Let the Carrier Carry the Attack: Preserving the Subject in Adversarial Image Generation

A visually secondary carrier can serve as an auxiliary spatial pathway to facilitate strong and transferable adversarial attacks while preserving the integrity of the primary subject. This research introduces a carrier—a secondary visual element constructed separately from the main subject—to allow for unrestricted, targeted attacks under global classifier guidance without compromising human recognition of the original content.

Key Findings

1. A carrier mitigates subject distortion by absorbing a larger share of globally normalized attack updates when compared to a No-Carrier baseline.

2. A carrier improves cross-model transferability, where stronger target-related carrier characteristics yielding progressively larger gains in transferability.

3. Successful targeted attacks retain the personalized subject as the primary content perceived by humans while successfully misleading the classifier, as evidenced by human evaluation confirming that the personalized subject remains the primary image content.

Methodology and Attack Realizations

The framework is built upon a concept-based attack setting where a visually secondary object is constructed outside of the primary subject. The construction methods explored include:

(1) Composite Reconstruction Attack (CRA):

(2) Clean Inpainting Reconstruction Attack (CIRA):

(3) Joint Inpainting Attack (JIA):

The attack process involves three main stages: personalized source preparation, carrier construction, and adversarial realization. Source preparation utilizes a subject-specific LoRA to expand limited reference images into source candidates varying in pose, layout, and background. The carrier is constructed using FLUX via two mechanisms:

(1) Direct compositing:

(2) Mask-guided inpainting:

The attack stage employs global classifier guidance and finite-return techniques. The specific realizations are defined as follows:

(1) CRA:

xadv = R(xcomp clean, ct; hcomp), where R denotes the partial-inversion and finite-return operator.

(2) CIRA:

xadv = R(xinp clean, ct; hinp), where xinp clean is generated via a complete 50-step clean conditional inpainting before applying the inversion and return.

(3) JIA:

JIA directly injects global classifier guidance into the inpainting trajectory, using a velocity update: v JIA k = v k + 1[k ∈ A]λ NormRMS(g k).

Theoretical Analysis

The theoretical analysis formalizes two key effects of the carrier. First, under global RMS normalization, the carrier gradient component changes the allocation of the applied attack update across spatial regions. The decomposition shows that for a Carrier image, "the carrier contributes a target-sensitive component to the classifier gradient:∥gC,t∥2 > 0." This leads to a reduction in the normalized update applied to the primary-subject region under matched comparison. Second, when increasing target-related carrier characteristics yields a larger ideal target margin (Assumption 2), it yields a higher conditional lower bound on targeted transferability, formalized by Theorem 2: Td ≥ Ld.

Experimental Evaluation

The experiments utilize 600 source–target pairs across 30 ImageNet-1K target classes. Evaluation metrics include WhiteBox Top-1 and Top-5 attack success, BlackBox cross-model transferability (averaged over five models), and human evaluation.

(1) Subject Preservation:

Measured by DINOv3 cosine similarity on fixed subject crops and SAM3 IoU on re-segmented masks. Results show that CRA and CIRA retain DINO similarities of 0.9799–0.9857 under strong attacks, compared with 0.7928 for the No-Carrier baseline, demonstrating improved preservation under the same guidance setting and attack success.

(2) Target Transferability:

The transferability bound Ld is non-decreasing with respect to the positive ideal target margin γ∗d, confirming that progressively stronger target-related carrier conditions produce a monotonically nondecreasing guaranteed lower bound on targeted Top-1 transferability.

Qualitative Analysis

Qualitative analysis using Grad-CAM and whitening intervention confirms the mechanism.

(1) Gradient Allocation:

Regional gradient decomposition shows that for the No-Carrier gradient g NC t = gS t + gR t, "ρC S t < ρNC S t," meaning the carrier introduces an additional class-related share, reducing the relative shares assigned to the primary subject.

Based on the scientific paper LET THE CARRIER CARRY THE ATTACK: PRESERVING THE SUBJECT IN ADVERSARIAL IMAGE GENERATION, here are specific, actionable improvements for AI systems, categorized by the capabilities they would gain.

) 1. Enhanced Robust Adversarial Training (Defensive Mechanism)

The core finding that a visually secondary carrier can reduce the normalized update applied to the primary subject under global RMS normalization suggests a mechanism for mitigating distortion.

• Specific Improvement: Implement an adversarial training framework that explicitly models and accounts for regional gradient allocation (as analyzed in Section E). The system should be trained not just on global loss, but with a regularization term that penalizes large updates in regions classified as the primary subject when the classifier gradient is globally normalized.

• Improved AI System Capability: This would create a more robust generative model (like FLUX) that is inherently resistant to strong, unrestricted adversarial attacks. The system learns to allocate attack perturbations intelligently across multiple spatial regions (subject and carrier), ensuring that even under high guidance strength, the core semantic features of the subject remain stable.

) 2. Subject-Preserving Targeted Attack Generation

The paper demonstrates that by using a Target Carrier, an unrestricted attack can be strong and transferable while retaining the subject as the primary content perceived by humans.

• Specific Improvement: Integrate a conditional carrier construction module into generative attack pipelines (CRA, CIRA, JIA). This module should dynamically select or construct a carrier based on predefined semantic relationships with the target class to maximize transferability (as per Section F).

• Improved AI System Capability: The system can generate highly effective adversarial examples that successfully mislead a classifier toward a specific target class (strong attack) while ensuring that human perception remains focused on the intended personalized subject. This is crucial for applications where manipulation must be subtle or targeted, such as counter-forensics or sophisticated content filtering.

--- 3. Transferability Optimization via Carrier Characteristics

The analysis shows that the strength of target-related carrier characteristics directly correlates with a higher guaranteed lower bound on cross-model transferability (Theorem 2).

• Specific Improvement: Develop an automated heuristic or reinforcement learning agent that optimizes the visual features of the carrier during attack generation to maximize its target-related characteristic score, as defined by the mapping heuristic in Section A.2.

• Improved AI System Capability: The system can generate adversarial examples that are more likely to transfer successfully across different downstream classifiers (cross-model transferability). This is vital for deploying models where the attack must succeed against a wide variety of unseen target classifiers without retraining for each one.

--- 4. Semantic Evidence Verification and Attack Failure Prediction

The ablation study (Section J) shows that removing the visible carrier region can cause a significant drop in target logit, indicating that the carrier provides critical predictive evidence.

• Specific Improvement: Implement an auxiliary Carrier Presence Detector within the attack pipeline. This detector should predict whether a specific visual region is currently contributing to the classifier's prediction for the target class.

• Improved AI System Capability: The system can perform real-time analysis of its own attack progress, allowing it to dynamically adjust its adversarial strategy (e.g., by prioritizing changes in the carrier region if it is deemed highly predictive) or predict when an attack is likely to fail based on the loss of this crucial evidence.

--- 5. Subject Integrity Monitoring

The high human evaluation scores (99.96% subject selection rate) and DINOv3 similarity metrics suggest strong subject preservation, even under strong attacks. However, the paper notes that high attack success doesn't always imply preservation (e.g., NatADiff).

• Specific Improvement: Establish a continuous monitoring system that calculates DINOv3 similarity and SAM3 IoU between the clean and attacked images post-generation. If these metrics drop below a dynamically set threshold, the system should flag the output as potentially compromised, even if the attack technically achieved its target class prediction.

• Improved AI System Capability: This provides an essential safety layer for generative AI systems. It ensures that high performance on a classification task does not come at the cost of destroying or severely altering the identity of a personalized subject, preventing identity drift in generated content.

Strong unrestricted adversarial attacks can distort the primary object of an image, hereafter referred to as the subject. To preserve subject integrity without compromising attack magnitude, we introduce the carrier: a secondary visual element that provides an auxiliary region to facilitate the attack under global classifier guidance. We demonstrate three key findings: 1. A carrier mitigates subject distortion by absorbing a larger share of globally normalized attack updates. 2. A carrier improves cross-model transferability, governed by the strength of target-related features that balance semantic separation and transfer performance. 3. Successful targeted attacks retain the personalized subject as the primary content perceived by humans while successfully misleading the classifier. Our results demonstrate that a visually secondary carrier offers an auxiliary spatial pathway for adversarial changes, enabling strong and transferable attacks while improving subject preservation.