Spatially Transformed Adversarial Examples

Abstract

Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the ${\mathcal{L}}_p$ distance for penalizing perturbations. Researchers have explored different defense methods to defend against such adversarial attacks. While the effectiveness of ${\mathcal{L}}_p$ distance as a metric of perceptual quality remains an active research area, in this paper we will instead focus on a different type of perturbation, namely spatial transformation, as opposed to manipulating the pixel values directly as in prior works. Perturbations generated through spatial transformation could result in large ${\mathcal{L}}_p$ distance measures, but our extensive experiments show that such spatially transformed adversarial examples are perceptually realistic and more difficult to defend against with existing defense systems. This potentially provides a new direction in adversarial example generation and the design of corresponding defenses. We visualize the spatial transformation based perturbation for different examples and show that our technique can produce realistic adversarial examples with smooth image deformation. Finally, we visualize the attention of deep networks with different types of adversarial examples to better understand how these examples are interpreted.

Cited by in corpus (104)

• Robustness May Be at Odds with Accuracy
• Adversarial Attack and Defense on Graph Data: A Survey
• Generating Adversarial Examples with Adversarial Networks
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• DPatch: An Adversarial Patch Attack on Object Detectors
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• The Origins and Prevalence of Texture Bias in Convolutional Neural Networks
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Deceiving End-to-End Deep Learning Malware Detectors using Adversarial Examples
• Provably Minimally-Distorted Adversarial Examples
• Understanding and Enhancing the Transferability of Adversarial Examples
• SpaceNet MVOI: a Multi-View Overhead Imagery Dataset
• Functional Adversarial Attacks
• Adversarial Training against Location-Optimized Adversarial Patches
• Attacks Which Do Not Kill Training Make Adversarial Learning Stronger
• Testing Robustness Against Unforeseen Adversaries
• Unrestricted Adversarial Examples via Semantic Manipulation
• Hardware Trojan Attacks on Neural Networks
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Security and Privacy Issues in Deep Learning
• Watch out! Motion is Blurring the Vision of Your Deep Neural Networks
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Overfitting in adversarially robust deep learning
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Learning perturbation sets for robust machine learning
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• Divide, Denoise, and Defend against Adversarial Attacks
• Transfer of Adversarial Robustness Between Perturbation Types
• DeepHunter: Hunting Deep Neural Network Defects via Coverage-Guided Fuzzing
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Mutual Adversarial Training: Learning together is better than going alone
• Generating 3D Adversarial Point Clouds
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Adversarial Defense by Latent Style Transformations
• Interpretable Deep Learning under Fire
• DeepLaser: Practical Fault Attack on Deep Neural Networks
• Robustness of Rotation-Equivariant Networks to Adversarial Perturbations
• Imperceptible Adversarial Examples by Spatial Chroma-Shift
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• Adversarial Framework with Certified Robustness for Time-Series Domain via Statistical Features
• Learning to Anonymize Faces for Privacy Preserving Action Detection
• Training Robust Deep Models for Time-Series Domain: Novel Algorithms and Theoretical Analysis
• Adversarial Image Color Transformations in Explicit Color Filter Space
• Learning by Analogy: Reliable Supervision from Transformations for Unsupervised Optical Flow Estimation
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Pruning a restricted Boltzmann machine for quantum state reconstruction
• Understanding Adversarial Robustness Through Loss Landscape Geometries
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Query Attack via Opposite-Direction Feature:Towards Robust Image Retrieval
• Sparse Adversarial Video Attacks with Spatial Transformations
• Adversarial Token Attacks on Vision Transformers
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Playing it Safe: Adversarial Robustness with an Abstain Option
• TRS: Transferability Reduced Ensemble via Encouraging Gradient Diversity and Model Smoothness
• Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Models
• On the Certified Robustness for Ensemble Models and Beyond
• TSS: Transformation-Specific Smoothing for Robustness Certification
• Relative stability toward diffeomorphisms indicates performance in deep nets
• Attacking and Defending Machine Learning Applications of Public Cloud
• MeshAdv: Adversarial Meshes for Visual Recognition
• Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces
• Joint Adversarial Training: Incorporating both Spatial and Pixel Attacks
• SMART: Skeletal Motion Action Recognition aTtack
• Internal Wasserstein Distance for Adversarial Attack and Defense
• Taking Care of The Discretization Problem: A Comprehensive Study of the Discretization Problem and A Black-Box Adversarial Attack in Discrete Integer Domain
• Natural & Adversarial Bokeh Rendering via Circle-of-Confusion Predictive Network
• Cloud-based Image Classification Service Is Not Robust To Simple Transformations: A Forgotten Battlefield
• Efficient Project Gradient Descent for Ensemble Adversarial Attack
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Adversarial Attacks on Co-Occurrence Features for GAN Detection
• Pyramid Adversarial Training Improves ViT Performance
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Interpretation of Disease Evidence for Medical Images Using Adversarial Deformation Fields
• Tiny Adversarial Mulit-Objective Oneshot Neural Architecture Search
• Auditing AI models for Verified Deployment under Semantic Specifications
• Recurrent Attention Model with Log-Polar Mapping is Robust against Adversarial Attacks
• Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS
• Understanding the Error in Evaluating Adversarial Robustness
• Convolutional Neural Networks with Transformed Input based on Robust Tensor Network Decomposition
• Data Augmentation via Structured Adversarial Perturbations
• Heat and Blur: An Effective and Fast Defense Against Adversarial Examples
• Amora: Black-box Adversarial Morphing Attack
• A principled approach for generating adversarial images under non-smooth dissimilarity metrics
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Domain Invariant Adversarial Learning
• Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks
• Generating Unrestricted Adversarial Examples via Three Parameters
• Lagrangian Objective Function Leads to Improved Unforeseen Attack Generalization in Adversarial Training
• Adversarial Ranking Attack and Defense
• Adversarial Examples as an Input-Fault Tolerance Problem
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search
• Exploring Adversarial Fake Images on Face Manifold
• What Else Can Fool Deep Learning? Addressing Color Constancy Errors on Deep Neural Network Performance
• Targeted Physical-World Attention Attack on Deep Learning Models in Road Sign Recognition
• FAWA: Fast Adversarial Watermark Attack on Optical Character Recognition (OCR) Systems
• Shape Defense Against Adversarial Attacks