Imperceptible Adversarial Examples by Spatial Chroma-Shift

Abstract

Deep Neural Networks have been shown to be vulnerable to various kinds of adversarial perturbations. In addition to widely studied additive noise based perturbations, adversarial examples can also be created by applying a per pixel spatial drift on input images. While spatial transformation based adversarial examples look more natural to human observers due to absence of additive noise, they still possess visible distortions caused by spatial transformations. Since the human vision is more sensitive to the distortions in the luminance compared to those in chrominance channels, which is one of the main ideas behind the lossy visual multimedia compression standards, we propose a spatial transformation based perturbation method to create adversarial examples by only modifying the color components of an input image. While having competitive fooling rates on CIFAR-10 and NIPS2017 Adversarial Learning Challenge datasets, examples created with the proposed method have better scores with regards to various perceptual quality metrics. Human visual perception studies validate that the examples are more natural looking and often indistinguishable from their original counterparts.

arXiv comment10 pages, 5 figures. Accepted to International Workshop on Adversarial Learning for Multimedia, ACM Multimedia 2021

References in corpus (17)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Image Quality Assessment: Unifying Structure and Texture Similarity
• Spatially Transformed Adversarial Examples
• Comparison of Image Quality Models for Optimization of Image Processing Systems
• Foolbox: A Python toolbox to benchmark the robustness of machine learning models
• Functional Adversarial Attacks
• Unrestricted Adversarial Examples via Semantic Manipulation
• Quantifying Perceptual Distortion of Adversarial Examples
• ADef: an Iterative Algorithm to Construct Adversarial Deformations
• Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions
• Attack Type Agnostic Perceptual Enhancement of Adversarial Images

Cited by in corpus (2)

• Metricizing the Euclidean Space towards Desired Distance Relations in Point Clouds
• Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces