ADef: an Iterative Algorithm to Construct Adversarial Deformations

Alaifari, Rima; Alberti, Giovanni S.; Gauksson, Tandri

doi:10.48550/arxiv.1804.07729

Cited by 15 publications

(31 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also see other unique ways of rendering inputs adversarial for deep learning models. Alaifari et al [197] deformed image planes to construct adversarial examples. The techniques in [198] and [126] aim at perceptibility reduction of adversarial perturbations by directly focusing on 0 -norm reduction of perturbation vector.…”

Section: G Miscellaneous Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: G Miscellaneous Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…Therefore, we only include samples that can fool the model in less than a specific number of iterations. We use a threshold of 10 as the maximum number of iterations, and demonstrate results on classification, semantic segmentation and object detection 1 . We use the first 10 generated examples for each starting image in the segmentation and detection tasks.…”

Section: Resultsmentioning

confidence: 99%

“…Another line of work creates unrestricted adversarial examples that are not bounded by a norm threshold. One way to achieve this is by applying subtle geometric transformations such as spatial transformations [37,1], translations and rotations [14] or pose changes [2] to the inputs. Other works consider recoloring [19,25,4], intermediate features [13,26,41] and inserting new objects or patches in the image [6].…”

Section: Adversarial Examplesmentioning

confidence: 99%

“…In order for a model to become robust to all realistic variations of inputs, it needs to see a diverse set of samples during training. However, most of the existing works only alter a low-level aspect of images such as color [19,25,4], spatial [14,37,1], pose [2,43], and others. Even if we consider the union of several types of attacks, the model can still be vulnerable to other input variations that are not contained in any of the constituent threat models.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Robustness and Generalization via Generative Adversarial Training

Poursaeed¹,

Jiang²,

Yang³

et al. 2021

Preprint

View full text Add to dashboard Cite

While deep neural networks have achieved remarkable success in various computer vision tasks, they often fail to generalize to new domains and subtle variations of input images. Several defenses have been proposed to improve the robustness against these variations. However, current defenses can only withstand the specific attack used in training, and the models often remain vulnerable to other input variations. Moreover, these methods often degrade performance of the model on clean images and do not generalize to out-of-domain samples. In this paper we present Generative Adversarial Training, an approach to simultaneously improve the model's generalization to the test set and outof-domain samples as well as its robustness to unseen adversarial attacks. Instead of altering a low-level pre-defined aspect of images, we generate a spectrum of low-level, midlevel and high-level changes using generative models with a disentangled latent space. Adversarial training with these examples enable the model to withstand a wide range of attacks by observing a variety of input alterations during training. We show that our approach not only improves performance of the model on clean images and out-of-domain samples but also makes it robust against unforeseen attacks and outperforms prior work. We validate effectiveness of our method by demonstrating results on various tasks such as classification, segmentation and object detection.

show abstract

“…The forenamed methods mostly conform to this by limiting the l p -norm of the difference between the clean data and its adversary to a small value. There are some others that maintain high perceptual similarity without the l p -norm limitation [17], [18], [19], [20], [21]. For example, Engstrom et al [19] found that neural networks are vulnerable to simple image transformations, such as rotation and translation.…”

Section: A Adversarial Examplesmentioning

confidence: 99%

Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search

Xia¹,

Li²,

Li³

2021

Preprint

View full text Add to dashboard Cite

Numerous studies have demonstrated that deep neural networks are easily misled by adversarial examples. Effectively evaluating the adversarial robustness of a model is important for its deployment in practical applications. Currently, a common type of evaluation is to approximate the adversarial risk of a model as a robustness indicator by constructing malicious instances and executing attacks. Unfortunately, there is an error (gap) between the approximate value and the true value. Previous studies manually design attack methods to achieve a smaller error, which is inefficient and may miss a better solution.In this paper, we establish the tightening of the approximation error as an optimization problem and try to solve it with an algorithm. More specifically, we first analyze that replacing the non-convex and discontinuous 0-1 loss with a surrogate loss, a necessary compromise in calculating the approximation, is one of the main reasons for the error. Then we propose AutoLoss-AR, the first method for searching loss functions for tightening the approximation error of adversarial risk. Extensive experiments are conducted in multiple settings. The results demonstrate the effectiveness of the proposed method: the best-discovered loss functions outperform the handcrafted baseline by 0.9%-2.9% and 0.7%-2.0% on MNIST and CIFAR-10, respectively. Besides, we also verify that the searched losses can be transferred to other settings and explore why they are better than the baseline by visualizing the local loss landscape.

show abstract

ADef: an Iterative Algorithm to Construct Adversarial Deformations

Cited by 15 publications

References 0 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Robustness and Generalization via Generative Adversarial Training

Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search

Contact Info

Product

Resources

About