Vision models show weaknesses under natural changes in images
Discovering Natural Transformation Vulnerabilities in Black-Box Vision Models
Computer Vision and Pattern RecognitionArtificial Intelligence
Summary
Computer vision systems, which help computers understand pictures, can sometimes make mistakes when images change in realistic ways like weather or background. The researchers developed a new way called Adversarial Scenario Attack (ASA) that finds these weak spots without needing inside knowledge of the system. ASA uses smart language and image tools to try different natural changes and quickly finds ones that confuse the vision models. These tricky changes work on many types of models and different images, showing that certain vulnerabilities are common and reusable.
Natural adversarial examplesBlack-box attacksVision modelsImage transformationsQuery-based optimizationMultimodal language modelGenerative editorAttack transferabilityImageNet classifiersSemantic changes
Authors
Dongsu Song, DaeYun GO, Jay Hoon Jung
Abstract
Natural adversarial examples (NAEs) reveal that vision models can fail under realistic semantic changes beyond norm-bounded perturbations. However, generating NAEs in a black-box setting remains challenging because existing generative attacks often rely on surrogate models, learned attack priors, or costly query-based optimization, whereas the natural transformations that expose model vulnerabilities are unknown a priori. We propose \textbf{Adversarial Scenario Attack (ASA)}, a query-based black-box framework that searches over natural-language editing scenarios using a multimodal language model and a modern text-guided generative editor. ASA jointly explores background, weather, and material/color transformations through winner--loser feedback, and uses a greedy explorer to compose only attack-improving scenarios. Across diverse ImageNet classifiers, ASA achieves substantially higher attack success rates than prior query-based generative attacks while requiring fewer victim-model queries and preserving competitive perceptual quality. Moreover, ASA exhibits both image-level and prompt-level transferability: its adversarial images remain effective across victim-model architectures, while its discovered editing scenarios can be reused across same-class images and, in some cases, across architectures. These findings suggest that vision models possess reusable vulnerabilities to natural transformation patterns, which ASA can efficiently identify in a black-box setting.