Houdini: Fooling Deep Structured Prediction Models

Abstract

Generating adversarial examples is a critical step for evaluating and improving the robustness of learning machines. So far, most existing methods only work for classification and are not designed to alter the true performance measure of the problem at hand. We introduce a novel flexible approach named Houdini for generating adversarial examples specifically tailored for the final performance measure of the task considered, be it combinatorial and non-decomposable. We successfully apply Houdini to a range of applications such as speech recognition, pose estimation and semantic segmentation. In all cases, the attacks based on Houdini achieve higher success rate than those based on the traditional surrogates used to train the models while using a less perceptible adversarial perturbation.

12 pages, 8 figures, under review

References in corpus (7)

• DeepPose: Human Pose Estimation via Deep Neural Networks
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Human pose estimation via Convolutional Part Heatmap Regression
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• DeepFool: a simple and accurate method to fool deep neural networks
• Practical Black-Box Attacks against Machine Learning
• Adversarial Examples for Semantic Segmentation and Object Detection

Cited by in corpus (67)

• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• A General Framework for Adversarial Examples with Objectives
• Mitigating Adversarial Effects Through Randomization
• DARTS: Deceiving Autonomous Cars with Toxic Signs
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Models
• Constructing Unrestricted Adversarial Examples with Generative Models
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Characterizing Audio Adversarial Examples Using Temporal Dependency
• Low Frequency Adversarial Perturbation
• POBA-GA: Perturbation Optimized Black-Box Adversarial Attacks via Genetic Algorithm
• Improving Transferability of Adversarial Examples with Input Diversity
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems
• Hermes Attack: Steal DNN Models with Lossless Inference Accuracy
• Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight
• Protecting Voice Controlled Systems Using Sound Source Identification Based on Acoustic Cues
• An Overview of Vulnerabilities of Voice Controlled Systems
• Parallelization Techniques for Verifying Neural Networks
• Universal adversarial examples in speech command classification
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• SirenAttack: Generating Adversarial Audio for End-to-End Acoustic Systems
• Fooling a Real Car with Adversarial Traffic Signs
• DUP-Net: Denoiser and Upsampler Network for 3D Adversarial Point Clouds Defense
• Improving adversarial robustness of deep neural networks by using semantic information
• PAC-learning in the presence of evasion adversaries
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• Verification of Neural Network Control Policy Under Persistent Adversarial Perturbation
• Multitask Learning Strengthens Adversarial Robustness
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Universal Adversarial Perturbation for Text Classification
• Identifying Audio Adversarial Examples via Anomalous Pattern Detection
• Adversarial Attacks and Defenses for Speech Recognition Systems
• Real-Time Adversarial Attacks
• Adversarial Visual Robustness by Causal Intervention
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• CoCoFuzzing: Testing Neural Code Models with Coverage-Guided Fuzzing
• Improving Global Adversarial Robustness Generalization With Adversarially Trained GAN
• SPARK: Spatial-aware Online Incremental Attack Against Visual Tracking
• Exploring Counterfactual Explanations Through the Lens of Adversarial Examples: A Theoretical and Empirical Analysis
• Defending Your Voice: Adversarial Attack on Voice Conversion
• A geometry-inspired decision-based attack
• Adversarial Example Detection by Classification for Deep Speech Recognition
• Patch-wise Attack for Fooling Deep Neural Network
• Mitigating Gradient-based Adversarial Attacks via Denoising and Compression
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Adversarial Black-Box Attacks On Text Classifiers Using Multi-Objective Genetic Optimization Guided By Deep Networks
• ReMASC: Realistic Replay Attack Corpus for Voice Controlled Systems
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• Reducing audio membership inference attack accuracy to chance: 4 defenses
• On the human evaluation of audio adversarial examples
• HASP: A High-Performance Adaptive Mobile Security Enhancement Against Malicious Speech Recognition
• An Evasion Attack against Stacked Capsule Autoencoder
• Exploring Targeted Universal Adversarial Perturbations to End-to-end ASR Models
• Model-Agnostic Defense for Lane Detection against Adversarial Attack
• Improving Adversarial Robustness by Encouraging Discriminative Features
• Using LIP to Gloss Over Faces in Single-Stage Face Detection Networks
• LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks
• Context-Aware Image Denoising with Auto-Threshold Canny Edge Detection to Suppress Adversarial Perturbation