{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T12:42:39Z","timestamp":1760013759334,"version":"3.41.0"},"reference-count":50,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2023,3,29]],"date-time":"2023-03-29T00:00:00Z","timestamp":1680048000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-sa\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Evol. Learn. Optim."],"published-print":{"date-parts":[[2023,3,31]]},"abstract":"<jats:p>An adversarial example is an input that a neural network misclassifies although the input differs only slightly from an input that the network classifies correctly. Adversarial examples are used to augment neural network training data, measure the vulnerability of neural networks, and provide intuitive interpretations of neural network output that humans can understand. Although adversarial examples are defined in the literature as similar to authentic input from the perspective of humans, the literature measures similarity with mathematical norms that are not scientifically correlated with human perception. Our main contributions are to construct a genetic algorithm (GA) that generates adversarial examples more similar to authentic input than do existing methods and to demonstrate with a survey that humans perceive those adversarial examples to have greater visual similarity than existing methods. The GA incorporates a neural network, and we test many parameter sets to determine which fitness function, selection operator, mutation operator, and neural network generate adversarial examples most visually similar to authentic input. We establish which mathematical norms are most correlated with human perception, which permits future research to incorporate the human perspective without testing many norms or conducting intensive surveys with human subjects. We also document a tradeoff between speed and quality in adversarial examples generated by GAs and existing methods. Although existing adversarial methods are faster, a GA provides higher-quality adversarial examples in terms of visual similarity and feasibility of adversarial examples. We apply the GA to the Modified National Institute of Standards and Technology (MNIST) and Canadian Institute for Advanced Research (CIFAR-10) datasets.<\/jats:p>","DOI":"10.1145\/3582276","type":"journal-article","created":{"date-parts":[[2023,1,30]],"date-time":"2023-01-30T11:53:34Z","timestamp":1675079614000},"page":"1-44","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["The Generation of Visually Credible Adversarial Examples with Genetic Algorithms"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8766-6830","authenticated-orcid":false,"given":"James R.","family":"Bradley","sequence":"first","affiliation":[{"name":"William &amp; Mary, Williamsburg, VA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8787-2263","authenticated-orcid":false,"given":"A. Paul","family":"Blossom","sequence":"additional","affiliation":[{"name":"William &amp; Mary, Williamsburg, VA"}]}],"member":"320","published-online":{"date-parts":[[2023,3,29]]},"reference":[{"key":"e_1_3_2_2_1","unstructured":"Moustafa Alzantot Bharathan Balaji and Mani Srivastava. 2018a. Did you hear that? Adversarial examples against automatic speech recognition. arxiv:cs.CL\/1801.00554 (2018)."},{"key":"e_1_3_2_3_1","doi-asserted-by":"crossref","unstructured":"Moustafa Alzantot Yash Sharma Ahmed Elgohary Bo-Jhang Ho Mani Srivastava and Kai-Wei Chang. 2018b. Generating natural language adversarial examples. arxiv:cs.CL\/1804.07998 (2018).","DOI":"10.18653\/v1\/D18-1316"},{"key":"e_1_3_2_4_1","unstructured":"Thomas B\u00e4ck and Frank Hoffmeister. 1991. Extended selection mechanisms in genetic algorithms. In Proceedings of the 4th International Conference on Genetic Algorithms (ICGA\u201991) . 92\u201399."},{"key":"e_1_3_2_5_1","volume-title":"Proceedings of the 1st International Conference on Genetic Algorithms","author":"Edward Baker. James","year":"1985","unstructured":"James Edward Baker. 1985. Adaptive selection methods for genetic algorithms. In Proceedings of the 1st International Conference on Genetic Algorithms. 101\u2013111."},{"issue":"6","key":"e_1_3_2_6_1","article-title":"A review of selection strategies in genetic algorithm","volume":"5","author":"Bala Anju","year":"2017","unstructured":"Anju Bala. 2017. A review of selection strategies in genetic algorithm. International Journal of Advance Research in Computer Science and Management Studies 5, 6 (2017), 133\u2013141.","journal-title":"International Journal of Advance Research in Computer Science and Management Studies"},{"key":"e_1_3_2_7_1","first-page":"2613","volume-title":"Advances in Neural Information Processing Systems","author":"Bastani Osbert","year":"2016","unstructured":"Osbert Bastani, Yani Ioannou, Leonidas Lampropoulos, Dimitrios Vytiniotis, Aditya Nori, and Antonio Criminisi. 2016. Measuring neural net robustness with constraints. In Advances in Neural Information Processing Systems. 2613\u20132621."},{"key":"e_1_3_2_8_1","doi-asserted-by":"publisher","DOI":"10.1162\/evco.1996.4.4.361"},{"key":"e_1_3_2_9_1","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Brendel Wieland","year":"2018","unstructured":"Wieland Brendel, Jonas Rauber, and Matthias Bethge. 2018. Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. In Proceedings of the International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=SyZI0GWCZ."},{"key":"e_1_3_2_10_1","article-title":"Adversarial patch","author":"Brown Tom B.","year":"2017","unstructured":"Tom B. Brown, Dandelion Man\u00e9, Aurko Roy, Mart\u00edn Abadi, and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665 (2017).","journal-title":"arXiv preprint arXiv:1712.09665"},{"key":"e_1_3_2_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"issue":"145","key":"e_1_3_2_12_1","first-page":"145","article-title":"Rethinking explainable machines: The GDPR\u2019S \u201cright to explanation\u201d debate and the rise of algorithmic audits in enterprise","volume":"34","author":"Casey Bryan","year":"2019","unstructured":"Bryan Casey, Ashkan Farhangi, and Roland Vogl. 2019. Rethinking explainable machines: The GDPR\u2019S \u201cright to explanation\u201d debate and the rise of algorithmic audits in enterprise. Berkeley Technology Law Journal 34, 145 (2019), 145\u2013189.","journal-title":"Berkeley Technology Law Journal"},{"key":"e_1_3_2_13_1","volume-title":"Proceedings of the 41st IEEE Symposium on Security and Privacy","author":"Chen Jianbo","year":"2020","unstructured":"Jianbo Chen, Michael I. Jordan, and Martin J. Wainwright. 2020. HopSkipJumpAttack: A query-efficient decision-based attack. In Proceedings of the 41st IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDAR.2011.229"},{"key":"e_1_3_2_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/3427474"},{"key":"e_1_3_2_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2211477"},{"key":"e_1_3_2_17_1","unstructured":"Digit Recognizer. 2020. How to Choose CNN Architecture MNIST. Retrieved October 21 2020 from https:\/\/www.kaggle.com\/code\/cdeotte\/how-to-choose-cnn-architecture-mnis."},{"key":"e_1_3_2_18_1","unstructured":"Alexey Dosovitskiy Lucas Beyer Alexander Kolesnikov Dirk Weissenborn Xiaohua Zhai Thomas Unterthiner Mostafa Dehghani et\u00a0al. 2021. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv:2010.11929 (2021)."},{"issue":"2","key":"e_1_3_2_19_1","first-page":"646","article-title":"Technological tethereds: Potential impact of untrustworthy artificial intelligence in criminal justice risk assessment instruments","volume":"78","author":"Parliament European","year":"2021","unstructured":"European Parliament and Council of the European Union. 2016. Regulation (EU) 2016\/679 of the European Parliament and of the Council. Retrieved February 7, 2023 from https:\/\/eur-lex.europa.eu\/legal-content\/EN\/TXT\/HTML\/?uri=CELEX:32016R0679&from=E. Sonia M. Gibson-Rankin. 2021. Technological tethereds: Potential impact of untrustworthy artificial intelligence in criminal justice risk assessment instruments. Washington and Lee Law Review 78, 2 (2021), 646\u2013724.","journal-title":"Washington and Lee Law Review"},{"volume-title":"Genetic Algorithms in Search, Optimization, and Machine Learning","year":"1989","key":"e_1_3_2_20_1","unstructured":"D. E. Goldberg. 1989. Genetic Algorithms in Search, Optimization, and Machine Learning. Addison-Wesley."},{"key":"e_1_3_2_21_1","first-page":"69","volume-title":"Foundations of Genetic Algorithms","author":"Goldberg David E.","year":"1991","unstructured":"David E. Goldberg and Kalyanmoy Deb. 1991. A comparative analysis of selection schemes used in genetic algorithms. In Foundations of Genetic Algorithms, Vol. 1. Elsevier, 69\u201393."},{"key":"e_1_3_2_22_1","article-title":"Explaining and harnessing adversarial examples","volume":"1412","author":"Goodfellow Ian J.","year":"2014","unstructured":"Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples. CoRR abs\/1412.6572 (2014).","journal-title":"CoRR"},{"key":"e_1_3_2_23_1","article-title":"Benchmarking neural network robustness to common corruptions and perturbations","author":"Hendrycks Dan","year":"2019","unstructured":"Dan Hendrycks and Thomas Dietterich. 2019. Benchmarking neural network robustness to common corruptions and perturbations. In Proceedings of the International Conference on Learning Representations.","journal-title":"Proceedings of the International Conference on Learning Representations."},{"key":"e_1_3_2_24_1","volume-title":"Adaptation in Natural and Artificial Systems","author":"Holland John Henry","year":"1975","unstructured":"John Henry Holland. 1975. Adaptation in Natural and Artificial Systems. University of Michigan Press, Ann Arbor, MI."},{"key":"e_1_3_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3022181"},{"key":"e_1_3_2_26_1","unstructured":"Alex Krizhevsky Vinod Nair and Geoffrey Hinton. 2022. The CIFAR-10 Dataset. Retrieved September 23 2022 from https:\/\/www.cs.toronto.edu\/kriz\/cifar.html."},{"issue":"15","key":"e_1_3_2_27_1","first-page":"32","volume":"92","author":"Kuncel Nathan R.","year":"2014","unstructured":"Nathan R. Kuncel, David M. Slieger, and Deniz S. Ones. 2014. Harvard Business Review 92, 15 (2014), 32\u201332.","journal-title":"Harvard Business Review"},{"key":"e_1_3_2_28_1","volume-title":"Proceedings of the 2017 International Conference on Learning Representations","author":"Kurakin Alexey","year":"2017","unstructured":"Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial machine learning at scale. In Proceedings of the 2017 International Conference on Learning Representations. https:\/\/openreview.net\/forum?id=BJm4T4Kgx."},{"key":"e_1_3_2_29_1","unstructured":"Yann LeCun Corinna Cortes and Christopher J. C. Burges. 2020. The MNIST Database. Retrieved February 7 2023 from http:\/\/yann.lecun.com\/exdb\/mnist\/."},{"key":"e_1_3_2_30_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arxiv:stat.ML\/1706.06083 (2017)."},{"key":"e_1_3_2_31_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2020. MadryLab\/mnist_challenge. Retrieved October 13 2020 from https:\/\/github.com\/MadryLab\/mnist_challenge."},{"key":"e_1_3_2_32_1","unstructured":"Aleksander Madry Aleksandar Makelov Ludwig Schmidt Dimitris Tsipras and Adrian Vladu. 2022. MadryLab\/cifar10_challenge. Retrieved November 17 2022 from https:\/\/github.com\/MadryLab\/cifar10_challenge."},{"key":"e_1_3_2_33_1","article-title":"Hiring algorithms are not neutral","author":"Mann Gideon","year":"2016","unstructured":"Gideon Mann and Cathy O\u2019Neil. 2016. Hiring algorithms are not neutral. Harvard Business Review. Retrieved February 7, 2023 from https:\/\/hbr.org\/2016\/12\/hiring-algorithms-are-not-neutral.","journal-title":"Harvard Business Review."},{"issue":"3","key":"e_1_3_2_34_1","doi-asserted-by":"crossref","first-page":"283","DOI":"10.1016\/S0167-9236(00)00077-4","article-title":"The cost-minimizing inverse classification problem: A genetic algorithm approach","volume":"29","author":"Mannino Michael V.","year":"2000","unstructured":"Michael V. Mannino and Murlidhar V. Koushik. 2000. The cost-minimizing inverse classification problem: A genetic algorithm approach. Decision Support Systems 29, 3 (2000), 283\u2013300.","journal-title":"Decision Support Systems"},{"key":"e_1_3_2_35_1","unstructured":"MetaAI. 2022. Image Classification on CIFAR-10. Retrieved November 17 2022 from https:\/\/paperswithcode.com\/sota\/image-classification-on-cifar-10."},{"key":"e_1_3_2_36_1","first-page":"2574","volume-title":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","author":"Moosavi-Dezfooli Seyed-Mohsen","year":"2016","unstructured":"Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. 2016. DeepFool: A simple and accurate method to fool deep neural networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2574\u20132582."},{"key":"e_1_3_2_37_1","first-page":"1","volume-title":"Proceedings of the World Congress on Engineering","author":"Razali Noraini Mohd","year":"2011","unstructured":"Noraini Mohd Razali and John Geraghty. 2011. Genetic algorithm performance with different selection strategies in solving TSP. In Proceedings of the World Congress on Engineering, Vol. II. 1\u20136."},{"key":"e_1_3_2_38_1","article-title":"CERTIFAI: Counterfactual explanations for robustness, transparency, interpretability, and fairness of artificial intelligence models","volume":"1905","author":"Sharma Shubham","year":"2019","unstructured":"Shubham Sharma, Jette Henderson, and Joydeep Ghosh. 2019. CERTIFAI: Counterfactual explanations for robustness, transparency, interpretability, and fairness of artificial intelligence models. CoRR abs\/1905.07857 (2019).","journal-title":"CoRR"},{"key":"e_1_3_2_39_1","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Sharma Yash","year":"2018","unstructured":"Yash Sharma and Pin-Yu Chen. 2018. Attacking the Madry defense model with \\(L_1\\) -based adversarial examples. In Proceedings of the International Conference on Learning Representations."},{"issue":"4","key":"e_1_3_2_40_1","first-page":"96","article-title":"Inspecting algorithms for bias","author":"Spielkamp Matthias","year":"2017","unstructured":"Matthias Spielkamp. 2017. Inspecting algorithms for bias. MIT Technology Review 4 (2017), 96\u201398.","journal-title":"MIT Technology Review"},{"key":"e_1_3_2_41_1","doi-asserted-by":"publisher","DOI":"10.1016\/B978-0-08-050684-5.50009-4"},{"key":"e_1_3_2_42_1","first-page":"49","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Szegedy C.","year":"2014","unstructured":"C. Szegedy, W. Zaremba, I. Sutskever, and J. Bruna. 2014. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations. 49\u201358. https:\/\/arxiv.org\/abs\/1312.6199."},{"key":"e_1_3_2_43_1","doi-asserted-by":"crossref","unstructured":"Rohan Taori Amog Kamsetty Brenton Chu and Nikita Vemuri. 2019. Targeted adversarial examples for black box audio systems. (2019). arxiv:cs.LG\/1805.07820 (2019).","DOI":"10.1109\/SPW.2019.00016"},{"key":"e_1_3_2_44_1","article-title":"The space of transferable adversarial examples","author":"Tram\u00e8r Florian","year":"2017","unstructured":"Florian Tram\u00e8r, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. 2017. The space of transferable adversarial examples. arXiv preprint arXiv:1704.03453 (2017).","journal-title":"arXiv preprint arXiv:1704.03453"},{"key":"e_1_3_2_45_1","doi-asserted-by":"crossref","DOI":"10.1016\/j.neunet.2020.04.015","article-title":"Vulnerability of classifiers to evolutionary generated adversarial examples","author":"Vidnerov\u00e1 Petra","year":"2020","unstructured":"Petra Vidnerov\u00e1 and Roman Neruda. 2020. Vulnerability of classifiers to evolutionary generated adversarial examples. Neural Networks 127 (2020), 168\u2013181.","journal-title":"Neural Networks"},{"issue":"2","key":"e_1_3_2_46_1","article-title":"Counterfactual explanations without opening the black box: Automated decisions and the GDPR","volume":"31","author":"Wachter Sandra","year":"2018","unstructured":"Sandra Wachter, Brent Mittlestadt, and Chris Russell. 2018. Counterfactual explanations without opening the black box: Automated decisions and the GDPR. Harvard Journal of Law & Technology 31, 2 (Spring 2018), 1\u201347.","journal-title":"Harvard Journal of Law & Technology"},{"issue":"4","key":"e_1_3_2_47_1","first-page":"114","article-title":"Collaborative intelligence: Humans and AI are joining forces","volume":"96","author":"Wilson H. James","year":"2018","unstructured":"H. James Wilson and Paul R. Daugherty. 2018. Collaborative intelligence: Humans and AI are joining forces. Harvard Business Review 96, 4 (2018), 114\u2013123.","journal-title":"Harvard Business Review"},{"key":"e_1_3_2_48_1","unstructured":"Eric Wong Leslie Rice and J. Zico Kolter. 2020. Fast is better than free: Revisiting adversarial training. arxiv:cs.LG\/2001.03994 (2020)."},{"key":"e_1_3_2_49_1","unstructured":"Zhuolin Yang Bo Li Pin-Yu Chen and Dawn Song. 2019. Characterizing audio adversarial examples using temporal dependency. arxiv:cs.LG\/1809.10875 (2019)."},{"key":"e_1_3_2_50_1","doi-asserted-by":"crossref","first-page":"701","DOI":"10.1109\/TIFS.2020.3021899","article-title":"Walking on the edge: Fast, low-distortion adversarial examples","volume":"16","author":"Zhang H.","year":"2021","unstructured":"H. Zhang, Y. Avrithis, T. Furon, and L. Amsaleg. 2021. Walking on the edge: Fast, low-distortion adversarial examples. IEEE Transactions on Information Forensics and Security 16 (2021), 701\u2013713.","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"e_1_3_2_51_1","first-page":"4939","volume-title":"Advances in Neural Information Processing Systems","author":"Zhang Huan","year":"2018","unstructured":"Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. 2018. Efficient neural network robustness certification with general activation functions. In Advances in Neural Information Processing Systems. 4939\u20134948."}],"container-title":["ACM Transactions on Evolutionary Learning and Optimization"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3582276","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3582276","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T17:51:32Z","timestamp":1750182692000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3582276"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,3,29]]},"references-count":50,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,3,31]]}},"alternative-id":["10.1145\/3582276"],"URL":"https:\/\/doi.org\/10.1145\/3582276","relation":{},"ISSN":["2688-299X","2688-3007"],"issn-type":[{"type":"print","value":"2688-299X"},{"type":"electronic","value":"2688-3007"}],"subject":[],"published":{"date-parts":[[2023,3,29]]},"assertion":[{"value":"2022-06-02","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-01-20","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2023-03-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}