{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,20]],"date-time":"2025-09-20T19:21:32Z","timestamp":1758396092788,"version":"3.41.2"},"reference-count":63,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2023,2,9]],"date-time":"2023-02-09T00:00:00Z","timestamp":1675900800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62162067"],"award-info":[{"award-number":["62162067"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Neurorobot."],"abstract":"<jats:p>Recent adversarial attack research reveals the vulnerability of learning-based deep learning models (DNN) against well-designed perturbations. However, most existing attack methods have inherent limitations in image quality as they rely on a relatively loose noise budget, i.e., limit the perturbations by<jats:italic>L<\/jats:italic><jats:sub><jats:italic>p<\/jats:italic><\/jats:sub>-norm. Resulting that the perturbations generated by these methods can be easily detected by defense mechanisms and are easily perceptible to the human visual system (HVS). To circumvent the former problem, we propose a novel framework, called<jats:bold>DualFlow<\/jats:bold>, to craft adversarial examples by disturbing the image's latent representations with spatial transform techniques. In this way, we are able to fool classifiers with human imperceptible adversarial examples and step forward in exploring the existing DNN's fragility. For imperceptibility, we introduce the flow-based model and spatial transform strategy to ensure the calculated adversarial examples are perceptually distinguishable from the original clean images. Extensive experiments on three computer vision benchmark datasets (CIFAR-10, CIFAR-100 and ImageNet) indicate that our method can yield superior attack performance in most situations. Additionally, the visualization results and quantitative performance (in terms of six different metrics) show that the proposed method can generate more imperceptible adversarial examples than the existing imperceptible attack methods.<\/jats:p>","DOI":"10.3389\/fnbot.2023.1129720","type":"journal-article","created":{"date-parts":[[2023,2,9]],"date-time":"2023-02-09T09:54:29Z","timestamp":1675936469000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model"],"prefix":"10.3389","volume":"17","author":[{"given":"Renyang","family":"Liu","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xin","family":"Jin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dongting","family":"Hu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jinhong","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuanyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jin","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wei","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1965","published-online":{"date-parts":[[2023,2,9]]},"reference":[{"key":"B1","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2002.12504","article-title":"Detecting patch adversarial attacks with image residuals","author":"Arvinte","year":"2020","journal-title":"CoRR"},{"key":"B2","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1145\/3475724.3483604","article-title":"\u201cImperceptible adversarial examples by spatial chroma-shift,\u201d","volume-title":"ADVM '21: Proceedings of the 1st International Workshop on Adversarial Learning for Multimedia","author":"Aydin","year":"2021"},{"key":"B3","doi-asserted-by":"publisher","first-page":"109037","DOI":"10.1016\/j.patcog.2022.109037","article-title":"Query efficient black-box adversarial attack on deep neural networks","volume":"133","author":"Bai","year":"2023","journal-title":"Pattern Recognit"},{"key":"B4","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1911.03274","article-title":"Imperceptible adversarial attacks on tabular data","author":"Ballet","year":"2019","journal-title":"CoRR"},{"key":"B5","doi-asserted-by":"crossref","first-page":"15681","DOI":"10.1109\/ICCV48922.2021.01541","article-title":"\u201cTriggering failures: out-of-distribution detection by learning from local adversarial attacks in semantic segmentation,\u201d","volume-title":"2021 IEEE\/CVF International Conference on Computer Vision (ICCV)","author":"Besnier","year":"2021"},{"key":"B6","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1109\/SP.2017.49","article-title":"\u201cTowards evaluating the robustness of neural networks,\u201d","volume-title":"2017 IEEE Symposium on Security and Privacy","author":"Carlini","year":"2017"},{"key":"B7","first-page":"6222","article-title":"\u201cEfficient robust training via backward smoothing,\u201d","volume-title":"Thirty-Sixth AAAI Conference on Artificial Intelligence, (AAAI) 2022, Thirty-Fourth Conference on Innovative Applications of Artificial Intelligence, IAAI 2022, The Twelveth Symposium on Educational Advances in Artificial Intelligence","author":"Chen","year":"2022"},{"key":"B8","article-title":"\u201cRobustbench: a standardized adversarial robustness benchmark,\u201d","author":"Croce","year":"2021","journal-title":"Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1"},{"key":"B9","first-page":"6437","article-title":"\u201cSparse-rs: a versatile framework for query-efficient sparse black-box adversarial attacks,\u201d","volume-title":"Thirty-Sixth AAAI Conference on Artificial Intelligence, AAAI 2022, Thirty-Fourth Conference on Innovative Applications of Artificial Intelligence, IAAI 2022, The Twelveth Symposium on Educational Advances in Artificial Intelligence","author":"Croce","year":"2022"},{"key":"B10","first-page":"248","article-title":"\u201cImagenet: a large-scale hierarchical image database,\u201d","volume-title":"2009 IEEE Computer Society Conference on Computer Vision and Pattern Recognition","author":"Deng","year":"2009"},{"key":"B11","doi-asserted-by":"publisher","first-page":"1258","DOI":"10.1007\/s11263-020-01419-7","article-title":"Comparison of full-reference image quality models for optimization of image processing systems","volume":"129","author":"Ding","year":"2021","journal-title":"Int. J. Comput. Vis"},{"key":"B12","doi-asserted-by":"publisher","first-page":"2567","DOI":"10.1109\/TPAMI.2020.3045810","article-title":"Image quality assessment: unifying structure and texture similarity","volume":"44","author":"Ding","year":"2022","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell"},{"key":"B13","article-title":"\u201cNICE: non-linear independent components estimation,\u201d","volume-title":"3rd International Conference on Learning Representations","author":"Dinh","year":"2015"},{"key":"B14","article-title":"\u201cAdvFlow: Inconspicuous black-box adversarial attacks using normalizing flows,\u201d","author":"Dolatabadi","year":"2020","journal-title":"Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020"},{"key":"B15","doi-asserted-by":"crossref","first-page":"9185","DOI":"10.1109\/CVPR.2018.00957","article-title":"\u201cBoosting adversarial attacks with momentum,\u201d","volume-title":"2018 IEEE Conference on Computer Vision and Pattern Recognition","author":"Dong","year":"2018"},{"key":"B16","first-page":"4312","article-title":"\u201cEvading defenses to transferable adversarial examples by translation-invariant attacks,\u201d","volume-title":"IEEE Conference on Computer Vision and Pattern Recognition","author":"Dong","year":"2019"},{"key":"B17","first-page":"97","article-title":"\u201cAdversarial camouflage: Hiding physical-world attacks with natural styles,\u201d","volume-title":"2020 IEEE\/CVF Conference on Computer Vision and Pattern Recognition","author":"Duan","year":"2020"},{"key":"B18","doi-asserted-by":"crossref","first-page":"1625","DOI":"10.1109\/CVPR.2018.00175","article-title":"\u201cRobust physical-world attacks on deep learning visual classification,\u201d","volume-title":"2018 IEEE Conference on Computer Vision and Pattern Recognition","author":"Eykholt","year":"2018"},{"key":"B19","doi-asserted-by":"crossref","first-page":"106.1","DOI":"10.5244\/C.29.106","article-title":"\u201cManitest: are classifiers really invariant?,\u201d","volume-title":"Proceedings of the British Machine Vision Conference 2015","author":"Fawzi","year":"2015"},{"key":"B20","article-title":"\u201cExplaining and harnessing adversarial examples,\u201d","volume-title":"3rd International Conference on Learning Representations","author":"Goodfellow","year":"2015"},{"key":"B21","article-title":"\u201cSimple black-box adversarial attacks,\u201d","volume-title":"Proceedings of the 36th International Conference on Machine Learning","author":"Guo","year":"2019"},{"key":"B22","doi-asserted-by":"crossref","first-page":"770","DOI":"10.1109\/CVPR.2016.90","article-title":"\u201cDeep residual learning for image recognition,\u201d","volume-title":"2016 IEEE Conference on Computer Vision and Pattern Recognition","author":"He","year":"2016"},{"key":"B23","first-page":"2712","article-title":"\u201cUsing pre-training can improve model robustness and uncertainty,\u201d","volume-title":"in Proceedings of the 36th International Conference on Machine Learning","author":"Hendrycks","year":"2019"},{"key":"B24","first-page":"2261","article-title":"\u201cDensely connected convolutional networks,\u201d","volume-title":"2017 IEEE Conference on Computer Vision and Pattern Recognition","author":"Huang","year":"2017"},{"key":"B25","first-page":"2142","article-title":"\u201cBlack-box adversarial attacks with limited queries and information,\u201d","volume-title":"Proceedings of the 35th International Conference on Machine Learning","author":"Ilyas","year":"2018"},{"key":"B26","article-title":"\u201cPrior convictions: black-box adversarial attacks with bandits and priors,\u201d","volume-title":"7th International Conference on Learning Representations","author":"Ilyas","year":"2019"},{"key":"B27","first-page":"2017","article-title":"\u201cSpatial transformer networks,\u201d","volume-title":"Advances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015","author":"Jaderberg","year":"2015"},{"key":"B28","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1902.08265","article-title":"Quantifying perceptual distortion of adversarial examples","author":"Jordan","year":"2019","journal-title":"CoRR"},{"key":"B29","first-page":"10236","article-title":"\u201cGlow: generative flow with invertible 1x1 convolutions,\u201d","volume-title":"Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018","author":"Kingma","year":"2018"},{"journal-title":"Learning multiple layers of features from tiny images","year":"2009","author":"Krizhevsky","key":"B30"},{"key":"B31","article-title":"\u201cAdversarial examples in the physical world,\u201d","volume-title":"5th International Conference on Learning Representations","author":"Kurakin","year":"2017"},{"key":"B32","first-page":"10408","article-title":"\u201cFunctional adversarial attacks,\u201d","volume-title":"Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019","author":"Laidlaw","year":"2019"},{"key":"B33","first-page":"7167","article-title":"\u201cA simple unified framework for detecting out-of-distribution samples and adversarial attacks,\u201d","volume-title":"Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018","author":"Lee","year":"2018"},{"key":"B34","first-page":"339","article-title":"Spatial quality evaluation of fusion of different resolution images","volume":"33","author":"Li","year":"2000","journal-title":"Int. Arch. Photogramm. Remot. Sens."},{"key":"B35","first-page":"1028","article-title":"\u201cPerceptual-sensitive gan for generating adversarial patches,\u201d","volume-title":"The Thirty-Third AAAI Conference on Artificial Intelligence 2019, The Thirty-First Innovative Applications of Artificial Intelligence","author":"Liu","year":"2019"},{"key":"B36","article-title":"\u201cDPATCH: an adversarial patch attack on object detectors,\u201d","volume-title":"Workshop on Artificial Intelligence Safety 2019 co-located with the Thirty-Third AAAI Conference on Artificial Intelligence 2019","author":"Liu","year":"2019"},{"key":"B37","first-page":"1652","article-title":"\u201cTowards imperceptible and robust adversarial example attacks against neural networks,\u201d","volume-title":"Proceedings of the Thirty-Second Conference on Artificial Intelligence, (AAAI-18), the 30th Innovative Applications of Artificial Intelligence (IAAI-18), and the 8th AAAI Symposium on Educational Advances in Artificial Intelligence (EAAI-18)","author":"Luo","year":"2018"},{"key":"B38","doi-asserted-by":"crossref","first-page":"15294","DOI":"10.1109\/CVPR52688.2022.01488","article-title":"\u201cFrequency-driven imperceptible adversarial attack on semantic similarity,\u201d","volume-title":"2022 IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","author":"Luo","year":"2022"},{"key":"B39","first-page":"122","article-title":"\u201cShufflenet V2: practical guidelines for efficient CNN architecture design,\u201d","author":"Ma","year":"2018","journal-title":"ECCV, Vol. 11218"},{"key":"B40","article-title":"\u201cCharacterizing adversarial subspaces using local intrinsic dimensionality,\u201d","volume-title":"6th International Conference on Learning Representations","author":"Ma","year":"2018"},{"key":"B41","article-title":"\u201cTowards deep learning models resistant to adversarial attacks,\u201d","volume-title":"6th International Conference on Learning Representations","author":"Madry","year":"2018"},{"key":"B42","first-page":"1310","article-title":"\u201cSimple black-box adversarial attacks on deep neural networks,\u201d","volume-title":"2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops","author":"Narodytska","year":"2017"},{"key":"B43","first-page":"8093","article-title":"\u201cOverfitting in adversarially robust deep learning,\u201d","volume-title":"2017 IEEE Conference on Computer Vision and Pattern Recognition Workshops","author":"Rice","year":"2020"},{"key":"B44","article-title":"\u201cDo adversarially robust imagenet models transfer better?,\u201d","author":"Salman","year":"2020","journal-title":"Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020"},{"key":"B45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00474","article-title":"Inverted residuals and linear bottlenecks: Mobile networks for classification, detection and segmentation","author":"Sandler","year":"2018","journal-title":"CoRR"},{"key":"B46","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.2105.10304","article-title":"Exploring misclassifications of robust neural networks to enhance adversarial attacks","author":"Schwinn","year":"2021","journal-title":"CoRR"},{"key":"B47","doi-asserted-by":"publisher","first-page":"1184","DOI":"10.1109\/TASLP.2021.3129339","article-title":"Advexpander: Generating natural language adversarial examples by expanding text","volume":"30","author":"Shao","year":"2022","journal-title":"IEEE ACM Trans. Audio Speech Lang. Process"},{"key":"B48","first-page":"709","article-title":"\u201cImage information and visual quality,\u201d","author":"Sheikh","year":"2004","journal-title":"ICASSP"},{"key":"B49","article-title":"\u201cVery deep convolutional networks for large-scale image recognition,\u201d","author":"Simonyan","year":"2015","journal-title":"ICLR"},{"key":"B50","first-page":"49","article-title":"\u201cFooling automated surveillance cameras: adversarial patches to attack person detection,\u201d","volume-title":"CVPR","author":"Thys","year":"2019"},{"key":"B51","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","article-title":"Image quality assessment: from error visibility to structural similarity","volume":"13","author":"Wang","year":"2004","journal-title":"IEEE Trans. on Image Process"},{"key":"B52","article-title":"\u201cFast is better than free: revisiting adversarial training,\u201d","author":"Wong","year":"2020","journal-title":"ICLR"},{"key":"B53","article-title":"\u201cAdversarial weight perturbation helps robust generalization,\u201d","author":"Wu","year":"2020","journal-title":"NeurIPS"},{"key":"B54","article-title":"\u201cSpatially transformed adversarial examples,\u201d","author":"Xiao","year":"2018","journal-title":"ICLR"},{"key":"B55","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1007\/s11633-019-1211-x","article-title":"Adversarial attacks and defenses in images, graphs and text: a review","volume":"17","author":"Xu","year":"2020","journal-title":"Inte. J. Autom. Comput"},{"key":"B56","first-page":"470","article-title":"\u201cLance: a comprehensive and lightweight CNN defense methodology against physical adversarial attacks on embedded multimedia applications,\u201d","volume-title":"ASP-DAC","author":"Xu","year":"2020"},{"key":"B57","first-page":"1957","article-title":"\u201cRolling colors: adversarial laser exploits against traffic light recognition,\u201d","author":"Yan","year":"2022","journal-title":"USENIX Security"},{"key":"B58","doi-asserted-by":"publisher","first-page":"11948","DOI":"10.1007\/s10489-021-02800-w","article-title":"Fine-tuning more stable neural text classifiers for defending word level adversarial attacks","volume":"52","author":"Yi","year":"2022","journal-title":"Appl. Intell"},{"key":"B59","first-page":"586","article-title":"\u201cThe unreasonable effectiveness of deep features as a perceptual metric,\u201d","author":"Zhang","year":"2018","journal-title":"CVPR"},{"key":"B60","first-page":"1412","article-title":"\u201cGeneralizing universal adversarial attacks beyond additive perturbations,\u201d","author":"Zhang","year":"2020","journal-title":"ICDM"},{"key":"B61","first-page":"1989","article-title":"\u201cSeeing isn't believing: Towards more robust adversarial attack against real world object detectors,\u201d","author":"Zhao","year":"2019","journal-title":"CCS"},{"key":"B62","first-page":"25","article-title":"\u201cThe adversarial attacks threats on computer vision: a survey,\u201d","author":"Zhou","year":"2019","journal-title":"MASS"},{"key":"B63","first-page":"13991","article-title":"\u201cDeep residual flow for out of distribution detection,\u201d","author":"Zisselman","year":"2020","journal-title":"CVPR"}],"container-title":["Frontiers in Neurorobotics"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fnbot.2023.1129720\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,13]],"date-time":"2024-10-13T21:55:13Z","timestamp":1728856513000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fnbot.2023.1129720\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,9]]},"references-count":63,"alternative-id":["10.3389\/fnbot.2023.1129720"],"URL":"https:\/\/doi.org\/10.3389\/fnbot.2023.1129720","relation":{},"ISSN":["1662-5218"],"issn-type":[{"type":"electronic","value":"1662-5218"}],"subject":[],"published":{"date-parts":[[2023,2,9]]},"article-number":"1129720"}}