PaperlayerView exact revision on arXiv

Source-linked AI summary

Discovering Natural Transformation Vulnerabilities in Black-Box Vision Models

Dongsu Song, DaeYun GO, Jay Hoon Jung

arXiv:2609.07110v1cs.CVcs.AI

TL;DR

Generating natural adversarial edits to a given image remains challenging in query-limited black-box settings, where existing methods may rely on surrogate models, learned priors, or costly optimization. ASA searches natural-language editing scenarios with an MLLM and text-guided editor, combining attack-improving scenarios. It achieves the highest ASR on every evaluated victim model and the lowest Avg. Q on seven of eight models, while discovered prompts can transfer across same-class images and sometimes architectures.

  • Problem

    Natural adversarial editing of a given input remains underexplored in query-limited black-box settings without surrogate training or attack-prior learning.

    Source: §1 · p. 1

  • Method

    ASA uses a query-based black-box framework to search natural-language editing scenarios with a text-guided generative editor.

    Source: §1 · p. 2

  • Results

    ASA achieves the highest ASR on every evaluated victim model and the lowest Avg. Q on seven of eight models.

    Source: §4.2.1 · p. 6

  • Takeaways & Limitations

    Discovered adversarial prompts often transfer across same-class images and sometimes across architectures, suggesting reusable natural transformation vulnerabilities.

    Source: §1 · p. 2

Abstract

from arXiv · show

Natural adversarial examples (NAEs) reveal that vision models can fail under realistic semantic changes beyond norm-bounded perturbations. However, generating NAEs in a black-box setting remains challenging because existing generative attacks often rely on surrogate models, learned attack priors, or costly query-based optimization, whereas the natural transformations that expose model vulnerabilities are unknown a priori. We propose \textbf{Adversarial Scenario Attack (ASA)}, a query-based black-box framework that searches over natural-language editing scenarios using a multimodal language model and a modern text-guided generative editor. ASA jointly explores background, weather, and material/color transformations through winner--loser feedback, and uses a greedy explorer to compose only attack-improving scenarios. Across diverse ImageNet classifiers, ASA achieves substantially higher attack success rates than prior query-based generative attacks while requiring fewer victim-model queries and preserving competitive perceptual quality. Moreover, ASA exhibits both image-level and prompt-level transferability: its adversarial images remain effective across victim-model architectures, while its discovered editing scenarios can be reused across same-class images and, in some cases, across architectures. These findings suggest that vision models possess reusable vulnerabilities to natural transformation patterns, which ASA can efficiently identify in a black-box setting.

1 Introduction

ASA addresses the challenge of generating natural adversarial edits to a given image in query-limited black-box settings, where the most vulnerable natural transformation is unknown. It searches and combines editing scenarios, achieving higher attack success with fewer victim-model queries while supporting image- and prompt-level transfer.

1 Introduction

  • Prior NAE methods leave natural adversarial editing of a given input underexplored in query-limited black-box settings without surrogate training or attack-prior learning.Norm-bounded pixel perturbations may also overlook realistic semantic variations.Source: §1 · p. 1
  • ASA searches natural-language editing scenarios with a query-based black-box framework and a text-guided generative editor.The framework uses FLUX.2 9B-KV to generate natural adversarial examples.Source: §1 · p. 2
  • Because the transformation that exposes a victim model’s vulnerability is unknown in advance, ASA jointly explores multiple natural editing scenarios.An MLLM generates plausible strategy-specific scenarios, and a Greedy Explorer composes combinations only when they improve the attack score.Source: §1 · p. 2
  • ASA achieves higher attack success with fewer victim-model queries than prior generative attacks.It also achieves competitive transferability and visual similarity without access to model internals.Source: §1 · p. 2
  • Discovered adversarial prompts often transfer across same-class images and sometimes across architectures, suggesting reusable natural transformation vulnerabilities.Figure 1 illustrates same-class prompt transfer producing diverse natural adversarial examples.Source: §1 · p. 2, Figure 1 · p. 2

2 Related work

Prior work uses generative models to create natural adversarial examples, often with surrogate guidance or learned priors. Query-based methods use victim feedback but can be costly, while prior-assisted approaches commonly require additional training and often remain perturbation-bounded.

2.1 Generative models for natural adversarial examples

  • Generative approaches include from-scratch AC-GAN synthesis, semantic color or texture edits, and diffusion-based latent or trajectory manipulation.Examples include ColorFool [24], Natural Color Fool [10], DiffAttack, AdvDiff [16], and NatADiff [11].Source: §2.1 · p. 3
  • Many generative methods rely on surrogate-model guidance, which can misalign attack direction with a black-box victim’s decision boundary.The passage contrasts this with query-based attacks that optimize directly from victim-model feedback.Source: §2.1 · p. 3

2.2 Prior-assisted query-based black-box attacks

  • Query-based black-box attacks use victim feedback without model parameters or gradients, but direct exploration can be inefficient in high-dimensional spaces.AdvFlow uses a pre-trained normalizing flow and NES-based queries [26].Source: §2.2 · p. 3
  • Prior-assisted methods use surrogate or generative information to improve query efficiency, but often require surrogate transfer or attack-specific training and use ℓp-bounded formulations.Examples include conditional adversarial distributions, meta-generators, and autoencoders trained on clean–adversarial pairs [28].Source: §2.2 · p. 4

3 Method

ASA searches for realistic, label-preserving edits by querying a black-box classifier over natural-language scenarios. It combines strategy-specific exploration with greedy composition of scenarios that improve the attack objective.

3.1 Problem definition

  • ASA seeks a realistic edit that misclassifies the input using only victim confidence-score queries, with at most 100 queries per image.The attack score is the strongest non-ground-truth confidence minus the ground-truth confidence; a positive score indicates success.Source: §3.1 · p. 4

3.2 Adversarial scenario attack

  • ASA evaluates background, weather, and material/color scenarios under a shared query budget, using history-guided proposals and feedback to explore plausible edits.An MLLM proposes scenarios for each strategy and avoids explicit class injection, object replacement, and unnatural corruptions.Source: §3.2 · p. 5
  • A candidate is accepted as a final adversarial example only if it both misclassifies the image and passes the naturalness verifier.The verifier checks plausibility, subject consistency, and whether changes are limited to the intended factors; rejection feedback is added to the search history.Source: §3.2 · p. 5

3.3 Greedy explorer

  • The Greedy Explorer composes promising scenarios and updates its running prompt only when a composition improves the attack objective.It initializes from the best-scoring candidate, then visits remaining scenarios sequentially and uses each improving composition as the reference for the next trial.Source: §3.3 · pp. 5–6

4.1 Experimental details

The experiments use ImageNet-compatible images and evaluate ASA across several classifier families. Separate data and additional models are used for prompt-level transferability.

4.1 Experimental details

  • Query-based and transfer attacks use 1,000 ImageNet-compatible images resized from 299×299 to 224×224; prompt-level transfer uses 21,500 images across 430 classes.The latter subset contains 50 images per class and is used to evaluate transfer of class-level scenarios.Source: §4.1 · p. 6
  • Victims include CNN, Transformer, and state-space-model classifiers, with adversarially trained models included for robustness evaluation.Transferability experiments additionally include Inception-v3, Wide-ResNet-50, and Vision Transformer-Base.Source: §4.1 · p. 6
  • Scenario generation and naturalness evaluation use Gemma 4 E4B, while image editing uses FLUX.2 9B-KV; each strategy proposes one scenario per iteration, with up to 50 iterations and 100 victim queries.The MLLM is used without fine-tuning or task-specific adaptation.Source: §4.1 · p. 6

4.2 Comparison

ASA achieves the highest attack success rate across evaluated victim models and the lowest average query count on seven of eight. Its image-level transferability is strongest among query-based attacks and remains competitive with transfer-based methods.

4.2.1 Query-based attacks

  • ASA achieves the highest ASR on every evaluated victim model and the lowest Avg. Q on seven of eight models.The comparison uses the same query budget; Avg. Q counts successful samples only.Source: §4.2.1 · p. 6, Table 1 · p. 7
  • Scenario-level search offers an architecture-agnostic alternative for black-box NAE generation.Prior query-based attacks can trade off attack success against query efficiency on modern and heterogeneous model families.Source: §4.2.1 · pp. 6–7

4.2.2 Image-level transferability

  • Among query-based attacks, ASA shows the strongest image transferability across all source models and transfers reliably across diverse victim architectures.The evaluation spans CNNs, Transformers, SSMs, and robust models.Source: §4.2.2 · p. 7, Table 2 · p. 7
  • ASA remains competitive with source-supervised transfer attacks, ranking within the top three across source models while balancing robust transferability and visual fidelity.Among highly transferable attacks, ASA has the best DINOv2-based perceptual similarity and competitive FID, including improved distributional fidelity over ACA.Source: §4.2.2 · pp. 7–8

4.3 Prompt-level transferability

ASA reuses discovered editing prompts on unseen images of the same classes and across victim architectures. Full ASA consistently improves prompt transferability over its ablations.

4.3 Prompt-level transferability

  • The protocol applies each discovered prompt unchanged to a separate validation subset of 21,500 images across 430 classes, without re-optimizing prompts.The subset contains 50 images per class.Source: §4.3 · p. 8
  • Full ASA consistently improves prompt transferability over both ablations across diverse victim models.Table 3 reports ASR across victim models; w/o S, G removes structured scenario guidance and greedy exploration, while w/o G removes only greedy exploration.Source: §4.3 · p. 8, Table 3 · p. 8
  • Coverage-normalized transfer counts labels without a generated source prompt as zero transferred successes, with the denominator set to all 21,500 validation images.The results indicate reusable class-level natural transformation vulnerabilities that remain effective on unseen images and across architectures.Source: §4.3 · p. 8

4.4 Image quality

ASA maintains competitive visual quality while generating adversarial edits. Its outputs are largely natural scene-level changes, though their absolute quality remains bounded by the underlying editor.

4.4 Image quality

  • ASA ranks in the top three on NIMA-AVA, HyperIQA, and MUSIQ-AVA, and remains competitive on TReS.The assessment uses five no-reference image-quality metrics: NIMA-AVA, HyperIQA, MUSIQ-AVA, MUSIQ-KoniQ, and TReS.Source: §4.4 · p. 8, Table 4 · p. 8
  • ASA primarily produces natural scene-level changes, while several baselines introduce visible noise, color artifacts, or local distortions.Examples of ASA changes include lighting, weather, background, and material variations.Source: §4.4 · p. 9
  • ASA’s absolute image quality is bounded by the underlying editor because ASA searches editing scenarios without modifying image generation.The results suggest that attack effectiveness improves without substantially degrading visual naturalness.Source: §4.4 · p. 9

4.5 Ablation study

Scenario generation and greedy selection are complementary: together, they yield the strongest ASR while reducing query counts relative to scenario generation without greedy selection.

4.5 Ablation study

  • Full ASA achieves the best ASR across source models and reduces victim-model and MLLM query counts compared with ASAw/o G.Figure 3 summarizes ASR with bars and query counts with lines across source models.Source: §4.5 · p. 9, Figure 3 · p. 9
  • Adding scenario generation substantially improves attack effectiveness over naive prompt construction without scenario generation or greedy selection.Without both components, ASR degrades clearly; semantically meaningful scenarios provide strong candidate attacks.Source: §4.5 · p. 9
  • Greedy selection further strengthens ASA by choosing more effective scenarios while avoiding unnecessary queries.The study describes scenario generation and greedy selection as complementary components.Source: §4.5 · p. 9

4.6 Time analysis

ASA’s runtime profile requires no pre-generation training and has the shortest per-image generation time among the compared query-based methods.

4.6 Time analysis

  • ASA requires no pre-generation training and has the shortest per-image generation time among the compared query-based methods.Tab. 5 compares pre-generation training cost, per-image generation time, and generation-time ratio normalized by ASA.Source: §4.6 · p. 9
  • Tab. 5 compares pre-generation training cost, per-image generation time, and relative generation time.Prior denotes additional attack-specific training before generation; Gen. is average per-image generation time, and Rel. is the generation-time ratio normalized by ASA.Source: §4.6 · p. 9
  • Among the compared query-based methods, ASA has the most efficient runtime profile.The comparison covers training cost and generation time.Source: §4.6 · p. 9

5 Conclusion

ASA searches natural-language editing scenarios to generate natural adversarial examples, and the experiments report strong attack success, low query cost, and transferability. The conclusion frames scenario-level search as a practical direction for black-box robustness evaluation and identifies future work on vulnerability causes and adversarial training.

5 Conclusion

  • Table 5 is identified as a runtime comparison.Source: Table 5 · p. 9
  • ASA achieves strong attack success, low query cost, competitive image-level transferability, and prompt-level transferability across images and architectures.The conclusion describes the framework as generating natural adversarial examples through natural-language scenario search.Source: §5 · p. 9
  • The results suggest vision models exhibit reusable vulnerabilities to specific natural transformation patterns.The conclusion highlights scenario-level search as a practical direction for black-box robustness evaluation beyond conventional perturbation-centered attacks.Source: §5 · p. 9
  • Future work will investigate why these vulnerabilities arise and how discovered scenarios can be incorporated into adversarial training.The stated aim is to improve robustness against realistic semantic variations.Source: §5 · p. 9
Loading 2609.07110v1…