Natural Language Induced Adversarial Images

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-03-23 10:54:08

Abstract: Research of adversarial attacks is important for AI security because it shows the vulnerability of deep learning models and helps to build more robust models.  Adversarial attacks on images are most widely studied, which includes noise-based attacks, image editing-based attacks, and latent space-based attacks. However, the adversarial examples crafted by these methods often lack sufficient semantic information, making it challenging for humans to understand the failure modes of deep learning models under natural conditions. To address this limitation, we propose a natural language induced adversarial image attack method. The core idea is to leverage a text-to-image model to generate adversarial images given input prompts, which are maliciously constructed to lead to misclassification for a target model. To adopt commercial text-to-image models for synthesizing more natural adversarial images, we propose an adaptive genetic algorithm (GA) for optimizing discrete adversarial prompts without requiring gradients and an adaptive word space reduction method for improving the query efficiency.  We further used CLIP to maintain the semantic consistency of the generated images. In our experiments, we found that some high-frequency semantic information such as "foggy'', "humid'', "stretching'', etc. can easily cause classifier errors. These adversarial semantic information exist not only in generated images, but also in photos captured in the real world. We also found that some adversarial semantic information can be transferred to unknown classification tasks. Furthermore, our attack method can transfer to different text-to-image models (e.g., Midjourney, DALL·E 3, etc.) and image classifiers.

Main paper: 
 related works 2.1 noise-based attacks: 
 These attacks generate adversarial images by adding adversarial noises on the original images. Classical methods include L-BPGS [52] , FGSM [17] , PGD [41] , C&W [3] , etc. Some recent works further improved the strength and feasibility of noise-based attacks. For example, SparseFool [43] , ADMM [61] and LP-BFGS [67] enhanced the group sparsity of perturbations. PONS [19] , HO-FMN [16] and FAB-Attack [11] maintained attack performance with less computational efforts during noise searching. Xie [60] , Rahmati [46] , Ilyas [25] and Ergezer [14] generalized noise-based attack to new scenarios, such as anchor-free detectors, multi-angle detectors, black-box models, etc.These attacks operate image transformations to generate adversarial images. The early works [13, 20, 29, 62] mainly involved image rotation, flipping, and adjustment of the HSV space. Some recent works introduced more complex image processing methods. For example, Liu [33] , Zeng [65] used additional differentiable renderers to do image transformations. Wang [57] leveraged perception similarity supervision [68] to enlarge adversarial perturbations.These attacks change the latent space of generative models to generate adversarial images. Zhao [69] , Lin [32] , Hu [22] , Lapid [30] and Lau [31] used Generative Adversarial Network (GAN) to generate adversarial images by finetuning its generator. Xue [64] , Wang [55] , Chen [4] , Liu [34] and Chen [6] used diffusion models to generate adversarial images by optimizing the parameters of the U-Net structure, or by adding learned noises in the latent space.Text-to-image models are a group of multimodal generative models that can create images from text prompts. These models firstly encode the text prompt into a latent space, then circularly and conditionally denoising a Gaussian Distribution back to an image. The denoising process are trained from a predefined forward process. Influential Text-to-image models include Midjourney[42], Stable Diffusion [48] , DALL•E 2 [47] , Imagen [49] , etc. 
problem formulation and overview: 
 Our idea is to optimize the words within a sentence to obtain prompts for text-to-image models, and then input the prompts to text-to-image models to obtain adversarial images. Let 𝑊 denote the word space, including subjects, verbs, adjectives, etc. These words can be combined into a prompt 𝑝 according to grammatical order. Let Combination denote this function. Let 𝐺 denote the textto-image model. For any prompt 𝑝, 𝐺 (𝑝) is the generated image with the ground truth category 𝑦. Let 𝑓 denote the image classifier. Our goal is to conduct an untargeted attack, and we hope that by optimizing 𝑝, the classifier 𝑓 will misclassify the image 𝐺 (𝑝) into a category other than 𝑦. We define the attack success rate of 𝑝 as ASR (𝑝). At the same time, we hope that the generated image 𝐺 (𝑝) contain enough target semantic information of ground truth category 𝑦. For this purpose, we define the target semantic information strength as SEM (𝑝). We formulate the problem as:EQUATIONwhere 𝜆 is determined empirically.To optimize the prompt 𝑝, we propose an adaptive genetic algorithm for optimizing discrete adversarial prompts without requiring gradients and an adaptive word space reduction method for improving the query efficiency. We further used CLIP to maintain the semantic consistency of the the generated images. The overal pipeline of our method is shown in Figure 2 .The adversarial prompt structure is customizable. For example, in our animal classification attack experiments, the prompt structure is defined as "<number><color>[target animal] <appearance>is <gesture>on the <background>on a <weather>day, the [target animal] faces forward, the [target animal] occupies the main part in this scene, viewed <viewangle>. " The optimization word space is also customizable. "<word>" represents a word that can be optimized. For example, in our experiments, the word space of "<weather>" is { "sunny", "rainy", "cloudy", "snowy", "windy", "foggy", "stormy", "humid" }. "[target animal]" is the ground truth target category 𝑦 (e.g. "cat") of the generated images, which is user-defined in prompt 𝑝 and fixed during the prompt optimization.We can also use GPT-4 to automatically construct the word space, which can be transferred to other classification tasks. Here are the steps: First, we can select a target category, such as race, vehicle, etc. Next, the above hand-constructed word space is input into GPT-4 as an example, and GPT-4 is instructed to generate a similar word space for new tasks. Details are introduced in Supplementary Material (SM).The settings of other prompts and word spaces are introduced in SM. The word space 𝑊 and the set of prompts 𝑃 are formulated as follows:EQUATIONwhereEQUATIONWe optimize the adversarial prompts based on genetic algorithm which simulates the genetic evolution process of a population. We assume that there are 𝑁 prompts, constituting a population 𝑃, and each prompt 𝑝 is an individual in this population. One critical task is to evaluate the fitness of these individuals, simulating the natural selection process to retain the most optimal individuals. The fitness function F is designed according to the Equation 1, which isEQUATIONTo evaluates the attack performance of our method, we define the attack success rate (ASR) as the ratio of the number of successfully attacked images generated by the text-to-image model 𝐺 using prompt 𝑝, denoted as 𝑁 𝑓 (𝐺 (𝑝))≠𝑦 , to the total number of generated images, denote as 𝑁 𝐺 (𝑝) . The calculation formula is ASR (𝑝) = 𝑁 𝑓 (𝐺 (𝑝))≠𝑦 /𝑁 𝐺 (𝑝) .(5)Our goal is to generate adversarial images that contain enough target semantic information consistent with the prompts. One challenge is how to to maintain the semantic consistency of the the generated images. To address this issue, we employ the CLIP [44] model's text Encoder 𝐸 𝑇 and image Encoder 𝐸 𝐼 to calculate the cosine distance between the generated image 𝐺 (𝑝) and the target semantic information 𝑔 𝑡 of ground truth category 𝑦 (e.g., "a photo of a cat"). This measure reflects their relevance, considering CLIP's robust multimodal capabilities, enabling accurate assessment of the semantic correlation between the image content and the target semantic text. Besides, CLIP is trained on a large-scale (i.e. 400 million) dataset, exhibiting strong generalization across diverse image styles and backgrounds. To enhance the target semantic information in adversarial images, we incorporate it as part of the fitness function during the genetic optimization process, specifically asEQUATION)The number of queries is closely related to optimization time and cost of using commercial text-to-image models. Besides, some models such as DALL•E 3 limit the number of queries. To reduce the number of queries, we propose an adaptive word space reduction method. The core idea is to select the individual with the lowest fitness, denoted as 𝑝 𝑙𝑜𝑤𝑒𝑠𝑡 , in each generation. removed from the word space. This is similar to eliminate weaker genes from the gene pool based on fitness in the current generation 𝑡, retaining relatively high-quality genes for the next 𝑡 + 1 generation's reproduction, that isEQUATIONWe optimize the adversarial prompts based on GA algorithm, the optimization process includes prompts initialization, crossover, mutation, selection, iteration and termination.3.5.1 Prompts Initialization. We initialize 𝑁 prompts 𝑃 𝑖𝑛𝑖𝑡 by randomly selecting words from word space. These prompts can be regarded as parent prompts, which are candidates for evolution.3.5.2 Crossover. The crossover operation is to select two parent prompts 𝑃 parent1 , 𝑃 parent2 each time to generate child prompts 𝑃 child by exchanging words. Different from the standard GA algorithm that randomly selects parents with a fixed probability, we set the probability 𝑝𝑐 of selecting each prompt as a parent is proportional to its fitness score as shown in Equation 8, assuming that parents with higher fitness are more likely to produce offspring with higher fitness. Each word is like a gene, and the offspring randomly selects the genes of either parent.EQUATION𝑃 child = Crossover 𝑃 parent1 , 𝑃 parent2 , 𝑝𝑐 .3.5.3 Mutation. During the evolution of a population, mutations may occur in the genes of individuals, which contributes to the diversity of the population. Similar to this biological process, we set a small probability 𝑝𝑚 for each word in a prompt to be randomly changed to another word of the same type. This helps us avoid local optimal solutions. The new population with mutated individuals areEQUATION3.5.4 Selection. We use a roulette strategy to select prompts for the next generation. This means that the probability 𝑝𝑠 of each offspring surviving is proportional to their fitness, and is calculated using the Equation 11. In this way, we select individuals with highest fitness, reflecting the natural principle of "survival of the fittest" in the evolutionary process. SoEQUATION)EQUATION3.5.5 Iteration and Termination Condition. The crossover, mutation, and selection are performed iteratively. There are two iteration termination conditions: one is when the number of iterations reaches a threshold 𝛼, and the other is when the success rate reaches a threshold 𝛽. After the termination, the final batch of retained offspring prompts serves as the set of adversarial prompts. These prompts are then fed into the text-to-image model to generate adversarial images. 
experiments 4.1 text-to-image models: 
 We mainly used the Midjourney [42], which is a powerful commercial text-to-image model to generate the natural language induced adversarial images. We also tested our method on the other famous text-to-image models including DALL•E 2 [47] , DALL•E 3 [2] , Stable Diffusion [48] , Mysterious XL v4 [10] , Dreamshaper XL alpha 2 [8] , and Real Cartoon XL v4 [9] . For animal image classifiers, we used the models including ResNet [18] , ViT [12] , VGG [50] , Inception v3 [51] , DenseNet [23] , Mo-bileNet [21] , EfficientNet [53] , SqueezeNet [24] , RegNet [45] , AlexNet [27] implemented in the torchvision library. We also used two adversarial trained models: Swin-L [38] and ConvNeXt-L [39] . For race image classifier, we used the ViT model. The accuracy of the finetuned classifiers are all above 98% on the corresponding dataset.We used the attack success rate (ASR) as the evaluation metric for our attack method, which is widely used by previous works [5, 36, 37, 58] . The ASR is defined as the ratio of misclassified images to the total number of generated images. Its calculation method has been introduced in Section 3.3.1. We evaluated the attack effect of our method on ten-animal classification tasks. We chose Midjourney as the generator of adversarial images. and the settings for adversarial prompt structure and word space were introduced in Section 3.2. For the target animal, we used 10 types of animals in Animals-10. We used our adaptive GA method to get the adversarial prompts. For each target animal, we initialized 20 prompts with random word initialization. The probability of mutation was 0.01, and the hyperparameter 𝜆 in the fitness function was 0.1. The termination condition was that the number of iterations reached 8 generations. For fair comparison, we chose three methods, clean image generation (e.g. the prompt is "generate an image of dog"), random word selection and combinatorial testing [28] as control experiments. Under each setting, we got 20 prompts for each target animal, and each prompt generated 8 images through Midjourney, so a total of 160 images for each target animal were generated under each setting. We inputted these images into the animal classifier ResNet101 which was trained on ImageNet, and calculated the ASRs. The results are presented in Table 1 . It indicates that, on the 10-animals classification task, our method achieved an average ASR of 84.7% for the ResNet101 classifier. In contrast, the average ASR for clean image generation, random word selection and combination testing was 4.1%, 36.5%, and 37.6%, respectively. Examples of adversarial prompts and images are shown in SM. We observed variations of baselines and attack effects for different animal categories. For example, the ASRs of clean image generation for sheep and dog were 0.0% and 29.2%, which varied a lot. The reason may be as follows. As stated in Section 4.2.2, there is a category imbalance problem in ImageNet, which may cause unbalanced classification performance of classifiers trained on ImageNet and attack effects for different categories. Despite this, the ASRs of our method for different animals were all higher than that of control experiments, which indicates the effectiveness of our method.To build a more category-balanced classifier as the attack target classifier, we finetuned the classifier ResNet101 on a categorybalanced dataset Animals-10. We then attacked the finetuned classifier ResNet101, and the results are shown in Table 2 . The average ASR of our method was 85.7%, which was much better than that of clean image generation (1.0%), random word selection (29.3%) and combination testing (31.5%). This further indicates that our method is effective. Figure 3 shows a set of examples.Since the generation of text-to-image models is a stochastic process, the same prompt may lead to different images in successive queries. To verify the stability of our attack method, we selected 10 optimized prompts, then inputted it into Midjourney 10 times, and tested the ASRs of the 40 generated adversarial images each time. The results are shown in Table 3 . It indicates that the ASRs of our adversarial prompts were higher than 75% in 10 successive attacks. The average ASR was 84.5% ± 5.4%. This shows that our attack method has good stability. Moreover, This suggests that, to a certain extent, our method can find the key semantic information in the natural language space, and adversarial images with such semantic information have stable adversarial effects.We tried to explore a novel perspective by analyzing adversarial images from the viewpoint of natural language. We analyzed 198 adversarial (misclassified) images and their prompts with ASR higher than 87.5% from experiments in Section 4.5 and found that the frequency of some words in these prompts were significantly higher than that of other words. For example, for "<number>", "two" appeared most frequently, and its frequency was 50.5%. For "<color>", "green" had the highest frequency, which was 61.0%. For "<weather>", "foggy" and "humid" appeared most frequently, where the frequency was 46.3% and 35.5%, respectively. For "<ap-pearance>", "wearing clothes" and "wearing a pair of glasses" appeared most frequently, and the frequency was 38.1% and 35.5%, respectively. For "<gesture>", "stretching" had the highest frequency, which was 53.3%. This indicates that when the above adversarial semantic information appears, the generated images are prone to cause classifier errors. To verify the above conclusion, we try to combine the highfrequency adversarial semantic information such as "green", "wearing clothes", "foggy", etc. into the prompts. For example, the prompt is "an image of dog wearing clothes on a foggy day". We got 12 prompts in this way and then input them to Midjourney to generate 48 images. The generated images were input to ResNet101 classifier. The results indicate that 72.9% of the images with adversarial semantic information were misclassified, in contrast, only 29.3% of the images generated by random word selection were misclassified. Some examples of adversarial images are shown in Figure 4 . It indicates that the adversarial semantic information analyzed above has an important impact on the accuracy of the classifier, which helps us to understand of the failure modes of these classifiers under natural conditions.We found that the adversarial semantic information not only existed in generated images, but also in photos captured in real world. We searched for some photos captured in the real world on Google according to the adversarial semantic information analyzed by our method. For example, we obtained 50 images returned by Google with prompts "A cat is stretching", "A horse in a foggy day", etc. For fair comparison, we also searched 50 images by Google using prompts with random word selection as control experiments. The experimental details are described in SM. We input these images to the classifier ResNet101. The results show that the searched images with adversarial semantic information can also cause the misclassifications, and the ASR was 42.0%. In contrast, the ASR for random word selection was only 14.0%. Figure 5 shows some seached images with adversarial semantic information. It indicates that some semantic information in the real world (e.g. foggy, humid, stretching, etc.) may have an important impact on the accuracy of deep learning-based classifiers. This helps us to understand the weakness of classifiers implemented in real-world applications, and also helps to build more secure and robust models.We also found the adversarial semantic information analyzed in Section 4.7 was transferable to unseen classification tasks, and we called it zero-shot attack. We tried to apply the high-frequency adversarial semantic information obtained from animal classification attacks to attack the human race classifier. For example, the prompt is "A black person wearing clothes is stretching on a foggy day". We built 30 prompts by this way and input them to Midjourney to generate 120 images. We also set the random word selection as control experiments. The generated images were input to Vit classifier which was finetuned on FairFace dataset. The results indicated that 53.3% of the images with adversarial semantic information were misclassified, while only 25.0% of the images in control experiments were misclassified. Some examples of adversarial images are shown in Figure 6 . The reason may be that some adversarial semantic information such as "stretching" and "wearing clothes" have the advantage of cross-tasks (from animal to human). The ASR of zero-shot attacks was lower than that of our GAbased method, this is reasonable because it's a difficult task, however, it shows the possibility of transfer the adversarial semantic information to unseen classification tasks using our method.4.9 Ablation Study 4.9.1 SEM. We conducted ablation experiments on the SEM function. We seperately used the fitness function with SEM and without SEM. The termination condition was that ASR was over 70%, and other experimental settings consistent with Section 4.5. For each experimental group, we obtained 50 adversarial images. Some examples are shown in Figure 7 .We conducted a subjective evaluation and invited 10 volunteers (5 male, 5 female, ages 19-28, with normal acuity) to rate the two sets of adversarial images on a scale from 1 to 10, where higher scores indicate a greater presence of target class semantic information. The experiments were approved by the Institutional Review Board (IRB). The results showed that the average human evaluation score was 8.1±0.6 with SEM and 3.3±1.0 without SEM. It suggests that the SEM effectively enhanced the target semantic information in adversarial images while keeping a high ASR.4.9.2 Adaptive Word Space Reduction. We conducted ablation experiments on Adaptive Word Space Reduction (AWSR). We seperately conducted experiments with ASWR and without ASWR. The termination condition was that ASR was over 70%, with other experimental settings consistent with Section 4.5. The results indicated that AWSR significantly reduced the number of queries (from 201 to 127) while keeping a high ASR. This not only improves search efficiency but also leads to a considerable reduction in query costs, such as the query cost for DALL•E 3 being 0.12 US dollars per image.We tested the attack effect of our method in the physical world. We selected 40 adversarial images obtained in Section 4.5 which successfully misled the ResNet101 classifier. Using a Canon MF657 printer, we printed these images and then captured them with iPhone 12 Pro from a distance of 30 cm. Examples of the digital and physical images are shown in SM. We inputted the captured photos into the ResNet101 classifier and calculated the ASR. The results indicated that our method achieved a 100% ASR both in the digital and physical worlds. The physical world adds more perturbations [54] to the images, e.g. the printer may cause color distribution variations [15] , usually leading to lower physical ASRs for previous noise-based [40] or image editing-based [56] approaches compared to their digital ASRs. However, our method are based on language with explicit semantic information, and therefore may be more robust in the physical world. 4 . This indicates that the adversarial prompts obtained by our method can be transferred to different text-to-image models to generate adversarial images. The reason may be that some key language semantic information has an important impact on the adversarial effect. This key language semantic information can be transferred to different text-to-image models and then generate adversarial images.We then evaluated the attack transferability of adversarial images of our method across different classifiers. During the optimization of adversarial images, we used the Midjourney text-to-image model and separately used a CNN-based classifier ResNet, a transformerbased classifier ViT, and an adversarial trained classifier ConvNeXt-L (CNXL) to optimize adversarial images. For each classifier, we obtained 100 adversarial images. Subsequently, we input these adversarial images into other classifiers, including ViT [12] , VGG [50] , ResNet [18] , Inception v3 [51] , DenseNet [23] , MobileNet [21] , Effi-cientNet [53] , SqueezeNet [24] , RegNet [45] , AlexNet [27] , Swin-L [38] , and CNXL [7] , and then calculated the ASRs.The results are presented in Table 5 , indicating the good attack transferability accross different classifiers. It is worth noting that our method successfully attacked classifiers with different architectures, including CNN-based and transformer-based architectures. This suggests that our attack method is not entirely dependent on the classifier architecture. Furthermore, our attack method can not only attack ordinary classifiers, but also attack classifiers based on adversarial training (Swin-L and CNXL). Since traditional adversarial training usually focuses on adversarial noise, it may not be well-suited for our attack method, posing new challenges for adversarial defense methods.As described in Section 4.8, the adversarial semantic information also exists in human race classification attacks. We also conducted the GA-based attack experiments, and the ASR against human race classifier Vit was 89%, the details are described in SM, which further verified the above conclusion. This revealed the potential impact of text-to-image models on social fairness. Given that many social media platforms, such as Twitter and Facebook, employ AI models for image moderation, the potential for race misclassification poses concerns for fairness. This encourage us to build more fair and robust AI models. 
conclusion: 
 In this work, we propose a natural language induced adversarial image attack method, which has rich semantic information and helps humans to analyze the adversarial images from a natural language view. To adopt commercial text-to-image models for synthesizing more natural adversarial images, we propose an adaptive genetic algorithm (GA) for optimizing discrete adversarial prompts without requiring gradients and an adaptive word space reduction method for improving the query efficiency. We further used CLIP to maintain the semantic consistency of the generated images. In our experiments, we found that some high-frequency semantic information can easily cause classifier errors. These adversarial semantic information exist not only in generated images, but also in photos captured in the real world. We also found that some adversarial semantic information can be transferred to unknown classification tasks. Furthermore, our attack method can transfer to different text-to-image models and image classifiers. Our work reveals the potential impact of text-to-image models on AI safety and social fairness and inspire researchers to develop more fair and robust AI models. 
: 
 most adversarial attacks focus on adversarial images, which can be roughly categorized into three types (Figure 1 ). The first type is noise-based attack [3, 17, 35, 41, 59] , which generates adversarial examples by adding adversarial noise to the image. The second type is image editing-based attack [62, 63, 66] , which modifies certain properties (e.g. HSV, brightness, etc. ) of the image. The third type is latent space-based attack [30, 64] . This attack guides the generators such as GAN to generate adversarial images by modifying the latent space variables of the generators.If we want to understand under what natural conditions images are easily misled in classification, the above methods are ineffective because they are difficult to incorporate semantic information during attacks. To describe natural situations, the most convenient method for users is language. For example, users can use language to depict numerous natural scenes (such as various weather conditions or different gestures of objects), utilize text-to-image models to generate a large number of images, and test an image classifier on which natural scenarios it is easy to be misled.To achieve this goal, we propose a natural language induced adversarial image attack method. Language is one of the easiest ways to be understood by humans. The current progress in text-to-image models [42, 48] makes it possible for us to use natural language to generate adversarial images according to our needs. The core idea is to leverage a text-to-image model to generate adversarial images given input prompts, which are maliciously constructed to lead to misclassification for a target model. We construct the adversarial prompts by optimizing the words in prompts. Our language-based method has rich semantic information and helps humans to analyze the adversarial images from a natural language view.Optimizing the words in prompts for text-to-image models faces challenges. First, each word in a sentence is a discrete variable, which is difficult to be optimized using gradient-based methods. Second, many commercial text-to-image models such as Midjourney are black-box models whose gradients and parameters are not accessible. Third, some commercial models such as DALL•E 3 limit the number of queries, which bring difficulty for the adversarial optimization. Besides, we should make the generated images contain enough semantic information consistent with the prompts during the optimization.To adopt commercial text-to-image models for synthesizing more natural adversarial images, we propose an adaptive genetic algorithm (GA) for optimizing discrete adversarial prompts without requiring gradients and an adaptive word space reduction method for improving the query efficiency. We further used CLIP to maintain the semantic consistency of the the generated images.We evaluated our method on different classification attack tasks. In our experiments, we found that some high-frequency semantic information such as "foggy", "humid", "stretching", etc. can easily cause classifier errors. These adversarial semantic information exist not only in generated images, but also in photos captured in the real world. We also found that some adversarial semantic information can be transferred to unseen classification tasks. Furthermore, our attack method can transfer to different text-to-image models (e.g., Midjourney, DALL•E 3, etc.) and image classifiers. Our method helps people to better understand the weakness of classifiers from a natural language perspective. Through experiments, we also reveal the potential safety and fairness issues of current text-to-image models. It inspires us to build more robust and fair AI models. 
 
 Appendix:  


Decision: The paper proposed a method of generating adversarial images using natural language prompts. The paper received 2 borderline accept and 1 borderline reject after rebuttal. The reviewer who provided borderline reject actually raised the score from weak reject and seems to be satisfied with the rebuttal. AC looked at the reviews and rebuttal and voted for the acceptance of the paper.

Reviews: review: paper_summary: paper_summary: The paper proposes a novel method for generating adversarial images using natural language prompts and simply leveraging commercial text-to-image models. They employ an adaptive genetic algorithm (GA) and an adaptive word space reduction method to optimize these prompts without requiring gradients. The results demonstrate that certain high-frequency semantic information in natural language can easily cause classifier errors. CLIP is employed to maintain semantic consistency. Experimental results demonstrate the method's effectiveness in causing misclassifications and its applicability across various models and classifiers. The authors also show semantical explainability and extensions to the proposed method.
strength_weakness: strength_weakness: The proposed method is simple and efficient in terms of queries. It is smart to leverage the commercial Text-to-Image models for semantical analysis and adversarial attacks.

I like the idea of using the adaptive genetic algorithm to update the words and optimize the prompt. It is a stochastic process to get a reasonable adversarial image with a natural language explanation.

The analysis and applications are very comprehensive and the authors give many use cases in extension to the proposed method.
limitations: limitations: I understand the limitation of limited queries for text-to-image generation and the authors provide an ablation study on AWSR. However, more information could be indicated to make it more convincing. How do you know there is not a combination of attributes (while individually contributes little to the attack), that could have a great impact when combined? Also, how much difference will it make in terms of ASR?
Following up with the previous comment, is the prompt of ten runs in Table 3 similar to each other?

The experiments are limited to animal and race categories, which is around 10 classes. I wonder how it would work on all the categories of ImageNet. Will it still work? If not what is the limitation?

I failed to locate how many images are used to generate ASR in a single fitness score for one prompt. Such would be important in terms of the efficiency of attacking the model. Also, the efficiency such as images generated (costs), time, or memory is missing in the paper.

There is also a series of previous works on semantic information with generative models and explainability [1-5], I wonder how the method would compare in domains other than animals in terms of semantic explanation.

[1] ICCV 2019, Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers.
[2] ECCV 2020, SemanticAdv: Generating Adversarial Examples via Attribute-conditioned Image Editing.
[3] ICCV 2021, Explaining in Style: Training a GAN to explain a classifier in StyleSpace.
[4] CVPR 2023, Zero-shot Model Diagnosis.
[5] NeurIPS 2024, LANCE: Stress-testing Visual Models by Generating Language-guided Counterfactual Images.
paper_summary: paper_summary: To investigate what natural conditions images are easily misled the classification method, this paper propse natural language induced adversarial attack method, where the authors leverage T2I models to generate adversarial images that mislead pretrained classifiers. Experimental results highlight the effectiveness of specific high-frequency semantic information in causing classifier errors.
strength_weakness: strength_weakness: - The use of natural language to generate adversarial images is a creative and novel method.
- The proposed method identifies specific high-frequency semantic information that induces classifier errors.
limitations: limitations: - I found similarities between the conclusions mentioned in Section 4.7 and some conclusions discussing the robustness of the model in image corruption. Could you please explain the difference in contribution between the attack method proposed in the paper and natural image corruption, especially, some classical image corruption methods have contained the "foggy", "rainy" and "snowy". I would raise my score if the author could make a convincing explanation.
- In my understanding, the images optimized for adversarial attacks are usually sampled from the test dataset of the victim model, and are described later with test samples (the content in brackets indicates whether it is attacked), which basically guarantees that the test sample (clean) is an I.I.D. situation, that is to say, it will be correctly classified. However, in Tables 1 and 2, I found that the samples generated by the clean method still misclassified some class. This caused me to worry about whether the clean test sample generated by the generative model might itself be an O.O.D. sample (to the victim model). Is it still meaningful to attack an O.O.D. sample? As far as I know, classification models trained on natural samples usually manifest significant performance degradation on AI- Generated samples. I hope the author can explain this. Note that this may also lead to changes in scores.
paper_summary: paper_summary: This paper targets an interesting topic: the use of generative AI to produce adversarial examples. The authors build a framework for adversarial example generation based on the text-image generqative model, combining prompt engineering and genetic algorithm, and explore the possibilities of AI-generated adversarial examples.
strength_weakness: strength_weakness: + paper is well organized
+ idea is fun
limitations: limitations: - minor grammar and typo issues, e.g., ``overal''.
- this paper lacks a solid threat model. The concept of adversarial examples (AE) in this paper needs to be redefined. Traditional AE are often based on real inputs from the physical world, and are used to deceive models through precise, human-imperceptible perturbations. The AE in this paper, on the other hand, are generated entirely by the generating AI and lack the original inputs as a reference. This significant difference leads to the fact that the traditional attack model is no longer applicable to this work.
- the lack of clarity in the definition raises many new questions: for example, how can the strength of an attack be evaluated? Does the opportunity for such an attack come from the proposed approach, or from the inefficiency of the detection model itself for generative AI? There is a need to develop a more rational attack and evaluation framework.
- The prompting framework presented in this paper is relatively simple and does not provide informative insights. Some of the adjectives observed by the authors, such as cloudy and foggy, produce more high-frequency noise, which is consistent with observations in traditional AEs.