Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Duan, Ranjie; Ma, Xingjun; Wang, Yisen; Bailey, James E.; Qin, A. K.; Ye, Yun

doi:10.1109/cvpr42600.2020.00108

Cited by 192 publications

(118 citation statements)

References 20 publications

Supporting

Mentioning

118

Contrasting

Order By: Relevance

“…14. Representative examples of successful physical world attacks to fool recognition systems with AdvCam [273], RP2 [123] and adversarial patch [45]. object detectors can be fooled in vehicle detectioin scenarios.…”

Section: Physical World Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: Physical World Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…Although external features are well defined, how to construct them is still difficult since the learning dynamic of DNNs remains unclear and the concept of features itself is complicated. However, at least we know that the image style can serve as a feature for the learning of DNNs in imagerelated tasks, based on some recent studies (Geirhos et al 2019;Duan et al 2020;Cheng et al 2021). As such, we can use style transfer (Johnson, Alahi, and Fei-Fei 2016;Huang and Belongie 2017;Chen et al 2020) for embedding external features.…”

Section: Embedding External Featuresmentioning

confidence: 99%

Defending against Model Stealing via Verifying Embedded External Features

Li¹,

Zhu²,

Xing³

et al. 2021

Preprint

View full text Add to dashboard Cite

Obtaining a well-trained model involves expensive data collection and training procedures, therefore the model is a valuable intellectual property. Recent studies revealed that adversaries can 'steal' deployed models even when they have no training samples and can not get access to the model parameters or structures. Currently, there were some defense methods to alleviate this threat, mostly by increasing the cost of model stealing. In this paper, we explore the defense from another angle by verifying whether a suspicious model contains the knowledge of defender-specified external features. Specifically, we embed the external features by tempering a few training samples with style transfer. We then train a meta-classifier to determine whether a model is stolen from the victim. This approach is inspired by the understanding that the stolen models should contain the knowledge of features learned by the victim model. We examine our method on both CIFAR-10 and ImageNet datasets. Experimental results demonstrate that our method is effective in detecting different types of model stealing simultaneously, even if the stolen model is obtained via a multi-stage stealing process. The codes for reproducing main results are available at Github (https://github.com/zlh-thu/StealingVerification).

show abstract

“…Therefore, we can see that deep learning is facing many security problems. The scenarios which the adversaries can attack includes face recognition( [13]), disease diagnosis( [14]), spam detection( [15]), autonomous driving( [16]) and so on. How to defend against these attacks is still an open problem for researchers.…”

Section: Introductionmentioning

confidence: 99%

Use Procedural Noise to Achieve Backdoor Attack

Chen

2021

IEEE Access

View full text Add to dashboard Cite

In recent years, more researchers pay their attention to the security of artificial intelligence. The backdoor attack is one of the threats and has a powerful, stealthy attack ability. There exist a growing trend towards the triggers is that the triggers become dynamic and global. In this paper, we propose a novel global backdoor trigger generated by procedural noise. Our backdoor triggers are much stealthy and straightforward to implement compared with most triggers. There are three types of procedural noise, and we evaluate the attack ability for the triggers with them on the different classification datasets, including CIFAR-10, GTSRB, CelebA, and ImageNet12.The experiment results show that our attack approach can bypass most defense approaches, even for the inspections of humans. We only need poison 5%-10% training data, and the attack success rate(ASR) can reach over 99%. To test the robustness of the backdoor model against the corruption methods that in practice, we introduce 17 corruption methods and compute the accuracy, attack success rate(ASR) of the backdoor model. The facts show that the backdoor models generated by our approaches have strong robustness for the most corruption methods and can be applied in reality.

show abstract

Adversarial Camouflage: Hiding Physical-World Attacks With Natural Styles

Cited by 192 publications

References 20 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Defending against Model Stealing via Verifying Embedded External Features

Use Procedural Noise to Achieve Backdoor Attack

Contact Info

Product

Resources

About