Exploring Semantic-constrained Adversarial Example with Instruction Uncertainty Reduction

TL;DR

This work tackles the uncertainty inherent in human instructions used to guide semantic-constrained adversarial examples (SemanticAE). It introduces InSUR, a multi-dimensional framework comprising residual-guided sampling (ResAdv-DDIM), context-encoded scenario constraints, and semantic-abstracted evaluation to produce more transferable, adaptive, and effective SemanticAEs. The authors provide a formal problem formulation, address three core uncertainties (reference diversity, descriptive incompleteness, boundary ambiguity), and demonstrate substantial transferability gains in 2D and pioneering reference-free 3D SemanticAE generation via a differentiable rendering pipeline. They also propose an evaluation taxonomy based on WordNet-inspired abstraction to better bound semantic constraints and enhance reproducibility, with extensive ablations validating the contributions of residual approximation and guidance masking. The work further discusses extensions to large vision-language models and broader applications, highlighting potential safety implications and future research directions for semantic-guided red-teaming and 3D world-model alignment.

Abstract

Recently, semantically constrained adversarial examples (SemanticAE), which are directly generated from natural language instructions, have become a promising avenue for future research due to their flexible attacking forms. To generate SemanticAEs, current methods fall short of satisfactory attacking ability as the key underlying factors of semantic uncertainty in human instructions, such as referring diversity, descriptive incompleteness, and boundary ambiguity, have not been fully investigated. To tackle the issues, this paper develops a multi-dimensional instruction uncertainty reduction (InSUR) framework to generate more satisfactory SemanticAE, i.e., transferable, adaptive, and effective. Specifically, in the dimension of the sampling method, we propose the residual-driven attacking direction stabilization to alleviate the unstable adversarial optimization caused by the diversity of language references. By coarsely predicting the language-guided sampling process, the optimization process will be stabilized by the designed ResAdv-DDIM sampler, therefore releasing the transferable and robust adversarial capability of multi-step diffusion models. In task modeling, we propose the context-encoded attacking scenario constraint to supplement the missing knowledge from incomplete human instructions. Guidance masking and renderer integration are proposed to regulate the constraints of 2D/3D SemanticAE, activating stronger scenario-adapted attacks. Moreover, in the dimension of generator evaluation, we propose the semantic-abstracted attacking evaluation enhancement by clarifying the evaluation boundary, facilitating the development of more effective SemanticAE generators. Extensive experiments demonstrate the superiority of the transfer attack performance of InSUR. Moreover, we realize the reference-free generation of semantically constrained 3D adversarial examples for the first time.

Figures (30)

• Figure 1: SemanticAE s are generated directly by instructions.
• Figure 2: Overview of multi-dimensional instruction uncertainty reduction (InSUR) framework.
• Figure 3: Inconsistent adv. direction problem.
• Figure 4: Residual-driven attacking direction stabilization. ResAdv-DDIM is designed for the efficient and thorough exploration of new adversarial patterns constrained by multi-step sampling processes.
• Figure 5: 3D optimization pipeline. Scenario knowledge is encoded with the Gaussian renderer.

Theorems & Definitions (4)

• Proposition B.1: Lower Bound of the Diffusion Step
• proof
• Proposition B.2: $ASR_\mathrm{relative}$ characterize the upper-bound probability of the successful attack
• proof