Quantifying Perceptual Distortion of Adversarial Examples

Abstract

Recent work has shown that additive threat models, which only permit the addition of bounded noise to the pixels of an image, are insufficient for fully capturing the space of imperceivable adversarial examples. For example, small rotations and spatial transformations can fool classifiers, remain imperceivable to humans, but have large additive distance from the original images. In this work, we leverage quantitative perceptual metrics like LPIPS and SSIM to define a novel threat model for adversarial attacks. To demonstrate the value of quantifying the perceptual distortion of adversarial examples, we present and employ a unifying framework fusing different attack styles. We first prove that our framework results in images that are unattainable by attack styles in isolation. We then perform adversarial training using attacks generated by our framework to demonstrate that networks are only robust to classes of adversarial perturbations they have been trained against, and combination attacks are stronger than any of their individual components. Finally, we experimentally demonstrate that our combined attacks retain the same perceptual distortion but induce far higher misclassification rates when compared against individual attacks.

18 pages, codebase/framework available at https://github.com/revbucket/mister_ed

References in corpus (9)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Deep Residual Learning for Image Recognition
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
• Adversarial Feature Learning
• Synthesizing Robust Adversarial Examples
• Technical Report on the CleverHans v2.1.0 Adversarial Examples Library
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

Cited by in corpus (16)

• RobustBench: a standardized adversarial robustness benchmark
• Functional Adversarial Attacks
• Testing Robustness Against Unforeseen Adversaries
• Adversarial Robustness Against the Union of Multiple Perturbation Models
• Transfer of Adversarial Robustness Between Perturbation Types
• Towards Visual Distortion in Black-Box Attacks
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Imperceptible Adversarial Examples by Spatial Chroma-Shift
• Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces
• Can Perceptual Guidance Lead to Semantically Explainable Adversarial Perturbations?
• Bio-inspired Robustness: A Review
• On the human evaluation of audio adversarial examples
• Robustifying ${\ell }_{\infty }$ Adversarial Training to the Union of Perturbation Models
• FROB: Few-shot ROBust Model for Classification and Out-of-Distribution Detection
• Achieving Adversarial Robustness Requires An Active Teacher
• Localized Uncertainty Attacks