Adversarial Pseudo-Hazing Module

• The paper demonstrates the integration of constrained atmospheric scattering and adversarial optimizations to synthesize realistic haze that disrupts model predictions.
• AdvHaze employs both homogeneous and inhomogeneous perturbations with smoothness constraints to enhance realism and benchmark robustness on datasets like ImageNet.
• The module extends to language via dual-layer ciphering and lexical obfuscation, proving effective as a model-agnostic attack vector across domains.

An adversarial pseudo-hazing module is a computational approach or learned mapping that synthesizes realistic haze or analogous semantic obfuscations with the explicit aim of fooling neural network-based models. These modules combine physical or learned haze-generation with adversarial signal injection, serving both as robustness evaluations for vision models and as a model-agnostic attack vector in diverse adversarial contexts. Contemporary instantiations include both physically grounded image attacks that parameterize atmospheric scattering, and generalized pseudo-hazing in latent or lexical spaces as exemplified by cipher-based obfuscation of LLM prompts.

1. Physical and Statistical Foundations of Adversarial Pseudo-Hazing

Adversarial pseudo-hazing in the image domain begins with the Koschmieder atmospheric scattering model, formalized as

$$H(\mathbf{x}) = J(\mathbf{x}) t(\mathbf{x}) + A(\mathbf{x})(1 - t(\mathbf{x})),$$

where $J$ is the clean scene radiance, $A$ is atmospheric light (airlight), $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$ is transmittance dependent on per-pixel depth $d(\mathbf{x})$ and scattering coefficient $\beta$, and $H$ is the observed hazy image. Homogeneous cases simplify $A$ and $\beta$ to spatial constants; inhomogeneous approaches allow spatial variation to simulate realistic haze patterns. Perturbing $A$ and $J$0 in a constrained manner yields adversarial haze that preserves photometric plausibility while introducing model-disruptive signals (Gao et al., 2021).

2. Algorithmic Structures and Optimization Procedures

In AdvHaze, the generation of adversarial haze is formalized as a constrained optimization problem over haze parameters:

• Homogeneous Adversarial Haze ("HAdvHaze") holds $J$1 and $J$2 constant, optimizing

$J$3

where $J$4 is the classifier, $J$5 the standard cross-entropy loss.

• Inhomogeneous Adversarial Haze ("IAdvHaze") optimizes $J$6, $J$7 at the pixel level, then smooths via convolution with low-pass kernels $J$8, enforcing

$J$9

under $A$0 bounds on deviations from nominal $A$1.

Stochastic sign gradient descent with momentum (MI-FGSM), typically over 10 iterations, is employed. Smoothness constraints via Gaussian filtering on haze parameters are essential, as direct pixel-wise perturbation produces implausible, grainy haze (Gao et al., 2021).

In learned pseudo-hazing for unpaired dehazing, as in Dehaze-GLCGAN, a generator $A$2 is adversarially trained to produce synthetic haze from clean images, leveraging both global and local (patchwise) discriminators. Adversarial (least-squares GAN) losses, cycle-consistency, color statistics, and perceptual losses extracted from VGG-16 features coordinate to induce spatially and chromatically plausible haze (Anvari et al., 2020).

3. LLM Pseudo-Hazing: Ciphering and Lexical Obfuscation

Adversarial pseudo-hazing extends to LLMs via algorithmic obfuscation strategies such as RoguePrompt's dual-layer ciphering (Tafreshian, 24 Nov 2025). Here, the forbidden prompt $A$3 is partitioned into even-indexed $A$4 and odd-indexed $A$5 token streams. $A$6 is encrypted with a Vigenère cipher keyed by $A$7, then $A$8, a natural-language unwrapping instruction, and the ciphertext $A$9 are concatenated. An outer ROT-13 encoding is applied to the entire payload, yielding $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$0. The decoding/recoding is delegated to the model via natural-language plaintext instructions, bypassing moderation by ensuring the adversarial content never appears in the clear until after all safety layers are bypassed.

Pseudocode for encoding:

$$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$9

This strategy leverages both tokenization robustness (character-wise ciphers) and model instruction-following to evade static and dynamic moderation (Tafreshian, 24 Nov 2025).

4. Empirical Performance and Quantitative Comparison

In AdvHaze:

• White-box attack success: HAdvHaze achieves only $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$1, while IAdvHaze attains $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$2 success rates on ImageNet and NIPS2017, with NIQE $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$3 (lower is more natural). Noise-based methods (FGSM, MI-FGSM) reach comparable success but degrade image quality (higher NIQE).
• Transferability: IAdvHaze exhibits $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$4 transfer success; HAdvHaze only $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$5.
• Ablations: Removing filter smoothing reduces realism and attack success; nonhaze attacks are less correlated in success across samples, indicating orthogonality in exploited vulnerabilities (Gao et al., 2021).

In Dehaze-GLCGAN: | Setting | ↑ PSNR | ↑ SSIM | ↓ CIEDE2000 | |-------------------------------------------|---------|--------|-------------| | CycleGAN baseline | 13.39 | 0.52 | 17.61 | | Full Dehaze-GLCGAN | 15.48 | 0.78 | 14.89 | | w/o local discriminator | 14.07 | 0.71 | 19.95 | | w/o residual blocks | 14.11 | 0.69 | 16.43 |

Excluding the local discriminator or residual blocks degrades PSNR and perceptual color fidelity, evidencing the criticality of spatially-variant adversarial haze generation (Anvari et al., 2020).

For RoguePrompt: | Method | Bypass | Reconstruction | Execution | |------------------------|-------:|---------------:|----------:| | RoguePrompt (rot13+vig)| 84.7 % | 80.2 % | 71.5 % | | pair | 73.4 % | 68.9 % | 58.1 % | | base64_raw | 39.8 % | 36.3 % | 27.5 % |

Success is measured sequentially for (i) filter bypass, (ii) correct payload decoding, and (iii) execution. RoguePrompt markedly outperforms other obfuscation strategies (Tafreshian, 24 Nov 2025). Removal of any single encoding stage (ROT-13, Vigenère, or token splitting) yields $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$6% drop in success.

5. Practical Guidelines: Modularization and Deployment

Reusable adversarial pseudo-hazing modules should expose:

• A primary API (e.g., synthesize_haze(image, depth_map, A_map, beta_map)) implementing the parameterized haze generation.
• Utilities for depth estimation, parameter map smoothing (custom/learned filters), and flexible gradient-based adversarial optimization against arbitrary loss metrics.
• User-controllable bounds, optimization hyperparameters, and output options supporting full introspection (modulated $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$7 maps).
• Extension hooks for combining haze with other naturalistic or semantic perturbations to systematically benchmark model robustness (Gao et al., 2021).

Pseudo-hazing modules for language or latent spaces must encapsulate transformation, partitioning, layered ciphering, and in-context decoding triggers, exposing the underlying transformation structure to facilitate systematic evaluation and forensic inspection (Tafreshian, 24 Nov 2025).

6. Comparative Analysis and Transferability

Adversarial pseudo-hazing, both in vision and language domains, exploits model inductive biases orthogonal to traditional noise-based attacks. Image classifiers robust to $$t(\mathbf{x}) = \exp(-\beta(\mathbf{x}) d(\mathbf{x}))$$8-bounded perturbations are often vulnerable to appropriately parameterized atmospheric or semantic haze due to the attack’s physical plausibility and its distributional similarity to naturally occurring phenomena. Cross-method correlation matrices computed on the attack’s success sets show weak congruence between pseudo-haze and noise-based attacks, demonstrating their complementarity as robustness diagnostics (Gao et al., 2021). In LLMs, pseudo-hazing (dual-layer ciphering) exploits decoupling between moderation-time and runtime behaviors—security blind spots inherent in current pipeline separation (Tafreshian, 24 Nov 2025).

7. Research Directions and Limitations

The APHM concept spans both physically-constrained generation (e.g., using accurate depth maps and haze statistics) and learnable mappings in unpaired adversarial training frameworks. Its modularity invites extension to other atmospheric phenomena (rain, snow, blur), adversarial content (watermarks, camouflage), and transfer to non-vision tasks (latent or semantic pseudo-hazing). Key limits include the need for accurate auxiliary signals (depth, color statistics), optimization stability, and in security contexts, the potential for future combined static–dynamic moderation that evaluates fully decoded prompts or adversarial transformations in-line. A plausible implication is that advances in both physical and higher-level semantic adversarial pseudo-hazing will catalyze more robust, multimodal evaluation paradigms (Gao et al., 2021, Anvari et al., 2020, Tafreshian, 24 Nov 2025).