Improving Visual Quality of Unrestricted Adversarial Examples with Wavelet-VAE

Unrestricted adversarial attacks pose a new safety threat: Traditional adversarial examples work by adding small, mathematically-bounded noise to images. This paper highlights that "unrestricted adversarial attacks" without such constraints represent an emerging concern for AI safety that requires attention.

New attacks can be imperceptible to humans while remaining effective: The wavelet-VAE method generates adversarial examples by modifying the underlying structure of images rather than adding visible noise. The authors demonstrate these modifications fool AI systems while remaining "imperceptible to human eyes," making them harder to detect than traditional perturbation-based attacks.

High-quality adversarial examples can be generated at scale: The method successfully generates adversarial examples on ImageNet (a large-scale image dataset with over 1 million images), suggesting this attack approach is practical and scalable across diverse real-world image types.

Current defenses may need to evolve: Since these unrestricted attacks operate differently from traditional perturbation-based methods—modifying latent representations rather than pixel values—existing defense mechanisms designed for conventional adversarial examples may be insufficient, highlighting a gap in current AI robustness strategies.