Carrier improves adversarial attacks while preserving main image objects
Let the Carrier Carry the Attack: Preserving the Subject in Adversarial Image Generation
Computer Vision and Pattern RecognitionArtificial Intelligence
Summary
Adversarial attacks on images try to fool AI systems but often distort the main object in the picture. The authors propose adding a ‘carrier,’ a less important part of the image that carries most of the attack changes instead. This approach keeps the main object looking normal to humans while still tricking AI across different models. The carrier helps balance strong attacks with keeping the subject recognizable.
What this means in practice
- •For machine learning security teams: Design adversarial tests that confuse classifiers without degrading main object appearance to strengthen model robustness.
- •For image recognition system developers: Create adversarial inputs that maintain the primary object’s integrity while misleading classifiers across multiple models.
Authors
Linfeng Jiang, Steven McDonagh, Yuhang Chen, Xingyu Zhao, Siddartha Khastgir, Andi Zhang
Abstract
Strong unrestricted adversarial attacks can distort the primary object of an image, hereafter referred to as the subject. To preserve subject integrity without compromising attack magnitude, we introduce the carrier: a secondary visual element that provides an auxiliary region to facilitate the attack under global classifier guidance. We demonstrate three key findings: 1. A carrier mitigates subject distortion by absorbing a larger share of globally normalized attack updates. 2. A carrier improves cross-model transferability, governed by the strength of target-related features that balance semantic separation and transfer performance. 3. Successful targeted attacks retain the personalized subject as the primary content perceived by humans while successfully misleading the classifier. Our results demonstrate that a visually secondary carrier offers an auxiliary spatial pathway for adversarial changes, enabling strong and transferable attacks while improving subject preservation.