Adversarial Ranking Attack and Defense

Abstract

Deep Neural Network (DNN) classifiers are vulnerable to adversarial attack, where an imperceptible perturbation could result in misclassification. However, the vulnerability of DNN-based image ranking systems remains under-explored. In this paper, we propose two attacks against deep ranking systems, i.e., Candidate Attack and Query Attack, that can raise or lower the rank of chosen candidates by adversarial perturbations. Specifically, the expected ranking order is first represented as a set of inequalities, and then a triplet-like objective function is designed to obtain the optimal perturbation. Conversely, a defense method is also proposed to improve the ranking system robustness, which can mitigate all the proposed attacks simultaneously. Our adversarial ranking attacks and defense are evaluated on datasets including MNIST, Fashion-MNIST, and Stanford-Online-Products. Experimental results demonstrate that a typical deep ranking system can be effectively compromised by our attacks. Meanwhile, the system robustness can be moderately improved with our defense. Furthermore, the transferable and universal properties of our adversary illustrate the possibility of realistic black-box attack.

arXiv commentECCV2020

References in corpus (21)

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Unifying Visual-Semantic Embeddings with Multimodal Neural Language Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Evidential Deep Learning to Quantify Classification Uncertainty
• Robust Physical-World Attacks on Deep Learning Models
• Countering Adversarial Images using Input Transformations
• Adversarial Personalized Ranking for Recommendation
• Understanding Adversarial Training: Increasing Local Stability of Neural Nets through Robust Optimization
• Learning with a Strong Adversary
• Spatially Transformed Adversarial Examples
• Defensive Distillation is Not Robust to Adversarial Examples
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognition
• Foveation-based Mechanisms Alleviate Adversarial Examples
• On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
• Adv-BNN: Improved Adversarial Defense through Robust Bayesian Neural Network
• Understanding and Enhancing the Transferability of Adversarial Examples
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• DeepSafe: A Data-driven Approach for Checking Adversarial Robustness in Neural Networks
• On the Effectiveness of Defensive Distillation
• Intermediate Level Adversarial Attack for Enhanced Transferability