{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/structure-preserving-transformation","title":"Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples","arxiv_id":"1809.02786","date":"2018-09-08","proceeding":null,"authors":["Dan Peng","Zizhan Zheng","Xiaofeng Zhang"],"abstract":"Adversarial examples are perturbed inputs designed to fool machine learning\nmodels. Most recent works on adversarial examples for image classification\nfocus on directly modifying pixels with minor perturbations. A common\nrequirement in all these works is that the malicious perturbations should be\nsmall enough (measured by an L_p norm for some p) so that they are\nimperceptible to humans. However, small perturbations can be unnecessarily\nrestrictive and limit the diversity of adversarial examples generated. Further,\nan L_p norm based distance metric ignores important structure patterns hidden\nin images that are important to human perception. Consequently, even the minor\nperturbation introduced in recent works often makes the adversarial examples\nless natural to humans. More importantly, they often do not transfer well and\nare therefore less effective when attacking black-box models especially for\nthose protected by a defense mechanism. In this paper, we propose a\nstructure-preserving transformation (SPT) for generating natural and diverse\nadversarial examples with extremely high transferability. The key idea of our\napproach is to allow perceptible deviation in adversarial examples while\nkeeping structure patterns that are central to a human classifier. Empirical\nresults on the MNIST and the fashion-MNIST datasets show that adversarial\nexamples generated by our approach can easily bypass strong adversarial\ntraining. Further, they transfer well to other target models with no loss or\nlittle loss of successful attack rate.","url_abs":"http://arxiv.org/abs/1809.02786v3","url_pdf":"http://arxiv.org/pdf/1809.02786v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"structure-preserving-transformation","repo_url":"https://github.com/lepangdan/Structure-Preserving-Transformation","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":null}],"tasks":[{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}