Deep neural networks are exploited using natural adversarial samples, which
have no impact on human perception but are misclassified. Current approaches
often rely on the white-box nature of deep neural networks to generate these
adversarial samples or alter the distribution of adversarial samples compared
to training distribution. To alleviate the limitations of current approaches,
we propose EvoSeed, a novel evolutionary strategy-based search algorithmic
framework to generate natural adversarial samples. Our EvoSeed framework uses
auxiliary Diffusion and Classifier models to operate in a model-agnostic
black-box setting. We employ CMA-ES to optimize the search for an adversarial
seed vector, which, when processed by the Conditional Diffusion Model, results
in an unrestricted natural adversarial sample misclassified by the Classifier
Model. Experiments show that generated adversarial images are of high image
quality and are transferable to different classifiers. Our approach
demonstrates promise in enhancing the quality of adversarial samples using
evolutionary algorithms. We hope our research opens new avenues to enhance the
robustness of deep neural networks in real-world scenarios. Project Website can
be accessed at https://shashankkotyan.github.io/EvoSeed.

使用进化算法生成的自然对抗样本可以提高深度神经网络的鲁棒性。

EvoSeed：揭示深度神经网络在现实世界中的威胁

EvoSeed: Unveiling the Threat on Deep Neural Networks with Real-World  Illusions

Facial attributes, emerging soft biometrics, must be automatically and
reliably extracted from images in order to be usable in stand-alone systems.
While recent methods extract facial attributes using deep neural networks
(DNNs) trained on labeled facial attribute data, the robustness of deep
attribute representations has not been evaluated. In this paper, we examine the
representational stability of several approaches that recently advanced the
state of the art on the CelebA benchmark by generating adversarial examples
formed by adding small, non-random perturbations to inputs yielding altered
classifications. We show that our fast flipping attribute (FFA) technique
generates more adversarial examples than traditional algorithms, and that the
adversarial robustness of DNNs varies highly between facial attributes. We also
test the correlation of facial attributes and find that only for related
attributes do the formed adversarial perturbations change the classification of
others. Finally, we introduce the concept of natural adversarial samples, i.e.,
misclassified images where predictions can be corrected via small
perturbations. We demonstrate that natural adversarial samples commonly occur
and show that many of these images remain misclassified even with additional
training epochs, even though their correct classification may require only a
small adjustment to network parameters.

本文研究了利用深度神经网络提取面部特征的鲁棒性，通过生成对抗性样本测试了多种算法的可靠性，并提出了自然对抗样本的概念，发现即使在经过多次训练的情况下，网络仍然存在一些本该被正确分类的对抗样本。