label classifiers (VGG16, VGG19, ResNet50 (Res50), Res152, Den169, and DenseNet121 (Den121)) in Table and Table 3 (white-bor box attacks are marked with cell color). We outperform all baselines in the majority of cases, with an average absolute difference (w.r.t. closest method) of 13 percentage points (pp) for PoS and 46pp for MS-COCO.
Black-box (single-label classification): We evaluate the attacks in a black-bor -box setting with various single-label classifiers for CIFAR [84] (coarse-grained tasks [13]). CUB-200-201 I (CUB) [32]. Stanford Cars (Car) [85], and FGVC Aircrafts (Air) [86] (fine-grained tasks [13]) in Table 6, and ImageNet [87] (50K validation set) in Table 4 and Table Following [13], the vietim models of coarse-graines tasks are taken from [88], fine- geniigrieedd task models (Res50, SENet154 (SeNet), and SE-ResNer101 (se-Res101) [89]) from [90], and six ImageNet models from [33]. Here, we beat our closest baseline in all cases by ~ 13.33pp for Pascal-VOC and ~5.83pp for MS-COCO on six ImageNet models. Note that the ImageNet results also demonstrate the drop in performance of TAP [12) and BIA [13] attacks that show close to 0% top-1 accuracy when Ge(.) is trained on ImageNet on the attacker side [12, 13]. We hypothesize that such a drop in performance is due to sensitivity to the dataset of the manually selected mid-level layer of f()) used by the attacker. We observe similar trend when attacking non-Imag Imageete distributions as suggested by BIA [13] in coarse and fine mn--graieed tasks in Table 6. In this case, GAMA beats the prior attacks by average ~13.33pp when (.).) is trained with Pascal-VOC
Black-box (Object detection): We also evaluate a difficult black-box attack with state-of-the-art MS-COCO object detectors (Faster RCNN with Res50 backbone (FRCN) [91], RetinaNet with Res50 backbone (RNet) [92]. DEtection TRansformer (DETR) [93]. and Deformable DETR (D²ETR) [94]) in Table 7, available from [95]. It can be observed that GAMA outperforms competitors when Go (-) is trained with Pascal-VOC.
7

---

Table 2: Pascal-VOC
Pascal-VOC
Table 3: MS-COCO MS-COCO
Meibod
VGGTG
VGG119
RosS0
Ros152
Dent69
Dvai31
Anrrgg
Meihed
VGGG66
VGGG1
Redii
Deni89
Ytock
$2.51
43.15
30.52
53.74
53.07
$2.09
Attack
66.30
66.48
07.95
07.59
66.39
66.64
GAP [10]
19:64
10.50
72.95
76.24
08.75
06.30
55.45
GAP[T9]
8:31
10.51
19.09
05.00
01:00
38.12
30.92
V60
[DD [11]
16.16
20.52
61.40
65.67
10:53
07.67
51.13
CDA [11]
6.57
8:57
17.55
43:56
55-41
15. 59.99
79, 34
TAP [12)
26.77
19.26
65.95
66.95
68.65
64.51
51.84
TAP [12)
3.45
6.14
25.77
29.56
30,05
21.15
17.68
14:00
27.95
21.45
6.11
41.17
41.35
GAMA
1.59
3.25
93.45
24.00
13.94
GAP [10]
56.93
56.20
65.55
72.25
75.22
n9.56
65.05
GAPTR0]
22.39
45.41
51.22
33.35
54.16
32.54
09.34
Red13
CDN [11]
41.07
58.24
47.60
56.52
$3.64
47.22
67.50
64.56
39.65
52.81
Roil
CDA [11]
TAP (12)
24.34
30.15
25.94
37.79
42.33
24.13
45.13
35.55
49.24
33.06
44.33
24.74
41.65
[13]
51.98
BIA 113]
23.73
22.76
22.16
56,05
32.41
27.45
GAMA
33.42
39.42
32.39
20.46
49.76
49.54
37.49
GAMA
24.52
27.73
30.62
23.04
31.30
27.31
27.42
GAF [10]
62.09
59.55
65,50
72.81
76.09
72.70
68.64
GAP [10]
29.85
32.77
36.15
+0.84
24.95
33,99
33.43
Destd9
59.65
AvaLEs
1111
39.39
41.19
43.42
44.53
64.29
[17]
TAP (17)
27:73
00.33
15.73
70.90
[15]
51.77
16.15
61.31
54.01
58.85
55.77
RIA [13]
20.01
70 59
14.01
41.42
13.97
34.89
28.83
GAMA
44.25
52,89
45,63
53.25
45,00
$0.96
49.19
GAMA
10.40
13.47
19.30
23.46
6.65
10.29
14.26
Table 4:
Pascal-VOC. + ImageNet
Table 5: MS-COCO + ImageNet
10
No
Method
VGU1
VGG19
ResSi
Res152
Den121
Dentol
75.74
Average
73.83
]()
Method
VGG16
VGG19
Redi
Rea152
Daail1
Deni69
Avcrigt
75.81
CAP (10)
34.44
21.64
63.65
67.84
63.09
63:47
51.02
GAP [10]
15.55
15.06
49.50
55.07
47.05
53.49
39.55
VGG19
CDA [111
13.83
11.99
47.32
53.92
46.81
52.24
37.68
VGC19
C33N
13.05
12.59
66.77
52.55
43.55
50.05
36.42
TAP [121
04.70
07.25
50.94
$7.36
47.68
53.43
37.23
TAP (12)
02.31
02:91
19.28
35.20
19.65
23.42
17.10
48.53
$7.65
$3.37
33.95
(13
36.55
24.36
GAMA
60,17
60.41
22.82
34.04
24.51
30,35
1941
GAMA
62
02.57
19.59
15.21
76.20
57.96
19:81
GAP (10)
54.54
14.07
$2.85
61.51
35.09
96.36
5006
(A0
32.95
34,41
$3.34
12.55
30.56
04.11
12.09
CDA
44.25
51.62
42.17
35.09
39.40
54.84
53.55
58.92
09102
BIA (13)
37:44
34.56
36.74
45.48
51.36
56-40
(15)
14.98
21.98
36.11
24.84
GAMA
16.45
17.02
21.93
17.07
31.63
30,57
22.44
GAMA
17:94
19.16
24.37
17.34
25.07
36,37
23.19
GAP
57.79
65.31
36.55
GAP (10)
10.93
11
40/87
51.17
41.00
37.46
18.61
Deatel
CDD
TAP [12)
28.92
37.51
10.19
52.30
38.36
50.92
61.78
54.68
45.88
57.85
00.78
50.13
39.17
Denit
TAP [12)
25.45
27.30
45.76
30.83
53.44
25.34
20.52
47.51
RIA (15)
26.13
47
17.00
61. MM
40.63
99.56
16.88
[IN
20.91
25.01
37.16
50.63
34.71
29.38
$1.97
GAMA
31,67
36.12
GAMA
$6.34
16.3
1099
11.00
13.2
06.21
1234
Table 6: PaScal-VOC. + Coarse (CIFAR10/100) and Fine- grained (CUB, Car, Air) tasks
CIFARIO
CIFAR100
CUB
CUB
CUB
Car
Car
Air
Air
Method
Average
f6)
[88]
[88]
Res50
ScNet
se-Res101
Rex50
ScNet
se-Res101
Res50
ScNet
se-Res101
No Attack
93.79
74,28
87.35
86.81
86.54
94.35
93.36
92.97
92.23
92.05
91.90
89.60
GAP [10]
73.58
39.10
78.94
79.79
80.41
82.33
85.71
87.19
81.19
81,82
79.99
77.27
VGG19
CDA [1]]
70.40
44.68
54.76
64.74
68.99
70.87
75.64
81.78
42.87
74.38
77.20
66.02
TAP [12]
73.18
35.41
72:42
74.39
73.94
78.40
77.08
84.59
78.91
78.94
75.52
72.98
BIA [IA
59.82
27.84
68.31
64
73:70
75.61
67.90
81.83
75.88
66.13
76:75
67.22
GAMA
53.85
53.52
66.93
60.08
69.11
78.95
45.51
63.37
56.56
GAP [10]
69.80
41.06
64.96
80.01
81.77
72.62
86.02
87.53
84.28
84.64
85.48
76.19
Res152
CDA [1])
77.60
49.43
65.38
71.52
71.63
73:04
76.52
79.54
66.61
72.73
60.10
69.46
TAP [12)
70.92
38.39
48.60
73:20
76.10
69.02
86.62
81 94
74.65
80.68
83:20
71.21
BIA (13)
67.54
36.43
51.17
70.64
71.63
70.85
82.85
80.21
72.94
80.20
81.01
69.58
GAMA
09.53
38.57
27.67
64.79
59.18
80.50
59.71
69.10
65.77
61.26
GAP [19]
83.25
56.06
64:70
76.77
80.65
85.95
81.79
84.40
85.03
78.50
Den169
CDA [1]]
84.34
58.03
61.75
73.40
71.75
84.21
85.57
84.58
78.97
82.24
78.22
76.64
TAP [12]
86.77
58.67
54.04
64.45
62.51
76.13
81.35
82,91
34.02
76.66
76.75
68.55
[I3]
85,20
55,21
47.95
58.18
56,02
55.88
73.65
72.30
62.47
72.97
70.39
64.56
GAMA
78:27
46.80
33.57
57.44
63.24
49.31
70.65
75.14
48.48
62.95
70.15
59.63
Gel Stuiied
46.03
(8)
Soower
90000
30.00
(a) Custom architecture (both from (88))
(b) Standard architecture (left: Res50, right: se- sc-Res101)
Figure 3: Transferability on types of victim model designs. GAMA shows potent transferring attacks to victim networks that were custom designed (Figure 3(a)) and that contain standard blocks like Residual blocks [80] (Figure 3())..
8

---

Provel VOC Phoce VOC
bragche
Table Pascal-VOC MS-COCO Object Detection task
Method
FRCN
RNet
DETR
D'ETR
Average
f(-
No Attack
0.582
0.554
0.607
0.633
0.594
GAP [10]
0.424
0.404
0,360
0.410
0.399
VGG19
CDA [11]
0.276
0.250
0.208
0.244
0.244
[AP[12]
0.384
0.340
0.275
0.320
0.329
BIA [13]
0.347
0.318
0.253
0.281
0.299
Figure 4: Ablation analysis of loss objec- tive. We analyze the contribution due to the introduction of cach loss function Liz and
GAMA
0.234
0.207
0.117
0.122
0.170
GAP [10]
0.389
0.362
0.363
0.408
0.380
Res152
CDA [11]
0.305
0.274
0.256
0.281
0.279
fin towards the final objective L, both in
TAP [12]
0.400
0.348
0.288
0.350
0.346
same distribution (left) and different distribu- tion (right). The surrogate model Res152.
BIA [13]
0.321
0.275
0.205
0,256
0.264
GAMA
0.172
0.138
0.080
0.095
0.121
Performance on Type of Architectures. In Figure 3, we further study the transferability of attacks depending on the type of victim architecture: standard which follow the standard modules like Residual blocks [80] to build the classifier, and custom where the victim classifier doesn't It adhere to specific pattern of network modules. In both cases, GAMA consistently maintains better attack rates than other attacks. This shows convincing transferability of perturbations crafted from GAMA's s Go(-) under diverse black-box settings. We provide additional results in the supplementary material.
Robustness of Attacks against Defenses. To analyze the robustness of all the methods, we launch misclassification attacks (Ge(-) trained on MS-COCO with the surrogate model as Den when the victim deploys input processing based defense such as median blur with window size as 3 x 3, and Neural Representation purifier (NRP) [76] on three ImageNet models (VGG16, R52, Den1 From Table 8(a) and Table 8(b), we can observe that the attack success of GAMA is better than prior methods even when the victim pre-processes the perturbed image before making decisions. In Figure 8(c), we observe that Projected Gradient Descent (PGD) [77] assisted Res50 is difficult to break with GAMA performing slightly better than other methods. Finally, motivated by [96], we analyze an output processing defense scenario where the victim can check the context consistency of predicted labels on perturbed images using the co-occurrence matrix O. In particular, if perturbed image is misclassified showing co-occurrence of labels not present in O, we term this as a detected attack. Otherwise, we call an undetected attack. To measure this performance, we first compute the co-occurrence matrix Os by perturbing all the test set images and estimate its precision w.r.t. ground-truth O. To check for attacks that have high precision value p and high miselassification rate, we calculate 'context score' (higher is better) that is a harmonic mean of p and misclassification rate (I-accuracy). We show the attack performance against this context consistency check in Figure 8(d) for both Pascal-VOS and MS-COCO averaged over all surrogate models under white-box attacks. Clearly, GAMA presents itself as the best undetected attack compared to prior works.
Ablation Analysis. We dissect the contribution of each loss function in our proposed loss objective of Equation (4) in Figure 4 where G- is trained with Pascal-VOC with Res 152 surrogate model. We analyze the attack transferability to different victim models (VGG16, Res50). We observe that the introduction of each loss objective (left to right) increases the strength of the attack both in the same distribution (Pascal- VOC) as the attacker and in the unknown distribution (ImageNet) on both victim classifiers. Finally, we visualize some perturbed image examples crafted by GAMA in Figure 5.
Method
Res153
Den121
Avergge
Meehad
VGG16
Res155
Deni21
Awarage
No Amack
64.57
76114
T1
09:57
No Atrick
16.25
63.37
68
62.61
33.35
36.90
46.34
45.52
GAF(
31.08
45.11
37.85
38.01
CDA [1:]]
37.89
58.95
56.0 19
$1.02
CDA [11]
34.61
47.56
51.32
44.52
37.95
36.54
BIA (13)
25.09
46.34
41.96
[13)
19.04
41.00
25.07
23.08
GAMA
20.34
29.6
37.58
35.85
GAMA
7.38
19.00
7.87
11.41
010
Jaaks
(a) Median Blur
(b) NRP
(c) PGD (E 4
(d) Context check
Table 8: Robustness Analysis against various defenses. Our proposed attack GAMA consistently shows better performances compared to baselines in scenarios where the victim deploys attack defenses.

---

person, bus
person, dog, bicycle
dog, traffic light
aeroplane
Aika
sofa, tv monitor
potted plant, cat
dinning table, chair
bottle, chair
Anika
Figure 5: Qualitative Examples. We show some clean (lop) and perturbed (bottom) images from GAMA. Best viewed in color/zoomed.
Conclusion
In this paper, we propose new generative attack GAMA that can learn to create perturbations against multi-object scenes. For the first time in generative attack literature, we show the utility of a pre- trained dision-and-languaa
model CLIP to optimize effectual perturbation generators. Specifically, CLIP's joint text and image aligning property allow us use natural language semantics in order to handle the multi-object semantics in the input scene to be perturbed. To demonstrate GAMA'S s efficiency, we perform extensive experiments that show state-of-the-art attacks across wide range of black-box victim models Amulti-label/single- the robustness of our attacks against various defense mechanisms. As part of our future works, we will explore more complex methodologies to employ vision-language models both for adversarial attacks and defense systems.
classifiers. and object detectors). We also evaluate
Limitations and Societal Impacts
Limitations. The pre-trained CLIP model "ViT-B16' outputs 512-dimensional embedding that restricts us to compare the features extracted from the surrogate model our losses the same size. Another limitation of our method is the use of co-occurencce matrices to extract the right pair of classes that exist together in real-world scenes. this paper. we make an assumption that text prompts are created using two classes that exist together according to the co-occurrence matrix of size C' x C (for C' classes in the data distribution). However, we can also use a triplet of classes that exist together in input scene which would need co-occurrence tensor of size C x C C. Computing such a huge tensor would be tedious to cover all the images provided the train set (usually in the order of thousands).
Societal Impacts. Adversarial attacks are designed with the sole goal to subvert machine decisions by any means available. Our attack approach shows one such method where a benign open-sourced vision-language model can utilized by an attacker to create potent perturbations. This demonstrates the need for the victim to prepare for constantly evolving attacks that may cause major harm in real-world systems (e.g. person re-identification [97]). We believe that our work can help further propagate research into designing efficient and robust models that do not break down to attacks built upon multi-modal (in our case, text-image) features. Future researchers should also be aware of video generative models [98, 99] that can be used to create adversarial attacks for ubiquitous video classifiers built on the success of langun-e models.
Acknowledgement. This material is based upon work supported by the Defense Advanced Research Projects Agency (DARPA) under Agreement No. HR001 12090096. Approved for public release; distribution is unlimited.
10

---

References
[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfel- low, and Rob Fergus. Intriguing Properties of Neural Networks. arXiv preprint arXiv: 1312.6/99, 2013.
[2] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Adver- sarial Examples. arXiv preprint arXiv:1412.6572. 2014.
[3] Linxi Jiang, Xingjun Ma, Shaoxiang Chen, James Bailey, and Yu-Gang Jiang. Black-box adversarial attacks on video recognition models. In Proceedings of the 27th ACM International Conference on Multimedia, pages 864-872 6644 2019.
[4] Huanqian Yan, Xingxing Wei, and Bo Li. Sparse black-box video attack with reinforcement learning. arXiv preprint wrXhv:2011.03754 2020.
[5] Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat-Seng Chua, Fengfeng Zhou, and Yu- la-Gang Jiang. Heuristic black-bo box adversarial attacks on video recogmition models. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 12338 12345,, 2020.
[6] Shasha Li, Abhishek Aich, Shitong Zhu, Salman Asif, Chengyu Song. Amit Roy- foy-Chowdhury, and Srikanth Krishnamurthy. Adversarial attacks on black box video classifiers: Leveraging the power of geometric transformations. Advances in Neural Information Prucessing Systems, 34, 2021.
[7] Hu Zhang, Linchao Zhu, Yi Zhu, and Yi Yang. Motion-excited sampler: Video adversarial attack with sparked prior. In European Conference on Computer Vision. Springer, 2020.
[8] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks, In 2017 IEEE symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
(9] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: Simple and Accurate Method to Fool Deep Neural Networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2574-2582. IEEE, 2016.
[10] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative Adversarial Per- turbations. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 4422 -431. IEFF, 2018.
[11] Muzammal Naseer, Salman H Khan, Harris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-Domain Transferability of Adversarial Perturbations. arXiv preprint arXiv: 1905. / 1736, 2019.
[12] Mathieu Salzmann et al. Learning transferable adversarial perturbations. Advances in Neural Information Processing Systems, 34, 2021.
[13] Qilong Zhang, Xiaodan Li, YueFeng Chen, Jingkuan Song, Lianli Gao, Yuan He, and Hui Xue', Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. In International Conference on Learning Representations. International Conference on Learning Representations (ICLR), 2022.
[14] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning scale. arXiv preprint 1rXiv:161..01253 2016.
[15] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep Neural Networks Easily Fooled: High Confidence Predictions for Unrecognizable Images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436. IEEE, 2015.
[16] Qingquan Song, Haifeng Jin, Xiao Huang, and Xia Hu. Multi-label adversarial perturbations. In 2018 IEEE International Conference on Data Mining (ICDM), pages 1242-1247. IEEE, 2018.
[17] Nan Zhou, Wenjian Luo, Xin Lin, Peilan Xu, and Zhenya Zhang. Generating multi-label adversarial examples by linear programming. In 2020 International Joint Conference on Neural Networks (IJCNN) pages 1-8. IEEE, 2020.

---

[18] Shaohao Lu, Yuqiao Xian, Ke Yan, Yi Hu, Xing Sun, Xiaowei Guo, Feiyue Huang, and Wei-Shi Zheng. Discriminator-free generative adversarial attack. In Proceedings of the 29th ACM International Conference on Multimedia, pages 1544-1552, ACM, 2021.
[19] Alex Krizhevsky, Ily Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012.
[20] Matthew R Boutell, Jiebo Luo, Xipeng Shen, and Christopher M Brown. Learning multi-label scene classification. Pattern recognition, 3709)1757-1771, 2004.
[21] Min-Ling Zhang and Zhi-Hua Zhou. MI-knn: A lazy learning approach to multi-label learning. Pattern recognition, 40(7):2088-2448, 2007.
[22] Jesse Read, Bernhard Pfahringer, Geoff Holmes, and Eibe Frank. Classifier chains for multi- label classification. Machine learning, page 333, 2011.
[23] Shang-Fu Chen, Yi-Chen Chen, Chin Yeh, and Yu-Chiang Wang. Order-free mn with visual attention for multi-label classification. In Proceedings of the AAAI Conference Artificial Intelligence. AAAI, 2018.
[24] Erin L Allwein, Robert E Schapire, and Yoram Singer. Reducing multiclass to binary: A unifying approach for margin classifiers. Journal of machine learning research, 1(Dec): 13-141, 2000.
[25] Zhao-Min Chen, Xiu-Shen Wei, Peng Wang, and Yanwen Guo. Multi-Label Image Recognition with Graph Convolutional Networks. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2019.
[26] Zikui Cai, Shantanu Rane, Alejandro E Brito, Chengyu Song, Srikanth V Krishnamurthyy Amit K Noy-Chowdhhry, and M Salman Asif. Zero-query transfer attacks context-aware object detectors. arXiv preprint arXiv:2203. /5230, 2022.
[27] Zikui Cai, Xinxin Xie, Shasha Li, Mingjun Yin, Chengyu Song, Srikanth V Krishnamurthy, Amit K Koy-Chowdhury, and M Salman Asif. Context-aware transfer attacks for object detection. arXiv preprint 1rX0vv21 2021.
[28] Chawin Sitawarin, Arjun Nitin Bhagoji, Arsalan Mosenia, Mung Chiang, and Prateek Mittal. Darts: Deceiving autonomous cars with toxic signs. arXiv preprint arXiv: 0adv:/8800 1802.06430 2018.
[29] Shang-Tse Chen, Cory Cornelius, Jason Martin, and Duen Horng Polo Chau. Shapeshifter: Robust physical adversarial attack on faster r-cnn object detector. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pages 52-68. Springer, 2018.
[30] Mingjun Yin, Shasha Li, Zikui Cai, Chengyu Song, M Salman Asif, Amit K Roy- Chowdhury,, and Srikanth V Krishnamurthy, Exploiting multi-object relationships for detecting adversarial attacks in complex scenes. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7858-7867, 2021.
[31] Chaowei Xiao, Bo Li, Man Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating Adversarial Examples with Adversarial Networks. arXiv preprint
2018.
[32] Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. The caltech-uesd birds-200-2011 dataset. 2011.
[33] PyTorch. Imagenet models and pre-trained weights. PyTorch, 2022. URL https::////yytorcc watission/stabl//mooooo
html.
[34] Claudine Badue, Rânik Guidolini, Raphael Vivacqua Carneio, Pedro Azevedo, Vinicius B Cardoso, Avelino Forechi, Luan Jesus. Rodrigo Berriel, Thiago M Paixao, Filipe Mutz, et al. Self-driving cars: A survey, Expert Systems with Applications, 165:113816,, 2021.
[35] Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoe Le, Yun- Hsuan Sung, Zhen Li, and Tom Duerig. Scaling up visual and vision-languag representation learning with noisy text supervision. International Conference on Machine Learning, pages 4904-4916. PMLR, 2021.
12

---

[36] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning. pages 7748-8763. PMIR, 2021.
[37] Norman Mu, Alexander Kirillov, David Wagner, and Saining Xie. Slip: Self-supervision meets language-image pre-training. arXiv preprint arXiv:2112.1275: 2021.
(38) Yangguang Li, Feng Liang, Lichen Zhao, Yufeng Cui, Wanli Ouyang, Jing Shao, Fengwei Yu, and Junjie Yan. Supervision exists everywhere: data efficient contrastive language-image pre-training paradigm. arXiv preprint arXiv:21 2021.
[39] Lewei Yao, Runhui Huang, Lu Hou, Guansong Lu, Minzhe Niu, Hang Xu, Xiaodan Liang, Zhenguo Li, Xin Jiang, and Chunjing Xu. Filip: Fine-graines interactive language-image pre-training. arXiv preprint arXiv:2111.07783 2021.
[40] Huaishao Luo, Lei Ji, Ming Zhong, Yang Chen, Wen Lei, Nan Duan, and Tianrui Li. Clip4clip: An empirical study of clip for end to end video clip retrieval. arXiv preprint arXiv:2104.0886) 2021.
[41] Or Patashnik, Zongze Wu, Eli Shechtman, Daniel Cohen-Or, and Dani Lischinski. Styleclip: Text-driven manipulation of stylegan imagery. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 2085-2094, 2021.
[42] Apoorv Khandelwal, Luca Weihs, Roozbeh Mottaghi, and Aniruddha Kembhavi. Simple but effective: Clip embeddings for embodied ai. arXiv preprint arXiv:211..0980 2021.
[43] Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06/15, 2022.
[44] Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International Conference on Machine Learning, pages 8821-8831. PMLR, 2021.
[45] Marcos V Conde and Kerem Turgutlu. Clip-art: contrastive pre-training for fine-grained art classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3956-3960, 2021.
[46] Rinon Gal, Or Patashnik, Haggai Maron, Gal Chechik, and Daniel Cohen-Or. Stylegan-nada: Clip-guided domain adaptation of image generators. arXiv preprint 100i::2200.0004466 2021.
[47] Aditya Sanghi, Hang Chu, Joseph G Lambourne, Ye Wang, Chin-Yi Cheng, and Marco Fumero. Clip-forge: Towards zero-shot text-to-shapp generation. arXiv preprint arXiv:2110.02624 2021.
[48] Gwanghyun Kim and Jong Chul Ye. Diffusionclip: Text-guides image manipulation using diffusion models. arXiv preprint arXiv:2110.02711. 2021.
[49] Gihyun Kwon and Jong Chul Ye. Clipstyler: Image style transfer with a single text condition. arXiv preprint arXiv:2112.00374 2021.
[50] Yongming Rao, Wenliang Zhao, Guangyi Chen, Yansong Tang, Zheng Zhu, Guan Huang, Jie Zhou, and Jiwen Lu. Denseclip: Language-guides dense prediction with context-aware prompting. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[51] Manling Li, Ruochen Xu, Shuohang Wang, Luowei Zhou, Xudong Lin, Chenguang Zhu, Michael Zeng, Heng Ji, and Shih-Fu Chang. Clip-event: Connecting text and images with event structures. arXiv preprint arXiv:2001.05000 2022.
[52] Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Analysis of Classifiers' Robustness to Adversarial Perturbations. Machine Learning, pages 481-508, 2018.
13

---

[53] Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, and Dacheng Tao. Perceptual Senssiivv GAN for Generating Adversarial Patches. In Proceedings of the AAAI conference on artificial intelligence, pages 1028-1035. AAAI, 2019.
[54] Jiangfan Han, Xiaoyi Dong, Ruimao Zhang, Dongdong Chen, Weiming Zhang, Nenghai Yu, Ping Luo, and Xiaogang Wang. Once MAN: Towards Multi-Target Attack via Learning Multi- Target Adversarial Network Once. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5158-5167. IEEE, 2019.
[55] Chaowei Xiao, Jun Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. arXiv preprint arXiv: wew.:020100011110 2018.
[56] Krishna Kanth Nakka and Mathicu Salzmann. Indirect local attacks for context-awar semantic segmentation networks. In European Conference Computer Vision, pages 611-6111666 611-628, Springer, 2020.
[57] Shu Hu, Lipeng Ke, Xin Wang, and Siwei Lyu. Tkml-ap: Adversarial attacks to top-k multi- label learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7649-7657, IEEE, 2021.
[58] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting Adversarial Attacks with Momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185-9193. IEEE, 2018
[59] Yanbo Fan, Baoyuan Wu, Tuanhui Li, Yong Zhang, Mingyang Li, Zhifeng Li, and Yujiu Yang. Sparse adversarial attack via perturbation factorization. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part XXII 16, pages 35-50. Springer, 2020.
[60] Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A Forsyth. Unrestricted adversarial examples via semantic manipulation. arXiv preprini DrXiiv/904.000 2019.
[61] Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, and Bo Li. Semanti- cadv: Generating adversarial examples via attribute-conditioned image editing. In European Conference on Computer Vision, pages 19-37. Springer, 2020.
[62] Alexia Jolicoeur-Martineau. The relativistic discriminator: a key element missing from standard gan. In International Conference on Learning Representations, 2018
[63] Han Fang, Pengfei Xiong, Luhui Xu, and Yu Chen. Clip2video: Mastering video-text retrieval via image clip. arXiv preprint arXiv:2106.11097, 2021.
[64] Karen Simonyan and Andrew Zisserman. Very Deep Convolutional Networks for Large-Scale Image Recognition. arXiv preprint 10Xiv:1409.1556, 2014.
[65] Justin Johnson, Alexandre Alahi, and Li Fei-Fei. Perceptual Losses for Real-Time Time Style Transfer and Super-Resolune In European conference on computer vision, pages 694-711. Springer, 2016.
[66] Roey Mechrez, Itamar Talmi, and Lihi Zeinik-Mandn The contextual loss for image transfor- mation with non-aligned data. In Proceedings of the European conference on computer vision (ECCV), pages 768-783, 2018
[67] Jack Hessel, Ari Holtzman, Maxwell Forbes, Ronan Le Bras, and Yejin Choi. CLIPScore: reference-free evaluation metric for image captioning. EMNLP, 2021.
[68] Kaiyang Zhou, Jingkang Yang, Chen Change Loy, and Ziwei Liu. Conditional prompt learning for vasionnl models. In CVPR, 2022.
[69] Zhao-Min Chen, Xiu-Shen Wei, Peng Wang, and Yanwen Guo. Multi-label image recognition with graph convolutional networks. Proceedings of the IEFF/CVE conference on computer vision and pattern recognition, pages 5177-5186, 2019.
14

---

[70] Md Amirul Islam, Matthew Kowal, Konstantinos G Derpanis, and Neil DB Bruce. Segmix: Co-occurrence driven mixup for semantic segmentation and adversarial robustness. arXiv preprint arXiv:2108.09922) 2021.
[71] Hang Zhang, Han Zhang, Chenguang Wang, and Junyuan Xie. Co-occurrent features in semantic segmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 548-557, 2019.
[72] Md Amirul Islam, Matthew Kowal, Konstantinos G Derpanis, and Neil DB Bruce. Feature binding with category-dependee mixup for semantic segmentation and adversarial robustness. arXiv preprint arXiv:2008.05667, 2020.
[73] Raia Hadsell, Sumit Chopra, and Yann LeCun. Dimensionality reduction by learning an invariant mapping. In 2006 IEEE Computer Society Conference on Computer Vision and Puttern Recognition (CVPR'06) volume 2. pages 1735-1742. IEEE, 2006.
[74] Ching- Yao Chuang, Joshua Robinson, Yen-Chen Lin, Antonio Torralba, and Stefanic Jegelka. Debiased contrastive learning. Advances in neural information processing systems, 33:8765- 8775, 2020.
[75] Diederik P Kingma and Jimmy Ba. Adam: A Method for Stochastic Optimization. arXiv preprint arXiv: 1412.6980, 2014.
[76] Muzammal Naseer, Salman Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. A supervud approach for adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 262-271, 2020.
[77] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arxiv: (00.:770600083, 2017.
[78] Mark Everingham, Luc Van Gool, Christopher KI Williams, John Winn, and Andrew Zisserman. The Pascal Visual Object Classes (VOC) Challenge. International journal of computer vision, 88(2):303-338, 2010.
[79] Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft COCO: Common Objects in Context. In European conference on computer vision, pages 740-755. Springer, 2014.
[80] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. In Proceedings gs of the IEEE conference on computer vision and pattern recognition, pages 770-778. IEEE, 2016.
[81] Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely Con- nected Convolutional Networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700-4708. IEEE, 2017.
[82] Shantanu Godbole and Sunita Sarawagi. Discriminative methods for multi- multi-labeled classification. In Pacific-Asia conference on knowledge discovery and data mining, pages 22-30. Springer, 2004.
[83] Mohammad S Sorower. literature survey on algorithms for multi-label learning. Oregon State University, Corvallis, 18:1-25, 2010.
[84] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
[85] Jonathan Krause, Jia Deng, Michael Stark, and Li Fei-Fei. Collecting large-scale dataset of fine-grained cars. 2013.
[86] Subhransu Maji, Esa Rahtu, Juho Kannala, Matthew Blaschko, and Andrea Vedaldi. Fine- grained visual classification of aircraft. arXiv preprint arXiv:1306.5751, 2013.
15

---

[87] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- scale hierarchical image database. 2009 IEEE conference on computer vision and pattern recognition, pages 248-255. IEFF, 2009.
[88] Aaron Chen. Coarse-grain models and pre-trained weights. GitHub link, 2022. URL https:
/ //github. com/aaron- wttpaaaaannniceecaaaaaaaaaaaaaaa wwwwhhiichhccrrreeeeeeee pwwphhhundaggddudd....
[89] Jie Hu, Li Shen, and Gang Sun.
networks. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 7132-7141. IEEE, 2018.
[90] Alibaba-AAIG. Fine-grain models and pre-trained weights. GitHub link, 2022.
URL https://gi tttpb//ggtttuuut/t/ www/Aliiaaaaaaaocooocoooo AAIGA zip..
[91] Ross Girshick. Fast r-cnn. In Proceedings the IEEE international conference on computer vision, 2015.
[92] Tsung- Yi Lin, Priya Goyal, Ross Girshick, Kaiming He, and Piotr Dollár. Focal loss for dense object detection. In Proceedings of the IEEE international conference on computer vision, 2017.
[93] Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In ECCV, 2020.
[94] Xizhou Zhu, Weijie Su, Lewei Lu, Bin Li, Xiaogang Wang, and Jifeng Dai. Deformable detr: De- formable transformers for end-to-end object detection. In International Conference on Learning Representations, 2021. URL https: http:p:://pppeeeeeeee
wwt. www.:formmmmiddddd. wtg.
[95] Kai Chen, Jiaqi Wang. Jiangmiao Pang, Yuhang Cao, Yu Xiong, Xiaoxiao Li, Shuyang Sun, Wansen Feng, Ziwei Liu, Jiarui Xu, Zheng Zhang, Dazhi Cheng, Chenchen Zhu, Tianheng Cheng, Qijie Zhao, Buyu Li, Xin Lu, Rui Zhu, Yue Wu, Jifeng Dai, Jingdong Wang, Jianping Shi, Wanli Ouyang, Chen Change Loy, and Dahua Lin. MMDetection: Open mmlab detection toolbox and benchmark. arXiv preprint 190.:1906.07155, 2019.
[96] Shasha Li, Shitong Zhu, Sudipta Paul, Amit Roy-Chhwddhur, Chengyu Song, Srikanth Krishna- murthy, Ananthram Swami, and Kevin S Chan. Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency. In European Conference on Computer Vision, pages 396-413. Springer, 2020.
[97] Abhishek Aich, Meng Zheng, Srikrishna Karanam, Terrence Chen, Amit K. Roy-Chowdhury, and Ziyan Wu. Spatio-temporal representation factorization for vidco-based person re- identification. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 152-162, October 2021.
[98] Abhishek Aich, Akash Gupta, Rameswar Panda, Rakib Hyder, M. Salman Asif, and Amit K. Roy-Chowdhury. Non-adversarial video synthesis with learned priors. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), June 2020.
[99] Akash Gupta, Abhishek Aich, and Amit K Roy-Chowdhury. Alanet: Adaptive latent atten- tion network for joint video deblurring and interpolation. In Proceedings of the 28th ACM International Conference Multimedia, pages 256-264, 2020.
16

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes]
(c) Did you discuss any potential negative societal impacts of your work? [Yes]
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either the supplemental material or as a URL)? [Yes]. The code has been released here: https: //gi thub. cww/ con/abbisee www.ssheeeihhhi. (AA/27//MAAPPPA GAMAApytorchhh
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes]. We provide these details in the supplementary material.
(c) Did you report error bars (e.g., with respect to the random seed after running ex- periments multiple times)? [Yes]. We provide these details the supplementary material.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes]. . We provide these details in the supplementary material.
4. If you using existing assets (e.g., code, data, models) or curating/releasing assets...
(a) If your work uses existing assets, did you cite the creators? [Yes].
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any assets either in the supplemental material URL? [N/A]
(d) Did you discuss whether and how consent was obtained from people whose [N/A]
(c) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given participants and screenshots, if applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, applicable? [N/A]
(c) Did you include the estimated hourly wage paid to participants and the total amount spent participant compensation? [N/A]
17


Reviews:
[{"review_id": "qYPh2wQ3Lw1", "reviewer": "Reviewer_SbKy", "summary": "This paper proposes the first generative adversarial attack specifically for multi-object scene classification. It makes use of a CLIP model to provide additional losses during training. Good performance is achieved across a variety of tasks and models in black box and white box settings.", "questions": "1. Can you explain why you think the method works better when trained on Pascal-VOC vs MSCOCO?\n2. Have you evaluated the adversarial images on the clip model? ", "limitations": "The discussion of limitations and societal impacts is good.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper is well written and the explanation of the method is relatively easy to understand given its complexity.\n- The results are convincing and demonstrate the effectiveness of the method on various tasks, datasets and models, and in both black and white box settings.\nWeaknesses:\n- The method does not outperform the baselines as consistently when trained on MSCOCO as it does on Pascal-VOC", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "mUBB6Yiyouj", "reviewer": "Reviewer_zurs", "summary": "This paper studies the problem of adversarial attacks on multi-object scenes by leveraging a pre-trained vision language model. More specifically, it leverages the joint embedding space learned from cross-modal data to provide self-supervised signals for generating adversarial perturbations on the image domain. Experiments have been conducted on multiple image benchmarks including single-object benchmarks such as PASCAL-VOC and multi-object benchmarks such as MS-COCO.", "questions": "* [Q1] Explain why GAMA is less effective than TAP in some cases as mentioned in [W1]. \n* [Q2] Provide some findings and analysis of the GAMA perturbations (e.g., raw input level and feature level).", "limitations": "Limitations have been mentioned in the paper.", "rating": 7, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n* [S1] This paper presents a clean solution to generating multi-object attacks. The quantitative results demonstrate the strength of the proposed attacks when compared to state-of-the-art attacks. The reviewer feels that the paper could possibly open up a new research area of using foundation models to craft adversarial attacks and defenses in the future.\n\nWeaknesses:\n* [W1] In Table 3 and Table 5, the proposed GAMA is less effective than TAP [Ref 12] when applied to the VGG19 network. It would be helpful to provide some explanations and high-level insights on this.\n* [W2] Although the quantitative experiments are thorough and solid enough, the qualitative analysis is definitely insufficient (Figure 5). As a scientific study, it would be helpful to understand how GAMA explores the perturbation space compared to other existing attacks (e.g., perturbation/feature visualization).\n* [W3] Missing discussions on mid-level or semantic-level adversarial attacks using generative models ([NewRef1-2]).\n\nReferences \n* [NewRef 1] SemanticAdv: Generating Adversarial Examples via Attribute-conditioned Image Editing. Qiu et al., In ECCV 2020.\n* [NewRef 2] Unrestricted Adversarial Examples via Semantic Manipulation. Bhattad et al., In ICLR 2020.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "SykELBQK34F", "reviewer": "Reviewer_pwfE", "summary": "This paper introduces the first multi-object generative attack, GAMA, which utilizes a pre-trained CLIP model as an attacker tool to enhance the transferability across different data distributions. Extensive experiments in this paper show that GAMA can achieve state-of-the-art transferability on various black-box settings when training on multi-label datasets. Besides, GAMA also shows its superior efficacy against various defense methods compared with baselines.", "questions": "1. See Con 1), How does GAMA perform and transfer compared with prior works on attacking single-object scenes? This result should play an important role in judging the significance and applicability of this paper to the community. If GAMA can still beat those baselines that focus on single-object attacks then in the future one could directly choose to use GAMA to perform attacks without caring about the number of objects in the image.\n\n2. For $\\rho\\_\\text{img}$ and $\\rho\\_\\text{txt}$, are you using the joint image/text embeddings or the embeddings that directly come from the image/text encoder? Do you use any normalization on $z$, $\\hat{z}$, $\\rho\\_\\text{img}$, and $\\rho\\_\\text{txt}$? If not, how do you ensure that $\\hat{z}$, $\\rho\\_\\text{img}$, and $\\rho\\_\\text{txt}$ are within the same feature space so that you can contrast them with each other, considering that the surrogate classifier and CLIP image/text encoder are using different architectures.", "limitations": "The authors adequately discussed the limitations and potential societal impact in the last section of the main paper.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Pros:\n\n1. This paper first proposes the problem of multi-object scene based adversarial attack. \n\n2. Introducing joint vision-and-language pre-trained models, such as CLIP, to adversarial attacks is interesting. Specifically, the authors generate multi-class text prompts and leverage the semantics relationship underlying the text representations to tackle the multi-object attack problem. \n\n3. When training on multi-label datasets, the proposed method outperforms prior works in terms of transferability on various black-box settings.\n\n4. This paper is clearly written and very easy to follow. \n\nCons:\n\n1. This paper only considers the settings of training on multi-object datasets in the experiments, such as Pascal-VOC and MS-COCO, and shows its superiority compared with prior works. Those prior works focus on single-object scenes and the authors adapted them to multi-object scenes. However, the proposed method should also be able to handle single-object scenarios, while the experiments of training on single-object scenes, such as ImageNet, and transferring to other single-object datasets, as done in TAP [12], BIA [13], are not included in this paper. I am curious about how GAMA performs compared with those prior works on this standard setting.\n\n2. Typos: L159 and L201: $\\mathcal{L}\\_{\\text{txt}}$ -> $\\mathcal{L}\\_{\\text{img}}$.\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "JFtHaGgFVKO", "reviewer": "Reviewer_FDtQ", "summary": "This paper proposes the GAMA attack, a generative approach to generating adversarial examples. The proposed method incorporates the vision-language model CLIP in the training of the generator. Experiments demonstrate the effectiveness of the proposed method in various attack settings.", "questions": "* Does the GAMA attack perform well on the single-object dataset like ImageNet? In Table 1, it is said that the GAMA attack can analyze both attacking scenarios with input scenes that contain multiple objects or a single object. However, in experiments, the GAMA attack is only trained on PASCAL-VOC and MS-COCO, which are scenes containing multiple objects. So does the GAMA attack perform well when training on the single-object dataset like ImageNet?\n* How to conduct fair comparisons with baseline methods, which aim to handle attacking scenarios with input scenes that contain a single object? As mentioned in Table 1, previous methods only analyze single-object attacking scenarios. However, in experiments, all previous methods are also trained on PASCAL-VOC and MS-COCO,  which are scenes containing multiple objects. Is it fair to compare with baseline methods in a different setting from their original design?", "limitations": "The authors adequately addressed the limitations and potential negative social impact of their work.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths \n* The paper is well-written and easy to follow.\n* Experiments demonstrate the effectiveness of the proposed method in various attack settings, including both the white-box and the black-box, even under the setting with different datasets and tasks.\n\n### Weaknesses\n* The major concern is that the algorithmic contribution of the proposed method is limited. The main contribution of the proposed method is incorporating the vision-language model CLIP in the training of the generator, which is also the main concern.  Previous methods only train the generator with a pre-trained DNN and the corresponding dataset. Instead of a pre-trained model, the proposed method requires access to the CLIP model. The  CLIP  extracts knowledge from ~400 million image-text pairs. Thus, the proposed method actually leverages much more information in training the generator, compared with previous generative approaches. Thus, the effectiveness of the proposed method is obvious, since it leverages much more information. From this perspective, the algorithmic contribution of the proposed method seems limited.\n\n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept