Concept-based adversarial generation method with maneuverable and diversified semantics

Abstract

Methods and systems for performing concept-based adversarial generation with manipulable and diverse semantics. A system includes an electronic processor configured to access an input image. The electronic processor is further configured to perform concept-based semantic image generation based on the input image. The electronic processor is further configured to perform concept-based semantic adversarial learning using a set of semantic latent spaces generated as part of performing the concept-based semantic image generation. The electronic processor is further configured to generate an adversarial image from the concept-based semantic adversarial learning. The electronic processor is further configured to test a target model using the adversarial image.

Description

Technical Field

[0001] The embodiments relate to a concept-based adversarial generative approach that leverages steerable and diverse semantics. Summary of the Invention

[0002] Efficiently generating test cases to evaluate and validate the performance of complex artificial intelligence (“AI”) models, such as image classifiers and object detectors based on deep neural networks (“DNNs”), is challenging. For example, in the medical imaging community, researchers use generative adversarial networks (“GANs”) to generate new images (such as brain MRI images) to validate trained image classification models. Since collecting diagnostic medical images is expensive, GANs offer an efficient method for generating realistic new test images. As another example, in the field of autonomous driving, testing trained AI models in diverse scenarios is crucial before deploying them on a large scale in autonomous driving systems. However, collecting diverse real-life traffic data is challenging. Therefore, methods based on three-dimensional (“3D”) simulation are used to generate test cases for autonomous driving AI models, such as, for example, DNN-based pedestrian detectors.

[0003] Recent advances in deep generative models and adversarial attacks have shown promising directions for this test case generation. Deep generative models can generate a large number of test cases that closely resemble real-world data. As an example, StyleGAN (a deep GAN model) is able to generate fake human portraits that deceptively resemble real human faces. Adversarial attack methods can efficiently probe weaknesses in machine learning models. As an example of an adversarial attack on a DNN model, injecting small, imperceptible noise into an input image (e.g., a "smiling face" image) can easily fool the DNN model into making incorrect predictions (e.g., classifying the input image as a "non-smiling face" image).

[0004] Despite recent advances in deep generative models and adversarial attacks for generating such test cases, several challenges remain in using adversarial attack methods to generate meaningful test cases for evaluating and validating DNN models. These challenges include, for example, how to leverage interpretable high-level concepts to generate meaningful test cases, how to understand and manipulate (or adapt) the concepts used for adversarial generation, and how to generate diverse test cases for broad test coverage.

[0005] Generating meaningful adversarial test cases using interpretable high-level concepts is challenging. As noted above, traditional adversarial attack methods often find small random noises that significantly alter the model's classification. These methods aim to minimize this noise so that it is imperceptible to humans. However, this results in generated adversarial examples that look identical to the original image. Therefore, the noise and the generated adversarial examples do not reflect real-world phenomena (such as lighting and background color) or have semantic meaning (such as hairstyle and wearing glasses). In other words, one cannot generalize the weaknesses of DNN models from traditional adversarial test cases to real-life scenarios.

[0006] Understanding and manipulating (or adapting) the concepts used for adversarial generation requires extraordinary effort. To comprehensively test AI models, machine learning engineers need to be able to easily interpret and control the generation of test cases. However, generative models (GANs) are considered black-box models, where making the generation process understandable or controllable by users is challenging. Therefore, it is difficult to intuitively generate test cases with desired properties.

[0007] Regarding the generation of diverse test cases, methods for generating diverse adversarial test cases are desirable for broad test coverage. To test AI models in different use cases, the generated test cases need to possess diverse properties. With current generation methods, test cases tend to have uniform characteristics, which fail to cover a wide range of real-world scenarios.

[0008] To address these and other issues, the embodiments described herein, among others, provide methods and systems for performing concept-based adversarial generation that leverages interpretable, manipulable, and diverse semantics. The embodiments described herein include components for concept-based semantic image generation, concept-based semantic adversarial test case generation, and semantic adversarial analysis. Therefore, the embodiments described herein enable concept-based adversarial generation that efficiently utilizes interpretable and manipulable semantics to generate diverse test data.

[0009] Therefore, the embodiments described herein advantageously provide: a concept-based adversarial generative framework with disentangled representation learning and generative adversarial networks; a generative framework with separate high-level concepts and low-level imperceptible features in the latent space; a black-box adversarial attack method for generating concept-based adversarial results without knowing the parameters of the target model; a manipulable attack method for generating diverse results by balancing high-level concepts and low-level imperceptible features; and visual summarization for obtaining actionable insight into the generated adversarial patterns.

[0010] For example, one embodiment provides a system for performing concept-based adversarial generation utilizing manipulated and diverse semantics. The system includes an electronic processor configured to access an input image. The electronic processor is also configured to: perform concept-based semantic image generation based on the input image. The electronic processor is further configured to: perform concept-based semantic adversarial learning using a set of semantic latent spaces generated as part of performing concept-based semantic image generation. The electronic processor is further configured to: generate adversarial images based on the concept-based semantic adversarial learning. The electronic processor is further configured to: test a target model using the adversarial images.

[0011] Another embodiment provides a method for performing concept-based adversarial generation utilizing manipulated and diverse semantics. The method includes: accessing an input image. The method further includes: utilizing an electronic processor to perform concept-based semantic image generation based on the input image. The method further includes: utilizing an electronic processor to perform concept-based semantic adversarial learning using a set of semantic latent spaces generated as part of performing concept-based semantic image generation. The method further includes: utilizing an electronic processor to generate adversarial images based on the concept-based semantic adversarial learning. The method further includes: utilizing an electronic processor to test a target model using the adversarial images. The method further includes: utilizing an electronic processor to generate a performance profile of the target model for display.

[0012] Another embodiment provides a non-transitory computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions. The set of functions includes: accessing an input image. The set of functions further includes: performing concept-based semantic image generation based on the input image. The set of functions further includes: performing concept-based semantic adversarial learning using a set of semantic latent spaces generated as part of performing concept-based semantic image generation. The set of functions further includes: generating adversarial images based on the concept-based semantic adversarial learning. The set of functions further includes: testing a target model using the adversarial images. The set of functions further includes: generating a performance summary of the target model for display.

[0013] Other aspects and embodiments will become apparent upon consideration of the detailed description and accompanying drawings. Attached Figure Description

[0014] Figure 1 The diagram schematically illustrates a system for performing concept-based adversarial generation that leverages manipulated and diverse semantics, according to some embodiments.

[0015] Figure 2 The illustration schematically depicts, according to some embodiments, items included in Figure 1 The server in the system.

[0016] Figures 3A-3B The example input image is shown in the illustration.

[0017] Figure 4 This is a flowchart illustrating a method for performing concept-based adversarial generation utilizing manipulated and diverse semantics, according to some embodiments. Figure 1 The system executes this.

[0018] Figure 5 The illustration shows a visualization of the semantic latent space of a trained variational autoencoder, comprising both continuous and discrete latent dimensions, according to some embodiments.

[0019] Figure 6 The illustration shows semantic adversarial learning using black-box queries according to some embodiments. Detailed Implementation

[0020] Before explaining any embodiment in detail, it is to be understood that the embodiments are not limited in their application to the details of the construction and arrangement of the components set forth in the following description or illustrated in the following figures. Other embodiments are possible, and the embodiments described and / or illustrated herein can be practiced or performed in various ways.

[0021] It should also be noted that the embodiments described herein can be implemented using multiple hardware and software-based devices and multiple different structural components. Furthermore, embodiments may include hardware, software, and electronic components or modules, which, for the purposes of discussion, may be illustrated and described as if most components were implemented solely in hardware. However, those skilled in the art will recognize from this detailed description that, in at least one embodiment, the electronic aspects of the embodiments described herein may be implemented in software (e.g., software stored on a non-transitory computer-readable medium) that may be executed by one or more electronic processors. Thus, it should be noted that various embodiments can be implemented using multiple hardware and software-based devices and multiple different structural components. It should also be understood that although some figures illustrate hardware and software residing within a particular device, these depictions are for illustrative purposes only. In some embodiments, the illustrated components may be combined or divided into separate software, firmware, and / or hardware. For example, logic and processing may be distributed across multiple electronic processors, rather than residing in and being executed by a single electronic processor. Regardless of how they are combined or divided, hardware and software components can reside on the same computing device or be distributed across different computing devices connected by one or more networks or other suitable communication links.

[0022] Figure 1 A system 100 for performing concept-based adversarial generation is illustrated according to some embodiments. In the illustrated example, system 100 includes user equipment 105 and server 110. In some embodiments, system 100 includes a comparison Figure 1 The components illustrated may be fewer, additional, or different. For example, system 100 may include multiple user devices 105, multiple servers 110, or combinations thereof.

[0023] User equipment 105 and server 110 communicate via one or more wired or wireless communication networks 115. Part of the communication network 115 may use a wide area network such as the Internet, or a network such as Bluetooth. TM This can be implemented using a network or a local area network such as Wi-Fi, or combinations thereof or derivatives thereof. Alternatively or additionally, in some embodiments, the components of system 100 communicate directly with each other, rather than through communication network 115. Furthermore, in some embodiments, the components of system 100 communicate via... Figure 1 Communicates with one or more intermediate devices not shown in the diagram.

[0024] Server 110 includes computing devices such as servers and databases. For example... Figure 2As illustrated, server 110 includes an electronic processor 200, a memory 205, and a communication interface 210. The electronic processor 200, memory 205, and communication interface 210 communicate wirelessly via one or more communication lines or buses, or a combination thereof. In various configurations, server 110 may include, in addition to... Figure 2 Additional components beyond those illustrated herein. For example, server 110 may also include one or more human-machine interfaces, such as a keyboard, keypad, mouse, joystick, touchscreen, display device, printer, speaker, etc., which receive input from the user, provide output to the user, or combinations thereof. Server 110 may also perform additional functions beyond those described herein. Moreover, the functions described herein as being performed by server 110 may be distributed across multiple servers or devices (e.g., as part of a cloud service or cloud computing environment).

[0025] Communication interface 210 may include a transceiver that communicates with user equipment 105 via communication network 115 and optionally via one or more other communication networks or connections. Electronic processor 200 includes a microprocessor, application-specific integrated circuit (“ASIC”), or another suitable electronic device for processing data, and memory 205 includes a non-transitory computer-readable storage medium. Electronic processor 200 is configured to access and execute computer-readable instructions (“software”) stored in memory 205. Software may include firmware, one or more applications, program data, filters, rules, one or more program modules, and other executable instructions. For example, software may include instructions and associated data for performing a set of functions including the methods described herein.

[0026] For example, such as Figure 2As illustrated, memory 205 can store learning engine 220 and model database 225. In some embodiments, learning engine 220 uses one or more machine learning functions to develop one or more deep learning models. Machine learning functions are generally functions that allow computer applications to learn without being explicitly programmed. In particular, learning engine 220 is configured to develop algorithms or models based on training data. For example, to perform supervised learning, training data includes example inputs and corresponding expected (e.g., actual) outputs, and the learning engine progressively develops a model (e.g., a deep learning model, such as an object detection model, a semantic segmentation model, etc.) that maps inputs to outputs included in the training data. Machine learning performed by learning engine 220 can be performed using various types of methods and mechanisms, including but not limited to decision tree learning, association rule learning, artificial neural networks, inductive logic programming, support vector machines, clustering, Bayesian networks, reinforcement learning, representation learning, similarity and metric learning, sparse dictionary learning, and genetic algorithms. These methods allow learning engine 220 to ingest, parse, and understand data, and progressively refine models for data analysis.

[0027] The models generated by the learning engine 220 are stored in the model database 225. The models stored in the model database 225 may include, for example, image classification models, object detection models, and DNN-based person detection models. Figure 2 As illustrated, the model database 225 is included in the memory 205 of the server 110. However, in some embodiments, the model database 225 is included in a separate device (either included in the server 110 or outside the server 110) that can be accessed by the server 110.

[0028] Additionally, such as Figure 2 As illustrated, memory 205 includes adversarial generation application 230. Adversarial generation application 230 is a software application executable by electronic processor 200. As described in more detail below, electronic processor 200 executes adversarial generation application 230 to perform concept-based adversarial generation, which efficiently utilizes interpretable and manipulable semantics to generate diverse test data. For example, as described in more detail below, in some embodiments, adversarial generation application 230 performs concept-based semantic image generation and performs concept-based semantic adversarial learning to generate one or more adversarial examples or images. Adversarial generation application 230 can use one or more adversarial examples or images to perform model testing and semantic adversarial analysis.

[0029] The memory 205 also includes a collection or set of input images 240. Figure 3A and3B The example input image 240 is illustrated. As an example, Figure 3A The illustration depicts a driving scenario, using example input image 240. (As shown in...) Figure 3A As seen in the image, the driving scene includes multiple bounding boxes 305, each associated with a corresponding object 310. In some embodiments, a deep learning model (e.g., a model stored in model database 225) identifies or identifies objects 310 in the driving scene and locates or generates bounding boxes 305 around the objects 310. As yet another example, Figure 3B The illustration shows a human portrait as an example input image 240. Although Figure 2 The illustration shows one or more input images 240 included in the memory 205 of server 110, but in some embodiments, the input images 240 are included in a separate device (included in server 110 or outside server 110) that can be accessed by server 110.

[0030] User device 105 also includes computing devices such as desktop computers, laptop computers, tablet computers, terminals, smartphones, smart TVs, smart wearable devices, or another suitable computing device for user interaction. The end user can use user device 105 to interact with adversarial generation application 230. In some embodiments, the end user can interact with adversarial generation application 230 to perform functional tests that examine the performance (e.g., robustness and potential vulnerabilities) of a deep learning model (e.g., a target deep learning model), as described in more detail below. Alternatively or additionally, the end user can use user device 105 to interact with functional test results, such as a performance summary of functional test (or adversarial attack) results provided by adversarial generation application 230, as described in more detail below. For example, in some embodiments, adversarial generation application 230 generates or provides visual analysis tools accessible to the end user for performing model testing and semantic adversarial analysis.

[0031] Despite Figure 1Not illustrated, but user equipment 105 may include components similar to server 110, such as an electronic processor (e.g., a microprocessor, ASIC, or another suitable electronic device), memory (e.g., a non-transitory computer-readable storage medium), a communication interface (e.g., a transceiver) for communication via communication network 115 and optionally via one or more additional communication networks or connections, and one or more human-machine interfaces. For example, to communicate with server 110, user equipment 105 may store browser applications or dedicated software applications executable by the electronic processor. System 100 is described herein as providing functional testing services via server 110. However, in other embodiments, functions described herein as being performed by server 110 may be performed locally by user equipment 115. For example, in some embodiments, user equipment 105 may store adversarial generation application 230.

[0032] Figure 4 This is a flowchart illustrating a method 400 for performing concept-based adversarial generation according to some embodiments, the method 400 being performed by system 100. Method 400 is described as being performed by server 110, and specifically by an adversarial generation application 230 executed by electronic processor 200. However, as noted above, the functionality described with respect to method 400 can be performed by other devices (such as user device 105) or distributed across multiple devices (such as multiple servers included in a cloud service).

[0033] like Figure 4 As illustrated, method 400 includes accessing input image 240 (at box 405). In some embodiments, electronic processor 200 accesses one or more input images 240 from memory 205. Alternatively or additionally, electronic processor 200 may access one or more input images 240 from a separate device accessible by server 110 (which is included in or outside server 110, such as a separate database).

[0034] After accessing input image 240 (at box 405), electronic processor 200 performs concept-based semantic image generation based on input image 240 (at box 410). In some embodiments, electronic processor 200 uses disentangled representation learning and generative adversarial learning to perform concept-based semantic image generation. Thus, in some embodiments, electronic processor 200 trains the semantic image generator using a method that combines disentangled representation learning (such as, for example, variational autoencoders, β(beta)-variable autoencoders, etc.) and generative adversarial learning (such as, for example, GANs). The learned disentangled latent space (e.g., the trained semantic image generator) encodes both continuous and categorical features or dimensions. End users can use the learned disentangled latent space to encode high-level concepts and generate high-fidelity forged images in a semantic manner. Therefore, in some embodiments, the electronic processor 200 performs concept-based semantic image generation by training an image generator with disentangled continuous and discrete representations and training a generative adversarial network based on the semantic latent space disentangled by the image generator.

[0035] Electronic processor 200 can train an image generator with disentangled continuous and discrete representations (i.e., with interpretable latent representations). In some embodiments, electronic processor 200 trains the image generator as a variational autoencoder (e.g., a disentangled representation model). In some embodiments, electronic processor 200 trains the image generator by learning a disentangled latent space with both continuous and discrete encodings (e.g., of the input image 240) and aligning that latent space with semantic features (e.g., as an encoder). The image generator can then generate one or more new images from that semantic latent space (e.g., as a decoder). Therefore, when adversarial examples or images are generated (as described in more detail below), the semantics of the generated adversarial images can be easily controlled and understood. Thus, in some embodiments, electronic processor 200 trains the image generator by training an encoder to learn a disentangled latent space with continuous and discrete encodings (e.g., of the input image) and aligning the disentangled latent space with semantic features as a semantic latent space, and training a decoder to generate new images from that semantic latent space.

[0036] As an example, Figure 5 The illustration shows a visualization of the semantic latent space of a trained variational autoencoder, which includes both continuous and discrete latent dimensions (in the context of human facial attribute classification). For example, in... Figure 5As seen in the diagram, continuous latent dimensions can be trained to represent azimuth (i.e., facial orientation), and discrete latent dimensions (or binary category dimensions) can be trained to represent glasses (e.g., 1 if the person wears glasses, and 0 if the person does not). Figure 5 In the example illustrated, continuous latent dimensions can include, for example, skin color, hair color, background color, azimuth angle, hair length, and background brightness. Discrete latent dimensions can include, for example, gender, the presence of glasses, the presence of a smile, eyebrow characteristics, and weight characteristics. Having a semantic latent space allows end users to easily control adversarial image generation using high-level concepts. As an example, an end user can easily generate images of smiling human faces (e.g., adversarial images) without needing to rotate glasses 30 degrees to the left.

[0037] After training an image generator (e.g., a variational autoencoder) and disentangling the semantic latent space, the electronic processor 200 trains a GAN (e.g., a GAN model) using random inputs and vectors sampled from that semantic latent space (e.g., the disentangled semantic latent space). Compared to a variational autoencoder, a GAN model can generate more realistic and high-fidelity images (e.g., GAN-generated images). Unlike traditional GAN ​​models, in some embodiments, the GAN model trained by the electronic processor 200 allows the user to control the semantics of the GAN-generated images using latent space vectors with both continuous and discrete dimensions. Therefore, method 400 (executed by the electronic processor 200) supports both continuous latent space and categorical (or discrete) latent space. Regarding Figure 5 Images generated by GAN models (where a semantic latent space dimension is traversed in each row) look similar to real-world images, and semantic properties (e.g., background color, hair length) can be controlled.

[0038] return Figure 4 The electronic processor 200 then uses a set of semantic latent spaces generated as part of performing concept-based semantic image generation to perform concept-based semantic adversarial learning (at box 415). Therefore, in some embodiments, the electronic processor 200 identifies one or more semantic latent space samples that can be used to generate one or more adversarial images. Adversarial images may include, for example, new forged test images that deceive or cause the target model (such as a facial attribute classifier) ​​to fail.

[0039] In some embodiments, the electronic processor 200 implements a black-box adversarial learning method (e.g., a method that works on various target classifiers without needing to know the internal workings of the target model). In some embodiments, the electronic processor 200 searches for small noise in the image space to identify one or more semantic latent space samples that can be used to generate adversarial images. Alternatively or additionally, the electronic processor 200 may search in a semantic latent space having both continuous and class dimensions.

[0040] Figure 6 The illustration depicts semantic adversarial learning utilizing black-box queries according to some embodiments. For example... Figure 6 As shown, for a specific input image, the electronic processor 200 attempts to generate an adversarial image, where a target facial attribute classifier (e.g., a target model) will give different predictions. The adversarial image is expected to look similar to the input image but have semantic differences. (As shown in...) Figure 6 As seen in the image, the electronic processor 200 utilizes an image generator (in... Figure 6 The input image (illustrated as the "VAE encoder") is encoded into a semantic latent space. Then, the electronic processor 200 adds small random noise to the latent mean vector and uses the perturbed latent vector to generate new test images (e.g., adversarial images) using a GAN. Next, by feeding a small set of test images into a target classifier (e.g., a target model), the electronic processor 200 can approximate the gradient of the target classifier's loss function based on the semantic latent space distribution. Figure 6 (Illustrated as "gradient estimation"). Using the projective gradient descent ("PGD") adversarial attack method, the electronic processor 200 can efficiently find latent vectors that lead to small semantic modifications of the adversarial example or image. In some embodiments, the electronic processor 200 continues this process until at least an adversarial image has been generated, a limited query budget has been reached, etc.

[0041] Therefore, as in Figure 4As seen in the example provided, the electronic processor generates adversarial images based on concept-based semantic adversarial learning (at box 420), and using these adversarial images, the electronic processor 200 can then test the target model (at box 425). Therefore, after performing concept-based semantic image generation (at box 410) and concept-based semantic adversarial learning (at box 415), the electronic processor 200 can efficiently generate one or more realistic and semantically meaningful adversarial examples or images. The electronic processor 200 can use the adversarial images to test the target model (e.g., a model included in model database 225) to, for example, discover edge cases, identify model vulnerabilities, etc. Alternatively or additionally, the electronic processor 200 can semantically analyze and summarize the robustness of the target model using, for example, interactive visual analysis tools (e.g., provided by or as part of the adversarial generation application 230).

[0042] In some embodiments, the electronic processor 200 generates a performance profile of the target model for display (at box 430). The performance profile may be based on testing of the target model. For example, the performance profile may include information related to discovered edge cases, model vulnerabilities, robustness of the target model, etc. In some embodiments, the electronic processor 200 generates the performance profile via, for example, a visual analytics tool accessible by the user device 105 and transmits it to the user device 105 for display. Thus, the end user can interact with the performance profile (e.g., via a visual analytics tool accessible by the user device 105) to interactively compare different representations (e.g., in the latent space of a variational autoencoder, the feature space of a classifier, etc.) to gain actionable insights into, for example, the robustness of the target model.

[0043] Therefore, the embodiments described herein provide an interpretable and manipulable framework for generating novel, realistic, and diverse test images (e.g., adversarial examples or images) in which a trained AI model (e.g., the target model) fails to correctly predict, for example, attributes. Specifically, the embodiments described herein leverage a combination of disentangled representation learning methods (such as variational autoencoders) and GANs to learn a semantic adversarial generator. The embodiments described herein use adversarial attack methods (e.g., black-box adversarial attack methods) to generate new test images (e.g., adversarial examples or images) in which the target model performs poorly. The embodiments described herein then summarize and analyze the adversarial examples and test results (e.g., using visual analysis tools).

[0044] Therefore, these embodiments provide, among others, methods and systems for performing concept-based adversarial generation that efficiently utilize interpretable and manipulable semantics to generate diverse test data. Various features and advantages of certain embodiments are set forth in the following claims.

Claims

1. A system for performing concept-based adversarial generation utilizing manipulated and diverse semantics, the system comprising an electronic processor configured to: Access the input image, Concept-based semantic image generation is performed based on the input image in the following manner: An image generator is trained to learn a disentangled semantic latent space with continuous and discrete encodings, the semantic latent space being aligned with the semantic features of the input image. Generative adversarial networks are trained based on the semantic latent space de-entangled by the image generator. Concept-based semantic adversarial learning is performed using a set of semantic latent spaces generated as part of the concept-based semantic image generation process. Generate adversarial images based on concept-based semantic adversarial learning, and The adversarial images are used to test the target model, wherein the adversarial images include fake test images used to deceive the target model or cause the target model to fail.

2. The system of claim 1, wherein the electronic processor is configured to perform concept-based semantic image generation using disentangled representation learning and generative adversarial learning.

3. The system according to claim 1, wherein the image generator is a variational autoencoder.

4. The system of claim 1, wherein training the image generator comprises: Train the encoder, which is configured to: Learning disentangled latent spaces with continuous and discrete encodings, and Aligning the latent space of the unentangled structure with the semantic features is used as the semantic latent space.

5. The system of claim 1, wherein training the image generator further comprises: A decoder is trained and configured to generate new images from the semantic latent space.

6. The system of claim 1, wherein the electronic processor is configured to train the generative adversarial network using random inputs and vectors sampled from the semantic latent space.

7. The system of claim 1, wherein concept-based semantic adversarial learning is performed as a black-box adversarial learning method.

8. The system of claim 1, wherein the electronic processor is configured to perform concept-based semantic adversarial learning in such a way as: Analyze the aforementioned set of semantic latent spaces, and Identify at least one semantic latent space. The adversarial image is generated based on the at least one semantic latent space.

9. The system of claim 8, wherein the adversarial image has at least one semantic feature that is different from the input image.

10. The system of claim 1, wherein the adversarial image causes the target model to fail.

11. The system of claim 10, wherein the target model is an attribute classifier.

12. The system of claim 1, wherein the electronic processor is further configured to generate a performance profile of the target model for display.

13. A method for performing concept-based adversarial generation utilizing manipulated and diverse semantics, the method comprising: Access the input image; Using an electronic processor, concept-based semantic image generation is performed based on the input image in the following manner: An image generator is trained to learn a disentangled semantic latent space with continuous and discrete encodings, the semantic latent space being aligned with the semantic features of the input image. Generative adversarial networks are trained based on the semantic latent space de-entangled by the image generator. The electronic processor is used to perform concept-based semantic adversarial learning using a set of semantic latent spaces generated as part of the execution of concept-based semantic image generation; The electronic processor is used to generate adversarial images based on concept-based semantic adversarial learning. The electronic processor is used to test the target model using the adversarial image, wherein the adversarial image includes a fake test image used to deceive the target model or cause the target model to fail. as well as The electronic processor is used to generate a performance profile of the target model for display.

14. The method of claim 13, wherein performing concept-based semantic image generation comprises: Concept-based semantic image generation is performed using unentangled representation learning and generative adversarial learning.

15. The method of claim 13, wherein training the image generator comprises: Train the encoder, which is configured to: Learning disentangled latent spaces with continuous and discrete encodings, and Aligning the latent space of unentanglement with semantic features to form the semantic latent space; as well as A decoder is trained and configured to generate new images from the semantic latent space.

16. The method of claim 13, wherein performing concept-based semantic adversarial learning comprises: Analyze the aforementioned set of semantic latent spaces, and Identify at least one semantic latent space. The adversarial image is generated based on the at least one semantic latent space.

17. A non-transitory computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions, the set of functions comprising: Access the input image; Concept-based semantic image generation is performed based on the input image in the following manner: An image generator is trained to learn a disentangled semantic latent space with continuous and discrete encodings, the semantic latent space being aligned with the semantic features of the input image. Generative adversarial networks are trained based on the semantic latent space de-entangled by the image generator. Concept-based semantic adversarial learning is performed using a set of semantic latent spaces generated as part of the execution of concept-based semantic image generation; Generate adversarial images based on concept-based semantic adversarial learning; The adversarial images are used to test a target model, wherein the adversarial images include forged test images used to deceive the target model or cause the target model to fail; and Generate a performance summary of the target model for display.

Images