ADef: an Iterative Algorithm to Construct Adversarial Deformations

Abstract

While deep neural networks have proven to be a powerful tool for many recognition and classification tasks, their stability properties are still not well understood. In the past, image classifiers have been shown to be vulnerable to so-called adversarial attacks, which are created by additively perturbing the correctly classified image. In this paper, we propose the ADef algorithm to construct a different kind of adversarial attack created by iteratively applying small deformations to the image, found through a gradient descent step. We demonstrate our results on MNIST with convolutional neural networks and on ImageNet with Inception-v3 and ResNet-101.

arXiv commentICLR 2019 conference paper. 25 pages, 20 figures

References in corpus (6)

• Ensemble Adversarial Training: Attacks and Defenses
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Synthesizing Robust Adversarial Examples
• Certified Defenses against Adversarial Examples
• Spatially Transformed Adversarial Examples

Cited by in corpus (11)

• 3D-VField: Adversarial Augmentation of Point Clouds for Domain Generalization in 3D Object Detection
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Imperceptible Adversarial Examples by Spatial Chroma-Shift
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Relative stability toward diffeomorphisms indicates performance in deep nets
• 3D Adversarial Augmentations for Robust Out-of-Domain Predictions
• Adversarial Transformations for Semi-Supervised Learning
• Generating Unrestricted Adversarial Examples via Three Parameters
• Domain Invariant Adversarial Learning
• Enabling Data Diversity: Efficient Automatic Augmentation via Regularized Adversarial Training
• Improving Resistance to Adversarial Deformations by Regularizing Gradients