Synthesizing Robust Adversarial Examples

Abstract

Standard methods for generating adversarial examples for neural networks do not consistently fool neural network classifiers in the physical world due to a combination of viewpoint shifts, camera noise, and other natural transformations, limiting their relevance to real-world systems. We demonstrate the existence of robust 3D adversarial objects, and we present the first algorithm for synthesizing examples that are adversarial over a chosen distribution of transformations. We synthesize two-dimensional adversarial images that are robust to noise, distortion, and affine transformation. We apply our algorithm to complex three-dimensional objects, using 3D-printing to manufacture the first physical adversarial objects. Our results demonstrate the existence of 3D adversarial objects in the physical world.

ICML 2018

References in corpus (9)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Defensive Distillation is Not Robust to Adversarial Examples
• On Detecting Adversarial Perturbations
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Early Methods for Detecting Adversarial Images

Cited by in corpus (183)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Robust Physical-World Attacks on Deep Learning Models
• Black-box Adversarial Attacks with Limited Queries and Information
• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Adversarial Examples: Opportunities and Challenges
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Regularization for Deep Learning: A Taxonomy
• Natural Adversarial Examples
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Why do deep convolutional networks generalize so poorly to small image transformations?
• Robust Audio Adversarial Example for a Physical Attack
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• PrivacyNet: Semi-Adversarial Networks for Multi-attribute Face Privacy
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Adversarial Attacks Against Medical Deep Learning Systems
• Adversarial Examples that Fool Detectors
• Physical Adversarial Examples for Object Detectors
• Benchmarking Adversarial Patch Against Aerial Detection
• Understanding and Enhancing the Transferability of Adversarial Examples
• Your Classifier is Secretly an Energy Based Model and You Should Treat it Like One
• Testing Robustness Against Unforeseen Adversaries
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Improving the Transferability of Adversarial Examples with Resized-Diverse-Inputs, Diversity-Ensemble and Region Fitting
• Adversarial camera stickers: A physical camera-based attack on deep learning systems
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Security and Privacy Issues in Deep Learning
• Characterizing and evaluating adversarial examples for Offline Handwritten Signature Verification
• Standard detectors aren't (currently) fooled by physical adversarial stop signs
• Towards robust sensing for Autonomous Vehicles: An adversarial perspective
• Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting
• Adversarial Machine Learning -- Industry Perspectives
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compression
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Overfitting in adversarially robust deep learning
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Logit Pairing Methods Can Fool Gradient-Based Attacks
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Weighted-Sampling Audio Adversarial Example Attack
• Learning perturbation sets for robust machine learning
• DeepBillboard: Systematic Physical-World Testing of Autonomous Driving Systems
• Adversarial Patch Attacks on Monocular Depth Estimation Networks
• Pix2Vex: Image-to-Geometry Reconstruction using a Smooth Differentiable Renderer
• Defining Explainable AI for Requirements Analysis
• Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating
• Theoretical evidence for adversarial robustness through randomization
• Robust Backdoor Attacks against Deep Neural Networks in Real Physical World
• Daedalus: Breaking Non-Maximum Suppression in Object Detection via Adversarial Examples
• Pixle: a fast and effective black-box attack based on rearranging pixels
• Quantifying Perceptual Distortion of Adversarial Examples
• Dynamic Adversarial Patch for Evading Object Detection Models
• "That Is a Suspicious Reaction!": Interpreting Logits Variation to Detect NLP Adversarial Attacks
• AI Research Considerations for Human Existential Safety (ARCHES)
• Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracy
• Query-Efficient Black-box Adversarial Examples (superceded)
• Transfer of Adversarial Robustness Between Perturbation Types
• Rogue Signs: Deceiving Traffic Sign Recognition with Malicious Ads and Logos
• GenAttack: Practical Black-box Attacks with Gradient-Free Optimization
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Pick-Object-Attack: Type-Specific Adversarial Attack for Object Detection
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• What does it mean to understand a neural network?
• Provably scale-covariant continuous hierarchical networks based on scale-normalized differential expressions coupled in cascade
• Generating 3D Adversarial Point Clouds
• DANCin SEQ2SEQ: Fooling Text Classifiers with Adversarial Text Example Generation
• When Explainability Meets Adversarial Learning: Detecting Adversarial Examples using SHAP Signatures
• Fooling a Real Car with Adversarial Traffic Signs
• Fooling Detection Alone is Not Enough: First Adversarial Attack against Multiple Object Tracking
• Interoceptive robustness through environment-mediated morphological development
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Adversarial attacks on Copyright Detection Systems
• Adversarial Defense by Latent Style Transformations
• Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks
• SPAA: Stealthy Projector-based Adversarial Attacks on Deep Image Classifiers
• Physically Realizable Adversarial Examples for LiDAR Object Detection
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection
• Defending From Physically-Realizable Adversarial Attacks Through Internal Over-Activation Analysis
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• A Spectral View of Adversarially Robust Features
• Playing the Game of Universal Adversarial Perturbations
• Physical Adversarial Attacks on Deep Neural Networks for Traffic Sign Recognition: A Feasibility Study
• Adversarial Sampling for Fairness Testing in Deep Neural Network
• Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World
• Curls & Whey: Boosting Black-Box Adversarial Attacks
• Robustifying Models Against Adversarial Attacks by Langevin Dynamics
• Large Margin Deep Networks for Classification
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• SDFDiff: Differentiable Rendering of Signed Distance Fields for 3D Shape Optimization
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• On the Limitation of MagNet Defense against $L_1$-based Adversarial Examples
• Projecting Trouble: Light Based Adversarial Attacks on Deep Learning Classifiers
• Adversarial Attacks on GMM i-vector based Speaker Verification Systems
• Adversarial Learning of Deepfakes in Accounting
• Unsupervised Hard Example Mining from Videos for Improved Object Detection
• Query-Efficient Black-Box Attack by Active Learning
• Fooling Vision and Language Models Despite Localization and Attention Mechanism
• Security and Machine Learning in the Real World
• Adversarial Visual Robustness by Causal Intervention
• Analyzing and Improving Neural Networks by Generating Semantic Counterexamples through Differentiable Rendering
• Decision-based Universal Adversarial Attack
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Monocular Depth Estimators: Vulnerabilities and Attacks
• Towards Resistant Audio Adversarial Examples
• A Transferable Anti-Forensic Attack on Forensic CNNs Using A Generative Adversarial Network
• Identifying Classes Susceptible to Adversarial Attacks
• Better the Devil you Know: An Analysis of Evasion Attacks using Out-of-Distribution Adversarial Examples
• Weakly Supervised Learning of Multi-Object 3D Scene Decompositions Using Deep Shape Priors
• Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises
• Adversarial Attack and Defense in Deep Ranking
• Relative stability toward diffeomorphisms indicates performance in deep nets
• Enhancing Adversarial Defense by k-Winners-Take-All
• Semantics Preserving Adversarial Learning
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
• Defending against Adversarial Attack towards Deep Neural Networks via Collaborative Multi-task Training
• Harmonic Adversarial Attack Method
• Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognition
• Random Directional Attack for Fooling Deep Neural Networks
• DiffDefense: Defending against Adversarial Attacks via Diffusion Models
• Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency
• Design and Interpretation of Universal Adversarial Patches in Face Detection
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• A Comprehensive Evaluation Framework for Deep Model Robustness
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Improving Adversarial Robustness via Unlabeled Out-of-Domain Data
• Evaluating a Simple Retraining Strategy as a Defense Against Adversarial Attacks
• Is Face Recognition Safe from Realizable Attacks?
• Predicting Adversarial Examples with High Confidence
• Attacking CNN-based anti-spoofing face authentication in the physical domain
• SIGMA : Strengthening IDS with GAN and Metaheuristics Attacks
• Brain-inspired reverse adversarial examples
• Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
• A Cyclically-Trained Adversarial Network for Invariant Representation Learning
• Man-in-the-Middle Attacks against Machine Learning Classifiers via Malicious Generative Models
• Maximal adversarial perturbations for obfuscation: Hiding certain attributes while preserving rest
• A Self-supervised Approach for Adversarial Robustness
• Representation of White- and Black-Box Adversarial Examples in Deep Neural Networks and Humans: A Functional Magnetic Resonance Imaging Study
• Towards transformation-resilient provenance detection of digital media
• Spot Evasion Attacks: Adversarial Examples for License Plate Recognition Systems with Convolutional Neural Networks
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• AdvMS: A Multi-source Multi-cost Defense Against Adversarial Attacks
• Virtuously Safe Reinforcement Learning
• White-Box Adversarial Defense via Self-Supervised Data Estimation
• Fooling Computer Vision into Inferring the Wrong Body Mass Index
• Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
• Utility-aware Privacy-preserving Data Releasing
• A New Angle on L2 Regularization
• Exploring Model Robustness with Adaptive Networks and Improved Adversarial Training
• Robust Invisible Hyperlinks in Physical Photographs Based on 3D Rendering Attacks
• Detecting Adversarial Patches with Class Conditional Reconstruction Networks
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• Content-Adaptive Pixel Discretization to Improve Model Robustness
• Real-time Detection of Practical Universal Adversarial Perturbations
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Local Competition and Uncertainty for Adversarial Robustness in Deep Learning
• Discrete Few-Shot Learning for Pan Privacy
• Adversarial Examples in Remote Sensing
• Affine Disentangled GAN for Interpretable and Robust AV Perception
• Sampling Prediction-Matching Examples in Neural Networks: A Probabilistic Programming Approach
• Robustness from Simple Classifiers
• Augmenting Model Robustness with Transformation-Invariant Attacks
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• Can We Distinguish Machine Learning from Human Learning?
• A Neuro-Inspired Autoencoding Defense Against Adversarial Perturbations
• Sequential Attacks on Kalman Filter-based Forward Collision Warning Systems
• Attack to Fool and Explain Deep Networks
• An Integrated Algorithm for Robust and Imperceptible Audio Adversarial Examples
• Robust Assessment of Real-World Adversarial Examples
• Realizable Learning is All You Need
• advPattern: Physical-World Attacks on Deep Person Re-Identification via Adversarially Transformable Patterns
• An Integrated Approach to Produce Robust Models with High Efficiency
• Universal Physical Camouflage Attacks on Object Detectors
• Closing the Gap: Achieving Better Accuracy-Robustness Tradeoffs against Query-Based Attacks
• CD-UAP: Class Discriminative Universal Adversarial Perturbation
• On Universalized Adversarial and Invariant Perturbations
• Tricking Adversarial Attacks To Fail
• Spatiotemporal Attacks for Embodied Agents
• Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models
• Target Training Does Adversarial Training Without Adversarial Samples