Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ARMOR: Agentic Reasoning for Methods Orchestration and Reparameterization for Robust Adversarial Attacks

Gabriel Lee Jun Rong, Christos Korgialas, Dion Jia Xu Ho, Pai Chet Ng, Xiaoxiao Miao, Konstantinos N. Plataniotis

TL;DR

The paper tackles the lack of strategic adaptation in automated adversarial attacks by introducing ARMOR, a VLM/LLM-guided, multi-agent framework that orchestrates CW, JSMA, and STA perturbations via a shared Mixing Desk. It formulates a four-phase loop—agentic reconnaissance, parallel perturbation generation, critique/adaptation, and adaptive ensemble mixing—optimized against a surrogate ensemble to improve transferability to a black-box target. ARMOR achieves perfect surrogate success and the strongest conditional transfer to a blind ViT-B/16 among evaluated methods, while maintaining competitive perceptual quality (SSIM). This work demonstrates that semantic-aware, agentic coordination can significantly enhance the effectiveness and robustness of adversarial attacks, informing both offensive research and potential defenses.

Abstract

Existing automated attack suites operate as static ensembles with fixed sequences, lacking strategic adaptation and semantic awareness. This paper introduces the Agentic Reasoning for Methods Orchestration and Reparameterization (ARMOR) framework to address these limitations. ARMOR orchestrates three canonical adversarial primitives, Carlini-Wagner (CW), Jacobian-based Saliency Map Attack (JSMA), and Spatially Transformed Attacks (STA) via Vision Language Models (VLM)-guided agents that collaboratively generate and synthesize perturbations through a shared ``Mixing Desk". Large Language Models (LLMs) adaptively tune and reparameterize parallel attack agents in a real-time, closed-loop system that exploits image-specific semantic vulnerabilities. On standard benchmarks, ARMOR achieves improved cross-architecture transfer and reliably fools both settings, delivering a blended output for blind targets and selecting the best attack or blended attacks for white-box targets using a confidence-and-SSIM score.

ARMOR: Agentic Reasoning for Methods Orchestration and Reparameterization for Robust Adversarial Attacks

TL;DR

The paper tackles the lack of strategic adaptation in automated adversarial attacks by introducing ARMOR, a VLM/LLM-guided, multi-agent framework that orchestrates CW, JSMA, and STA perturbations via a shared Mixing Desk. It formulates a four-phase loop—agentic reconnaissance, parallel perturbation generation, critique/adaptation, and adaptive ensemble mixing—optimized against a surrogate ensemble to improve transferability to a black-box target. ARMOR achieves perfect surrogate success and the strongest conditional transfer to a blind ViT-B/16 among evaluated methods, while maintaining competitive perceptual quality (SSIM). This work demonstrates that semantic-aware, agentic coordination can significantly enhance the effectiveness and robustness of adversarial attacks, informing both offensive research and potential defenses.

Abstract

Existing automated attack suites operate as static ensembles with fixed sequences, lacking strategic adaptation and semantic awareness. This paper introduces the Agentic Reasoning for Methods Orchestration and Reparameterization (ARMOR) framework to address these limitations. ARMOR orchestrates three canonical adversarial primitives, Carlini-Wagner (CW), Jacobian-based Saliency Map Attack (JSMA), and Spatially Transformed Attacks (STA) via Vision Language Models (VLM)-guided agents that collaboratively generate and synthesize perturbations through a shared ``Mixing Desk". Large Language Models (LLMs) adaptively tune and reparameterize parallel attack agents in a real-time, closed-loop system that exploits image-specific semantic vulnerabilities. On standard benchmarks, ARMOR achieves improved cross-architecture transfer and reliably fools both settings, delivering a blended output for blind targets and selecting the best attack or blended attacks for white-box targets using a confidence-and-SSIM score.
Paper Structure (11 sections, 15 equations, 1 figure, 3 tables, 1 algorithm)

This paper contains 11 sections, 15 equations, 1 figure, 3 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Proposed Methodology
  4. Phase 1: Agentic Reconnaissance & Objective Formulation
  5. Phase 2: Parallel Perturbation Generation
  6. Phase 3: Critique and Strategic Adaptation
  7. Phase 4: Adaptive Perturbation Ensemble
  8. Experimental Evaluation
  9. Setup
  10. Results
  11. Conclusions

Figures (1)

  • Figure 1: Comparison of adversarial examples generated by different methods on a representative fake image from the AADD-LQ dataset. Green and red labels indicate correct and incorrect predictions, respectively, across three detectors.