Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance

Abstract

The success of image perturbations that are designed to fool image classifier is assessed in terms of both adversarial effect and visual imperceptibility. The conventional assumption on imperceptibility is that perturbations should strive for tight $L_p$-norm bounds in RGB space. In this work, we drop this assumption by pursuing an approach that exploits human color perception, and more specifically, minimizing perturbation size with respect to perceptual color distance. Our first approach, Perceptual Color distance C&W (PerC-C&W), extends the widely-used C&W approach and produces larger RGB perturbations. PerC-C&W is able to maintain adversarial strength, while contributing to imperceptibility. Our second approach, Perceptual Color distance Alternating Loss (PerC-AL), achieves the same outcome, but does so more efficiently by alternating between the classification loss and perceptual color difference when updating perturbations. Experimental evaluation shows PerC approaches outperform conventional $L_p$ approaches in terms of robustness and transferability, and also demonstrates that the PerC distance can provide added value on top of existing structure-based methods to creating image perturbations.

arXiv commentAccepted at CVPR 2020; Code is available at https://github.com/ZhengyuZhao/PerC-Adversarial

References in corpus (13)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Robust Physical-World Attacks on Deep Learning Models
• A study of the effect of JPG compression on adversarial images
• Spatially Transformed Adversarial Examples
• A General Framework for Adversarial Examples with Objectives
• Preserving Color in Neural Artistic Style Transfer
• Functional Adversarial Attacks
• Unrestricted Adversarial Examples
• Unrestricted Adversarial Examples via Semantic Manipulation
• Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

Cited by in corpus (1)

• Testing Robustness Against Unforeseen Adversaries