Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

1 Introduction

Precisely crafted perturbations added onto input data can easily fool DNNs [Szegedy et al., 2014; Goodfellow et al., 2015; Carlini and Wagner, 2017; Kurakin et al., 2017]. This vulnerability that inherently exists inside DNNs is often exploited with adversarial examples, which are maliciously modified samples with imperceptible perturbations. Adversarial perturbations are crafted in a sense that they should be constrained within a bound that is as tight as possible [Goodfellow et al., 2015; Kurakin et al., 2017; Dong et al., 2018], so that the perturbation is invisible to humans. In light of this, a majority of attacks often measure image similarity with ℓp norms - ℓ0 [Carlini and Wagner, 2017; Papernot et al., 2016], ℓ2 [Carlini and Wagner, 2017] and ℓ∞ [Kurakin et al., 2017; Dong et al., 2018]. However, we argue that ℓp norms have limitations.

∗Equal contribution.

†Corresponding author.

Classic per-pixel measurements, such as the ℓ2 norm distance, are insufficient for assessing structured data included in images because they assume pixel-wise independence. As such, ℓp-based perturbations in the RGB color space often have high spatial frequencies, which inevitably changes the spatial frequencies of natural images, making adversarial examples easily spottable by humans. In addition, the adversary would often need to generate larger perturbations in order to achieve higher adversarial strength. This naturally leads to more perceptible changes to the original image that are, again, noticeable by humans. This is the trade-off between adversarial effectiveness and perturbation imperceptibility, which will always exist if ℓp norm bounds are applied.

Many works on adversarial examples have also gained awareness that pixel-wise differences measured with ℓp norms coincide deficiently with human perception. Many of the non-ℓp solutions execute an attack by modifying the colors of the original image and alleviate the unrealistic factors of the changes with various mitigations, for instance: Semantic Adversarial Examples [Hosseini and Poovendran, 2018] and ColorFool [Shamsabadi et al., 2020]. But for most of the time, these practices are not enough because many of the color changes are still easily perceptible. An optimal unrestricted adversarial attack should be able to exhibit powerful adversarial effectiveness on the premise that the perturbations are perceptually invisible. However, this unique challenge of comparing image similarity is still a wide-open problem. Because not only are visual patterns highly dimensional and highly correlated themselves, but the very measurement of visual similarity is often quite subjective if it's aimed to mimic human judgments.

In this paper, we propose to attenuate this conundrum by using Perceptual Similarity as a measurement for image similarity when crafting adversarial examples. Perceptual Similarity [Zhang et al., 2018] is an emergent property shared across deep visual representations. It is a metric that utilizes deep features from trained CNNs to measure image similarity [Johnson et al., 2016]. Specifically, we optimize perturbations with respect to Perceptual Similarity, creating a novel adversarial attack strategy, namely Demiguise Attack. By manipulating semantic information with Perceptual Similarity, Demiguise Attack can perturb images in a way that correlates extraordinary well with human perception such that the perturbations are imperceptible although they are of large magnitudes, as shown in the middle column of Figure 1. Our perturbations with high-order semantic information are even more likely to be classified into the same labels as original images or adversarial examples, which we further demonstrate in Section 4.2. Larger perturbations make the adversarial examples we craft more powerful, robust, and can even transfer from one task to another, which we discuss in Section 4.5. We also demonstrate that the effect of our approach is additive and can be used in combination with existing attacks to improve performances further. What's more, as shown in the rightmost column of Figure 1, by using Perceptual Similarity, our adversarial examples are somewhat able to simulate the illumination changes that occur in natural situations. This could be used for exposing the blind spots inside the target model and thereby helping it improve under real-world scenarios.

Our key contributions in this paper are:

• We propose a novel, unrestricted, black-box adversarial attack based on Perceptual Similarity, called Demiguise Attack. Our approach manipulates semantic information with the HVS-oriented image metric to craft invisible semantic adversarial perturbation.
• The perturbations generated with Perceptual Similarity can simulate the illumination and contrast changes in the real-world and enrich the semantic information lying within original images. This phenomenon implies enhancements that potentially exist for DNNs.
• Extensive experiments show that Demiguise Attack

crafted adversarial perturbations both manifest excellent visual quality and boost adversarial strength and robustness when combined with existing attacks. We demonstrate Demiguise Attack's compelling maximum of 50% increase in terms of black-box transferability and the promising nearly 90% successful attacks under crosstask black-box scenarios.

2 RelatedWork

2.1 Adversarial Attack

ℓp norm-based adversarial attack. Most adversarial attacks utilize a form of ℓp norm-based distance metric, whether they are used as optimization objectives (such as LBFGS [Szegedy et al., 2014] and C&W [Carlini and Wagner, 2017]), or direct constraints (such as FGSM [Goodfellow et al., 2015], BIM [Kurakin et al., 2017], and MI-FGSM [Dong et al., 2018]). These adversarial attacks, while being very effective in terms of fooling rate, often generate perturbations that have distinct characteristics - arbitrary multi-colored noise that is very obvious to human perception.

Non ℓp norm-based adversarial attack. Recent work suggests a different approach for adversarial attacks: unrestricted, semantic adversarial examples that are non-ℓp norm-based. Semantic Adversarial Examples [Hosseini and Poovendran, 2018] changes the colors of the image by shifting its hues and saturations in the HSV color space. ColorFool [Shamsabadi et al., 2020] perturbs images within a chosen natural-color range for specific semantic categories. While these attacks are all non-ℓp based, they all fail to generate perturbations that align well with human perception, creating unrealistic adversarial examples easily noticeable by humans.

2.2 Perceptual Distance of Images

Measuring how similar are two images is often a subjective notion. Per-pixel measurements like the ℓ2 Euclidean distance and Peak Signal-to-Noise Ratio (PSNR) have been proven to lack structural representation and fail to account for the many aspects of human perception. Perceptually motivated distance metrics like SSIM [Wang et al., 2004] and FSIM [Zhang et al., 2011] are still simple static functions that aren't ideal. Perceptual Similarity [Zhang et al., 2018], which utilizes deep features from trained CNNs, models lowlevel perceptual judgments surprisingly well, outperforming previous widely-used metrics, as we demonstrate in the following section.

3 Methodology

3.1 Measuring Perceptual Similarity

The challenge of image similarity comparison has been a long-standing problem in the field of computer vision. It also has proven itself to be of significance for generating imperceptible adversarial perturbations. As stated in Section 2.2, classical measurements like ℓp-norm distances, PSNR and SSIM, are all inadequate to express the similarity of highdimensional structured data like images that possess rich information. It would be ideal for constructing a "distance metric" that can represent human judgments when measuring image similarity. However, implementing such a metric is challenging, as human judgments are context-dependent, rely on high-order image semantic information, and may not constitute a distance metric. As such, we propose to utilize Perceptual Similarity [Zhang et al., 2018], a novel, HVS-oriented metric, to better craft adversarial examples by manipulating the semantic information lying within images. Here we briefly address concepts of Perceptual Similarity under adversarial settings.

Perceptual Similarity is a novel image quality metric that extracts characteristics from deep feature spaces of CNNs trained on image classification tasks. The metric itself is neither a special function nor a static module; instead, it is a consequence of visual representations tuned to be predictive about real-world structured information. Hence, we would be more capable of cultivating rich semantic information for crafting adversarial perturbation if we were to utilize Perceptual Similarity, thereby calibrating our perturbation to be in line with human perception. Notably, Perceptual Similarity is calculated based on a predefined and pretrained perceptual similarity network. For an original image x and its distorted partner x′ , with perceptual similarity network N, we compute the distance between x and x′ as

where l is one of the layers in the L layers feature stack in networkN, ˆ θl , ˆ θ′ l ∈ RHl×Wl×Cl are normalized features extracted from x and x′ when they are passing through layer l (with Hl,Wl,Cl representing height, width, and channel for each layer l respectively), and ωl is the vector that is used to scale the channel-wise activations. For adversarial attacks, x is the input image, and x′ is the resulting adversarial example. In this setting, the adversary attempts to make the classifier mispredict by modifying x with a negligible perturbation, producing x′ that is as close to x as possible - the optimization goal. The closeness between x and x′ is, in our case, measured by Eq. 1. Hence, Eq. 1 also constitutes as a perceptual loss function. By optimizing against Perceptual Similarity, we can manipulate deep semantic features that exist within natural images to create perturbations that correlate well with human perception.

3.2 Demiguise Attack

Demiguise-C&W - Combining C&W with Demiguise Attack Demiguise Attack is a universal strategy for integrating Perceptual Similarity into adversarial attacks. We start with Demiguise-C&W, which, as its name suggests, is a variant of Demiguise Attack with its optimisation solved using techniques from C&W [Carlini and Wagner, 2017]. Classic adversarial attacks often use optimization procedures to craft perturbations. In order to satisfy the adversary's goal, one would optimize against an objective function in order to find minimal perturbations as

for non-targeted attacks, where x and x′ are the original image and its (intermediate) adversarial example respectively, F is the target classifier, p is the norm used for distance calculation, and xadv is the final adversarial example. This is basically an optimization against a loss function that perturbs the input image until it is adversarial, while also assuring that the perturbation is minimal. Formally, current adversarial attacks are optimizations against the joint loss of

in essence, where Ladv is the adversarial loss that guides the optimization procedure to making the adversarial example adversarial, and Ldist is the distance loss that minimizes the distance between the original input and the adversarial example. However, this optimization problem is often thought to be NP-hard, and as such, various mitigation measures have been proposed to solve it. C&W attack, as one of the most effective approaches, use an f function-interpreted crossentropy loss as Ladv

where Z(x′ ) is the logit of x′ . Demiguise Attack applies optimizations against Perceptual Similarity with similar approaches as in C&W, formally expressed as

where a change of variables is applied, making x′ = 1/2 · tanh (u)+1, so that we optimise over u instead of x′ directly. We take the five convolutional layers from the VGG architecture as the perceptual similarity network N with pretrained weights. The perceptual similarity network N exposes distance D(x, x′ ) along with gradient information g so we can fully utilize it for crafting adversarial perturbations. The general Demiguise-C&W strategy is expressed in detail in Algorithm 1.

Combining other attacks with Demiguise Attack More importantly, we demonstrate that the strategy of Demiguise

Algorithm 1 Demiguise-C&W

Input: Input image x, original prediction y, weight of Perceptual Similarity loss λ, number of iterations N;

Output: Adversarial example x′ ;

• 1: Initialize: x′0 ←x, u0 ← 0;
• 2: Construct D - Perceptual Similarity instance with pretrained network N ;
• 3: for i = 0 to N -1 do
• 4: Initialize perturbation: δi ← 1/2 · tanh(ui) + 1 - x;
• 5: Ldist ←D(δi +x, x);
• 6: Ladv ← f(δi +x). f is specified in Equation 4;
• 7: Minimize ui over L = λ · Ldist +Ladv;
• 8: x′i ← 1/2 · tanh(ui) +1;
• 9: if L is not converging then
• 10: Early stop and return x′i ;
• 11: end if
• 12: end for
• 13: return x′ ←x′i

Attack is additive, and it can be used in combination with existing attacks to improve performances further. We showcase our strategy's simplicity and universality by illustrating how to combine Demiguise Attack with existing attacks.

In Demiguise Attack, Perceptual Similarity is used directly as the distance penalty for optimization-based attacks. Besides the actual distance, we can also access gradient information from the Perceptual Similarity distance as g = ∇xD(x, x′ ), which can then be used in gradient-based attacks. We address our general Demiguise Attack strategy (perturbation optimization procedure) in Figure 2.

With this, we can use Demiguise Attack in combination with existing state-of-the-art attacks, creating Demiguise{C&W, MI-FGSM, HopSkipJumpAttack}. Here we briefly address their implementations. For C&W and HopSkipJumpAttack [Chen et al., 2020], we combine their optimization procedure with Perceptual Similarity distance D. For MI-FGSM, we update its loss as

where J is our usual cross-entropy loss. For all Demiguise variants of these attacks, we introduce a new vector λ to balance the joint-optimization of perceptual loss and adversarial loss. Using Perceptual Similarity, Demiguise Attack crafts adversarial examples that dig deep into the rich semantic representations of images, achieving superior adversarial effectiveness while maintaining compelling imperceptibility.

4 Experiments

4.1 Experiment Setup

We use four different architectures of classifiers for evaluation: ResNet-{18, 50, 101, 152} [He et al., 2016a], VGG-{11, 16, 19} [Simonyan and Zisserman, 2015], Inception-v3 [Szegedy et al., 2016], MobileNet-v2 [Sandler et al., 2018]. We use pretrained models from PyTorch's torchvision library. We randomly pick 1000 images of 10 separate classes from ImageNet [Deng et al., 2009] that are all classified correctly by the models. All images are resized to 256 ∗ 256 and center cropped to 224 ∗ 224 in size, then normalized with mean=[0.485, 0.456, 0.406] and std=[0.229, 0.224, 0.225]. Our experiments are run on Ubuntu 20.04 LTS with NVIDIA GeForce RTX™ 3090 GPUs and 64GB of memory.

In terms of attacks, we choose a learning rate of 0.2 and a maximum of 1000 iterations for Demiguise-C&W. For Demiguise-MI-FGSM, we choose an ϵ of 0.4, a max iteration of 70 rounds, and a decay factor of 1.0. For DemiguiseHSJA, we choose a max iteration of 2000 queries. We use the ℓp-norm based versions of these attacks as baselines (including C&W [Carlini and Wagner, 2017], MI-FGSM [Dong et al., 2018], and HopSkipJumpAttack [Chen et al., 2020]), and we use the same hyper-parameters. Adversarial strength is evaluated in terms of the fooling rate of the attack, i.e., the proportion of successful cases over the whole validation set.

4.2 Comparison of Different Perceptual Distances

We start our experiments by investigating whether Perceptual Similarity is the optimal metric for crafting adversarial perturbations with respect to human perception. We compare the aforementioned metrics, including PSNR and SSIM, with Perceptual Similarity. We extend C&W attack as C&W-PSNR and C&W-SSIM and attack the same models as Demiguise-C&W with the same parameters.

Here we illustrate a few of the adversarial examples crafted by these attacks. Despite the fact that PSNR and SSIM are some of the most commonly used metrics in computer vision, they still are shallow, facile functions that fail to account for the many factors of human perception. We can see that perturbations crafted by C&W-PSNR and C&W-SSIM contain high spatial frequencies, which changes the spatial frequencies of natural images, as shown in Figure 3. C&W-PSNR crafted examples have obvious arbitrary noise, as shown in the enlarged region. Although C&W-SSIM's perturbations are less perceptible, a lot of noise is generated along the four sides of the image, as shown in the circled part. These noises make the perturbations spottable by humans and are the major drawbacks of these simple metrics. Conversely, Demiguise-C&W takes advantage of Perceptual Similarity, perturbing images by probing the rich semantic information within high-order structured representations, generating imperceptible perturbations. Besides, we couldn't help but notice that Demiguise Attacks' perturbations can somewhat simulate the natural illumination changes that occur in real-world situations. We believe that this peculiar phenomenon may suggest potential improvements that exist for current DNNs.

We are intrigued to see whether our perturbations crafted by Demiguise Attack actually mean anything to our "smart" classifiers. Thus, we passed our Demiguise Attack's perturbations through the classifiers alone and calculated the ratio of which the "perturbation" itself is classified as the same prediction of the original image or the adversarial example. We find that Demiguise Attack's perturbations attain ratios of about 80% for all four classifiers, more than 40% higher than those of C&W (ℓ2) as shown in Table 1. Hence, we argue that Demiguise Attack is truly utilizing the high-dimensional semantic information that was not fully used by other attacks. This behavior of semantic information manipulation is what empowers Demiguise Attack to create large feature-rich perturbations that maintain excellent imperceptibility.

We further discuss the intriguing characteristics of our Table 1: We pass our crafted perturbations alone into the same classifiers, and see whether these perturbations contain semantic meanings to our classifiers. Demiguise-C&W crafted perturbations alone are classified into the same label as the original image or the adversarial example for a ratio of around 80%, which is over 40% higher than those crafted by ℓ2-based C&W.

feature-rich perturbations crafted with respect to perceptual similarity. Here we demonstrate a comparison of perturbation between C&W (ℓ2) and our Demiguise-C&W under targeted white-box scenarios. For the ground truth image that is correctly classified as "school bus" by ResNet-50, we attack it for a total of seven times, each targeted to a different class. The results are shown in Figure 4. Once again, we observe that our perturbation crafted by Demiguise-C&W supersedes those of C&W (ℓ2) in terms of perturbation imperceptibility. Not only did Demiguise-C&W succeeded in all seven targeted attacks, but it also managed to maintain outstanding adversarial example quality, not to mention that ℓ2-based C&W even failed twice in the seven attacks.

4.3 Extend Adversarial Attacks with Demiguise Attack

With the excellent performances of Demiguise Attack, we continue to combine our approach with other state-of-the-

(a) Transferability among ResNet models

Figure 5: We compare the transferability of Demiguise-MI-FGSM with ℓ∞-based MI-FGSM. Fooling rates that reach 100% are whitebox attacks. Apart from these, we find that Demiguise-MI-FGSM (solid colors in the chart) outperforms ℓ∞-based MI-FGSM (translucent colors in the chart) across all models in terms of transferability. Fooling rates can be increased by an average of 10% to 30% by incorporating Demiguise Attack strategy.

art attacks. First, we combine Demiguise Attack with MIFGSM and investigate whether our strategy can further improve its black-box transferability. For this experiment, we use MI-FGSM and Demiguise-MI-FGSM to attack (1) the ResNet family (including ResNet-{18, 50, 101, 152}), and (2) ResNet-50, VGG-19, Inception-v3, MobileNet-v2. The fooling rates of these attacks under transfer-based black-box scenarios are shown in Figure 5a and Figure 5b respectively, where translucent-colored bars represent fooling rates of ℓpbased MI-FGSM, and solid-colored bars represent those of Demiguise-MI-FGSM. We find that the performance of MIFGSM can be increased by an outstanding margin of 10% to 30% overall by utilizing our Demiguise Attack strategy despite whether models are of the same or different architectures.

Input diversity is another approach that has been proven to be of great contribution to the transferability of MIFGSM. [Xie et al., 2019] Here, we attack white-box ResNet152, and transfer generated adversarial examples to VGG{11, 16, 19}, Inception-v3 and MobileNet-v2. We compare the transferability of Demiguise-MI-FGSM, DemiguiseDI-MI-FGSM with baseline performances respectively. As shown in Figure 6, we can see that input diversity (DI-MIFGSM) improves the transferability by a large extent, coming close to or even surpassing the performance of DemiguiseMI-FGSM. By incorporating our approach with input diversity, we can further increase the transferability for more than 5%, reaching fooling rates as high as 92%, creating one of the strongest attacks in terms of black-box transferability.

Table 2: We compare the fooling rates of ℓ2-based HopSkipJumpAttack, Demiguise-HSJA, and ColorFool under black-box scenarios. The fooling rate of ColorFool barely reaches 50% on 1000 samples, while Demiguise-HSJA keeps up with HopSkipJumpAttack (ℓ2), reaching fooling rates of over 89%.

Finally, we combine Demiguise Attack with one of the most potent decision-based black-box attacks: HopSkipJumpAttack (HSJA). As previously mentioned, ColorFool [Shamsabadi et al., 2020] is a typical non-ℓp based black-box adversarial attack where it only changes the colors of specific semantic categories in an image. We compare these attacks under black-box scenarios. A few of the examples crafted by these attacks are shown in Figure 7. We can easily see that ColorFool's color-changing strategy is not exactly ideal in terms of perturbation imperceptibility, generating colors beyond human comprehension, while DemiguiseHSJA crafted perturbations are imperceptible. What's more, ColorFool barely reaches fooling rates of over 50% over 1000 samples. In contrast, Demiguise-HSJA, with fooling rates of over 89%, keeps up with the performance of HopSkipJumpAttack (ℓ2). Detailed performances of ColorFool and Demiguise-HSJA are shown in Table 2.

4.4 Adversarial Robustness under Defense

In order to gain deeper insight into the effectiveness and strength of Demiguise Attack, we further testify the robustness of our attack against common adversarial defense strategies. Specifically, we utilize both JPEG compression [Das et al., 2018] and binary filter [Xu et al., 2018] as preprocessing measures that we implement directly into our aforementioned classifiers. We set JPEG compression quality as 75 and binary filter bit-depth as 4.

We demonstrate the fooling rates of C&W and DemiguiseC&W in Table 3. Due to the fact that defense schemes like JPEG compression and binary filter try to remove adversarial perturbations by image preprocessing filters, we find that Demiguise-C&W crafted adversarial perturbations tend to stay more intact than ℓp-based ones throughout defenses. We observe a 3% to 5% increase in fooling rates for DemiguiseC&W compared with ℓp-based C&W when attacking models with defenses.

Moreover, both JPEG Compression and Binary Filter have parameters that we can tweak: the compression ratio for JPEG Compression, and the bit depth for Binary Filter. For JPEG compression, we set the compression ratio from 100 to 10 with a step size of 15. For Binary Filter, we set its bit depth from 7 to 1 with a step size of 1. The results of JPEG Compression as a defense scheme are shown in Figure 8a, and the results of Binary Filter are shown in Figure 8b. We can see for both of these defense strategies, the lower image quality (i.e., lower JPEG compression ratio or the smaller bit depth), the more all fooling rates decreases. This characteristic is especially obvious for Binary Filter, where we see clear drops of our fooling rates when bit depth decreases. Nevertheless, when image quality is still reasonable, we find that Demiguise-C&W still achieves higher fooling rates than vanilla C&W for all four classification models most of the time. We argue that the utilization of perceptual similaritybased optimization rewards us with this boost in adversarial robustness and effectiveness.

4.5 Cross-task Transferability

Finally, we testify the cross-task transferability of Demiguise Attack. We use Demiguise-{C&W, MI-FGSM} crafted examples on the same aforementioned classifiers and transfer them to black-box object detectors. Specifically, we use PyTorch's official Faster R-CNN [Ren et al., 2015] (with a backbone of ResNet-50) and weights pre-trained on COCO, and we use the original weights for YOLOv3 [Redmon and Farhadi, 2018] as well. We total the number of cases where a sample is (1) not labeled at all (label vanished), (2) mislabeled, and (3) detected with extra objects. We consider the former two scenarios as successful attacks. We sum up the total number of unique samples falling in the former two cases as successful cases.

As in Table 4, both Demiguise-{C&W, MI-FGSM} crafted adversarial examples on all four target classifiers are able to fail detectors to a certain extent under cross-task black-box scenarios. We find that Demiguise-MI-FGSM can craft more transferable perturbations: of the 1000 samples, up to nearly

(a) JPEG Compression

(b) Binary Filter

Figure 8: We compare the adversarial robustness of DemiguiseC&W with C&W (ℓ2) with defenses of different parameters. When image quality is reasonable, we find that no matter what type of defense scheme is applied, Demiguise-C&W always achieves higher fooling rates than ℓ2-based C&W.

90% are successful, which is over 100 more than DemiguiseC&W on average. We also argue that attacking white-box classifiers and transferring adversarial examples to black-box detectors with the same backbone networks don't necessarily contribute to more transferability: Demiguise-C&W attacking ResNet-50 don't generate as many samples that can fail detectors as the other three classifiers, even though they share the same backbone network. Nevertheless, we demonstrate that Demiguise Attack is able to achieve outstanding transferability even under cross-task black-box scenarios.

4.6 Competition

Proposed method ranked third in the Security AI Challenger VI Track II: Unrestricted Adversarial Attacks on ImageNet in the CVPR2021 [Dong et al., 2021]. We implement our approach for attacking an ensemble of EfficientNet [Tan and Le, 2019], ResNet-50 [He et al., 2016b], VGG-16 [Simonyan and Zisserman, 2014] and ViT [Dosovitskiy et al., 2020]. And we adopt the ensemble in the logits.

5 Discussion

We mentioned in Section 1 that our approach crafts perturbations with rich semantic information, and can somewhat simulate illumination changes happening in real-world scenarios. We would like to further discuss this notion. Demiguise Attack's adversarial perturbations are optimised against Perceptual Similarity. Perceptual Similarity aligns with human perception because it utilizes deep features inside the VGG network, which learns a representation of the natural world that correlates well with perceptual judgement. Realworld objects constantly appear different because of illumination changes, and we happen to find our perturbations very similar to these. This is the primary reasoning for us to claim that our perturbations simulate some natural phenomena or photographic effects in real life. In addition, as our experiment results in Table 1 show, our perturbations actually contain semantic meanings to classifiers, which further implies that unknown blind spots may inherently exist inside DNNbased classifiers, and may indicate potential robustness enhancements for current widely-used DNNs.

6 Conclusion

In this paper, we propose a novel, unrestricted black-box adversarial attack based on Perceptual Similarity - Demiguise Attack. Our approach can not only craft largely imperceptible perturbation by manipulating deep semantic information in high-dimensional images but also contribute to extensive enhancements when combined with existing state-of-theart adversarial attacks. Demiguise Attack boosts adversarial strength and robustness, increases transferability for a maximum of 50%, and shows promising cross-task transferability performances. Besides, our findings imply that semantic defenses potentially exist for DNNs, which will be discussed in our future work.

Acknowledgements

This work is supported by the National Natural Science Foundation of China (No. 61876019, No. U1936218, and No. 62072037). We thank the security AI challenger program launched by Alibaba Group and Tsinghua University.