Original: Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks
Revised: Natural Color Fool: Towards Boosting Black-box Unrestricted Attacks

Original: Anonymous Author(s)

Original: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: Unrestricted color attacks, which manipulate semantically meaningful color of animage, have shown their stealthiness and success in fooling both human eyes anddeep neural networks.
Revised: Unrestricted color attacks, which manipulate semantically meaningful color of an image, have shown their stealthiness and success in fooling both human eyes and deep neural networks.

Original: However, current works usually sacrifice the flexibility of theuncontrolled setting to ensure the naturalness of adversarial examples.
Revised: However, current works usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples.

Original: As a result,the black-box attack performance of these methods is limited.
Revised: As a result, the black-box attack performance of these methods is limited.

Original: To boost transferability of adversarial examples without damaging image quality, we propose a novel Natural Color Fool (NCF) which is guided by realistic color distributions sampledfrom a publicly available dataset and optimized by our neighborhood search andinitialization reset.
Revised: To boost transferability of adversarial examples without damaging image quality, we propose a novel Natural Color Fool (NCF) which is guided by realistic color distributions sampled from a publicly available dataset and optimized by our neighborhood search and initialization reset.

Original: By conducting extensive experiments and visualizations, weconvincingly demonstrate the effectiveness of our proposed method.
Revised: By conducting extensive experiments and visualizations, we convincingly demonstrate the effectiveness of our proposed method.

Original: Notably, onaverage, results show that our NCF can outperform state-of-the-art approachesby 15.0% ∼ 32.9% for fooling normally trained models and 10.0% ∼ 25.3% forevading defense methods.
Revised: Notably, on average, results show that our NCF can outperform state-of-the-art approaches by 15.0% ∼ 32.9% for fooling normally trained models and 10.0% ∼ 25.3% for evading defense methods.

Original: Our code is available at Appendix.
Revised: Our code is available at https://github.com/ylhz/Natural-Color-Fool .

Original:  Introduction
Revised:  Introduction

Original: Deep neural networks (DNNs) have achieved excellent performance on a large number of tasks, suchas image recognition [1, 2], medical diagnostics [3, 4] and autonomous driving [5].
Revised: Deep neural networks (DNNs) have achieved excellent performance on a large number of tasks, such as image recognition [1, 2], medical diagnostics [3, 4], and autonomous driving [5].

Original: However, with therise of the field of adversarial attack [6, 7, 8, 9], the robustness of state-of-the-art DNNs [2, 10, 11, 12]is put in question.
Revised: However, with the rise of the field of adversarial attack [6, 7, 8, 9, 10, 11, 12], the robustness of state-of-the-art DNNs [2, 13, 14, 15, 16] is put in question.

Original: Adversarial examples thus reveal the vulnerability of DNNs and inevitably raiseconcerns about widely deployed models.
Revised: Adversarial examples thus reveal the vulnerability of DNNs and inevitably raise concerns about widely deployed models.

Original: To avoid potential risks, it is crucial to expose as many ofthe model’s “blind spots” as possible at this stage.
Revised: To avoid potential risks, it is crucial to expose as many of the model’s “blind spots” as possible at this stage.

Original: Generally, scenarios of adversarial attacks can divide into white-box and black-box.
Revised: Generally, scenarios of adversarial attacks can divide into white-box and black-box.

Original: For the white-boxscenario [13, 14, 15, 16], all information about the target model is publicly available, such as thearchitecture and parameters.
Revised: For the white-box scenario [17, 18, 19, 20], all information about the target model is publicly available, such as the architecture and parameters.

Original: Although the attacker can easily fool them with human-imperceptibleperturbations in this case, it is not practical in the real world since deployed models are usuallyopaque to unauthorized users.
Revised: Although the attacker can easily fool them with human-imperceptible perturbations in this case, it is not practical in the real world since deployed models are usually opaque to unauthorized users.

Original: To overcome this limitation, numerous works begin to study theblack-box attack [7, 17, 18, 19, 20, 21], which relies on the cross-model transferability of adversarialexamples.
Revised: To overcome this limitation, numerous works begin to study the black-box attack [7, 21, 22, 23, 24, 25], which relies on the cross-model transferability of adversarial examples.

Original: Typically, most existing black-box attacks maintain image quality by constraining the
Revised: Typically, most existing black-box attacks maintain image quality by constraining the

Original: L p -norm of perturbation [22, 19, 8].
Revised: L p -norm of perturbation [26, 23, 27, 8].

Original: However, the L p -norm constraint in RGB color space isnot an ideal indicator for measuring the perceptual distance between two images since adversarialexamples with a small perturbation size may still look unnatural to human eyes [15].
Revised: However, the L p -norm constraint in RGB color space is not an ideal indicator for measuring the perceptual distance between two images since adversarial examples with a small perturbation size may still look unnatural to human eyes [19].

Original: Thus theunrestricted attack [23, 24, 25, 26, 27, 28, 29] is proposed — replacing the traditional small L p -normperturbations with uncontrolled yet human-imperceptible ones, which is more practically meaningful.
Revised: Thus the unrestricted attack [28, 29, 30, 31, 32, 33, 34] is proposed — replacing the traditional small L p -norm perturbations with uncontrolled yet human-imperceptible ones, which is more practically meaningful.

Original: Among existing unrestricted attacks, the unrestricted color branch is a very promising direction.
Revised: Among existing unrestricted attacks, the unrestricted color branch is a very promising direction.

Original: As demonstrated in previous works [25, 27, 24], only manipulating the color of an image is notnoticeable to human eyes but can easily fool DNNs.
Revised: As demonstrated in previous works [30, 32, 29], only manipulating the color of an image is not noticeable to human eyes but can easily fool DNNs.

Original: This is mainly because global uniform changesin images are usually imperceptible, and DNNs are vulnerable to certain large-scale patterns.
Revised: This is mainly because global uniform changes in images are usually imperceptible, and DNNs are vulnerable to certain large-scale patterns.

Original: However, current unrestricted color attacks usually sacrifice the flexibility of the uncontrolled settingto ensure the naturalness of adversarial examples: either rely on intuition [23, 24] and objectivemetric [27] or use relatively small changes [25, 26].
Revised: However, current unrestricted color attacks usually sacrifice the flexibility of the uncontrolled setting to ensure the naturalness of adversarial examples: either rely on intuition [28, 29] and objective metric [32] or use relatively small changes [30, 31].

Original: Consequently, the transferability of adversarialexamples generated by these methods is limited.
Revised: Consequently, the transferability of adversarial examples generated by these methods is limited.

Original: To remedy this, we propose a Natural Color Fool (NCF) based on a more flexible perturbationspace.
Revised: To remedy this, we propose a Natural Color Fool (NCF) based on a more flexible perturbation space.

Original: Specifically, we build a color distribution library that contains diverse yet realistic colordistributions sampled from the ADE20K dataset [30] for each semantic class.
Revised: Specifically, we build a color distribution library that contains diverse yet realistic color distributions sampled from the ADE20K dataset [35] for each semantic class.

Original: By borrowing the colormapping technique of [31], we utilize the library to generate a set of image variants with realistic colordistribution for each clean image.
Revised: By borrowing the color mapping technique of [36], we utilize the library to generate a set of image variants with realistic color distribution for each clean image.

Original: Then we use the substitute model to select the most adversarialvariant.
Revised: Then we use the substitute model to select the most adversarial variant.

Original: To boost its transferability, we further introduce neighborhood search and initializationreset to optimize, thus obtaining the resulting adversarial example.
Revised: To boost its transferability, we further introduce neighborhood search and initialization reset to optimize, thus obtaining the resulting adversarial example.

Original: Figure 1 illustrates the simplifiedpipeline for our method.
Revised: Figure 1 illustrates the simplified pipeline for our method.

Original: In summary, our main contributions are:
Revised: In summary, our main contributions are:

Original: • We observe that current unrestricted color attacks lack flexibility, which results in limited transferability of the adversarial examples.
Revised: • We observe that current unrestricted color attacks lack flexibility, which results in limited transferability of the adversarial examples.

Original: • To alleviate this issue, we propose a Natural Color Fool (NCF), which fully exploits colordistributions of semantic classes in an image to craft human-imperceptible, flexible, andhighly transferable adversarial examples.
Revised: • To alleviate this issue, we propose a Natural Color Fool (NCF), which fully exploits color distributions of semantic classes in an image to craft human-imperceptible, flexible, and highly transferable adversarial examples.

Original: • Extensive experiments and visualizations demonstrate the effectiveness of our proposed method.
Revised: • Extensive experiments and visualizations demonstrate the effectiveness of our proposed method.

Original: Significantly, with high NIMA scores [32], NCFaveragely outperforms state-of-
Revised: Significantly, with high NIMA scores [37], NCF

Original: the-art methods by 15.0% ∼ 32.9% for fooling normally trained models, and 10.0% ∼ 25.3%for evading defense models.
Revised: averagely outperforms state-ofthe-art methods by 15.0% ∼ 32.9% for fooling normally trained models, and 10.0% ∼ 25.3% for evading defense models.

Original:  Related Works 
Revised:  Related Works 2.1 Unrestricted Attacks

Original: 2.1 Unrestricted Attacks

Original: Unrestricted attacks [25, 33, 34, 27], which usually significantly modify the image but can yieldhuman-imperceptible adversarial examples, have been widely studied in recent years.
Revised: Unrestricted attacks [30, 38, 39, 32], which usually significantly modify the image but can yield human-imperceptible adversarial examples, have been widely studied in recent years.

Original: For example,some works modify domain-specific structural attributes of the image.
Revised: For example, some works modify domain-specific structural attributes of the image.

Original: SemanticAdv [33] uses anattribute-conditioned image editing model to modify the attributes of the face (e.g., modifying thedegree of mouth opening).
Revised: SemanticAdv [38] uses an attribute-conditioned image editing model to modify the attributes of the face (e.g., modifying the degree of mouth opening).

Original: advCam [34] hides adversarial perturbations by using the style transfertechnique (e.g., changing a traffic sign to a rust style).
Revised: advCam [39] hides adversarial perturbations by using the style transfer technique (e.g., changing a traffic sign to a rust style).

Original: Of course, there are also many works modifygeneric attributes of images, such as texture and color.
Revised: Of course, there are also many works modify generic attributes of images, such as texture and color.

Original: Specifically, tAdv [27] infuses the texture ofanother image to generate adversarial examples.
Revised: Specifically, tAdv [32] infuses the texture of another image to generate adversarial examples.

Original: EdgeFool [28] craft adversarial perturbations byenhancing edge details of an image.
Revised: EdgeFool [33] craft adversarial perturbations by enhancing edge details of an image.

Original: Compared with texture-based attacks, color-based ones usually yield more natural results sincemanipulating groups of pixels along dimensions is less perceptible to human eyes.
Revised: Compared with texture-based attacks, color-based ones usually yield more natural results since manipulating groups of pixels along dimensions is less perceptible to human eyes.

Original: To our knowledge,
Revised: To our knowledge,

Original: Hosseini&Poovendran [23] first proposed the Semantic Adversarial Examples (SAE) in this branch.
Revised: Hosseini&Poovendran [28] first proposed the Semantic Adversarial Examples (SAE) in this branch.

Original: Specifically, they convert the image from the RGB color space to the HSV one, then uniformly andrandomly perturbed the H (Hue) and S (Saturation) channels of the entire image.
Revised: Specifically, they convert the image from the RGB color space to the HSV one, then uniformly and randomly perturbed the H (Hue) and S (Saturation) channels of the entire image.

Original: Laidlaw&Feizi
Revised: Laidlaw&Feizi

Original: [25]also notice that RGB color space is not a perceptually uniform space.
Revised: [30] also notice that RGB color space is not a perceptually uniform space.

Original: Thus, they operate in the
Revised: Thus, they operate in the

Original: CIELUV color space and propose a ReColorAdv that uses a specific function to uniformly transformall pixels belonging to the same color.
Revised: CIELUV color space and propose a ReColorAdv that uses a specific function to uniformly transform all pixels belonging to the same color.

Original: Similar to ReColorAdv, ACE [26] proposes a simple piecewiselinear color adjustment filter to manipulate the image.
Revised: Similar to ReColorAdv, ACE [31] proposes a simple piecewiselinear color adjustment filter to manipulate the image.

Original: The main difference is that ACE treats threechannels of an image independent of each other when transformed.
Revised: The main difference is that ACE treats three channels of an image independent of each other when transformed.

Original: AGV [35] increases the attackeffectiveness by filter composition.
Revised: AGV [40] increases the attack effectiveness by filter composition.

Original: Unlike them, cAdv [27] performs color transformation using apretrained colorization network and jointly varies input hints and masks to manipulate adversarialexamples.
Revised: Unlike them, cAdv [32] performs color transformation using a pretrained colorization network and jointly varies input hints and masks to manipulate adversarial examples.

Original: Among existing unrestricted color attacks, ColorFool [24], which exploits image semantics to modifycolors selectively, is the most related to ours.
Revised: Among existing unrestricted color attacks, ColorFool [29], which exploits image semantics to modify colors selectively, is the most related to ours.

Original: Nevertheless, there are several significant differencesbetween our work and ColorFool.
Revised: Nevertheless, there are several significant differences between our work and ColorFool.

Original: First, ColorFool requires manually selecting several humansensitive semantic classes (i.e., sky, water, plants, and humans), while our approach does not need.
Revised: First, ColorFool requires manually selecting several humansensitive semantic classes (i.e., sky, water, plants, and humans), while our approach does not need.

Original: Second, ColorFool adds uncontrolled perturbations on human-insensitive semantic classes, whileour approach utilizes a color distribution library as a guide.
Revised: Second, ColorFool adds uncontrolled perturbations on human-insensitive semantic classes, while our approach utilizes a color distribution library as a guide.

Original: Third, ColorFool optimizes adversarialexamples only via multiple random trials, while our approach also utilizes the gradient of the substitutemodel to fine-tune results.
Revised: Third, ColorFool optimizes adversarial examples only via multiple random trials, while our approach also utilizes the gradient of the substitute model to fine-tune results.

Original: 2.2 Adversarial Defenses
Revised: 2.2 Adversarial Defenses

Original: To mitigate the threat of adversarial examples, various defense methods have been proposed forthe past few years.
Revised: To mitigate the threat of adversarial examples, various defense methods have been proposed for the past few years.

Original: Generally, existing defense techniques can fall into two categories: adversarialtraining [36, 37, 38] and input pre-process [39, 40, 41].
Revised: Generally, existing defense techniques can fall into two categories: adversarial training [41, 42, 43, 44] and input pre-process [45, 46, 47].

Original: The former gains immunity to attacks byleveraging adversarial examples during the training phase.
Revised: The former gains immunity to attacks by leveraging adversarial examples during the training phase.

Original: For example, Tram ` e r et al.
Revised: For example, Tram ` e r et al.

Original: [37] improvethe black-box robustness by considering adversarial examples generated by other irrelevant models.
Revised: [42] improve the black-box robustness by considering adversarial examples generated by other irrelevant models.

Original: Xie et al.
Revised: Xie et al.

Original: [38] introduce feature denoising modules and train them on adversarial examples to buildwhite-box robust models.
Revised: [43] introduce feature denoising modules and train them on adversarial examples to build white-box robust models.

Original: Although adversarial training is usually the most robust strategy, it suffersfrom expensive training costs.
Revised: Although adversarial training is usually the most robust strategy, it suffers from expensive training costs.

Original: To overcome this limitation, the input pre-process branch is designedto cure the infection of adversarial examples before feeding to DNNs.
Revised: To overcome this limitation, the input pre-process branch is designed to cure the infection of adversarial examples before feeding to DNNs.

Original: For example, Guo et al.
Revised: For example, Guo et al.

Original: [39]introduce several input transformation techniques (e.g., JPEG compression [39]) to recover fromthe adversarial perturbations.
Revised: [45] introduce several input transformation techniques (e.g., JPEG compression [45]) to recover from the adversarial perturbations.

Original: Xie et al.
Revised: Xie et al.

Original: [42] propose R&P which mitigates the adversarial influencethrough random resizing and padding.
Revised: [48] propose R&P which mitigates the adversarial influence through random resizing and padding.

Original: Liao et al.
Revised: Liao et al.

Original: [43] come up with a high-level representationguided denoiser (HGD) to reduce the effect of adversarial perturbations.
Revised: [49] come up with a high-level representation guided denoiser (HGD) to reduce the effect of adversarial perturbations.

Original: Jia et al.
Revised: Jia et al.

Original: [40] propose anend-to-end image compression model called ComDefend against adversarial examples.
Revised: [46] propose an end-to-end image compression model called ComDefend against adversarial examples.

Original: Naseer etal.
Revised: Naseer et al.

Original: [41] train a neural representation purifier model (NRP) that cleans adversarial perturbation basedon the automatically derived supervision.
Revised: [47] train a neural representation purifier model (NRP) that cleans adversarial perturbation based on the automatically derived supervision.

Original:  Methodology 
Revised:  Methodology 3.1 Problem Formulation

Original: 3.1 Problem Formulation

Original: Let x be a clean image with true label y and F θ ( · ) denote the deep learning classifier with parametersθ .
Revised: Let x be a clean image with true label y and F θ ( · ) denote the deep learning classifier with parameters θ .

Original: Formally, unrestricted attacks aim to craft human-imperceptible adversarial perturbations (may bevery large in RGB color space) for x so that the resulting adversarial examples x ′ can induce F θ ( · )to misclassify:
Revised: Formally, unrestricted attacks aim to craft human-imperceptible adversarial perturbations (may be very large in RGB color space) for x so that the resulting adversarial examples x ′ can induce F θ ( · ) to misclassify:

Original: [Equation]
Revised: [Equation]

Original: In this paper, we focus on a more challenging black-box scenario (compared to the white-boxscenario), where the target model’s information (e.g., parameters and structure) is inaccessible.
Revised: In this paper, we focus on a more challenging black-box scenario (compared to the white-box scenario), where the target model’s information (e.g., parameters and structure) is inaccessible.

Original: Therefore, adversarial examples can only be crafted via the accessible substitute model F ϕ ( · ) andrely upon their transferability to fool target models.
Revised: Therefore, adversarial examples can only be crafted via the accessible substitute model F ϕ ( · ) and rely upon their transferability to fool target models.

Original: 3.2 Color Distribution Library
Revised: 3.2 Color Distribution Library

Original: Existing unrestricted color attacks tend to sacrifice their flexibility so that they can generate humanimperceptible adversarial examples.
Revised: Existing unrestricted color attacks tend to sacrifice their flexibility so that they can generate humanimperceptible adversarial examples.

Original: For example, ReColorAdv [25] requires constraining the perturbation to a relatively small range, which cannot take full advantage of the “unrestricted” setting;cAdv [27] enforces the color belonging to the low-entropy cluster to remain unchanged, whichinevitably reduces the attack space; ColorFool [24] manually splits an image into two parts and addscontrolled noises on the human-sensitive part, which largely depends on the authors’ intuition (but itvaries from person to person).
Revised: For example, ReColorAdv [30] requires constraining the perturbation to a relatively small range, which cannot take full advantage of the “unrestricted” setting; cAdv [32] enforces the color belonging to the low-entropy cluster to remain unchanged, which inevitably reduces the attack space; ColorFool [29] manually splits an image into two parts and adds controlled noises on the human-sensitive part, which largely depends on the authors’ intuition (but it varies from person to person).

Original: To remedy the above limitation, we borrow the idea of [44] to construct a “distribution of colordistributions” (DoD) for different semantic classes based on the ADE20K [30] dataset.
Revised: To remedy the above limitation, we borrow the idea of [50] to construct a “distribution of color distributions” (DoD) for different semantic classes based on the ADE20K [35] dataset.

Original: Specifically,for each class, DoD provides 20 different dominant distribution sets (represented by the color distributions), which are obtained by a hierarchical clustering based on color palettes 1 of correspondingsegmentation class in the dataset.

Original: Since the color distributions in each distribution set are similar and averaging all color distributionsof a specific distribution set may not yield a natural representation, we randomly select a colordistribution to represent the overall color characteristics for simplicity.

Original: Therefore, for a semanticclass ˜ y , its realistic color distribution space can be expressed as: [Equation] where c m ˜ y is a randomly sampled distribution from them -th set, and our color distribution library Ccan be denoted as: [Equation]
Revised: Specifically, for each class, DoD provides 20 different dominant distribution sets (represented by the color distri-

Original: ℒ 𝑎𝑎𝑎𝑎𝑎𝑎 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐 … 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐
Revised: ℒ 𝑎𝑎𝑎𝑎𝑎𝑎 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐 … 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐

Original: Car ( ℂ 𝑐𝑐𝑎𝑎𝑐𝑐 ) 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 … 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚
Revised: Car ( ℂ 𝑐𝑐𝑎𝑎𝑐𝑐 ) 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 … 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚

Original: Mountain ( ℂ 𝑚𝑚𝑚𝑚𝑚𝑚 )
Revised: Mountain ( ℂ 𝑚𝑚𝑚𝑚𝑚𝑚 )

Original: Transfer Matrix 𝑻𝑻 … …
Revised: Transfer Matrix 𝑻𝑻 … …

Original: Color Distribution Library ℂ
Revised: Color Distribution Library ℂ

Original: Segm
Revised: Segm

Original: MK Solution
Revised: MK Solution

Original: Color Mapping [Figure] 𝒙𝒙 𝑯𝑯′ 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐
Revised: Color Mapping 𝒙𝒙 𝒙𝒙 𝑯𝑯′ 𝒄𝒄 𝑚𝑚𝑚𝑚𝑚𝑚 𝒄𝒄 𝑐𝑐𝑎𝑎𝑐𝑐

Original: Semantic Mask 𝒙𝒙 𝑯𝑯 …
Revised: Semantic Mask 𝒙𝒙 𝑯𝑯 …

Original: +
Revised: +

Original: Forward (Clean image)
Revised: Forward (Clean image)

Original: Forward (Image variant)
Revised: Forward (Image variant)

Original: Backward (Neighborhood search) 
Revised: Backward (Neighborhood search) Query

Revised: Randomly Select w

Original: [Figure]
Revised: [Figure]

Original:  𝑯𝑯 ℱ 𝜙𝜙
Revised: ∗ [Figure] ∗ Target Distribution 𝑯𝑯 ℱ 𝜙𝜙

Original: For the input image x , we first obtain its mask by a segmentation model (Segm).
Revised: For the input image x , we first obtain its mask by a segmentation model (Segm).

Original: Then we randomly assign a realistic color distribution c for each class via our color distribution library C and fuse them into a target H based on the proportion of corresponding area w in the image.
Revised: Then we randomly assign a realistic color distribution c for each class via our color distribution library C and fuse them into a target H based on the proportion of corresponding area w in the image.

Original: Here x H is an image (without spatial information) directly converted by H so that we can adopt Monge-Kantorovitch (MK) solution to obtain the transfer matrix T .
Revised: Here x H is an image (without spatial information) directly converted by H so that we can adopt Monge-Kantorovitch (MK) solution to obtain the transfer matrix T .

Original: With it and Eq. 4, we can get the color mapping image variant x ′ H .
Revised: With it and Eq. 4, we can get the color mapping image variant x ′ H .

Original: Finally, we fine-tune T (i.e., neighborhood search) according to the loss L adv so that more threatening adversarial examples can be mapped.
Revised: Finally, we fine-tune T (i.e., neighborhood search) according to the loss L adv so that more threatening adversarial examples can be mapped.

Revised: butions), which are obtained by a hierarchical clustering based on color palettes 2 of corresponding segmentation class in the dataset.

Revised: Since the color distributions in each distribution set are similar and averaging all color distributions of a specific distribution set may not yield a natural representation, we randomly select a color distribution to represent the overall color characteristics for simplicity.

Revised: Therefore, for a semantic class ˜ y , its realistic color distribution space can be expressed as:

Revised: [Equation]

Original: where  M denotes the total number of semantic classes contained in our library (see Appendix A forthe pipeline of building color distribution library).
Revised: where c m ˜ y is a randomly sampled distribution from the m -th set, and our color distribution library C can be denoted as: [Equation] (3) where M denotes the total number of semantic classes contained in our library (see Appendix A for the pipeline of building color distribution library).

Original: In the following, we adopt this color distributionlibrary to ensure the colors of adversarial examples are natural and coordinated, thus making ourattack more flexible.
Revised: In the following, we adopt this color distribution library to ensure the colors of adversarial examples are natural and coordinated, thus making our attack more flexible.

Original: 3.3 Natural Color Fool
Revised: 3.3 Natural Color Fool

Original: To generate natural adversarial examples, precisely controlling the color perception is necessary.
Revised: To generate natural adversarial examples, precisely controlling the color perception is necessary.

Original: Inthis paper, we craft adversarial perturbations in CIELab color space where the perception is moreuniform than RGB color space.
Revised: In this paper, we craft adversarial perturbations in CIELab color space where the perception is more uniform than RGB color space.

Original: The framework of our proposed Natural Color Fool (NCF) isillustrated in Figure 1 (refer to Appendix B for Algorithm of NCF).
Revised: The framework of our proposed Natural Color Fool (NCF) is illustrated in Figure 1 (refer to Appendix B for Algorithm of NCF).

Original: Formally, for a given image x ,we first obtain a semantic mask through a semantic segmentation model.
Revised: Formally, for a given image x , we first obtain a semantic mask through a semantic segmentation model.

Original: Then, for each semanticclass ˜ y in x , we randomly select a color distribution c i ˜ y from C ˜ y
Revised: Then, for each semantic class ˜ y in x , we randomly select a color distribution c i ˜ y from C ˜ y

Original: in the color distribution library.
Revised: in the color distribution library.

Original: After that, we fuse the color distributions of all semantic classes based on the proportion of imagesoccupied by each class (e.g., w car , w mou in Figure 1), thus generating a target color distribution H .
Revised: After that, we fuse the color distributions of all semantic classes based on the proportion of images occupied by each class (e.g., w car , w mou in Figure 1), thus generating a target color distribution H .

Original: With it, we can use the following Eq.
Revised: With it, we can use the following Eq.

Original: 4 to generate a target image variant x ′ H (refer to Figure 1)which approximately replaces the color distribution of each semantic class of x with correspondingone in target H [31]:
Revised: 4 to generate a target image variant x ′ H (refer to Figure 1) which approximately replaces the color distribution of each semantic class of x with corresponding one in target H [36]:

Original: [Equation]
Revised: [Equation]

Original: where T ∈ R 3 × 3 is the transfer matrix, x H is an image reconstructed by H but without spatialinformation 2 (see Figure 1), and µ x , µ x H ( ∈ R 3 ) , Σ x , Σ x H ( ∈ R 3 × 3 ) are channel means of x ,channel means of x H , the covariance matrix of x , and the covariance matrix of x H , respectively.
Revised: where T ∈ R 3 × 3 is the transfer matrix, x H is an image reconstructed by H but without spatial information 3 (see Figure 1), and µ x , µ x H ( ∈ R 3 ) , Σ x , Σ x H ( ∈ R 3 × 3 ) are channel means of x , channel means of x H , the covariance matrix of x , and the covariance matrix of x H , respectively.

Original: Formally, there are numerous solutions [45, 46, 47, 48] for T .
Revised: Formally, there are numerous solutions [51, 52, 53, 54] for T .

Original: However, most of them may not obtainan intended color mapping, i.e., only color proportions are expected.
Revised: However, most of them may not obtain an intended color mapping, i.e., only color proportions are expected.

Original: To tackle this issue, we follow
Revised: To tackle this issue, we follow

Original: Piti ´e et al.
Revised: Piti ´e et al.

Original: [31] and convert color mapping into a Monge–Kantorovich transportation problem, thusgetting the solution for T :
Revised: [36] and convert color mapping into a Monge–Kantorovich transportation problem, thus getting the solution for T :

Original: [Equation]
Revised: [Equation]

Original: Intuitively, relying solely on randomly picking color distribution may limit the attack success rate.
Revised: Intuitively, relying solely on randomly picking color distribution may limit the attack success rate.

Original: Since our color distribution library contains a wide variety of color combinations and we haveaccessible substitute models, there is no reason not to take advantage of them.
Revised: Since our color distribution library contains a wide variety of color combinations and we have accessible substitute models, there is no reason not to take advantage of them.

Original: Thus, we utilize thesubstitute model F ϕ ( · ) to select a most adversarial distribution from η different color distributionssampled from our color distribution library:
Revised: Thus, we utilize the substitute model F ϕ ( · ) to select a most adversarial distribution from η different color distributions sampled from our color distribution library:

Original: [Equation]
Revised: [Equation]

Original: where H is the set containing η different color distributions and L adv is the C&W loss [14]:
Revised: where H is the set containing η different color distributions and L adv is the C&W loss [18]:

Original: [Equation]
Revised: [Equation]

Original: where z j denotes the logit concerning the j -th class.
Revised: where z j denotes the logit concerning the j -th class.

Original: To further boost our attack, we propose twotechniques: neighborhood search and initialization reset .
Revised: To further boost our attack, we propose two techniques: neighborhood search and initialization reset .

Original: Specifically, the former aims to slightlyadjust T (derived from Eq. 6) to improve the attack success rate while ensuring a natural mappingresult (see the comparison of adversarial examples with or without adopting neighborhood searchin Appendix E).
Revised: Specifically, the former aims to slightly adjust T (derived from Eq. 6) to improve the attack success rate while ensuring a natural mapping result (see the comparison of adversarial examples with or without adopting neighborhood search in Appendix E).

Original: Thus, the neighborhood search can be formulated as the following optimizationproblem:
Revised: Thus, the neighborhood search can be formulated as the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: where ϵ denotes the maximal perturbation size for T .
Revised: where ϵ denotes the maximal perturbation size for T .

Original: In our paper, we adopt MI-FGSM [17] with Niterations to optimize Eq. 9.
Revised: In our paper, we adopt MI-FGSM [21] with N iterations to optimize Eq. 9.

Original: Nonetheless, an adversarial transfer matrix T ′ found in the neighborhoodof a specific T may not be effective, since the search space is indeed limited.
Revised: Nonetheless, an adversarial transfer matrix T ′ found in the neighborhood of a specific T may not be effective, since the search space is indeed limited.

Original: To alleviate this issue, theinitialization reset repeats the operation of selecting one from η randomly sampled color distributions(i.e. , Eq.  K times, thus obtaining K ideal initial color distributions for the neighborhood search.
Revised: To alleviate this issue, the initialization reset repeats the operation of selecting one from η randomly sampled color distributions (i.e., Eq. 7) K times, thus obtaining K ideal initial color distributions for the neighborhood search.

Original: Then we choose the best one among them:
Revised: Then we choose the best one among them:

Original: [Equation]
Revised: [Equation]

Original: where H ∗ i and T ′ i denote the resulting color distribution and corresponding transfer matrix of thei -th reset.
Revised: where H ∗ i and T ′ i denote the resulting color distribution and corresponding transfer matrix of the i -th reset.

Original: Consequently, resulting adversarial examples can be obtained by:
Revised: Consequently, resulting adversarial examples can be obtained by:

Original: [Equation]
Revised: [Equation]

Original: In Figure 2, we show resulting adversarial examples generated by our proposed method and recentworks, i.e., cAdv [27], ColorFool [24], and ACE [26] (see Appendix G for more comparisons).
Revised: In Figure 2, we show resulting adversarial examples generated by our proposed method and recent works, i.e., cAdv [32], ColorFool [29], and ACE [31] (see Appendix G for more comparisons).

Original: Notably, despite our NCF implements significant modifications to the color distribution of the originalimages, the adversarial examples still look very natural. 
Revised: Notably, despite our NCF implements significant modifications to the color distribution of the original images, the adversarial examples still look very natural. [Figure]

Original:  Experiments
Revised:  Experiments

Original: In this section, we first introduce the setup for our experiments in Section 4.1.
Revised: In this section, we first introduce the setup for our experiments in Section 4.1.

Original: Then we report attacksuccess rates on normally trained and defense models in Section 4.2.
Revised: Then we report attack success rates on normally trained and defense models in Section 4.2.

Original: After that, we compare theimage quality of adversarial examples in Section 4.3.
Revised: After that, we compare the image quality of adversarial examples in Section 4.3.

Original: Finally, we conduct a series of ablation studiesin Section 4.4.
Revised: Finally, we conduct a series of ablation studies in Section 4.4.

Original: To better analyze the adversarial example, we also provide an illustration of attentionshift [49] in Appendix F.
Revised: To better analyze the adversarial example, we also provide an illustration of attention shift [55] in Appendix F.

Original: 4.1 Setup
Revised: 4.1 Setup

Original: Dataset.
Revised: Dataset.

Original: We conduct our experiments on the ImageNet-compatible Dataset 3 .
Revised: We conduct our experiments on the ImageNet-compatible Dataset 4 .

Original: This dataset iscomprised of 1,000 images and is widely used in recent transfer-based attacks [22, 18, 19, 50, 51, 52]. [Figure]
Revised: This dataset is comprised of 1,000 images and is widely used in recent transfer-based attacks [26, 22, 23, 56, 57, 58, 59].

Original: Models.
Revised: Models.

Original: In this paper, we evaluate the vulnerability of various convolutional neural networks(CNNs) and vision transformers (ViTs).
Revised: In this paper, we evaluate the vulnerability of various convolutional neural networks (CNNs) and vision transformers (ViTs).

Original: For CNNs, we consider both normally trained modelsand defense models.
Revised: For CNNs, we consider both normally trained models and defense models.

Original: Normally trained models include VGG-19 [53], ResNet-18 (Res-18), ResNet50 (Res-50) [2], Inception-v3 (Inc-v3) [54], DenseNet-121 (Dense-121) [10], and MobileNet-v2(Mobile-v2) [55].
Revised: Normally trained models include VGG-19 [60], ResNet-18 (Res-18), ResNet50 (Res-50) [2], Inception-v3 (Inc-v3) [61], DenseNet-121 (Dense-121) [13], and MobileNet-v (Mobile-v2) [62].

Original: Defense methods contain JPEG [39], Gray (gray-scale conversion), HGD [43],
Revised: Defense methods contain JPEG [45], Gray (gray-scale conversion), HGD [49],

Original: R&P [42], ComDefend [40], NRP [41], 4 Inc- v3 ens3 , IncRes- v2 ens [37], Res152 B , Res152 D and
Revised: R&P [48], ComDefend [46], NRP [47], 5 Inc- v3 ens3 , IncRes- v2 ens [42], Res152 B , Res152 D and

Original: ResNeXt DA [38].
Revised: ResNeXt DA [43].

Original: For ViT, we consider normally trained ViT-S/16 (ViT-S) [56], XCiT-N12/16(XCiT-N12) [57], and DeiT-S [56].
Revised: For ViT, we consider normally trained ViT-S/16 (ViT-S) [63], XCiT-N12/ (XCiT-N12) [64], and DeiT-S [63].

Original: Implementation Details.
Revised: Implementation Details.

Original: In all experiments, the semantic segmentation model is Swin-T [58](the influence of different segmentation models on the results can be found in Appendix H) andthe color distribution library size M = 150 , the number of random searches η = 50 , the iterationof neighborhood search N = 15 , the maximum perturbation of transfer matrix ϵ = 0 . 2 , the stepsize α = ϵ/N ≈ 0 .
Revised: In all experiments, the semantic segmentation model is Swin-T [65] (the influence of different segmentation models on the results can be found in Appendix H) and the color distribution library size M = 150 , the number of random searches η = 50 , the iteration of neighborhood search N = 15 , the maximum perturbation of transfer matrix ϵ = 0 . 2 , the step size α = ϵ/N ≈ 0 .

Original: 013 , the momentum u = 0 .
Revised: 013 , the momentum u = 0 .

Original: 6 (for MI-FGSM), and the reset number K = 10(see Appendix C for ablation of K ).
Revised: 6 (for MI-FGSM), and the reset number K =(see Appendix C for ablation of K )

Original: We compare our proposed method with Semantic Adversarial
Revised: We compare our proposed method with Semantic Adversarial

Original: Examples (SAE) [23], ReColorAdv [25], cAdv [27], ColorFool [24], and ACE [26].
Revised: Examples (SAE) [28], ReColorAdv [30], cAdv [32], ColorFool [29], and ACE [31]

Original: The parametersof each competitor follow the corresponding default setting.
Revised: The parameters of each competitor follow the corresponding default setting

Original: Our experiments are run on an NVIDIA
Revised: Our experiments are run on an NVIDIA

Original: TITAN
Revised: TITAN

Original: Xp GPU with 12GB of memory.
Revised: Xp GPU with 12GB of memory.

Original: 4.2 Transferability Comparison 
Revised: 4.2 Transferability Comparison 4.2.1 Results on Normally Trained Models

Original: 4.2.1 Results on Normally Trained Models

Original: In this section, we compare our proposed method with SA [23], ReColorAdv [25], cAdv [27],
Revised: In this section, we compare our proposed method with SA [28], ReColorAdv [30], cAdv [32],

Original: ColorFool [24] and ACE [26] on a variety of normally trained CNNs and Vision Transformers (ViTs).
Revised: ColorFool [29] and ACE [31] on a variety of normally trained CNNs and Vision Transformers (ViTs).

Original: Adversarial examples are crafted via Res-18, VGG-19, Mobile-V2, and Inc-V3, respectively.
Revised: Adversarial examples are crafted via Res-18, VGG-19, Mobile-V2, and Inc-V3, respectively.

Original: For theresults of ensemble attack [17] and using ViTs as the substitute model, please refer to Appendix I and D.
Revised: For the results of ensemble attack [21] and using ViTs as the substitute model, please refer to Appendix I and D.

Original: The attack success rates are presented in Table 1.
Revised: The attack success rates are presented in Table 1.

Original: We can observe that our resulting adversarialexamples usually achieve the highest transferability compared to those generated via state-of-the-artcompetitors.
Revised: We can observe that our resulting adversarial examples usually achieve the highest transferability compared to those generated via state-of-the-art competitors.

Original: For example, when the substitute model is Res-18, only 46.9%, 39.9%, and 40.8%of adversarial examples crafted by SA, ReColorAdv, and cAdv can successfully fool VGG-19.
Revised: For example, when the substitute model is Res-18, only 46.9%, 39.9%, and 40.8% of adversarial examples crafted by SA, ReColorAdv, and cAdv can successfully fool VGG-19.

Original: Incomparison, our NCF can achieve a much higher transferability of 72.1% .
Revised: In comparison, our NCF can achieve a much higher transferability of 72.1% .

Original: Besides, we also considerthe transferability from CNNs to ViTs, as their structures are quite different.
Revised: Besides, we also consider the transferability from CNNs to ViTs, as their structures are quite different.

Original: As shown in Table 1,when transferring adversarial examples from Mobile-V2 to XCiT-N12, recent ColorFool and ACEonly obtain success rates of 22.8% and 22.6%, respectively, while our method can get 56.4% successrate.
Revised: As shown in Table 1, when transferring adversarial examples from Mobile-V2 to XCiT-N12, recent ColorFool and ACE only obtain success rates of 22.8% and 22.6%, respectively, while our method can get 56.4% success rate.

Original: On average, adversarial examples crafted by our method are capable of achieving a 54.5% success rate, which significantly outperforms state-of-the-art approaches by 15.0% ∼ 32.9% .
Revised: On average, adversarial examples crafted by our method are capable of achieving a 54.5% success rate, which significantly outperforms state-of-the-art approaches by 15.0% ∼ 32.9% .

Original: Thisresult convincingly demonstrates the effectiveness of our method in fooling normally trained models.
Revised: This result convincingly demonstrates the effectiveness of our method in fooling normally trained models.

Original: [Table]

Original: [Table]
Revised: [Table]

Original: 4.2.2 Results on Defense Models
Revised: 4.2.2 Results on Defense Models

Original: Threats posed by L p -norm adversarial attacks [7, 17, 19, 51] promote the emergence of adversarialdefenses [36, 38, 41].
Revised: Threats posed by L p -norm adversarial attacks [7, 21, 23, 57] promote the emergence of adversarial defenses [41, 43, 47].

Original: However, whether these defense mechanisms are robust against unrestrictedattacks has not been extensively explored.
Revised: However, whether these defense mechanisms are robust against unrestricted attacks has not been extensively explored.

Original: Therefore, in this section, we consider both input preprocess defenses (i.e., JPEG [39], Gray, R&P [42], HGD [43], ComDefend [40], and NRP [41]) andadversarially trained models (i.e., Inc-v3 ens3 , IncRes-v2 ens , Res B [37], Res D , and ResNext DA [38])to fully investigate the performance of our method. 
Revised: Therefore, in this section, we consider both input preprocess defenses (i.e., JPEG [45], Gray, R&P [48], HGD [49], ComDefend [46], and NRP [47]) and adversarially trained models (i.e., Inc-v3 ens3 , IncRes-v2 ens , Res B [42], Res D , and ResNext DA [43]) to fully investigate the performance of our method. [Table]

Original: The black-box success rates of unrestricted attacks are reported in Table 2.
Revised: The black-box success rates of unrestricted attacks are reported in Table 2.

Original: Similar to Table 1, ourapproach still consistently outperforms existing advanced methods by a large margin.
Revised: Similar to Table 1, our approach still consistently outperforms existing advanced methods by a large margin.

Original: On average,our proposed NCF is capable of making 48.1% adversarial examples fool these defenses, while SA,
Revised: On average, our proposed NCF is capable of making 48.1% adversarial examples fool these defenses, while SA,

Original: ReColorAdv, cAdv, ColorFool, and ACE only obtain success rates of 38.1%, 22.8%, 27.9%, 34.8%,and 24.6%, respectively.
Revised: ReColorAdv, cAdv, ColorFool [Table] and ACE only obtain success rates of 38.1%, 22.8%, 27.9%, 34.8%, and 24.6%, respectively.

Original: Another interesting observation from Table 2 is that advanced defensealgorithms are not necessarily effective when faced with unrestricted adversarial examples.
Revised: Another interesting observation from Table 2 is that advanced defense algorithms are not necessarily effective when faced with unrestricted adversarial examples.

Original: Forexample, even white-box robust feature denoising models [38] are vulnerable, e.g., 60.1% adversarial examples can fool ResNeXt DA .
Revised: For example, even white-box robust feature denoising models [43] are vulnerable, e.g., 60.1% adversarial examples can fool ResNeXt DA .

Original: We speculate the main reason is that the defense mechanism isintermediate feature denoising, while unrestricted color attacks mainly manipulate the color and donot generate significant high-frequency noise.
Revised: We speculate the main reason is that the defense mechanism is intermediate feature denoising, while unrestricted color attacks mainly manipulate the color and do not generate significant high-frequency noise.

Original: In addition, we notice that many input pre-process defenses with target model VGG-19 cannot defendagainst our proposed NCF, but instead boost the transferability of adversarial examples (compareto the VGG-19 results of Table 1).
Revised: In addition, we notice that many input pre-process defenses with target model VGG-19 cannot defend against our proposed NCF, but instead boost the transferability of adversarial examples (compare to the VGG-19 results of Table 1).

Original: To better analyze this abnormal phenomenon, we visualize thepurified images generated by JPEG, ComDefend, and NRP in Figure 3.
Revised: To better analyze this abnormal phenomenon, we visualize the purified images generated by JPEG, ComDefend, and NRP in Figure 3.

Original: Interestingly, we observethat all defenses have little effect on our unrestricted color perturbations.
Revised: Interestingly, we observe that all defenses have little effect on our unrestricted color perturbations.

Original: It is mainly because ouradversarial examples are crafted using realistic colors as a guide and, therefore, can circumvent thesedefenses designed for common perturbation characteristics.
Revised: It is mainly because our adversarial examples are crafted using realistic colors as a guide and, therefore, can circumvent these defenses designed for common perturbation characteristics.

Original: Besides, we observe that JPEG and NRPsuppress key features of “Great egret”, and ComDefend generates many irrelevant repeating patterns.
Revised: Besides, we observe that JPEG and NRP suppress key features of “Great egret”, and ComDefend generates many irrelevant repeating patterns.

Original: As discussed in [59], these side effects of defense methods can reduce the confidence of the modelconcerning the true class, resulting in our adversarial examples instead of boosting the transferabilityafter being processed by these approaches.
Revised: As discussed in [66], these side effects of defense methods can reduce the confidence of the model concerning the true class, resulting in our adversarial examples instead of boosting the transferability after being processed by these approaches.

Original: This result also reminds us that the robustness evaluationof defenses needs to be more comprehensive.
Revised: This result also reminds us that the robustness evaluation of defenses needs to be more comprehensive.

Original: [Figure]
Revised: [Figure]

Original: 4.3 Image Quality
Revised: 4.3 Image Quality

Original: [Figure]

Original: [Table]

Original: Clean

Original: [Table]

Original: cAdv

Original: [Table] [Figure] [Table] Following ColorFool [24], we quantitatively evaluate image quality by a non-reference perceptual image qualitymeasure called neural image assessment (NIMA)
Revised: Following ColorFool [29], we quantitatively evaluate image quality by a non-reference perceptual image quality measure called neural image assessment (NIMA)

Original: [32]which is highly correlated with human perception.
Revised: [37] which is highly correlated with human perception.

Original: Inour paper, NIMA is based on the architecture of MobileNet [60] and is a composite of two models: one trainson AVA [61] for image technical assessment and anothertrains on TID2013 [62] for image aesthetics assessment.
Revised: In our paper, NIMA is based on the architecture of MobileNet [67] and is a composite of two models: one trains on AVA [68] for image technical assessment and another trains on TID2013 [69] for image aesthetics assessment.

Original: As reported in Table 3, image quality assessment results ofour NCF are on par with those of state-of-the-art competitors.
Revised: As reported in Table 3, image quality assessment results of our NCF are on par with those of state-of-the-art competitors.

Original: For NIMA (technical), both ACE and our NCF obtaina high score of over 4.939 , which is just 0.094 lower thanclean images.
Revised: For NIMA (technical), both ACE and our NCF obtain a high score of over 4.939 , which is just 0.094 lower than clean images.

Original: The case of NIMA (aesthetic) is similar,where aesthetic scores of our adversarial examples and clean images differ by only 0.097 , indicatingthat our NCF does not destroy the perceptual quality of images.
Revised: The case of NIMA (aesthetic) is similar, where aesthetic scores of our adversarial examples and clean images differ by only 0.097 , indicating that our NCF does not destroy the perceptual quality of images.

Original: 4.4 Ablation Studies
Revised: 4.4 Ablation Studies

Revised: [Table]

Original: About neighborhood search and initialization reset.
Revised: About neighborhood search and initialization reset.

Original: In this section, we investigate the effect ofneighborhood search and initialization reset.
Revised: In this section, we investigate the effect of neighborhood search and initialization reset.

Original: Specifically, we use Inc-v3 to craft adversarial examples,and then evaluate the transferability towards Res-18, VGG-19, Mobile-v2, Dense-121, Res-50, ViT-S, 
Revised: Specifically, we use Inc-v to craft adversarial examples, and then evaluate the transferability towards Res-18, VGG-19, Mobile-v2, Dense121, Res-50, ViT-S, XCiT-N12, and

Original: XCiT-N12, and DeiT-S.
Revised: DeiT-S.

Original: The results are shown in Table 4.
Revised: The results are shown in Table 4.

Original: In terms of the white-box attack, NCFoutperforms NCF-NS (NCF without NS), NCF-IR (NCF without IR), and NCF-IR-NS (NCF without 
Revised: In terms of the white-box attack, NCF outperforms NCF-NS (NCF without NS), NCF-IR (NCF without IR), and NCF-IR-NS (NCF without IR and

Original: IR and NS) by 17.7% , 13.3% , and 32.2% , respectively.
Revised: NS) by 17.7% , 13.3% , and 32.2% , respectively.

Original: On the black-box attacks, neighborhoodsearch and initialization reset bring an average performance improvement of 8.3% , and 6.5% .
Revised: On the black-box attacks, neighborhood search and initialization reset bring an average performance improvement of 8.3% , and 6.5% .

Original: Whenboth neighborhood search and initialization reset techniques are used, the transferability towardsblack-box models can be improved by an average of 12.5% .
Revised: When both neighborhood search and initialization reset techniques are used, the transferability towards black-box models can be improved by an average of 12.5% .

Original: The significant performance gain confirms the effectiveness of neighborhood search and initialization reset.
Revised: The significant performance gain confirms the effectiveness of neighborhood search and initialization reset.

Original: In addition, we notice thateven if neither proposed technique is used, our method still surpasses state-of-the-art competitors,except for SAE.
Revised: In addition, we notice that even if neither proposed technique is used, our method still surpasses state-of-the-art competitors, except for SAE.

Original: We attribute this phenomenon to the flexibility of our approach, which can naturallymodify the whole image without restriction.
Revised: We attribute this phenomenon to the flexibility of our approach, which can naturally modify the whole image without restriction.

Original: Note that NCF-IR-NS does not mean selecting randomcolors to attack.
Revised: Note that NCF-IR-NS does not mean selecting random colors to attack.

Original: The difference of them is discussed in Appendix J.
Revised: The difference of them is discussed in Appendix J.

Original: [Table]
Revised: [Table]

Original: About color distribution library size.
Revised: About color distribution library size.

Original: In this section, we investigate the influence of color distribution library size M on attack success rates.
Revised: In this section, we investigate the influence of color distribution library size M on attack success rates.

Original: Specifically, we tune M from 0 to 150 with an intervalof 15 and freeze other hyper-parameters, and adversarial examples are crafted via Inc-v3.
Revised: Specifically, we tune M from 0 to 150 with an interval of 15 and freeze other hyper-parameters, and adversarial examples are crafted via Inc-v3.

Original: Note that
Revised: Note that

Original: M = 0 means that our proposed library is not used, thus T is an identity matrix.
Revised: M = 0 means that our proposed library is not used, thus T is an identity matrix.

Original: The attack successrate is reported in Figure 4, where the dashed line indicates the white-box attack success rate andsolid lines refer to the black-box ones.
Revised: The attack success rate is reported in Figure 4, where the dashed line indicates the white-box attack success rate and solid lines refer to the black-box ones.

Original: It can be observed that the library size M plays a key role the number of semantic classes M .
Revised: It can be observed that the library size M plays a key role in attack success rates.

Original: The substitute model is Inc-v3.

Original: in attack success rates. Concretely, the attacksuccess rates increase rapidly at first, then gradually stabilize when the library size exceeds30, and reach the maximum at M = 150 inmost cases.
Revised: Concretely, the attack success rates increase rapidly at first, then gradually stabilize when the library size exceeds 30, and reach the maximum at M = 150 in most cases.

Original: For instance, when M = 150 ,
Revised: For instance, when M = 150 ,

Original: NCF has success rates of 57.7%, 57.6%, 56.8%,40.1%, and 47.6% on Res-18, VGG-19, Mobilev2, Dense-121, and Res-50, respectively.
Revised: NCF has success rates of 57.7%, 57.6%, 56.8%, 40.1%, and 47.6% on Res-18, VGG-19, Mobilev2, Dense-121, and Res-50, respectively.

Original: When
Revised: When

Original: M = 0 , it significantly degrades to 24.6%,18.6%, 21.1%, 14.8%, and 14.2%, respectively.
Revised: M = 0 , it significantly degrades to 24.6%, 18.6%, 21.1%, 14.8%, and 14.2%, respectively.

Original: Intuitively, this is because the target color distribution trivially turns to be the correspondingdistribution of the original image, and thus thespace we perturb on the original image will bereduced.
Revised: Intuitively, this is because the target color distribution trivially turns to be the corresponding distribution of the original image, and thus the space we perturb on the original image will be reduced.

Original: This convincingly demonstrates theeffectiveness of building a class-rich color distribution library.
Revised: This convincingly demonstrates the effectiveness of building a class-rich color distribution library.

Original:  Conclusion
Revised:  Conclusion

Original: In this paper, we propose a black-box unrestricted color attack called Natural Color Fool (NCF).
Revised: In this paper, we propose a black-box unrestricted color attack called Natural Color Fool (NCF).

Original: Different from existing works which either rely on intuition and objective metrics or use relativelysmall changes to yield natural results, our method instead exploits color distribution to craft humanimperceptible, flexible, and highly transferable adversarial examples.
Revised: Different from existing works which either rely on intuition and objective metrics or use relatively small changes to yield natural results, our method instead exploits color distribution to craft humanimperceptible, flexible, and highly transferable adversarial examples.

Original: Extensive experiments andvisualizations demonstrate the effectiveness of our NCF.
Revised: Extensive experiments and visualizations demonstrate the effectiveness of our NCF.

Original: Notably, our adversarial examples caneasily evade current L p robust defense techniques.
Revised: Notably, our adversarial examples can easily evade current L p robust defense techniques.

Original: Furthermore, the transferability of our adversarialexamples is even boosted after being processed by several input pre-process defenses.
Revised: Furthermore, the transferability of our adversarial examples is even boosted after being processed by several input pre-process defenses.

Original: We hope ourwork can draw researchers’ attention to unrestricted color attacks.
Revised: We hope our work can draw researchers’ attention to unrestricted color attacks.

Original: Limitation.
Revised: Limitation.

Original: In our paper, for each semantic class, we provide 20 different color distributions forchoosing.
Revised: In our paper, for each semantic class, we provide 20 different color distributions for choosing.

Original: Therefore, this library is discrete, which may be insufficient to model the whole colorspace.
Revised: Therefore, this library is discrete, which may be insufficient to model the whole color space.

Original: In the future, we will try to build a continuous color space to expand the spatial range andmore accurately simulate the color range of objects.
Revised: In the future, we will try to build a continuous color space to expand the spatial range and more accurately simulate the color range of objects.

Original: Negative Societal Impacts.
Revised: Negative Societal Impacts.

Original: Adversarial examples crafted by our proposed unrestricted color attacklook very natural but are with strong black-box transferability even towards defenses.
Revised: Adversarial examples crafted by our proposed unrestricted color attack look very natural but are with strong black-box transferability even towards defenses.

Original: Therefore,unscrupulous people may adopt our method to undermine real-world applications, which inevitablyraises new concerns about AI safety.
Revised: Therefore, unscrupulous people may adopt our method to undermine real-world applications, which inevitably raises new concerns about AI safety.

Original:  Checklist
Revised:  Acknowledgments

Original: For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
Revised: This study is supported by grants from National Key R&D Program of China (2022YFC2009903/2022YFC2009900), the National Natural Science Foundation of China (Grant No. 62122018, No. 62020106008, No. 61772116, No. 61872064).

Original: contributions and scope? [Yes]
Revised: A Color Distribution Library

Original: (b) Did you describe the limitations of your work?
Revised: In this section, we explain how to build our color distribution library.

Original: [Yes] See Section 5.
Revised: First, all semantic classes are extracted based on the images and annotations of the ADE20K training set [35] (ADE20K contains 150 semantic classes). The semantic classes are clustered into a set of 20 different dominant distribution sets according to their color styles using hierarchical clustering, which is the “distribution of color distribution” (DoD) [50].

Original: (c) Did you discuss any potential negative societal impacts of your work?
Revised: Then, since the color distributions of semantic classes in each cluster are similar, we select one object in each cluster to represent that style.

Original: [Yes] SeeSection 5.(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
Revised: Finally, we extract the color distributions to form our color distribution library. The pipeline is shown in Figure 1.

Original: [Yes]
Revised: [Figure]

Original: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
Revised: In this section, we provide the algorithm of NCF (see Algorithm 1). j to an image without spatial information.

Original: [N/A]
Revised: 9: Σ ¯ x Hj , µ ¯ x Hj ← Calculate covariance matrix and channel means for ¯ x H j . T ← MKSolution(Σ ¯ x , Σ ¯ x Hj ) (see Eq.(6)) 11: ¯ x ′ H

Original: (b) Did you include complete proofs of all theoretical results?
Revised: j ← T (¯ x − µ ¯ x ) + µ ¯ x Hj 12: end for 13: H ← { H j } ηj = 14: H ∗ ← arg max H ∈ H

Original: [N/A]
Revised: L adv ( F ϕ ( x ′ H ) , y ) 15: Σ ¯ x H ∗ , µ ¯ x H ∗ ← Calculate covariance matrix and channel means for ¯ x H ∗ . T ∗ ← MKSoulution(Σ ¯ x , Σ ¯ x H ∗ ) (see Eq.(6)) 17: µ ∗ ← µ ¯ x H ∗ 18:

Original: If you ran experiments... (a) Did you include the code, data, and instructions needed{+Initialize T ′ 
 ← T ∗ 19: for n ← 1+} to reproduce the main experi-
Revised: {+Initialize T ′ 
 ← T ∗ 19: for n ← 1+} to N do ▷ Neighborhood Search. 20: ¯ x ′ i ← T ′ n − 1 ( ¯ x − µ ¯ x ) + µ ∗ 21: g ← ∇ T ′

Original: mental results (either in the supplemental material or as a URL)?
Revised: L adv ( F ϕ ( lab 2 rgb ( ¯ x ′ i )) , y ) 22: g n ← u · g n − 1 + g || g ||23:

Original: [Yes] The code and instructions have been submitted as the supplemental material. (b) Did you specify all the training details (e
Revised: T ′ n ← T ′ n − 1 + α · sign( g n ) 24: end for 25: x ′ i ← lab 2 rgb ( ¯ x ′ i ) 26: end for 27: i ′ ← arg max i ∈ 1 , 2 ,...,K L adv ( F ϕ ( x ′ i ) , y ) 28: x ′ ← x ′ i ′ 29: return x ′ C Initialization Reset

Original: g., data splits, hyperparameters, how theywere chosen)? [Yes] Our experiments did not involve any model training, but all thealgorithm details were specified.
Revised: As mentioned in Section 3.3, initialization reset (IR) avoids the optimization of convert matrix to fall into local optimum. Therefore, we study the appropriate value for the number of resets in this section.

Original: (c) Did you report error bars (e g., with respect to the random seed after running experi- ments multiple times)?
Revised: Our adversarial examples are crafted via Inc-v3 by NCF with different resets, i.e., fromto 20. We report the attack success rate on the victim model in Figure 2.

Original: [No] We fixed the random seed for all the experiments.
Revised: As demonstrated in the figure, in the beginning, there is an approximate positive relationship between the attack success rate and the number of resets. Once K = 10 or larger, the attack success rate maintains stable. We choose K = 10 to reduce the computational overhead, where the attack successes rate is 84.0%, 57.7%, 57.6%, 56.8%, 40.1%, 47.6% for Inc-v3 [61], Res-18 [2], VGG-19 [60], Mobile-v2 [62],

Original: (d) Did you include the total amount of compute and the type of resources used (e
Revised: Dense-121 [13] and Res-50 [2], respectively. D Transferability on ViTs

Original: g.,type of GPUs, internal cluster, or cloud provider)? [No] We did not mention the runtime of the attacks due to the space limitation, but our hardware setting is available in
Revised: Recent work [70] points out that the vision transformer models are more concerned with lowfrequency information, thus we further evaluate attack success rate of black-box when Transformer models are used as substitute models.

Original: Section 4.1.
Revised: Specifically, we generate adversarial examples using ViT-S/ (ViT-S) [63] and XCiT-N12/16 (XCiT-N12) [64] as substitute models and evaluate the adversarial examples on multiple Transformer models (including ViT-S,XCiT-N12,DeiT-S [63],ViT-B [14],SwinT [65],PiT-Ti [71]) and multiple CNNs (including Res-18 [2], VGG-19 [60], Mobile-v2 [62]). Tablesummarizes the results on different black-box models. We can observe that our NCF usually achieves the highest transferability on black-box.

Original: If you are using existing assets (e g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
Revised: In particular, when transferring from ViTs to CNNs, NCF achieves an average success rate of 59.8%, but other attacks only achieve 48.3% (SAE), 29.9% (ReColorAdv), 36.8% (cAdv), 35.1% (ColorFool), 27.3% (ACE). We observe that the transferability of adversarial examples between ViTs is weaker than different

Original: [Yes] see Section 4.1.
Revised: CNNs (see Section 4.2.1).

Original: (b) Did you mention the license of the assets? [Yes]
Revised: This is consistent with the observation in [25]. It may be since that

Original: In a footnote of Section 4.1.
Revised: ViTs have multiple self-attention blocks that can generate class tokens independently.

Original: (c) Did you include any new assets either in the supplemental material or as a URL?
Revised: However, our loss only utilizes the last logit (which is equivalent to utilizing only the last class token).

Original: [No]
Revised: The discriminative information in the previous tokens is not directly utilized, which results the poor transferability of the adversarial

Original: [Table]
Revised: [Table]

Original: We did not use any new assets. (d) Did you discuss whether and how consent was obtained from people whose data you’re
Revised: In this section, we study the impact of neighborhood search (NS) on human perception. Figureshows the adversarial examples with and without NS, and we observe that our NS strategy has almost no effect on human perception.

Original: [Table]
Revised: [Figure]

Original: using/curating?
Revised: In this section, we show the Gradient-weighted Class Activation Mapping (Grad-CAM) [55] of different adversarial examples. Figure 4 illustrates that all of SAE, ReColorAdv, cAdv, ColorFool, and ACE have difficulty shifting the attention of the model, while our NCF can dramatically it, i.e., no longer on the target object.

Original: [Yes]
Revised: [Figure]

Original: In a footnote of Section 4.1.
Revised: In this section, we show some adversarial examples. In Figure 5, we observe that SAE is prone to global color distortion due to the unbounded range of variation.

Original: [Table]
Revised: ReColorAdv limits the perturbation to a small range, thus its adversarial examples are less perceptually different from the clean images. However, some areas of color gradients (e.g., the “clouds” in the second row of Figure 5) may produce some perceptual anomalies. cAdv relies on the colorization model, and some color anomalies are likely to occur locally in the image. ColorFool does not set the perturbation range in non-sensitive areas, resulting in non-sensitive areas prone to color distortion.

Original: (e) Did you discuss whether the data you are using/curating contains personally identifiable
Revised: ACE is similar to ReColorAdv in that sometimes details are lost.

Original: information or offensive content?
Revised: (e.g., the “plants” in the third row of Figure 5). NCF transforms the color distribution so that the images’ details are preserved. H The Influence of Segmentation Models In this section, we compare the performance of our NCF under different semantic segmentation models pre-trained on ADE20K (including Swin-T [65], OCRNet [72] and Deeplabv3+ [73]).

Original: [No]
Revised: As indicated in Table 2, segmentation models have impact on the attack success rates of resulting adversarial examples. Among these models, Swin-T is usually the best choice for our NCF. Therefore, in our paper, we choose it to segment inputs. Note that even if the segmentation model affects our method, the lowest black-box attack success rate of NCF is still much higher than the existing methods.

Original: [Table]
Revised: [Table]

Original: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if
Revised: As for ensemble model attack (fusing the logits of multiple models like [21]), here we report the result of NCF.

Original: applicable? [N/A]
Revised: As indicated in Table 3, the attack success rate of NCF can be further improved when crafting via an ensemble of models.

Original: [Table]
Revised: [Table]

Original: (b) Did you describe any potential participant risks, with links to Institutional Review
Revised: In this section, we discuss the difference between NCF-IR-NS and random color attack. Formally, NCF-IR-NS does not mean selecting random colors to attack.

Original: [Table]
Revised: Specifically, it first generates a set of adversarial examples with different color distributions and then selects the best example from them based on the loss of the white-box model to attack. Therefore, NCF-IR-NS is close to a white-box attack. To support our claim, we evaluate the performance of random color attack (NCF-IR-NS-), i.e., randomly select colors for each semantic class and use the resulting adversarial examples to attack. As demonstrated in Table 4, the performance of NCF-IR-NS- is much lower than NCF-IR-NS.

Original: Board (IRB) approvals, if applicable?
Revised: For example, NCF-IR-NS- only achieves a 27.3% (degraded from 51.6%) success rate on Inc-v3.

Original: [N/A]
Revised: Thus, directly using random colors to generate adversarial examples is ineffective. rate of using white-box information and not using it. NCF-IR-NS using Inc-v3 as the substitute model

Original: [Table]
Revised: [Table]

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount
Revised: Clean

Original: spent on participant compensation?
Revised: SAE ReColorAdv cAdv ColorFool ACE

Original: [N/A] [Table]
Revised: NCF (Ours)