Pith. sign in

REVIEW 5 major objections 5 minor 67 references

Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation

T0 review · 5 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CAPTCHAs can be generated from text alone and fool unseen AI classifiers.

desk verdict The unsourced generation setup is genuinely new and worth reading, but the headline black-box attack numbers do not survive contact with the evaluation details. read the letter →

arxiv 2506.10685 v3 pith:R7EMDRUQ submitted 2025-06-12 cs.CV cs.CR

Xia Du , Xiaoyuan Liu , Jizhe Zhou , Zheng Lin , Chi-man Pun , Cong Wu , Tao Li , Zhe Chen
show 2 more authors
Wei Ni Jun Luo
This is my paper
classification cs.CVcs.CR
keywords adversarialCAPTCHAdiffusionmodelunsourcedexampleblack-boxattacktransferabilitylargelanguagebi-pathoptimizationCLIP-guidedgeneration
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims to be the first to generate an unsourced adversarial CAPTCHA using a diffusion model: the CAPTCHA is synthesized from an attacker-specified text description, with no source photograph and no pixel-space perturbation. It introduces DAC for white-box targeted attacks and BP-DAC (bi-path unsourced adversarial CAPTCHA) for black-box untargeted attacks, and reports a near-99.4% attack success rate against unknown black-box models. A sympathetic reader would care because, if the claims hold, CAPTCHA designers could create diverse, natural-looking challenges from semantic prompts alone, sidestepping image licensing and data collection, while adversarial-example research gains a source-free generative route to transferable attacks. The framework's core move is to guide the diffusion model's latent variables, rather than pixels, using classifier gradients and text-based semantic alignment.

What carries the argument

The load-bearing mechanism is EDICT-style exact diffusion inversion with parameter-shared coupled noise-variable pairs $(x_t, y_t)$: at each discrete time step the two variables denoise each other in an alternating, invertible update, so the target model's gradient can be propagated backward through the entire chain rather than being lost to accumulated error. DAC merges the gradient-updated pair into a single latent $z_{t-1} = \alpha x^{\mathrm{inter}}_{t-1} + (1-\alpha) y^{\mathrm{inter}}_{t-1}$ and continues generation. BP-DAC adds two components: CLIP-gradient initialization that keeps the image aligned with the prompt, and a bi-path optimization that averages three proxy models' probability outputs and balances $\ell_{\mathrm{div}} = -\ell(x_t, y_{\mathrm{second}})$ with $\ell_{\mathrm{tar}} = \ell(x_t, y_{\mathrm{target}})$ through $\ell_{x_t} = (\ell_{\mathrm{div}} + \ell_{\mathrm{tar}})/2$ before updating the latent pair. A large language model expands the attacker's short category label into a richer prompt, which the paper shows reduces generation ambiguity and improves both image quality and attack efficiency.

What would settle it

A concrete test: generate BP-DAC CAPTCHAs and measure attack success against an OCR-based or segmentation-based CAPTCHA recognizer that was not among the proxy models and was trained on CAPTCHA-like images. If success is far below the reported near-99%, the surrogate-gradient assumption fails; a minimal version is to hold out an ImageNet architecture outside the seven-model set and check whether transfer success persists.

Watch

Extended reading notes

Core claim

The paper's central claim is that adversarial CAPTCHAs can be 'unsourced': instead of adding perturbations to a clean image, the generator starts from a category label, expands it with a large language model into a descriptive prompt, and runs a diffusion model whose latent variables are optimized so the output image is misclassified. For white-box targeted attacks, DAC keeps two coupled latent noise variables and, at each denoising step, takes gradient steps on a classification loss against the target class before merging the variables and continuing generation, which lets the attack gradient propagate through the full chain. For black-box untargeted attacks, BP-DAC replaces the single model gradient with the weighted average of three proxy models' gradients, initializes the latents with CLIP-based gradient guidance, and uses a bi-path loss that balances the target-class and second-highest-class terms, steering the image toward the decision boundary. The authors report almost 100% white-box targeted and untargeted success on all seven tested ImageNet models, black-box targeted averages up to 81.9%, and transfer success above roughly 99% across BP-DAC proxy-target combinations, including 99.4% in one configuration.

Load-bearing premise

The load-bearing premise is that the averaged gradients of three proxy ImageNet classifiers, combined with the two-path decision-boundary loss, are a faithful stand-in for any unseen victim model; the paper's black-box targets are all drawn from the same ImageNet classifier family, and in some columns the proxy models are themselves the targets, so a genuinely different CAPTCHA-solving architecture could break that premise.

Editorial extensions

If this is right

  • If the results hold, CAPTCHA systems can generate fresh, natural-looking challenges from semantic prompts without collecting or licensing source images.
  • A diffusion-based attack can transfer to unseen black-box ImageNet classifiers at roughly 99% success, a level the paper reports no prior generative attack reaching.
  • The bi-path loss plus multi-model gradient averaging survives common input defenses such as NRP, randomized smoothing, random resizing-and-padding, and HGD, with ASR between 95.7% and 100% in the paper's tests.
  • LLM-expanded prompts and CLIP-guided latent initialization cut the number of attack steps and improve image quality, measured by Clip Score, relative to single-word prompts.
  • White-box DAC reaches near-100% targeted and untargeted success on all seven tested architectures, including models where classical attacks such as PGD, FGSM, and BIM drop below 70% targeted success.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the black-box evaluation uses victim models drawn from the same ImageNet classifier pool, the 99%-scale transfer numbers may not carry over to OCR-based or segmentation-based CAPTCHA solvers; that is a direct testable consequence of the paper's surrogate assumption.
  • Editorial inference: the method is presented as defensive CAPTCHA design, but it is also an unrestricted, source-free adversarial attack; the same recipe could be used to audit models or to evade content filters, so deployment requires a threat-model choice.
  • Editorial inference: by moving the perturbation from pixels to semantics, the paper changes the threat model from bounded $\ell_p$ perturbations to unbounded paraphrastic changes, which would require defenses such as adversarial training or certified robustness to be rethought for that space.
  • Editorial inference: one could extend the approach by replacing the three fixed proxy models with a dynamically selected ensemble per target domain, or by using the large language model to sample many prompt paraphrases and testing whether ensemble diversity further lifts transfer.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes DAC, a framework for generating 'unsourced' adversarial CAPTCHAs: starting from a semantic class label, an LLM expands the label into a detailed prompt, and a diffusion model generates an image that is simultaneously natural and misclassified by image classifiers. For white-box scenarios, DAC performs gradient-guided latent-variable optimization during reverse diffusion, with two coupled latent variables merged after each gradient step (claimed to be based on EDICT). For black-box scenarios, the paper proposes BP-DAC, which replaces the single target-model gradient with a weighted combination of gradients from three proxy models, adds a bi-path loss combining the target class and the second-highest posterior class, and uses a CLIP-guided initialization. Experiments on ImageNet classifiers report near-perfect ASRs, including a claimed 99.4% ASR against unknown black-box models, and ablations showing improved CLIP scores and attack efficiency. The paper claims to be the first to generate unsourced adversarial CAPTCHAs with diffusion models and to achieve near-99.4% transferability in this setting.

Significance. If the central claims are valid, the paper would make a notable contribution: it moves adversarial CAPTCHA generation from pixel-space perturbations of existing images to semantics-driven, source-free synthesis, which could increase CAPTCHA diversity and realism, and combines LLM prompt expansion with diffusion-based optimization. The idea of using an ensemble of proxy models plus a bi-path loss to improve transferability is interesting, and the breadth of comparison against other unrestricted attack methods is useful. However, the headline claims about unknown black-box performance and the CAPTCHA-specific applicability are not currently supported by the evidence: Table V evaluates only the same seven-model ImageNet classifier set, includes the proxy models themselves as target columns, and Algorithm 2's use of a target model for early stopping blurs the distinction between transfer-based and query-based attacks. The absence of CAPTCHA-specific solvers, error bars, and sample counts further weakens the empirical case. The contribution is potentially significant, but the current paper does not substantiate it.

major comments (5)
  1. [§I and Table V] The claim of 'near 99.4% ASR against an unknown black-box model' is not supported because Table V evaluates transferability only within the same seven-model ImageNet classifier set, and each row's proxy models appear as target columns. For example, Row 1 uses ResNet50, SeResNext101, and Googlenet as proxies, and the target columns include exactly those three models; the near-100% ASR values on those columns are not unknown-model results. The paper should report ASR averaged only over columns whose models were not used as proxies for that row, or better, evaluate against genuinely held-out architectures not in the proxy ensemble.
  2. [Algorithm 2 and §IV-C] Algorithm 2 takes the target model ft as an input and uses it on line 6 to check whether ft(It) != yorigin for early termination, and the text in §IV-C states that the bi-path loss uses 'the target class and the second-highest posterior probabilities in the target model's output.' If ft is queried during generation, the attack is query-based, not the transfer-based unknown-black-box attack claimed in the title and Section I, and the comparison in Fig. 4 against query-free transfer attacks is unfair. If ft is not actually queried, then the algorithm and threat-model description are misleading. The authors must clarify whether ft is accessed during generation and, if it is, restate the threat model and the comparison accordingly.
  3. [§V-B, Tables III–V] No error bars, confidence intervals, or sample counts are reported for any ASR value. The tables report exact numbers such as 100.0%, 99.4%, and 95.4% without stating the number of generated CAPTCHAs, the number of random seeds, or the variance across runs. Given that the central claims rely on small percentage differences (e.g., 99.4% vs. 98.0%), the absence of any statistical assessment makes the near-perfect results unverifiable.
  4. [§V, experimental scope] The paper repeatedly frames the method as a CAPTCHA defense, but every experiment evaluates ImageNet classifiers on natural images. No OCR model, segmentation-based CAPTCHA solver, or any CAPTCHA-specific architecture is tested. The claimed applicability to real CAPTCHA systems is therefore untested, and the claim that BP-DAC 'is able to defend against most of the unknown models' in a CAPTCHA context is not evidenced by the presented experiments.
  5. [§IV-B and Algorithm 1] The paper claims to incorporate EDICT to achieve 'robust inversion through an iterative bidirectional calibration mechanism,' but Algorithm 1 does not implement the EDICT coupling equations (Eqs. 6–7). It simply applies separate gradient updates to x and y (lines 11–12) and then merges them into z with a weighted sum (line 13); there is no alternating cross-feedback or exact inversion as described in §III-C. If the method is not actually using EDICT's coupled inversion, the methodological novelty attributed to it is overstated, and the equations in §IV-B are incomplete. The authors should either show where the EDICT updates enter the optimization or remove the EDICT claim.
minor comments (5)
  1. [Algorithm 2, lines 10 and 12] Equation references are incorrect: line 10 refers to 'Eq. (12)' when the integrated probability distribution is Eq. (13), and line 12 refers to 'Eq. (14)' when the combined loss is Eq. (15). These numbering errors should be fixed.
  2. [Table III] The caption says 'with the four source models' but the table shows two source models (RN-50 and MN-v2) across two blocks, and the '*' marker for identical surrogate-target pairs is not explained in the table itself. Please clarify the setup.
  3. [Algorithm 1, line 14] Line 14 calls G(zt-1) without the prompt P' and noise epsilon_t that appear in line 4; this is inconsistent and should be corrected for reproducibility.
  4. [Throughout] The term 'defensive adversarial CAPTCHA' is confusing because the generated images are adversarial examples, not defenses; consider renaming to 'adversarial CAPTCHA' or defining the defensive intent more carefully.
  5. [Reference [39]] Reference [39] cites 'The Claude 3 model family' via a Semantics Scholar URL with no version or publication details; please provide a complete citation.

Circularity Check

1 steps flagged · score 4.0 of 10

One fitted-input-as-prediction step: Table V counts surrogate models as unknown targets; the exact 99.4% claim retains independent held-out evidence, so circularity is partial.

  1. fitted input called prediction [Section V-B, Table V (and the Section I claim of success against unknown black-box models).]
    "Baseline Models: ResNet50 SeResNext101 Googlenet ... ResNet50 100% 98.5% 100% 99.1% 100% 97.2% 98.0% ... Overall, the migration ASR of the BP-DAC method is higher than 99% on all model combinations, regardless of the architectural differences between the baseline and target models."

    In each row of Table V, the three 'Baseline Models' whose gradients are fused via Eqs. (13)-(16) are also listed as target columns. For example, Row 1 uses ResNet50, SeResNext101, and Googlenet as proxy models and reports 100% ASR against exactly those same models. Because the latent variables are updated by minimizing the losses of these same models, those 100% entries are the optimization objective itself, not transfer predictions. Presenting them as 'migration ASR ... on all model combinations' in support of 'unknown black-box' defense treats fitted surrogate outputs as held-out predictions. The specific 99.4% figure is from a held-out column (Efficientnet with Row 5 baselines), so the circularity is partial rather than total.

full rationale

The core generation pipeline is not circular: P' = fLLM(P) conditions a diffusion model, DAC propagates white-box gradients through EDICT-coupled latent pairs, and BP-DAC replaces the single gradient with a weighted ensemble of proxy-model gradients plus a bi-path loss. None of these steps defines the generated image in terms of the measured ASR, and the reported loss equations are functions of proxy-model predictions and the attacker-specified classes. Held-out target columns in Table V (e.g., Alexnet in Row 1, where the proxies are ResNet50, SeResNext101, and Googlenet) provide genuine transfer evidence. Algorithm 2's use of target-model queries for early termination and the absence of OCR/segmentation-based CAPTCHA solvers are external-validity threats rather than circular derivations. No load-bearing self-citation or imported uniqueness theorem appears; EDICT, CLIP, and the LLM are cited as external components. The only circular element is the inclusion of the surrogate models themselves as target models when the paper claims 'migration ASR' and defense against unknown models, which is a partial fitted-input-called-prediction step.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central results rest on standard machine-learning components (diffusion models, CLIP, proxy classifiers) plus several unstated or hand-tuned hyperparameters. The key unverified premises are the transferability of proxy gradients to truly unknown models and the use of CLIP score as a human-likeness proxy.

free parameters (6)
  • latent learning rate eta (eta_x = eta_y) = 1.0
    Selected via ablation on attack steps and CLIP score in Section V-E; not a predicted quantity.
  • perturbation gradient scale epsilon = 3e-3
    Chosen in ablation to minimize attack steps while keeping ASR at 100% in Section V-E.
  • latent merge weight alpha
    Appears in Eq. (11) but no value or tuning criterion is given in the paper.
  • proxy model weights beta1, beta2, beta3
    Used in Eq. (13) for multimodal gradient integration; values are not specified.
  • diffusion steps T
    Number of reverse diffusion steps is not reported; required to reproduce Algorithm 1 and 2.
  • CLIP bootstrap steps m
    Algorithm 2 line 3 mentions optimizing x and y 'through m' but m is undefined.
assumptions (5)
  • domain assumption The target victim system is a single-label ImageNet classifier, not an OCR or segmentation-based CAPTCHA solver.
    Section V-A threat model; all experiments use ImageNet classifiers. If real CAPTCHA solvers use segmentation and OCR, the adversarial CAPTCHA may not transfer.
  • domain assumption Three proxy models with averaged gradients are an adequate surrogate for any unknown black-box target.
    Section IV-C BP-DAC integrates gradients of f1, f2, f3; the paper assumes this ensemble approximates the target behavior, but only tests on seven ImageNet models.
  • domain assumption The diffusion model G is differentiable and exposed for gradient backpropagation through the reverse process; its exact architecture is immaterial to the attack.
    Section IV-B uses gradients of G implicitly; the specific diffusion backbone is never named, so the reader cannot check this assumption.
  • domain assumption CLIP score is a valid proxy for human visual naturalness and 'indistinguishable to humans'.
    Section V-A uses CLIP Score as the only quality metric; no human evaluation is performed, yet the paper claims human indistinguishability.
  • domain assumption The ImageNet 1000-class label space is sufficient for CAPTCHA content; classes are mapped to English prompts via an LLM.
    Section V-A uses ImageNet categories as input; no other CAPTCHA-like classes (digits, characters, objects not in ImageNet) are tested.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation." pith.science (2026). https://pith.science/paper/R7EMDRUQ

@misc{pith2026250610685,
  author       = {Pith},
  title        = {Pith review of: Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/R7EMDRUQ}},
  note         = {Machine review of arXiv:2506.10685}
}
read the original abstract

Traditional CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) schemes are increasingly vulnerable to automated attacks powered by deep neural networks (DNNs). Existing adversarial attack methods often rely on the original image characteristics, resulting in distortions that hinder human interpretation and limit their applicability in scenarios where no initial input images are available. To address these challenges, we propose the Unsourced Adversarial CAPTCHA (DAC), a novel framework that generates high-fidelity adversarial examples guided by attacker-specified semantics information. Leveraging a Large Language Model (LLM), DAC enhances CAPTCHA diversity and enriches the semantic information. To address various application scenarios, we examine the white-box targeted attack scenario and the black box untargeted attack scenario. For target attacks, we introduce two latent noise variables that are alternately guided in the diffusion step to achieve robust inversion. The synergy between gradient guidance and latent variable optimization achieved in this way ensures that the generated adversarial examples not only accurately align with the target conditions but also achieve optimal performance in terms of distributional consistency and attack effectiveness. In untargeted attacks, especially for black-box scenarios, we introduce bi-path unsourced adversarial CAPTCHA (BP-DAC), a two-step optimization strategy employing multimodal gradients and bi-path optimization for efficient misclassification. Experiments show that the defensive adversarial CAPTCHA generated by BP-DAC is able to defend against most of the unknown models, and the generated CAPTCHA is indistinguishable to both humans and DNNs.

Figures

Figures reproduced from arXiv: 2506.10685 by the authors.

Figure 1
Figure 1. Practical application scenarios of adversarial examples in CAPTCHA [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Our proposed bi-path unsourced adversarial CAPTCHA (BP-DAC) attack framework. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. The adversarial examples generated by our proposed method. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Attack success rate of transfer attacks based on Resnet50 (left) and [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Attack success rate, average attack steps, and Clip Score of different settings. [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Comparison plot of adversarial samples generated using detailed prompt versus using labels. It is easy to conclude that a more detailed prompt will [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

67 extracted references · 31 canonical work pages

  1. [1]

    Efficient parallel split learning over resource-constrained wireless edge networks,

    Z. Lin, G. Zhu, Y . Deng, X. Chen, Y . Gao, K. Huang, and Y . Fang, “Efficient parallel split learning over resource-constrained wireless edge networks,” IEEE Transactions on Mobile Computing , 2024. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 12

    work page 2024

  2. [2]

    Automated federated pipeline for parameter-efficient fine-tuning of large language models,

    Z. Fang, Z. Lin, Z. Chen, X. Chen, Y . Gao, and Y . Fang, “Automated federated pipeline for parameter-efficient fine-tuning of large language models,” arXiv preprint arXiv:2404.06448 , 2024

    arXiv 2024

  3. [3]

    Satsense: Multi-satellite collaborative framework for spectrum sensing,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Z. Fang, Y . Zhong, Z. Song, and Y . Gao, “Satsense: Multi-satellite collaborative framework for spectrum sensing,” IEEE Transactions on Cognitive Communications and Net- working, 2024

    work page 2024

  4. [4]

    Agentsco- driver: Large language model empowered collaborative driving with lifelong learning,

    S. Hu, Z. Fang, Z. Fang, Y . Deng, X. Chen, and Y . Fang, “Agentsco- driver: Large language model empowered collaborative driving with lifelong learning,” arXiv preprint arXiv:2404.06345 , 2024

    arXiv 2024

  5. [5]

    Sums: Sniffing unknown multiband signals under low sampling rates,

    J. Peng, Z. Chen, Z. Lin, H. Yuan, Z. Fang, L. Bao, Z. Song, Y . Li, J. Ren, and Y . Gao, “Sums: Sniffing unknown multiband signals under low sampling rates,” IEEE Transactions on Mobile Computing , 2024

    work page 2024

  6. [6]

    AdaptSFL: Adaptive Split Federated Learning in Resource-constrained Edge Networks

    Z. Lin, G. Qu, W. Wei, X. Chen, and K. K. Leung, “Adaptsfl: Adaptive split federated learning in resource-constrained edge networks,” arXiv preprint arXiv:2403.13101, 2024

    work page Pith review arXiv 2024

  7. [7]

    Hsplitlora: A heterogeneous split parameter- efficient fine-tuning framework for large language models,

    Z. Lin, Y . Zhang, Z. Chen, Z. Fang, X. Chen, P. Vepakomma, W. Ni, J. Luo, and Y . Gao, “Hsplitlora: A heterogeneous split parameter- efficient fine-tuning framework for large language models,” arXiv preprint arXiv:2505.02795, 2025

    arXiv 2025

  8. [8]

    Ic3m: In-car multimodal multi-object monitoring for abnormal status of both driver and passengers,

    Z. Fang, Z. Lin, S. Hu, H. Cao, Y . Deng, X. Chen, and Y . Fang, “Ic3m: In-car multimodal multi-object monitoring for abnormal status of both driver and passengers,” arXiv preprint arXiv:2410.02592 , 2024

    arXiv 2024

Show all 67 references
  1. [9]

    Leo-split: A semi-supervised split learning framework over leo satellite networks,

    Z. Lin, Y . Zhang, Z. Chen, Z. Fang, C. Wu, X. Chen, Y . Gao, and J. Luo, “Leo-split: A semi-supervised split learning framework over leo satellite networks,” arXiv preprint arXiv:2501.01293 , 2025

    2025 arXiv

  2. [10]

    Constructing 4d radio map in leo satellite networks with limited samples,

    H. Yuan, Z. Chen, Z. Lin, J. Peng, Y . Zhong, X. Hu, S. Xue, W. Li, and Y . Gao, “Constructing 4d radio map in leo satellite networks with limited samples,” arXiv preprint arXiv:2501.02775 , 2025

    2025 arXiv

  3. [11]

    Optimal resource allocation for u-shaped parallel split learning,

    S. Lyu, Z. Lin, G. Qu, X. Chen, X. Huang, and P. Li, “Optimal resource allocation for u-shaped parallel split learning,” in 2023 IEEE Globecom Workshops (GC Wkshps), 2023, pp. 197–202

    2023

  4. [12]

    Accelerating federated learning with model segmentation for edge networks,

    M. Hu, J. Zhang, X. Wang, S. Liu, and Z. Lin, “Accelerating federated learning with model segmentation for edge networks,” IEEE Transac- tions on Green Communications and Networking , 2024

    2024

  5. [13]

    Hierarchical split federated learning: Convergence analysis and system optimization,

    Z. Lin, W. Wei, Z. Chen, C.-T. Lam, X. Chen, Y . Gao, and J. Luo, “Hierarchical split federated learning: Convergence analysis and system optimization,” arXiv preprint arXiv:2412.07197 , 2024

    2024 arXiv

  6. [14]

    Robust deep reinforcement learning in robotics via adaptive gradient-masked adversarial attacks,

    Z. Zhang, T. Duan, Z. Lin, D. Huang, Z. Fang, Z. Sun, L. Xiong, H. Liang, H. Cui, Y . Cui et al. , “Robust deep reinforcement learning in robotics via adaptive gradient-masked adversarial attacks,” arXiv preprint arXiv:2503.20844, 2025

    2025 arXiv

  7. [15]

    Rethinking adversarial attacks in rein- forcement learning from policy distribution perspective,

    T. Duan, Z. Zhang, Z. Lin, Y . Gao, L. Xiong, Y . Cui, H. Liang, X. Chen, H. Cui, and D. Huang, “Rethinking adversarial attacks in rein- forcement learning from policy distribution perspective,” arXiv preprint arXiv:2501.03562, 2025

    2025 arXiv

  8. [16]

    State-aware perturbation optimization for robust deep reinforcement learning,

    Z. Zhang, T. Duan, Z. Lin, D. Huang, Z. Fang, Z. Sun, L. Xiong, H. Liang, H. Cui, and Y . Cui, “State-aware perturbation optimization for robust deep reinforcement learning,” arXiv preprint arXiv:2503.20613 , 2025

    2025 arXiv

  9. [17]

    Crafting adversarial examples for speech paralinguistics applications,

    Y . Gong and C. Poellabauer, “Crafting adversarial examples for speech paralinguistics applications,” in Proceedings of 2018 DYnamic and Novel Advances in Machine Learning and Intelligent Cyber Security (DYNAMICS 2018) Workshop, 2018

    2018

  10. [18]

    Houdini: Fooling deep structured prediction models,

    M. Cisse, Y . Adi, N. Neverova, and J. Keshet, “Houdini: Fooling deep structured prediction models,” in Advances in Neural Information Processing Systems (NIPS) , 2017, p. 6977–6987

    2017

  11. [19]

    No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation,

    M. Osadchy, J. Hernandez-Castro, S. Gibson, O. Dunkelman, and D. P´erez-Cabo, “No bot expects the deepcaptcha! introducing immutable adversarial examples, with applications to captcha generation,” IEEE Transactions on Information Forensics and Security, vol. 12, no. 11, pp. 26...

    2017

  12. [20]

    I am robot: (deep) learning to break semantic image captchas,

    S. Sivakorn, I. Polakis, and A. D. Keromytis, “I am robot: (deep) learning to break semantic image captchas,” in 2016 IEEE European Symposium on Security and Privacy (EuroS&P) , 2016, pp. 388–403

    2016

  13. [21]

    Muten: Boosting gradient-based adversarial attacks via mutant-based ensembles,

    Y . Guo, Q. Hu, M. Cordy, M. Papadakis, and Y . L. Traon, “Muten: Boosting gradient-based adversarial attacks via mutant-based ensembles,” 2021. [Online]. Available: https://arxiv.org/abs/2109.12838

    2021 arXiv

  14. [22]

    Gadt: Enhancing transferable adver- sarial attacks through gradient-guided adversarial data transformation,

    Y . Ma, X. Xu, L. Fang, and Z. Liu, “Gadt: Enhancing transferable adver- sarial attacks through gradient-guided adversarial data transformation,”

  15. [23]

    Meta gradient adversarial attack,

    Z. Yuan, J. Zhang, Y . Jia, C. Tan, T. Xue, and S. Shan, “Meta gradient adversarial attack,” in 2021 IEEE/CVF International Conference on Computer Vision (ICCV) , 2021, pp. 7728–7737

    2021

  16. [24]

    Constructing unrestricted adversarial examples with generative models,

    Y . Song, R. Shu, N. Kushman, and S. Ermon, “Constructing unrestricted adversarial examples with generative models,” 2018. [Online]. Available: https://arxiv.org/abs/1805.07894

    2018 arXiv

  17. [25]

    Advdiff: Generating unrestricted adversarial examples using diffusion models,

    X. Dai, K. Liang, and B. Xiao, “Advdiff: Generating unrestricted adversarial examples using diffusion models,” 2024. [Online]. Available: https://arxiv.org/abs/2307.12499

    2024 arXiv

  18. [26]

    Diffattack: Evasion attacks against diffusion-based adversarial purification,

    M. Kang, D. Song, and B. Li, “Diffattack: Evasion attacks against diffusion-based adversarial purification,” 2024. [Online]. Available: https://arxiv.org/abs/2311.16124

    2024 arXiv

  19. [27]

    Adversarial captchas,

    C. Shi, X. Xu, S. Ji, K. Bu, J. Chen, R. Beyah, and T. Wang, “Adversarial captchas,” IEEE Transactions on Cybernetics , vol. 52, no. 7, pp. 6095– 6108, 2022

    2022

  20. [28]

    Robust image-based captcha generation using adversarial attack,

    Y . Wen, “Robust image-based captcha generation using adversarial attack,” in Conference on Intelligent Computing and Human-Computer Interaction , 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:255801888

    2023

  21. [29]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” 2017. [Online]. Available: https://arxiv.org/abs/1607.02533

    2017 arXiv

  22. [30]

    Deepfool: a simple and accurate method to fool deep neural networks,

    S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard, “Deepfool: a simple and accurate method to fool deep neural networks,” 2016. [Online]. Available: https://arxiv.org/abs/1511.04599

    2016 arXiv

  23. [31]

    Effect of adver- sarial examples on the robustness of captcha,

    Y . Zhang, H. Gao, G. Pei, S. Kang, and X. Zhou, “Effect of adver- sarial examples on the robustness of captcha,” in 2018 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), 2018, pp. 1–109

    2018

  24. [32]

    Generating adversarial examples with adversarial networks,

    C. Xiao, B. Li, J.-Y . Zhu, W. He, M. Liu, and D. Song, “Generating adversarial examples with adversarial networks,” 2019. [Online]. Available: https://arxiv.org/abs/1801.02610

    2019 arXiv

  25. [33]

    Improved denoising diffusion probabilistic models,

    A. Nichol and P. Dhariwal, “Improved denoising diffusion probabilistic models,” 2021. [Online]. Available: https://arxiv.org/abs/2102.09672

    2021 arXiv

  26. [34]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” 2022. [Online]. Available: https://arxiv.org/abs/2010.02502

    2022 arXiv

  27. [35]

    Edict: Exact diffusion inversion via coupled transformations,

    B. Wallace, A. Gokul, and N. Naik, “Edict: Exact diffusion inversion via coupled transformations,” 2022. [Online]. Available: https://arxiv.org/abs/2211.12446

    2022 arXiv

  28. [36]

    High-resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High-resolution image synthesis with latent diffusion models,” 2022. [Online]. Available: https://arxiv.org/abs/2112.10752

    2022 arXiv

  29. [37]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” 2023. [Online]. Available: https://arxiv.org/abs/2302.13971

    2023 arXiv

  30. [38]

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,

    W.-L. Chiang, Z. Li, Z. Lin, Y . Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y . Zhuang, J. E. Gonzalez, I. Stoica, and E. P. Xing, “Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,” March 2023. [Online]. Available: https://lmsys.org/blog/2023- 03-30-vicuna/

    2023

  31. [39]

    The claude 3 model family: Opus, sonnet, haiku

    “The claude 3 model family: Opus, sonnet, haiku.” [Online]. Available: https://api.semanticscholar.org/CorpusID:268232499

  32. [40]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervision,” 2021. [Online]. Available: https://arxiv.org/abs/2103.00020

    2021 arXiv

  33. [41]

    Aggregated residual transformations for deep neural networks,

    S. Xie, R. Girshick, P. Doll ´ar, Z. Tu, and K. He, “Aggregated residual transformations for deep neural networks,” 2017. [Online]. Available: https://arxiv.org/abs/1611.05431

    2017 arXiv

  34. [42]

    Mobilenetv2: Inverted residuals and linear bottlenecks,

    M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L.-C. Chen, “Mobilenetv2: Inverted residuals and linear bottlenecks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2018, pp. 4510–4520

    2018

  35. [43]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” 2015. [Online]. Available: https://arxiv.org/abs/1512.03385

    2015 arXiv

  36. [44]

    Going deeper with convolutions,

    C. Szegedy, W. Liu, Y . Jia, P. Sermanet, S. Reed, D. Anguelov, D. Erhan, V . Vanhoucke, and A. Rabinovich, “Going deeper with convolutions,” 2014. [Online]. Available: https://arxiv.org/abs/1409.4842

    2014 arXiv

  37. [45]

    Efficientnet: Rethinking model scaling for convolutional neural networks,

    M. Tan and Q. V . Le, “Efficientnet: Rethinking model scaling for convolutional neural networks,” 2020. [Online]. Available: https://arxiv.org/abs/1905.11946

    2020 arXiv

  38. [46]

    Rethinking the inception architecture for computer vision,

    C. Szegedy, V . Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” 2015. [Online]. Available: https://arxiv.org/abs/1512.00567

    2015 arXiv

  39. [47]

    Imagenet classification with deep convolutional neural networks,

    A. Krizhevsky, I. Sutskever, and G. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in neural information processing systems, vol. 25, no. 2, 2012

    2012

  40. [48]

    Clipscore: A reference-free evaluation metric for image captioning,

    J. Hessel, A. Holtzman, M. Forbes, R. L. Bras, and Y . Choi, “Clipscore: A reference-free evaluation metric for image captioning,”

  41. [49]

    Semantic adversarial examples,

    H. Hosseini and R. Poovendran, “Semantic adversarial examples,”

  42. [50]

    Adef: an iterative algorithm to construct adversarial deformations,

    R. Alaifari, G. S. Alberti, and T. Gauksson, “Adef: an iterative algorithm to construct adversarial deformations,” 2019. [Online]. Available: https://arxiv.org/abs/1804.07729

    2019 arXiv

  43. [51]

    Functional adversarial attacks,

    C. Laidlaw and S. Feizi, “Functional adversarial attacks,” 2019. [Online]. Available: https://arxiv.org/abs/1906.00001

    2019 arXiv

  44. [52]

    Unrestricted adversarial examples via semantic manipulation,

    A. Bhattad, M. J. Chong, K. Liang, B. Li, and D. A. Forsyth, “Unrestricted adversarial examples via semantic manipulation,” 2020. [Online]. Available: https://arxiv.org/abs/1904.06347

    2020 arXiv

  45. [53]

    Adversarial color enhancement: Generating unrestricted adversarial images by optimizing a color filter,

    Z. Zhao, Z. Liu, and M. Larson, “Adversarial color enhancement: Generating unrestricted adversarial images by optimizing a color filter,”

  46. [54]

    Colorfool: Semantic adversarial colorization,

    A. S. Shamsabadi, R. Sanchez-Matilla, and A. Cavallaro, “Colorfool: Semantic adversarial colorization,” 2020. [Online]. Available: https://arxiv.org/abs/1911.10891

    2020 arXiv

  47. [55]

    Natural color fool: Towards boosting black-box unrestricted attacks,

    S. Yuan, Q. Zhang, L. Gao, Y . Cheng, and J. Song, “Natural color fool: Towards boosting black-box unrestricted attacks,” 2022. [Online]. Available: https://arxiv.org/abs/2210.02041

    2022 arXiv

  48. [56]

    Content- based unrestricted adversarial attack,

    Z. Chen, B. Li, S. Wu, K. Jiang, S. Ding, and W. Zhang, “Content- based unrestricted adversarial attack,” 2023. [Online]. Available: https://arxiv.org/abs/2305.10665

    2023 arXiv

  49. [57]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” 2019. [Online]. Available: https://arxiv.org/abs/1706.06083

    2019 arXiv

  50. [58]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2015. [Online]. Available: https://arxiv.org/abs/1412.6572

    2015 arXiv

  51. [59]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” 2017. [Online]. Available: https://arxiv.org/abs/1611.01236

    2017 arXiv

  52. [60]

    A self-supervised approach for adversarial robustness,

    M. Naseer, S. Khan, M. Hayat, F. S. Khan, and F. Porikli, “A self-supervised approach for adversarial robustness,” 2020. [Online]. Available: https://arxiv.org/abs/2006.04924

    2020 arXiv

  53. [61]

    Certified adversarial robustness via randomized smoothing,

    J. M. Cohen, E. Rosenfeld, and J. Z. Kolter, “Certified adversarial robustness via randomized smoothing,” 2019. [Online]. Available: https://arxiv.org/abs/1902.02918

    2019 arXiv

  54. [62]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” 2018. [Online]. Available: https://arxiv.org/abs/1711.01991

    2018 arXiv

  55. [63]

    Defense against adversarial attacks using high-level representation guided denoiser,

    F. Liao, M. Liang, Y . Dong, T. Pang, X. Hu, and J. Zhu, “Defense against adversarial attacks using high-level representation guided denoiser,” 2018. [Online]. Available: https://arxiv.org/abs/1712.02976

    2018 arXiv

  56. [2018]

    Available: https://arxiv.org/abs/1804.00499

    [Online]. Available: https://arxiv.org/abs/1804.00499

    arXiv

  57. [2020]

    Available: https://arxiv.org/abs/2002.01008

    [Online]. Available: https://arxiv.org/abs/2002.01008

    2002 arXiv

  58. [2022]

    Available: https://arxiv.org/abs/2104.08718 JOURNAL OF LATEX CLASS FILES, VOL

    [Online]. Available: https://arxiv.org/abs/2104.08718 JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 13

    2021 arXiv

  59. [2024]

    Available: https://arxiv.org/abs/2410.18648

    [Online]. Available: https://arxiv.org/abs/2410.18648

    arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.