Vision models have reusable weaknesses to natural changes in images
Discovering Natural Transformation Vulnerabilities in Black-Box Vision Models
Computer Vision and Pattern RecognitionArtificial Intelligence
Summary
Vision models used in AI can make mistakes when images are changed naturally, like different lighting or backgrounds. Creating such tricky images without knowing how the model works is hard. The authors developed a method called ASA that uses language and image tools to find these natural changes that fool models efficiently. Their method works better and faster than earlier ones and can even find changes that affect many models and images similarly.
What this means in practice
- •For machine learning engineers: Test vision AI systems against real-world image changes that reveal model weaknesses using an efficient black-box attack.
- •For security teams for ai products: Identify natural image transformations that cause AI vision failures to improve robustness and prevent misuse.
Authors
Dongsu Song, DaeYun GO, Jay Hoon Jung
Abstract
Natural adversarial examples (NAEs) reveal that vision models can fail under realistic semantic changes beyond norm-bounded perturbations. However, generating NAEs in a black-box setting remains challenging because existing generative attacks often rely on surrogate models, learned attack priors, or costly query-based optimization, whereas the natural transformations that expose model vulnerabilities are unknown a priori. We propose \textbf{Adversarial Scenario Attack (ASA)}, a query-based black-box framework that searches over natural-language editing scenarios using a multimodal language model and a modern text-guided generative editor. ASA jointly explores background, weather, and material/color transformations through winner--loser feedback, and uses a greedy explorer to compose only attack-improving scenarios. Across diverse ImageNet classifiers, ASA achieves substantially higher attack success rates than prior query-based generative attacks while requiring fewer victim-model queries and preserving competitive perceptual quality. Moreover, ASA exhibits both image-level and prompt-level transferability: its adversarial images remain effective across victim-model architectures, while its discovered editing scenarios can be reused across same-class images and, in some cases, across architectures. These findings suggest that vision models possess reusable vulnerabilities to natural transformation patterns, which ASA can efficiently identify in a black-box setting.