LaVAN: Localized and Visible Adversarial Noise

Abstract

Most works on adversarial examples for deep-learning based image classifiers use noise that, while small, covers the entire image. We explore the case where the noise is allowed to be visible but confined to a small, localized patch of the image, without covering any of the main object(s) in the image. We show that it is possible to generate localized adversarial noises that cover only 2% of the pixels in the image, none of them over the main object, and that are transferable across images and locations, and successfully fool a state-of-the-art Inception v3 model with very high success rates.

References in corpus (1)

• Universal adversarial perturbations

Cited by in corpus (32)

• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Adversarial Training against Location-Optimized Adversarial Patches
• Certified Defenses for Adversarial Patches
• (De)Randomized Smoothing for Certifiable Defense against Patch Attacks
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• ImageNet-Patch: A Dataset for Benchmarking Machine Learning Robustness against Adversarial Patches
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Masking
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifier
• Attacking Optical Character Recognition (OCR) Systems with Adversarial Watermarks
• Scratch that! An Evolution-based Adversarial Attack against Neural Networks
• Bias-based Universal Adversarial Patch Attack for Automatic Check-out
• Generative Dynamic Patch Attack
• Adversarial Attacks in a Multi-view Setting: An Empirical Study of the Adversarial Patches Inter-view Transferability
• Efficient Project Gradient Descent for Ensemble Adversarial Attack
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Adversarial Framing for Image and Video Classification
• DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attacks
• Visually Imperceptible Adversarial Patch Attacks on Digital Images
• ExAD: An Ensemble Approach for Explanation-based Adversarial Detection
• Who is Responsible for Adversarial Defense?
• Identification of Attack-Specific Signatures in Adversarial Examples
• Inconspicuous Adversarial Patches for Fooling Image Recognition Systems on Mobile Devices
• Defenses Against Multi-Sticker Physical Domain Attacks on Classifiers
• A Simple and Strong Baseline for Universal Targeted Attacks on Siamese Visual Tracking
• Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classes
• Harnessing Perceptual Adversarial Patches for Crowd Counting
• FAWA: Fast Adversarial Watermark Attack on Optical Character Recognition (OCR) Systems
• Localized Adversarial Training for Increased Accuracy and Robustness in Image Classification