Unrestricted Adversarial Examples via Semantic Manipulation

Abstract

Machine learning models, especially deep neural networks (DNNs), have been shown to be vulnerable against adversarial examples which are carefully crafted samples with a small magnitude of the perturbation. Such adversarial perturbations are usually restricted by bounding their ${\mathcal{L}}_p$ norm such that they are imperceptible, and thus many current defenses can exploit this property to reduce their adversarial impact. In this paper, we instead introduce "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors - color and texture - in order to generate effective and photorealistic adversarial examples. We show that these semantically aware perturbations are effective against JPEG compression, feature squeezing and adversarially trained model. We also show that the proposed methods can effectively be applied to both image classification and image captioning tasks on complex datasets such as ImageNet and MSCOCO. In addition, we conduct comprehensive user studies to show that our generated semantic adversarial examples are photorealistic to humans despite large magnitude perturbations when compared to other attacks.

Accepted to ICLR 2020. First two authors contributed equally. Code: https://github.com/aisecure/Big-but-Invisible-Adversarial-Attack and Openreview: https://openreview.net/forum?id=Sye_OgHFwH

References in corpus (13)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Auto-Encoding Variational Bayes
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Spatially Transformed Adversarial Examples
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Generating Adversarial Examples with Adversarial Networks
• Constructing Unrestricted Adversarial Examples with Generative Models
• Testing Robustness Against Unforeseen Adversaries
• Unrestricted Adversarial Examples
• Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning
• Quantitative Evaluation of Style Transfer

Cited by in corpus (32)

• The Pitfalls of Simplicity Bias in Neural Networks
• Watch out! Motion is Blurring the Vision of Your Deep Neural Networks
• Learning perturbation sets for robust machine learning
• AdvHaze: Adversarial Haze Attack
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• Towards Feature Space Adversarial Attack
• Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving
• Imperceptible Adversarial Examples by Spatial Chroma-Shift
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• Towards Verifying Robustness of Neural Networks Against Semantic Perturbations
• Defending Against Physically Realizable Attacks on Image Classification
• Towards Security Threats of Deep Learning Systems: A Survey
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Effective Universal Unrestricted Adversarial Attacks using a MOE Approach
• GhostImage: Remote Perception Attacks against Camera-based Image Classification Systems
• Playing it Safe: Adversarial Robustness with an Abstain Option
• Analyzing and Improving Neural Networks by Generating Semantic Counterexamples through Differentiable Rendering
• AVA: Adversarial Vignetting Attack against Visual Recognition
• On the Certified Robustness for Ensemble Models and Beyond
• Unrestricted Adversarial Attacks on ImageNet Competition
• Adversarial Relighting Against Face Recognition
• Natural & Adversarial Bokeh Rendering via Circle-of-Confusion Predictive Network
• Feature-Filter: Detecting Adversarial Examples through Filtering off Recessive Features
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Semantically Adversarial Learnable Filters
• Data Augmentation via Structured Adversarial Perturbations
• Adversarial Examples Detection beyond Image Space
• Fashion-Guided Adversarial Attack on Person Segmentation
• Towards Robustness against Unsuspicious Adversarial Examples
• Understanding Robustness in Teacher-Student Setting: A New Perspective
• Localized Uncertainty Attacks