Fine-grained Synthesis of Unrestricted Adversarial Examples
arXiv:1911.09058
Abstract
We propose a novel approach for generating unrestricted adversarial examples by manipulating fine-grained aspects of image generation. Unlike existing unrestricted attacks that typically hand-craft geometric transformations, we learn stylistic and stochastic modifications leveraging state-of-the-art generative models. This allows us to manipulate an image in a controlled, fine-grained manner without being bounded by a norm threshold. Our approach can be used for targeted and non-targeted unrestricted attacks on classification, semantic segmentation and object detection models. Our attacks can bypass certified defenses, yet our adversarial images look indistinguishable from natural images as verified by human evaluation. Moreover, we demonstrate that adversarial training with our examples improves performance of the model on clean images without requiring any modifications to the architecture. We perform experiments on LSUN, CelebA-HQ and COCO-Stuff as high resolution datasets to validate efficacy of our proposed approach.
References in corpus (30)
- Adam: A Method for Stochastic Optimization
- mixup: Beyond Empirical Risk Minimization
- Ensemble Adversarial Training: Attacks and Defenses
- Conditional Image Synthesis With Auxiliary Classifier GANs
- Deep Generative Image Models using a Laplacian Pyramid of Adversarial Networks
- Progressive Growing of GANs for Improved Quality, Stability, and Variation
- Towards Deep Learning Models Resistant to Adversarial Attacks
- LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loop
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Manifold Mixup: Better Representations by Interpolating Hidden States
- Countering Adversarial Images using Input Transformations
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- Spatially Transformed Adversarial Examples
- Generating Adversarial Examples with Adversarial Networks
- LR-GAN: Layered Recursive Generative Adversarial Networks for Image Generation
- Mitigating Adversarial Effects Through Randomization
- Semidefinite relaxations for certifying robustness to adversarial examples
- A Dual Approach to Scalable Verification of Deep Networks
- Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks
- DeepFool: a simple and accurate method to fool deep neural networks
- Deep Learning Face Attributes in the Wild
- Feature Denoising for Improving Adversarial Robustness
- Unrestricted Adversarial Examples
- Learning Hierarchical Semantic Image Manipulation through Structured Representations
- Stacked Generative Adversarial Networks
- ADef: an Iterative Algorithm to Construct Adversarial Deformations
- Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
- FineGAN: Unsupervised Hierarchical Disentanglement for Fine-Grained Object Generation and Discovery