Adversarial Attacks Beyond the Image Space

Zeng, Xiaohui; Liu, Chenxi; Wang, Yu-Siang; W, Qiu; Xie, Lingxi; Tai, Yu-Wing; Tang, Chengzhou; Yuille, Alan

doi:10.48550/arxiv.1711.07183

Cited by 7 publications

(11 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We summarize the difference between our approach and the previous non-image adversarial attacks in Table 1. , in computing adversarial examples (Athalye et al, 2017;Zeng et al, 2017), and in generalizing neural style transfer to a 3D context (Kato et al, 2018;Liu et al, 2018) These renderers, however, are expensive to evaluate, requiring orders of magnitude more computation and much larger memory footprints compared to our method.…”

Section: Related Workmentioning

confidence: 98%

“…This leads to unrealistic attack images that cannot model real-world scenarios (Goodfellow, 2018;Hendrycks & Dietterich, 2018;Gilmer et al, 2018). Zeng et al (2017) generate adversarial examples by altering physical parameters using a rendering network trained to approximate the physics of realistic image formation. This data-driven approach leads to an image formation model biased towards the rendering style present in the training data.…”

Section: Related Workmentioning

confidence: 99%

“…Even with perfect training, in their reported performance, it still requires 12 minutes on average to find new adversaries, we only take a few seconds Section 4.1. Our approach is based on a differentiable physically-based renderer that directly (and, so, more convincingly) models the image formation process, allowing us to alter physical parameters -like geometry and lighting -and compute (Zeng et al, 2017). We summarize the difference between our approach and the previous non-image adversarial attacks in Table 1.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Liu,

Tao,

et al. 2018

Preprint

View full text Add to dashboard Cite

Many machine learning image classifiers are vulnerable to adversarial attacks, inputs with perturbations designed to intentionally trigger misclassification. Current adversarial methods directly alter pixel colors and evaluate against pixel norm-balls: pixel perturbations smaller than a specified magnitude, according to a measurement norm. This evaluation, however, has limited practical utility since perturbations in the pixel space do not correspond to underlying real-world phenomena of image formation that lead to them and has no security motivation attached. Pixels in natural images are measurements of light that has interacted with the geometry of a physical scene. As such, we propose a novel evaluation measure, parametric normballs, by directly perturbing physical parameters that underly image formation. One enabling contribution we present is a physically-based differentiable renderer that allows us to propagate pixel gradients to the parametric space of lighting and geometry. Our approach enables physically-based adversarial attacks, and our differentiable renderer leverages models from the interactive rendering literature to balance the performance and accuracy trade-offs necessary for a memory-efficient and scalable adversarial data augmentation workflow.

show abstract

Section: Related Workmentioning

confidence: 98%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Liu,

Tao,

et al. 2018

Preprint

View full text Add to dashboard Cite

show abstract

“…Other Threat Models Some recent work has focused on spatial threat models, which allow for slight perturbations of the locations of features in an input rather than perturbations of the features themselves [23,22,3]. Others have proposed threat models based on properties of a 3D renderer [25], modification of an image's hue and saturation [6], and inverting images [7]. See appendix D for discussion of non-additive threat models and comparison to our proposed functional threat model.…”

Section: Review Of Existing Threat Modelsmentioning

confidence: 99%

“…Other Threat Models A few papers have focused on threat models that are neither additive or spatial. Zeng et al [25] perturb the properties of a 3D renderer to render an image of an object which is unrecognizable to a classifier or other machine learning algorithm. Hosseini and Poovendran [6] propose "Semantic Adversarial Examples," which allow modifications of the input image's hue and saturation.…”

Section: Non-additive Threat Modelsmentioning

confidence: 99%

Functional Adversarial Attacks

Laidlaw,

Feizi

2019

Preprint

View full text Add to dashboard Cite

We propose functional adversarial attacks, a novel class of threat models for crafting adversarial examples to fool machine learning models. Unlike a standard p -ball threat model, a functional adversarial threat model allows only a single function to be used to perturb input features to produce an adversarial example. For example, a functional adversarial attack applied on colors of an image can change all red pixels simultaneously to light red. Such global uniform changes in images can be less perceptible than perturbing pixels of the image individually. For simplicity, we refer to functional adversarial attacks on image colors as ReColorAdv, which is the main focus of our experiments. We show that functional threat models can be combined with existing additive ( p ) threat models to generate stronger threat models that allow both small, individual perturbations and large, uniform changes to an input. Moreover, we prove that such combinations encompass perturbations that would not be allowed in either constituent threat model. In practice, ReCol-orAdv can significantly reduce the accuracy of a ResNet-32 trained on CIFAR-10. Furthermore, to the best of our knowledge, combining ReColorAdv with other attacks leads to the strongest existing attack even after adversarial training.Preprint. Under review.

show abstract

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Adversarial Attacks Beyond the Image Space

Cited by 7 publications

References 26 publications

Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Beyond Pixel Norm-Balls: Parametric Adversaries using an Analytically Differentiable Renderer

Functional Adversarial Attacks

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Contact Info

Product

Resources

About