A General Framework for Adversarial Examples with Objectives

Abstract

Images perturbed subtly to be misclassified by neural networks, called adversarial examples, have emerged as a technically deep challenge and an important concern for several application domains. Most research on adversarial examples takes as its only constraint that the perturbed images are similar to the originals. However, real-world application of these ideas often requires the examples to satisfy additional objectives, which are typically enforced through custom modifications of the perturbation process. In this paper, we propose adversarial generative nets (AGNs), a general methodology to train a generator neural network to emit adversarial examples satisfying desired objectives. We demonstrate the ability of AGNs to accommodate a wide range of objectives, including imprecise ones difficult to model, in two application domains. In particular, we demonstrate physical adversarial examples-eyeglass frames designed to fool face recognition-with better robustness, inconspicuousness, and scalability than previous approaches, as well as a new attack to fool a handwritten-digit classifier. contexts in which it is necessary to model additional objectives of adversarial inputs. For example, our prior work considered a scenario in which adversaries could not manipulate input images directly, but, rather, could only manipulate the physical artifacts captured in such images [68]. Using eyeglasses for fooling face-recognition systems as a driving example, we showed how to encode various objectives into the process of generating eyeglass frames, such as ensuring that the frames were capable of being physically realized by an off-the-shelf printer. As another example, Evtimov et al. considered generating shapes that, when attached to street signs, would seem harmless to human observers, but would lead neural networks to misclassify the signs [20].These efforts modeled the various objectives they considered in an ad hoc fashion. In contrast, in this paper, we propose a general framework for capturing such objectives in the process of generating adversarial inputs. Our framework builds on recent work in generative adversarial networks (GANs) [25] to train an attack generator, i.e., a neural network that can generate successful attack instances that meet certain objectives. Moreover, our framework is not only general, but, unlike previous attacks, produces a large number of diverse adversarial examples that meet the desired objectives. This could be leveraged by an attacker to generate attacks that are unlike previous ones (and hence more likely to succeed), but also by defenders to generate labeled negative inputs to augment training of their classifiers. Due to our framework's basis in GANs, we refer to it using the anagram AGNs, for adversarial generative nets.To illustrate the utility of AGNs, we return to the task of printing eyeglasses to fool facerecognition systems [68] and demonstrate how to accommodate a number of types of objectives within it. Specifically, we use AGNs to accommodate robustness objectives to ensure...

Adversarial Attacks Against Face Recognition: A Comprehensive Study

“…Sharif et al [76] developed the Eyeglass Accessory Printing method to generate a physically realizable yet inconspicuous class of attacks. In [91], authors proposed Adversarial Generative Nets (AGNs) to generate images of artifacts (e.g., eyeglasses) that would lead to misclassification. The artifacts generated by such neural networks resembled a reference set of artifacts (e.g., real eyeglass designs) and satisfied the inconspicuousness objective.…”

“…In [91], Sharif et al assessed dodging and impersonation attacks against VGG-Face and OpenFace models. In the evaluation stage, they reported the accuracies of DNNs and SRs of the attacks.…”

“…Regarding physical attacks orientation, authors in [78] proposed the VLA against blackbox FR systems. Nguyen et al [55] focused on real-time light projection-based attacks considering both white-and Representative study Adversarial capacity Adversarial Specificity [71] None None [72] Black-box Both [85] Black-box Targeted [89] White-box Non-targeted [81] White-box Targeted [82] White-box Targeted [90] Both Both [76], [91] White-box Both [92] White-box Both [78] Black-box Both [55] Both Both [80] White-box Non-targeted [93] White-box Both [83] White-box Non-targeted [94] White-box Targeted [56] Black-box Both black-box attack settings. In geometry-oriented attacks, Deb et al [56] demonstrated that faces generated by the AdvFaces adversarial face synthesis method could evade several blackbox contemporary face-matching techniques while achieving unprecedented attack SRs.…”

“…The transferability of attack methods was explored by some studies [56], [80], [85], [91]. Zhong and Deng [85] explored the vulnerability of CNN-based FR models to transferable attacks.…”

“…They observed that their proposed DFANet technique could enhance the transferability of existing attack methods. Sharif et al [91] found that attacks against the OpenFace architecture could successfully fool the VGG architecture in only a limited number of attempts (10-12%), whereas dodging against VGG can lead to successful dodging against OpenFace in at least 63% of attempts. They also argued that the generated universal attacks could transfer between architectures with similar success.…”