Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reduction

Abstract

Neural networks are known to be vulnerable to carefully crafted adversarial examples, and these malicious samples often transfer, i.e., they remain adversarial even against other models. Although great efforts have been delved into the transferability across models, surprisingly, less attention has been paid to the cross-task transferability, which represents the real-world cybercriminal's situation, where an ensemble of different defense/detection mechanisms need to be evaded all at once. In this paper, we investigate the transferability of adversarial examples across a wide range of real-world computer vision tasks, including image classification, object detection, semantic segmentation, explicit content detection, and text detection. Our proposed attack minimizes the ``dispersion'' of the internal feature map, which overcomes existing attacks' limitation of requiring task-specific loss functions and/or probing a target model. We conduct evaluation on open source detection and segmentation models as well as four different computer vision tasks provided by Google Cloud Vision (GCV) APIs, to show how our approach outperforms existing attacks by degrading performance of multiple CV tasks by a large margin with only modest perturbations linf=16.

arXiv admin note: substantial text overlap with arXiv:1905.03333

References in corpus (11)

• Rethinking Atrous Convolution for Semantic Image Segmentation
• YOLOv3: An Incremental Improvement
• Encoder-Decoder with Atrous Separable Convolution for Semantic Image Segmentation
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Focal Loss for Dense Object Detection
• Fully Convolutional Networks for Semantic Segmentation
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Black-box Adversarial Attacks with Limited Queries and Information
• Foveation-based Mechanisms Alleviate Adversarial Examples
• Adversarial Examples for Semantic Segmentation and Object Detection
• Boosting Adversarial Attacks with Momentum

Cited by in corpus (2)

• Mission-Aware Spatio-Temporal Deep Learning Model for UAS Instantaneous Density Prediction
• Weighted Average Precision: Adversarial Example Detection in the Visual Perception of Autonomous Vehicles