Low-visibility adversarial sample generation method based on human visual perception

Abstract With deep learning now widely applied in visual perception tasks, the question of how to enhance adversarial stealth and effectiveness while addressing the sensitivity of the human visual system has become urgent. In response to the limitations of traditional $${L_p}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>L</mml:mi> <mml:mi>p</mml:mi> </mml:msub> </mml:math> norm based adversarial perturbations, which are easily noticed by the human eye in terms of brightness and color distribution, this paper introduces a low-visibility adversarial sample generation method Luminance Perception Constrained Adversarial Attack (LPCAA) that integrates brightness-aware constraints. First, it leverages the human eye’s varying sensitivity to different light wavelengths, prioritizes perturbations in the blue channel, and uses a dynamic brightness-weight function to suppress sudden changes in overall image brightness. Next, through an energy functional framework, it incorporates gradient regularization, sparsity constraints, and the $${L_2}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>L</mml:mi> <mml:mn>2</mml:mn> </mml:msub> </mml:math> norm to guarantee smoothness and sparsity in both the spatial distribution and amplitude of the perturbations. To adaptively search for the optimal perturbation distribution across various images and models, we propose a dynamic tuning mechanism that uses finite-difference or gradient feedback to iteratively adjust perturbation strength and constraint weighting, thereby balancing attack success rates with perceptibility. Our experiments, conducted on CIFAR-10, ILSVRC2012, and other datasets, systematically evaluated multiple mainstream networks such as ResNet, VGG, MobileNet, and various defense algorithms. The findings indicate that LPCAA achieves higher attack success rates than FGSM, PGD, ColorFool, and PerC-C&amp;W in both white-box and black-box settings, while also demonstrating notably lower perceptibility in terms of structural similarity index measure, perturbation ratio, and CIELCh color differences. Even with high-resolution images or defenses like compression and diffusion-based denoising, LPCAA leverages brightness awareness and the energy functional to maintain stable attack efficacy with minimal visual distortion. This approach not only offers a new balance between stealth and efficacy in adversarial attacks, but also poses fresh challenges for security evaluation and robust defense strategies in deep models.