Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation

Abstract

Deep Neural Networks (DNNs) have been widely applied in various recognition tasks. However, recently DNNs have been shown to be vulnerable against adversarial examples, which can mislead DNNs to make arbitrary incorrect predictions. While adversarial examples are well studied in classification tasks, other learning problems may have different properties. For instance, semantic segmentation requires additional components such as dilated convolutions and multiscale processing. In this paper, we aim to characterize adversarial examples based on spatial context information in semantic segmentation. We observe that spatial consistency information can be potentially leveraged to detect adversarial examples robustly even when a strong adaptive attacker has access to the model and detection strategies. We also show that adversarial examples based on attacks considered within the paper barely transfer among models, even though transferability is common in classification. Our observations shed new light on developing adversarial attacks and defenses to better understand the vulnerabilities of DNNs.

Accepted to ECCV 2018

References in corpus (6)

• Efficient Inference in Fully Connected CRFs with Gaussian Edge Potentials
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Spatially Transformed Adversarial Examples
• Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach

Cited by in corpus (24)

• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• End-to-end Prostate Cancer Detection in bpMRI via 3D CNNs: Effects of Attention Mechanisms, Clinical Priori and Decoupled False Positive Reduction
• Unsolved Problems in ML Safety
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Characterizing Attacks on Deep Reinforcement Learning
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• Anomalous Example Detection in Deep Learning: A Survey
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• Using Depth for Pixel-Wise Detection of Adversarial Attacks in Crowd Counting
• Frequency-Tuned Universal Adversarial Attacks
• MeshAdv: Adversarial Meshes for Visual Recognition
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• Adversarial Examples on Segmentation Models Can be Easy to Transfer
• Connecting the Dots: Detecting Adversarial Perturbations Using Context Inconsistency
• On the Robustness of Human Pose Estimation
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• Auditing AI models for Verified Deployment under Semantic Specifications
• Robust Tracking against Adversarial Attacks
• Exploiting Multi-Object Relationships for Detecting Adversarial Attacks in Complex Scenes
• Search Space of Adversarial Perturbations against Image Filters
• Multilingual and Multilabel Emotion Recognition using Virtual Adversarial Training
• Adversarial Attacks with Time-Scale Representations