Abstract:Research of adversarial attacks is important for AI security because it shows the vulnerability of deep learning models and helps to build more robust models. Adversarial attacks on images are most widely studied, which include noise-based attacks, image editing-based attacks, and latent space-based attacks. However, the adversarial examples crafted by these methods often lack sufficient semantic information, making it challenging for humans to understand the failure modes of deep learning models under natural conditions. To address this limitation, we propose a natural language induced adversarial image attack method. The core idea is to leverage a text-to-image model to generate adversarial images given input prompts, which are maliciously constructed to lead to misclassification for a target model. To adopt commercial text-to-image models for synthesizing more natural adversarial images, we propose an adaptive genetic algorithm (GA) for optimizing discrete adversarial prompts without requiring gradients and an adaptive word space reduction method for improving query efficiency. We further used CLIP to maintain the semantic consistency of the generated images. In our experiments, we found that some high-frequency semantic information such as "foggy", "humid", "stretching", etc. can easily cause classifier errors. This adversarial semantic information exists not only in generated images but also in photos captured in the real world. We also found that some adversarial semantic information can be transferred to unknown classification tasks. Furthermore, our attack method can transfer to different text-to-image models (e.g., Midjourney, DALL-E 3, etc.) and image classifiers. Our code is available at: <a class="link-external link-https" href="https://github.com/zxp555/Natural-Language-Induced-Adversarial-Images" rel="external noopener nofollow">this https URL</a>.

What problem does this paper attempt to address?

The problem that this paper attempts to solve is that current adversarial attack methods lack sufficient semantic information when generating adversarial samples, making it difficult for humans to understand why deep - learning models fail under natural conditions. Specifically, existing adversarial attack methods (such as noise - based attacks, image - editing - based attacks, and latent - space - based attacks) can effectively generate adversarial samples, but these samples often do not contain rich semantic information, which limits the understanding of the model's failure modes. To solve this problem, the author proposes an adversarial image attack method induced by natural language. The core idea of this method is to use a text - to - image model to generate adversarial images through maliciously constructed input prompts. These prompts are designed to cause misclassification of the target model. To make the generated adversarial images more natural and rich in semantic information, the author proposes the following key techniques: 1. **Adaptive Genetic Algorithm (GA)**: It is used to optimize discrete adversarial prompts without gradient information. This solves the problem that commercial text - to - image models are usually black - box models and their gradients and parameters cannot be accessed. 2. **Adaptive Word Space Reduction**: It improves the optimization efficiency by reducing the number of queries, which is especially important for some commercial models (such as DALL·E 3) that limit the number of queries. 3. **CLIP Model**: It is used to maintain the semantic consistency of the generated images. By calculating the cosine distance between the generated image and the target semantic information, it ensures that the generated image has sufficient target semantic information. Through these techniques, the author can not only generate adversarial images with rich semantic information but also reveal the weaknesses of current image classifiers under natural conditions, thus helping researchers better understand and improve the security and robustness of these models. The experimental results show that some frequently - occurring semantic information (such as "foggy", "damp", "stretched", etc.) is likely to cause classifiers to make mistakes, and these adversarial semantic information exists not only in the generated images but also in photos taken in the real world. In addition, the author's method can be transferred to different text - to - image models and image classifiers, showing good generalization ability.

Natural Language Induced Adversarial Images

Generating Natural Language Adversarial Examples on a Large Scale with Generative Models

SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing

A Hybrid Adversarial Attack for Different Application Scenarios

Mutual-modality Adversarial Attack with Semantic Perturbation

Clean-label attack based on negative afterimage on neural networks

AnyAttack: Targeted Adversarial Attacks on Vision-Language Models toward Any Images

Simple Transparent Adversarial Examples

Divide-and-Conquer Attack: Harnessing the Power of LLM to Bypass the Censorship of Text-to-Image Generation Model

Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey

Physical World Adversarial Attacks on Images and Texts

Untargeted Adversarial Attack Via Expanding the Semantic Gap

Generating Adversarial Examples in Limited Queries with Image Encoding and Noise Decoding.

Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction

Unrestricted Adversarial Examples via Semantic Manipulation

Adversarial Attacks on Parts of Speech: An Empirical Study in Text-to-Image Generation

AnyAttack: Towards Large-scale Self-supervised Generation of Targeted Adversarial Examples for Vision-Language Models

TextGuise: Adaptive Adversarial Example Attacks on Text Classification Model.

AdvJND: Generating Adversarial Examples with Just Noticeable Difference

Invisible Adversarial Attack Against Deep Neural Networks: an Adaptive Penalization Approach

Undermining Image and Text Classification Algorithms Using Adversarial Attacks