Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks
Authors: Shengming Yuan
Qilong Zhang
Lianli Gao
Yaya Cheng
Jingkuan Song
Venue: NeurIPS 2022 Accept (2022)
Keywords: unrestricted color attack
transferability
flexible
natural
semantic-based

Abstract: Unrestricted color attacks, which manipulate semantically meaningful color of an image, have shown their stealthiness and success in fooling both human eyes and deep neural networks. However, current works usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples. As a result, the black-box attack performance of these methods is limited. To boost transferability of adversarial examples without damaging image quality, we propose a novel Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset. By conducting extensive experiments and visualizations, we convincingly demonstrate the effectiveness of our proposed method. Notably, on average, results show that our NCF can outperform state-of-the-art approaches by 15.0%$\sim$32.9% for fooling normally trained models and 10.0%$\sim$25.3% for evading defense methods. Our code is available at https://github.com/VL-Group/Natural-Color-Fool.

Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks
Shengming Yuan
Qilong Zhang qilong. @hangdl@gmail com
shengming, yuan@outlook. com
Lianli Gao"
Yaya Cheng yaya. wwwennehotaminnncoooooooooo com
Jingkuan Song
lianli. Fianli.gaouuer www.uestc.cceooooom edu. cn
j jingkuan. wwngogmainnnccccooooooooommmo com
Center for Future Media, University Electronic Science and Technology of China
Abstract
Unrestricted color attacks, which manipulate semantically meaningful color image, have shown their stealthiness and success in fooling both human eyes and deep neural networks. However, current works usually sacrifice the flexibil- ity of the uncontrolled setting ensure the naturalness of adversarial examples. As result, the black-box attack performance of these methods is limited, To boost transferability of adversarial examples without damaging image quality, we propose novel Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset. By conducting extensive experi- ments and visualizations, we convincingly demonstrate the effectiveness of our proposed method. Notably, on average, results show that our NCF can outper- form state-of-the-aa approaches by 15.0% 32.9% for fooling normally trained models and 10.0% -2..3% for evading defense methods. Our code is available at https: /tte:://ittttt /ggbtt......... com www/Vomm/////e/eeeooo Lenn/VL-Graaa VL-Grrop/NNatrraa
1 Introduction
Deep neural networks (DNNs) have achieved excellent performance on a large number of tasks, such image recognition [1, 2], medical diagnostics [3, 4), and autonomous driving [5]. However, with the rise of the field of adversarial attack [6, 7, 8, 9, 10, 11, 12], the robustness of state-of-the-ar DNNs [2, 13, 14, 15, 16] is put in question. Adversarial examples thus reveal the vulnerability of DNNs and inevitably raise concerns about widely deployed models. To avoid potential risks, it is crucial expose many of the model's "blind spots" possible this stage.
Generally, scenarios of adversarial attacks can divide into white-box and black-box. For the white-bor box scenario [17, 18, 19, 20], all information about the target model is publicly available, such as the architecture and parameters. Although the attacker can easily fool them with human- mamaan-imprrceptbble perturbations in this case, it is not practical in the real world since deployed models are usually opaque to unauthorized users. To overcome this limitation, numerous works begin to study the black-box attack [7, 21, 22, 23, 24, 25], which relies the cross-mode model transferability of adversarial examples. Typically, most existing black-box attacks maintain image quality by constraining the Ly-norm of perturbation [26, 23, 27, 8J. However, the -n-norm constraint RGB color space is not an ideal indicator for measuring the perceptual distance between two images since adversarial
Cooresponniigg author
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

examples with small perturbation size may still look unnatural to human eyes [19]. Thus the unrestricted attack [28, 29, 30, 31, 32, 33, 34] is proposed - replacing the traditional small L, noor perturbations with uncontrolled yet human- cuman-imperceprible ones, which is more practically meaningful. Among existing unrestricted attacks, the unrestricted color branch very promising direction. As demonstrated in previous works [30, 32, 291, only manipulating the color of an image is not noticeable to human eyes but can easily fool DNNs. This is mainly because global uniform changes in images are usually imperceptible, and DNNs are vulnerable to certain large-scale patterns.
However, current unrestricted color attacks usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples: either rely on intuition [28, 29] and objective metrie [32] or use relatively small changes [30, 31j. Consequently, the transferability of adversarial examples generated by these methods is limited.
To remedy this, we propose Natural Color Fool (NCF) based on more flexible perturbation space. Specifically, we build a color distribution library that contains diverse yet realistic color distributions sampled from the ADE20K dataset [35] for each semantic class. By borrowing the color mapping technique of [36], we utilize the library to generate a set of image variants with realistic color distribution for each clean image. Then we use the substitute model select the most adversarial variant. To boost its transferability, we further introduce neighborhood search and initialization reset to optimize, thus obtaining the resulting adversarial example. Figure illustrates the simplified pipeline for our method.
In summary, main contributions are:
We observe that current unrestricted color attacks lack flexibility, which results in limited transferability of the adversarial examples.
To alleviate this issue, we propose a Natural Color Fool (NCF), which fully exploits color distributions of semantic classes in image to craft human-imperceppibl,, flexible, and highly transferable adversarial examples.
Extensive experiments and visualizations demonstrate the effectiveness of our proposed method. Significantly, with high NIMA scores [37], NCF averagely outperforms of- the-art methods by 15.0 -3..9% % for fooling normally trained models, and 10.0%~25.5. for evading defense models.
2 Related Works
2.1 Unrestricted Attacks
Unrestricted attacks [30, 38, 39, 32], which usually significantly modify the image but can yield human-imperte cimer--iiprropptbble adversarial examples, have been widely studied in recent years. For example, some works modify domain-speeific structural attributes of the image. SemanticAdy [38] uses an cutriuute-conditinn image editing model to modify the attributes of the face (e.g.. modifying the degree of mouth opening). advCam [39] hides adversarial perturbations by using the style transfer technique (e.g., changing traffic sign to rust style). Of course, there are also many works modify generic attributes of images, such as texture and color. Specifically, tAdv [32] infuses the texture of another image to generate adversarial examples. EdgeFool [33] craft adversarial perturbations by enhancing edge details of an image.
Compared with texture-based attacks, color-based ones usually yield more natural results since manipulating groups of pixels along dimensions is less perceptible human eyes. To our knowledge. Hosseini&Poovee &oovendran [28] first proposed the Semantic Adversarial Examples (SAE) in this branch. Specifically, they convert the image from the RGB color space to the HSV one, then uniformly and randomly perturbed the H (Hue) and S (Saturation) channels of the entire image. & [30] also notice that RGB color space not a perceptually uniform space. Thus, they operate in the CIELUV color space and propose a ReColorAdy that uses a specific function to uniformly transform all pixels belonging to the same color. Similar to ReColorAdv, ACE [31] proposes a simple piecewise- linear color adjustment filter to manipulate the image. The main difference is that ACE treats three channels of an image independent of each other when transformed. AGV [40] increases the attack effectiveness by filter composition. Unlike them, cAdv [32] performs color transformation using

---

pretrained colorization network and jointly varies input hints and masks to manipulate adversarial examples.
Among existing unrestricted color attacks, ColorFool [29], which exploits image semantics to modify colors selectively, is the most related to ours. Nevertheless, there are several significant differences between our work and ColorFool. First, ColorFool requires manually selecting several human- sensitive semantic classes (i.e., sky, water, plants, and humans), while our approach does not need. Second, ColorFool adds uncontrolled perturbations on human-insensitive semantic classes, while our approach utilizes a color distribution library guide. Third, ColorFool optimizes adversarial examples only via multiple random trials, while our approach also utilizes the gradient of the substitute model fine-tune results.
2.2 Adversarial Defenses
To mitigate the threat of adversarial examples, various defense methods have been proposed for the past few years. Generally, existing defense techniques can fall into categories: adversarial training [41, 42, 43, 44] and input pre-process [45, 46, 47J. The former gains immunity to attacks by leveraging adversarial examples during the training phase. For example, Tramér al. [42] improve the black-box robustness by considering adversarial examples generated by other irrelevant models. Xie er al. [43] introduce feature denoising modules and train them on adversarial examples build white-box robust models. Although adversarial training is usually the most robust strategy, it suffers from expensive training costs. To overcome this limitation, the input pre-process branch is designed to cure the infection of adversarial examples before feeding to DNNs. For example, Guo er al. [45] introduce several input transformation techniques (e.g.. JPEG compression [45]) to recover from the adversarial perturbations. Xie ef al. [48] propose R&P which mitigates the adversarial influence through random resizing and padding. Liao et al. [49] come up with a high-level representation guided denoiser (HGD) to reduce the effect of adversarial perturbations. Jia er al. [46] propose an end-to-end image compression model called ComDefend against adversarial examples. Naseer et al. [47] train a neural representation purifier model (NRP) that cleans adversarial perturbation based on the automatically derived supervision.
3 Methodology
3.1 Problem Formulation
Let æ: be a clean image with true label y and Fo(.) denote the deep learning classifier with parameters Formally, unrestricted attacks aim to craft human cuman-impprceptible adversarial perturbations (may be very large in RGB color space) for æ so that the resulting adversarial examples x' can induce Fo(-) to misclassify:
Fo(x') +
s.t. af is natural.
(1)
In this paper, we focus on a more challenging blx scenario (compared to the white-bot box scenario), where the target model's information (e.g., parameters and structure) is inaccessible. Therefore, adversarial examples can only be crafted via the accessible substitute model Fo()) and rely upon their transferability fool target models.
3.2 Color Distribution Library
Existing unrestricted color attacks tend to sacrifice their flcxibility so that they can generate human- imperceptible adversarial examples. For example, ReColorAdy [30] requires constraining the per- turbation to a relatively small range, which cannot take full advantage of the "unrestricted" setting; cAdv [32] enforces the color belonging to the low-entropy cluster to remain unchanged, which inevitably reduces the attack space; ColorFool [29] manually splits an image into two parts and adds controlled noises the human-sensitive part, which largely depends on the authors' intuition (but it varies from person to person).
To remedy the above limitation, we borrow the idea of [50] to construct "distribution of color distributions" (DoD) for different semantic classes based on the ADE20K [35] dataset. Specifically, for each class, DoD provides 20 different dominant distribution sets (represented by the color distri-
3

---

Forward (Clean image)
Forward (Image variant)
Backward (Neighborhood search)
Color Mapping
Solution
Trunsfer Matrix
X
Xy
Segm
Color Distribution Library C
W mon
Mountain (C
Query
Cinon
20
Cmoo
Semantic
Car (Ceur)
Target Distribution
Lastr
Mask
CorT
car
H
W
car
Randomly Select
The simplified pipeline of NCF (optimizing one image variant without initialization reset). For the input image we first obtain its mask by segmentation model (Segm). Then we randomly assign a realistic color distribution e for each class via our color distribution library and fuse them into a target H based on the proportion of corresponding area w in the image. Here 2 is an image (without spatial information) directly converted by H so that we can adopt Monge-Kan Kantorovitch (MK) solution obtain the transfer matrix T. With it and Eq. 4, variant F Finally, we fine-tune T (i.e., neighborhood search) according to the loss Lodv so that more threatening adversarial examples can be mapped.
Figure 1:
get the color mapping image
butions), which obtained by hierarchical clustering based color palettes? of corresponding segmentation class the dataset.
Since the color distributions in each distribution set are similar and averaging all color distributions of a specific distribution set may not yield natural representation, we randomly select a color distribution to represent the overall color characteristics for simplicity. Therefore, for a semantic class y. realistic color distribution space can expressed as:
Cø {cg 20
Jm=1,
where ci is randomly sampled distribution from the m-th set, and our color distribution library C can be denoted as:
C= UC,
(3)
where M denotes the total number of semantic classes contained in our library (see Appendix A for the pipeline of building color distribution library). In the following, we adopt this color distribution library ensure the colors of adversarial examples are natural and coordinated, thus making our attack more flexible
3.3 Natural Color Fool
To generate natural adversarial examples, precisely controlling the color perception is necessary. In this paper, we craft adversarial perturbations in CIELab color space where the perception is more uniform than RGB color space. The framework of our proposed Natural Color Fool (NCF) is illustrated in Figure/ (refer to Appendix for Algorithm of NCF). Formally, for given image æ. first obtain semantic mask through semantic segmentation model. Then, for each semantic class ÿ in æ, we randomly select color distribution ot from Cj in the color distribution library. After that, we fuse the color distributions of all semantic classes based on the proportion of images occupied by each class (c.g., Wear, Wnou in Figure I), thus generating target color distribution H. With it, we can use the following Eq. 4 to generate a target image variant x' (refer to Figure 1)
*Color palette is a simplified color distribution composed of object's primary colors. It is used to reduce the computation cost of clustering.

---

which approximately replaces the color distribution of each semantic class of æ with corresponding one in target H [36]:
H'H = T(x - 12)) + M
TEaT = EmH
(5)
where T E 3x33 is the transfer matrix, H is an image reconstructed by H but without spatial information (see Figure 1), and Pæ Man (E R Eg, Eæn R are channel means of æ, channel means of hH the covariance matrix of æ, and the covariance matrix of TH. respectively.
Formally, there are numerous solutions [51, 52, 53, 54] for T. However, most of them may not obtain an intended color mapping, i.e., only color proportions expected. To tackle this issue, follow transportation problem, thus
Pitié et al. [36] and convert color mapping into a getting the solution for T:
1/2 T= T=E-1/3 E1/2 21/3)
Σx 1/1/2
Intuitively, relying solely on randomly picking color distribution may limit the attack success rate. Since our color distribution library contains wide variety of color combinations and we have accessible substitute models, there is no reason not to take advantage of them. Thus, we utilize the substitute model (-) to select most adversarial distribution from 77 different color distributions
sampled from our color distribution library:
H arg max Lado (Fo((')))))) Hen
where IHI is the set containing 7) different color distributions and Lado is the C&W loss [18]:
Lado (z, y) max[z; y) Zy.
(8)
where zj denotes the logit concerning the j-th class. To further boost our attack, propose two techniques: neighborhood search and initialization reset. Specifically, the former aims to slightly adjust T (derived from Eq. 6) to improve the attack success rate while ensuring natural mapping result (see the comparison of adversarial examples with or without adopting neighborhood search in Appendix E). Thus, the neighborhood search can be formulated as the following optimization problem:
arg max Lado (F (T' (wx)) + Pag- ). v) s.t. IT - T' S, T
(9)
where denotes the maximal perturbation size for T. In paper, we adopt MI-FGSM [21] with N iterations to optimize Eq. 9. Nonetheless, an adversarial transfer matrix T' found in the neighborhood of specific T may not be effective, since the search space is indeed limited. To alleviate this issue, the initialization reset repeats the operation of selecting one from randomly sampled color distributions (i.e., Eq. 7) K times, thus obtaining K ideal initial color distributions for the neighborhood search. Then we choose the best one among them:
= arg max Lade (Fo (1-)2 + p ). 1e K..,
(10)
where H and TV denote the resulting color distribution and corresponding transfer matrix of the i-th reset. Consequently, resulting adversarial examples can be obtained by:
x' TV mbx) + Many
(11)
In Figure 2, we show resulting adversarial examples generated by our proposed method and recent works, i.e., cAdv [32]. ColorFool [29], and ACE [31] (see Appendix G for more comparisons). Notably, despite our NCF implements significant modifications to the color distribution of the original images, the adversarial examples still look very natural.
Z is used to calculate the covariance matrix. Please note that calculation result is the same matter how reconstruct it.
5

---

Clean
cAdv
ColorFool
ACE
NCF (Ours)
Figure Adversarial examples generated by different unrestricted color attacks and ours.
Experiments
In this section, we first introduce the setup for our experiments in Section 4.1. Then we report attack success rates normally trained and defense models in Section 4.2. After that, we compare the image quality of adversarial examples in Section 4.3. Finally, we conduct series of ablation studies in Section 4.4. To better analyze the adversarial example, we also provide an illustration of attention shift [55] in Appendix F.
4.1 Setup
Dataset. We conduct our experiments on the ImageNet-cooppttble Dataset'. This dataset is comprised of 1,000 images and is widely used in recent transfer-based attacks [26, 22, 23, 56, 57, 58, 59].
Models. In this paper, we evaluate the vulnerability of various convolutional neural networks (CNNs) and vision transformers (ViTs). For CNNs, we consider both normally trained models and defense models. Normally trained models include VGG-19 [60], ResNet-18 (Res-18), ResNet- 50 (Res-50) [2]. Inception-v3 (Inc-v3) [61]. DenseNet-121 (2ense-121) [13], and MobileNet-v2
(Mobile-v2) [62]. Defense methods contain JPEG [45], Gray (gray-scale conversion), HGD [49], R&P [48], ComDefend [46], NRP [47], Inc-v3ens3. IncRes-v2ens [42], Res152p, Res152p and ResNeXtrA [43]. For VIT, we consider normally trained ViT-S/16 (ViT-S) [63], XCTT-N12/16
(XCIT-NI2) [64], and DeiT-S [63].
Implementation Details. In all experiments, the semantic segmentation model is Swin-T [65] (the influence of different segmentation models on the results can be found in Appendix H) and the color distribution library size M 150, the number of random searches 17 50, the iteration of neighborhood search N = 15, the maximum perturbation of transfer matrix = 0.2, the step size = c/N 0.013, the momentum u 0.6 (for MI-FGSM), and the reset number K 10 (see Appendix C for ablation of K). We compare our proposed method with Semantic Adversarial Examples (SAE) [28], ReColorAdv [30], cAdv [32], ColorFool [29], and ACE [31]. The parameters of each competitor follow the corresponding default setting. Our experiments are on an NVIDIA
TITAN Xp GPU with 12GB of memory.
'nttps://githul examples/nips17 atappp/eee/ipp1.ddddeeerrrrraraa wawparriaalooppieeeeeeeeeamaeeee wwwpetiiiiiniio. tioo/dita/n........ FFrr HGD and R&P, we adopt the official models used in corresponding papers. For JPEG, Gray, ComDefend, and NRP, adopt VGG-10 19 the target model.
aadversarial....

---

4.2 Transferability Comparison
4.2.1 Results on Normally Trained Models
In this section, compare proposed method with SA [28]. ReColorAdy [30], cAdv [32], ColorFool [29] and ACE [31] on a variety normally trained CNNs and Vision Transformers (ViTs). Adversarial examples crafted via Res-18, 18, VGG-19, Mobile-V2, and Inc-V3 respectively. For the results of ensemble attack [21] and using ViT' as the substitute model, please refer to Appendix and D.
The attack success rates are presented in Table We can observe that our resulting adversarial examples usually achieve the highest transferability compared to those generated via state-of-the-an competitors. For example, when the substitute model is Res-18, only 46.9%, 39.9%, and 40.8% of adversarial examples crafted by SA, ReColorAdv, and cAdv can successfully fool VGG-19, In comparison, our NCF can achieve a much higher transferability of 72.1 %. Besides, we also consider the transferability from CNNs to ViTs, their structures are quite different. As shown in Table 1, when transferring adversarial examples from Mobile- V2 to XCIT-N12, recent ColorFool and ACE only obtain success rates of 22.8% and 22.6%, respectively, while method can get 56.4% success rate. On average, adversarial examples crafted by our method are capable of achieving a 54.5% % success rate, which significantly outperforms cate-of-the-arr approaches by 15.0% 5.3.99 %. This result convincingly demonstrates the effectiveness our method in fooling normally trained models.
Table 1:
Transferability comparison on normally trained CNNs and VITs. We report attack success rates (%) of each method and the leftmost model column denotes the substitute model ("*" means white-box attack results).
Transformers
Attacks
Model
Res-18
VGG-19
Mobile-v2
Inc-v3
Dense-121
Res-50
VIT-S
XCTT-NI2
DeiT-S
Clean
16.1
11.4
12.8
19.2
7.9
7.5
13.3
13.7
5.8
SAE
93.4*
46.9
45.5
31.3
36.5
37.0
44.5
37.4
22.2
ReColorAdy
98.6*
39.9
47.3
38.2
37.2
38.1
21.4
36.7
17.3
cAdv
100.0*
48.2
41.6
41.2
44.9
Res-18 18
ColorFool
93.0*
27.8
30.5
28.1
19.8
22.9
35.5
22.3
9.2
ACE
99.4
26.0
27.2
27.6
19.9
18.3
21.6
22.4
9.1
NCF (Ours)
92.9*
72.1
72.7
48.3
55.3
66.7
53.0
55.3
52.2
91.4*
48.8
32.3
39.3
39.0
48.3
37.6
24.3
ReColorAdy
42.5
96.0*
41.9
33.2
33.8
31.7
20.4
33.4
16.6
cAdv
54.0
100.0*
48.0
43.7
43.4
40.7
38.8
43.9
32.9
VGG-19
ColorFool
44.0
90.9*
36.5
29.2
23.5
26.6
42.2
25.6
ACE
33.4
99.7*
27.8
28.3
21.6
18.0
20.77
21.6
NCF (Ours)
73.7
93.3*
70.3
49.4
53.6
64.3
56.5
$3,5
30.7
SAE
53.5
49.6
92.2*
34.5
38.1
39.3
46.6
37.7
23.3
ReColorAdv
46.3
36.5
97.8*
36.4
32.4
34.4
20.7
36.7
MobileV2
cAdv
54.7
100.0*
42.8
44.3
39.1
36.0
44.1
ColorFool
41.5
30.6
93.2*
28.1
23.3
24.5
39.7
22.8
9.4
ACE
31.8
99.1*
26.7
20.0
19.0
20.3
22.6
NCF (Ours)
72.8
92.7*
50.0
$4.4
66.2
55.4
56.4
SAE
49.5
45.4
78.2*
36.1
36.5
46.6
34.7
ReColorAdy
26.5
19.9
21.9
96.2*
17.2
15.9
16.3
22.5
10.5
cAdv
32.7
23.4
27.6
99.8*
23.9
20.8
26.0
28.2
18.4
Inc-V3
ColorFool
40.4
35.4
25.3
42.6
26.5
ACE
28.6
24.1
23.9
96.9*
18.6
15.5
19.4
21.8
9.2
NCF (Ours)
57.7
$7.7
56.8
83.8*
40.1
47.7
45.3
45.2
23.8
4.2.2 Results on Defense Models
Threats posed by Ln-norm adversarial attacks [7, 21, 23, 57] promote the emergence of adversarial defenses [41, 43, 47]. However, whether these defense mechanisms are robust against unrestricted this section, we consider both input pre- process defenses (i.e., JPEG [45], Gray, R&P [48], HGD [49], ComDefend [46], and NRP [47]) and adversarially trained models (i.e., Inc-v3ema,, IncRes-v2emu. Resp [42], Resp, and ResNextpa [43]) to fully investigate the performance of our method.
attacks has not been extensively explored. Therefore,

---

Table 2: Transferability comparison on defense CNNs. We report attack success rates (%) of each method and the substitute model is Inc-v3.
Methods
JPBG
Gray
R&P
HGD
ComDefend
NRP
Resp 29.2
Rešp 24.4
ResNeettD
Inc-v3enad
Inc IncRes-22ma
Clean
17.4
26.7
2.4
28.2
16.8
19.8
4.2
SAE
52.7
13.0
62.2
53.7
53.5
ReColorAdy
26.9
34.4
7.8
5,6
38.0
27.6
32.9
28.8
24.3
14.7
9.3
cAdv
30.6
27.8
12.4
10.5
40.9
36.2
42.8
37.2
33.1
20.3
15.1
ColorFool
42.1
31.1
8.9
65.8
43.6
57.5
46.3
16.9
10.6
ACE
31.2
30.8
6.1
3.8
47.4
32.6
36.3
31.6
29.3
13.4
7.6
XCF((Our)
62.6
37.9
26.0
23.5
73.5
66.2
61.2
58.2
60.1
32.6
26.9
The black-box success rates of unrestricted attacks are reported in Table 2. Similar to Table I, our approach still consistently outperforms existing advanced methods by large margin. On average, our proposed NCF is capable of making 48.1 % adversarial examples fool these defenses, while SA, ReColorAdv, cAdv, ColorFool, and ACE only obtain success rates of 38.1% 1%, 22.8%, 27.9%, 34.8%, and 24.6%, respectively. Another interesting observation from Table 2 is that advanced defense algorithms not necessarily effective when faced with unrestricted adversarial examples. For example, even white-box robust feature denoising models [43] are vulnerable, e.g.. 60.1 % adversarial examples can fool ResNeXtpA- We speculate the main reason is that the defense mechanism is intermediate feature denoising, while unrestricted color attacks mainly manipulate the color and do generate significant high-frequency noise.
In addition, we notice that many imput pre-process defenses with target model VGG-19 19 cannot defend against our proposed NCF, but instead boost the transferability of adversarial examples (compare to the VGG-19 results of Table 1). To better analyze this abnormal phenomenon, we visualize the observe
purified images generated by JPEG, ComDefend, and NRP in Figure 3. Interestingly, that all defenses have little effect on our unrestricted color perturbations. It is mainly because our adversarial examples crafted using realistic colors guide and, therefore, can circumvent these defenses designed for common perturbation characteristics. Besides, we observe that JPEG and NRP suppress key features of "Great egret", and ComDefend generates many irrelevant repeating patterns. As discussed in [66]. these side effects of defense methods can reduce the confidence of the model concerning the class, resulting our adversarial examples instead of boosting the transferability after being processed by these approaches. This result also reminds us that the robustness evaluation of defenses needs be more comprehensive.
Clean
Adversarial (NCF)
Purified (JPBG)
Purified (ComDefennd)
Purified (NRP)
Figure 3: Visualization for the adversarial example and purified images. This result shows that JPEG, ComDefend, and NRP cannot remove our unrestricted perturbation, but instead may distort key features (e.g., feather) of the object (the label is "Great egret"). Zoom in for better comparison.
4.3 Image Quality
Following ColorFool [29], we quantitatively evaluate image quality by a non-reference perceptual image quality measure called neural image assessment (NIMA) [37] which is highly correlated with human perception. In our paper, NIMA is based on the architecture of MobileNet [67] and is composite of two models: one trains AVA [68] for image technical assessment and another trains on TID2013 [69] for image aesthetics assessment. results of our NCF are par with those of aate-of-theeart competitors. For NIMA (technical), both ACE and our NCF obtain high score of over 4.939, which just 0.094 lower than clean images. The case of NIMA (aesthetic) is similar, where aesthetic scores of our ad adversarial examples and
reported Table 3, image quality assessment

---

clean images differ by only 0.097, indicating that our NCF does not destroy the perceptual quality of images.
4.4 Ablation Studies
About neighborhood search and initialization reset. In this section, we investigate the effect of neighborhood search and initialization reset. Specifically, we use Inc-v3 to craft adversarial examples, and then evaluate the trans- ferability towards Res-18, VGG-19, Mobile-v2, Dense- 121, Res-50, ViT-S, XCIT-N12, and DeiT-S. The results are shown in Table 4. In terms of the white-box attack, NCF outperforms NCF-NS (NCF without NS). NCF-IR (NCF without IR), and NCF-IR-NS (NCF without IR and NS) by 17.7%, 13.3%, and 32.2% %, respectively. On the black-box attacks, neighborhood search and initialization reset bring average performance improvement of 8.3%, and 6.5 %. When both neighborhood search and initializa- tion reset techniques average of 12.5%. The significant performance gain confirms the effectiveness of neighborhood search and initialization reset. In addition, notice that even if neither proposed technique is used, our method still surpasses state-of-the- art competitors, except for SAE. We attribute this phenomenon the flexibility of our approach, which naturally modify the whole image without restriction. Note that NCF-IR-NS does not mean selecting random colors to attack. The difference of them is discussed in Appendix J.
Table 3: Image quality comparison.
NIMA f (technical)
NIMA
Methods
(aestheties)
Clean
5.033
4,457
SAE
4.924
4,326
ReColorAdy
4.886
4.117
cAdv
4.718
4,220
ColorFool
4.918
4,439
ACE
5.008
4.328
NCF (Ours)
4.939
4.360
used, the transferability towards black-box models can be improved by
Table 4: The effect neighborhood search (NS) and initialization reset (IR), Adversarial examples crafted via Inc-v3 (**" denotes white-box attack).
Methods
Inc-v3"
Res-18
VGG-19
Mobile-v2
Dense-121
Res-50
ViI-S
XCTT-N12
DeiT-S
NCF
83.8*
$7.7
$7.7
56,8
40.1
47.7
45.3
45,2
23.8
NCF-NS
66.1*
49.3
47.2
46.9
31.2
39.1
41.7
34.4
18.1
NCF-II
70.5*
50.2
48.8
48.5
34.4
39.7
43.7
19.0
NCF
51.6*
43.8
42.2
42.4
28.0
14.8
About color distribution library size. In this section, we investigate the influence of color distribu- tion library size M on attack success rates. Specifically, we tune M from 0 to 150 with an interval of 15 and freeze other syper-parameters, and adversarial examples are crafted via Inc-v3. Note that M = 0 means that proposed library is not used, thus T is identity matrix. The attack success rate is reported in Figure 4, where the dashed line indicates the white-box attack success rate and solid lines refer to the black-box ones. It can be observed that the library size M plays key role in attack success rates. Concretely, the attack success rates increase rapidly at first, then grad- ually stabilize when the library size exceeds
90
Attack Attack Success Rate (%)
30, and reach the maximum at M 150 in
most cases. For instance, when M = 150,
NCF has success rates of 57.7%. 57.6%, 56.8%,
60
40. %, and 47.6% on Res-18, VGG-19, Mobile-
50
v2, Dense- 121. and Res-50. respectively. When M = 0, it significantly degrades to 24.6%, 18.6%, 21.1%. 14.8%, and 14.2%. respectively. Intuitively, this is because the target color dis- tribution trivially turns to the corresponding distribution of the original image, and thus the space we perturb on original image will reduced. This convincingly demonstrates the effectiveness of building a class-rich color dis- tribution library.
40
Incw3*
Mobile-22
VGG-19
Res.50
10
0
15
30
45
60
75
90 105 120
135 150
Number of Semantic Classes
Figure 4: Attack success rates ( (%) w.r.t. the number of semantic classes M. The substitute model is Inc-v3.

---

Conclusion
In this paper, we propose black-box unrestricted color attack called Natural Color Fool (NCF). Different from existing works which either rely on intuition and objective metrics or use relatively small changes to yield natural results, our method instead exploits color distribution craft human- imperceptible, flexible, and highly transferable adversarial examples. Extensive experiments and visualizations demonstrate the effectiveness of our NCF. Notably, our adversarial examples can easily evade current Lp robust defense techniques. Furthermore, the transferability of our adversarial examples even boosted after being processed by several input pre-process defenses. We hope our work can draw researchers' attention to unrestricted color attacks.
Limitation. In our paper, for each semantic class, we provide 20 different color distributions for choosing. Therefore, this library is discrete, which may be insufficient to model the whole color space. In the future, we will try to build continuous color space expand the spatial range and more accurately simulate the color range of objects.
Negative Societal Impacts. Adversarial examples crafted by our proposed unrestricted color attack look very natural but are with strong black-box transferability even towards defenses. Therefore, unscrupulous people may adopt our method to undermine real-world applications, which inevitably raises new concerns about Al safety.
Acknowledgments
This study supported by grants from National Key R&D Program of China (002FFC20000/2222/2200002 the National Natural Science Foundation of China (Grant No. 62122018, No. 62020106008, No. 61772116, No. 61872064).
10

---

References
[1] Alex Krizhevsky, llya Sutskever, and Geoffrey E. Hinton. Imagenet classification with deep convolutional neural networks. In NIPS, 2012.
[2] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In CVPR, 2016. 6
[3] Brian MacNamee, Padraig Cunningham, Stephen Byrne, and O. I. Corrigan. The problem of hias in training data in regression problems medical decision support. Artif. Intell. Medicine, 2002.
[4] Jizong Peng, Ping Wang, Christian Desrosiers, and Marco Pedersoli. Self-paced contrastive learning for semi-supervised medical image segmentation with meta-labels. In NeurIPS, 2021.
[5] Yuchi Tian, Kexin Pei, Suman Jana, and Baishakhi Ray. Deeptest: automated testing of deep-neunal-eetorrrdiiv autonomous cars. In ICSE, 2018. I
[6] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014." 1
[7] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015. 1,7
[8] Muzammal Naseer, Kanchana Ranasinghe, Salman H. Khan, Fahad Shahbaz Khan, and Fatih Porikli. On improving adversarial transferability of vision transformers. ICLR, 2021.
[9] Qilong Zhang, Xiaodan Li, Yuefeng Chen, Jingkuan Song, Lianli Gao, Yuan He, and Hui Xue. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. In ICLR, 2022.
[10] Yongqiang Chen, Han Yang. Yonggang Zhang, Kaili Ma, Tongliang Liu, Bo Han, and James Cheng. Understanding and improving graph injection attack by promoting unnoticeability. In ICLR, 2022. 1
[11] Yonggang Zhang. Ya Li, Tongliang Liu, and Xinmei Tian. Dual-path distillation: A unified framework to improve black-box attacks. In ICML, 2020.
[12] Yonggang Zhang, Xinmei Tian, Ya Li, Xinchao Wang. and Dacheng Tao. Principal component adversarial example. IEEE Trans. Image Process., 2020.
[13] Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q. Weiinbegeer Densely connected convolutional networks. In CVPR, 2017. 1,6
[14] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
[15] Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Going deeper with image transformers. In ICCV, 2021.
[16] Ji Zhang, Jingkuan Song, Lianli Gao, Ye Liu, and Heng Tao Shen. Progressive meta-learning with curriculum. IEEE Trans. Circuits Syst. Video Technol., 2022.
[17] Seyed-Mohsen Moosavi- Dezfool,,,,, Alhussein Fawzi, and Pascal Frossard. Deepfool: A simple and accurate method to fool deep neural networks. In CVPR, 2016. I
[18] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE S&P, 2017. 1.
[19] Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Towards large yet imperceptible adversarial image perturbations with perceptual color distance. In CVPR, 2020. 1, 2
11

---

[20] Ye Liu, Yaya Cheng, Lianli Gao. Xianglong Liu, Qilong Zhang, and Jingkuan Song. Practical evaluation of adversarial robustness via adaptive auto attack. In CVPR, 2022. 1
[21] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018. 1, 5,5,
[22] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In CVPR, 2019, 6
[23] Lianli Gao, Qilong Zhang, Jingkuan Song. Xianglong Liu, and Heng Tao Shen. Patch-wise attack for fooling deep neural network. In ECCV, 2020. 1, 6, 7
[24] Yaya Cheng, Xiaosu Zhu, Qilong Zhang. Lianli Gao, and Jingkuan Song. Fast gradient non-sign methods. arXiv preprint arXiv:21 12734, 2021.
[25] Muzammal Naseer, Kanchana Ranasinghe, Salman Khan, Fahad Khan, and Fatih Porikli. On improving adversarial transferability of vision transformers, In ICLR, 2022. 1
[26] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by iossllationinvariann attacks. In CVPR, 2019. 6,6
[27] Lianli Gao, Qilong Zhang, Jingkuan Song, and Heng Tao Shen. Patch-wise++ perturbation for adversarial targeted attacks. CoRR, Abs/2012.15503. 2020. I
[28] Hossein Hosseini and Radha Poovendran. Semantic adversarial examples. In CVPR Workshops, 2018. 2, 7,
[29] Ali Shahin Shamsabadi, Ricardo Sánchez-Matilla, and Andrea Cavallaro. Colorfool: Semantic adversarial colorization. In CVPR, 2020. 2, 5, 6, 7,8
[30] Cassidy Laidlaw and Soheil Feizi. Functional adversarial attacks. In NewrlPS, 2019. 2, 3, 6,
[31] Zhengyu Zhao, Zhuoran Liu, and Martha A. Larson. Adversarial color enhancement: Generating unrestricted adversarial images by optimizing color filter. In BMVC, 2020. 2, 6,
[32] Anand Bhattad, Min Jin Chong, Kaizhao Liang, Bo Li, and David A. Forsyth. Unrestricted adversarial examples via semantic manipulation. In ICLR, 2020. 2, 3, 5, 6,
[33] Ali Shahin Shamsabadi, Changjae Oh, and Andrea Cavallaro. Edgefool: an adversarial image enhancement filter. In ICASSP, 2020. 2
[34] Yang Song, Rui Shu, Nate Kushman, and Stefano Ermon. Constructing unrestricted adversarial examples with generative models. In NeurIPS, 2018.
[35] Bolei Zhou, Hang Zhao, Xavier Puig, Sanja Fidler, Adela Barriuso, and Antonio Torralba. Scene parsing through ADE20K dataset. In CVPR, 2017. 2,
[36] F. Pitie and A. Kokaram. The linear monge-kantoroviich linear colour mapping for example- based colour transfer. 4th European Conference on Visual Media Production, 2007. 2,
5
[37] Hossein Talebi Esfandarani and Peyman Milanfar. NIMA: neural image assessment. IEEE
Trans. Image Process., 2018. 2, 8
[38] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin- Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial t-shirt! evading person detectors in physical world. In ECCV, 2020. 2
[39] Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A. Kai Qin, and Yun Yang. Adversarial camouflage: Hiding physical-worke attacks with natural styles. In CVPR, 2020. 2
[40] Alina Elena Baia, Alfredo Milani, and Valentina Poggioni. One for many: an instagram inspired black-box adversarial attack. 2021. 2
[41] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018. 3, 7
12

---

[42] Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses, In ICLR, 2018.
[43] Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan L. Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In CVPR, 2019. 7.8
[44] Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Schölkopf, and Kun Zhang. Adversarial robustness through the lens of causality, In ICLR, 2022.
3
[45] Chuan Guo, Mayank Rana, Moustapha Cissé, and Laurens der Maaten. Countering adversarial images using input transformations. In ICLR, 2018. 3, 7,
[46] Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. In CVPR, 2019. 3, 6,
[47] Muzammal Naseer, Salman H. Khan, Munawar Hayat, Fahad Shahbaz Khan, and Fatih Porikli. self-supervised approach for adversarial robustness. CVPR, 2020. 3, 6,
[48] Cihang Xie, Jianyu Wang, Zhishuai Zhang, Zhou Ren, and Alan L. Yuille. Mitigating adversarial effects through randomization. ICLR, 2018. 6,
[49] Fangzhou Liao, Ming Liang, Yinpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In CVPR, 2018.
6,
[50] Mahmoud Afifi, Brian Price, Scott Cohen, and Michael S. Brown. Image recoloring based on object color distributions. In Eurographics, 2019. 3
[51] Erik Reinhard, Michael M. Stark, Peter Shirley, and James A. Ferwerda. Photographic tone reproduction for digital images. ACM Trans. Graph., 2002. 5
[52] Arash Abadpour and Shohreh Kasaei. A fast and efficient fuzzy color transfer method. In International Symposium on Signal Processing and Information Technology. IEEE, 2004.
[53] Hiroaki Kotera. A scene-referred color transfer for pleasant imaging on display. In ICIP, 2005.
5
[54] François Pitié, Anil C. Kokaram, and Rozenn Dahyot. Automated colour grading using colour distribution transfer. Comput. Vis. Image Underst., 2007.
(55) Ramprasaath R. Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, 2017. 6
[56] Lianli Gao, Yaya Cheng, Qilong Zhang, Xing Xu, and Jingkuan Song. Feature space targeted attacks by statistic alignment. In IJCAI, 2021. 6
[57] Zhibo Wang, Hengchang Guo. Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren. Feature importance-aware transferable adversarial attacks. In ICCV, 2021. 6,7
[58] Qilong Zhang, Xiaosu Zhu, Jingkuan Song, Lianli Gao, and Heng Tao Shen. Staircase sign method for boosting adversarial attacks. CoRR, abs/2104.0977 2021. 6
[59] Yuyang Long, Qilong Zhang. Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. In European Conference Computer Vision, 2022. 6
[60] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In ICLR, 2015. 6
[61] Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jonathon Shlens, and Zhigniew Wojna. Rethinking the inception architecture for computer vision. In CVPR, 2016. 6
13

---

[62] Mark Sandler, Andrew G. Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chiet Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In CVPR, 2018. 6
[63]
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In ICML, 2021. 6
[64] Alaaeldin Ali, Hugo Touvron, Mathilde Caron, Piotr Bojanowski, Matthijs Douze, Armand Joulin, Ivan Laptev, Natalia Neverova, Gabriel Synnaeve, Jakob Verbeek, and Hervé Jégou. Xcit: Cross-covariance image transformers. In NeurlPS, 2021. 6
[65] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In ICCV, pages 9992-10002. IEEE, 2021. 6
[66] Qilong Zhang, Chaoning Zhang. Chaoqun Li, Jingkuan Song, Lianli Gao, and Heng Tao Shen. Practical no-box adversarial attacks with training-free hybrid image transformation. CoRR,
fos/2203.04607) 2022. 8
[67] Andrew G. Howard, Menglong Zhu, Bo Chen, Dmitry Kalenichenko, Weijun Wang, Tobias Weyand, Marco Andrectto, and Hartwig Adam. Mobilenets: Efficient convolutional neural networks for mobile vision applications. CoRR, abs/1704.04861, 2017. 8
[68] Naila Murray, Luca Marchesotti, and Florent Perronnin. AVA: large-scale database for aesthetic visual analysis. In CVPR, 2012.
[69] Nikolay N. Ponomarenko, Oleg leremeiev, Vladimir V. Lukin, Karen O. Egiazarian, Lina Jin, Jaakko Astola, Benoît Vozel, Kacem Chehdi, Marco Carli, Federica Battisti, and C.-C. Jay Kuo. Color image database TID2013: peculiarities and preliminary results. In EUVIP, 2013. 8
14

---

Checklist
1. For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
contributions and scope? [Yes]
(b) Did you describe the limitations of your work? [Yes] See Section
(c) Did you discuss any potential negative societal impacts of your work? [Yes] See Section 5.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
2. If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you ran experiments..
(a) Did you include the code, data, and instructions needed to reproduce the main experi- mental results (either in the supplemental material or as URL)? [Yes] The code and instructions have been submitted as the supplemental material.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] Our experiments did not involve any model training, but all the algorithm details were specified.
(c) Did you report error bars (e.g.. with respect the random seed after running experi- ments multiple times)? [No] We fixed the random seed for all the experiments.
(d) Did you include the total amount compute and the type of resources used (e.g.. type of GPUs, internal cluster, cloud provider)? [No] We did not mention the time of the attacks due to the space limitation, but our hardware setting is available in Section 4.1.
4. If you using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes] see Section 4.1.
(b) Did you mention the license of the assets? [Yes] In footnote of Section 4.1.
(c) Did you include any assets either in the supplemental material or URL? [No]
We did not use any new assets.
(d) Did you discuss whether and how consent was obtained from people whose data you'l 're using/curating? [Yes] In a footnote of Section 4.
(e) Did you discuss whether the data you are using/curating contains personally identifiable information offensive content? [No]
5. If you used crowdsourcing conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, applicable? [N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
(c) Did you include the estimated hourly wage paid participants and the total amount spent on participant compensation? [N/A]
15


Reviews:
[{"review_id": "rwiYWht9sx", "reviewer": "Reviewer_C6Jv", "summary": "The paper proposes a color based unrestricted adversarial black box attack on image classification deep neural networks by transferring the adversarial examples using a substitute network. Authors propose to generate a natural color distribution library based on the publicly available ADE20K dataset. They create a library of distinct color distributions for 150 semantic classes. They generate the adversarial examples by randomly picking several color distributions for each semantic class from the library and find the image that fools the substitute network. In addition, they perform neighborhood search on a 3x3 Transfer Matrix T that performs the color mapping to further boost the attack success rate. Furthermore, they reset the Transfer Matrix T like random restarts in PGD attack. Extensive results show that the proposed method maintains the image quality and boosts the attack transferability significantly compared to the existing methods. Major boost of the transferability comes from optimizing the matrix T to generate adversarial examples.", "questions": "In addition to the points mentioned in weakness, I have two additional questions:\n\nAt line 129, it is mentioned that “Since the color distributions in each distribution set are similar and averaging all color distributions of a specific distribution set may not yield a natural representation, we randomly select a color distribution to represent the overall color characteristics for simplicity”. If their distributions are similar, why not select a single color distribution as a template from each set? What does the natural representation mean here?\n\nIn line 141, authors mention that “we craft adversarial perturbations in CIELab color space where the perception is more uniform than RGB color space”. What does the perception is more uniform mean here? How does that help to create adv examples?\n", "limitations": "As per my understanding, authors briefly addressed the limitations and negative impact in their work.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n1)\tWell written paper. Most of the parts are easy to understand.\n2)\tProposes a novel method to generate transferrable adversarial attack.\n3)\tMethod explanation is easy to follow.\n4)\tConducted extensive experiments on wide variety of network architectures.\n5)\tShown a significant improvement of the attack success rate with the proposed method on both undefended and defended models (L_p based defenses and input processing defenses).\n\nWeakness:\n1)\tIn the beginning of the paper, authors often mention that previous works lack the flexibility compared to their work. It is not clear what does it mean and thus makes it harder to understand their explanation. \n2)\tIt is not clear regarding the choice of 20 distribution sets. Can we control the number of distribution sets for each class? What if you select only few number of distribution set? \n3)\tThe role of Tranfer Matrix T is not discussed or elaborated.\n4)\tIt is not clear how to form the target distribution H. How do you formulate H? \n5)\tThere is no discussion on how to generate x_H from H and what does x_H constitute of? \n6)\tDespite the significant improvement, it is not clear how this proposed method boost the transferability of the adversarial examples.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "Fo-EqTJUb0", "reviewer": "Reviewer_Hmyg", "summary": "This paper introduces a new unrestricted attack (NCF) that boosts the black box performance. It is done by color converting, neighborhood search, and initialization reset. The experiment includes both CNN and Vit architectures and compares a host of baseline methods. Overall, NCF achieves state-of-the-art performance. ", "questions": "See previous section", "limitations": "NA", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\nStrengths:\n1. The paper specifically targeted on black-box setting and achieved much higher adversarial transferability than baseline methods. \n2. The authors consider a lot of recent ViT models and lots of defense methods to evaluate. \n\nWeaknesses: \n1. The authors state that \"current unrestricted color attacks lack flexibility, which results in limited transferability of the adversarial examples\". First, I am not exactly sure what flexibility means here. Then, I observe (from table 1) that other attacks usually outperform NCF in the white-box setting. If NCF is more flexible, shouldn't it also have a higher white-box attack success rate? Authors should explain why NCF is better on transferability and worse on white-box attacks. \n\n2.  I noticed that all black-box attacks are generated from one substitute model, whereas in some real-world settings, attackers may have multiple substitute models. Could the NCF and baseline methods improve if more substitute models are used?  This paper [1] is also worth to be discussed. \n\n[1] Baia et al. One for Many: an Instagram-inspired black-box adversarial attack\n\n\n========================================================================\nAfter rebuttal: \nI think the authors carefully address my concerns, and I am willing to increase my score. \n\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "B7zFhfwP4-k", "reviewer": "Reviewer_UgYm", "summary": "This paper works on Unrestricted color attacks, which manipulate semantically meaningful color of an image.\nCurrent works usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples. As a result, the black-box attack performance of these methods is limited. To boost transferability of adversarial examples without damaging image quality, they propose a Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset. Extensive experiments and visualizations demonstrate the effectiveness of their proposed method.", "questions": "1. The proposed method is largely based on a segmentation network and a clustering strategy. What is the impact of different segmentation and clustering algorithms? Also, the clustering is based on the ADE20k dataset. Can this guarantee performance?\n2. In the main method, it is unclear to why a random color can successfully attack the classification model with such a high success rate?\n3. The main idea seems to be similar to [42]. [42] is a different application, but technically what are their differences?", "limitations": "Authors have addressed some limitations and potential negative social impact of their work, what about the feasibility of the attack in the physical world?", "rating": 7, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "The writing and exposition are clear and of high quality. The authors generally address this problem in the style of CV instead of ML.\n\n1. By exploiting the color distribution of semantic classes, the proposed Natural Color Fool (NCF) improves the flexibility of the current unrestricted color attack.\n2. Some experimental improvement is obtained.\n\nProblems:\n1. The proposed method is mostly empirical without theoretical proof. For example, why the proposed method can improve flexibility?\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Accept