Deep neural networks (DNNs) have achieved remarkable performance across many applications, yet they are vulnerable to adversarial examples. Most existing attacks constrain the perturbation by limiting its $L_p$ norm to keep changes imperceptible. This work explores attacks at the semantic level by altering image attributes, thereby creating unrestricted adversarial examples. We introduce SemanticAdv, an algorithm that leverages disentangled semantic factors to edit controlled attributes and steer the model toward chosen adversarial targets. Extensive experiments show that semantic‑based adversarial examples can fool tasks such as face verification and landmark detection, and achieve high targeted attack success rates against real‑world black‑box services like Azure's face verification via transferability. To demonstrate generality, we also apply semantic perturbations to street‑view images, proving the approach extends beyond face recognition. Controlled semantic manipulation highlights DNNs' sensitivity to high‑level features and suggests new directions for defensive strategies.
Review