Morphogenic adversarialism: reaction-diffusion patterns reveal structural vulnerabilities in deep neural networks

Engineering notes

We evaluated TDA on seven benchmark datasets spanning natural images, facial recognition, medical imaging, and traffic sign classification using both convolutional and transformer-based neural network architectures. Despite these performance reductions, image quality remained largely preserved, with structural similarity values exceeding 0.93 and perceptual similarity scores remaining below 0.10 across all benchmarks.

Chinese explanation / 中文解读

中文解读待补充：本站会优先为端到端自动驾驶、BEV感知、3D目标检测、轨迹预测、路径规划、LiDAR感知等高价值论文补充中文说明。

Original abstract

Deep neural networks have achieved remarkable success in image recognition tasks, yet they remain vulnerable to carefully designed input perturbations that can cause incorrect predictions while producing little visible change in the original image. In this study, we introduce the Turing Deimatic Attack (TDA), a biologically inspired adversarial attack that generates structured perturbations using reaction-diffusion processes that mimic natural pattern formation. Unlike conventional approaches that rely on gradient information from the target model, TDA operates without model queries and creates coherent spatial patterns from a compact set of control parameters. We evaluated TDA on seven benchmark datasets spanning natural images, facial recognition, medical imaging, and traffic sign classification using both convolutional and transformer-based neural network architectures. The proposed method consistently reduced classification performance across all datasets while maintaining high visual similarity to the original images. Mean attack success rates reached 48.3% on Fashion-MNIST and 63.3% on Labeled Faces in the Wild, with individual models exhibiting success rates of up to 80.5%. Despite these performance reductions, image quality remained largely preserved, with structural similarity values exceeding 0.93 and perceptual similarity scores remaining below 0.10 across all benchmarks. Our experiments further reveal that model susceptibility varies with the interaction between the spatial structure of the perturbation and the features used by different architectures. Convolutional networks were generally more vulnerable on lower-resolution images, whereas transformer-based models became increasingly susceptible at higher resolutions. Ablation analyses indicate that attack effectiveness is associated primarily with the spatial organization of the generated patterns rather than with perturbation magnitude alone. These findings demonstrate that biologically inspired pattern-generation mechanisms can expose systematic weaknesses in modern vision systems and provide a practical framework for evaluating model robustness under realistic, spatially structured perturbations.

Links and sources

• PDF from original source

Comments