Adversarial Learning With Margin-Based Triplet Embedding Regularization

Zhong, Yaoyao; Deng, Weihong

doi:10.1109/iccv.2019.00665

Cited by 40 publications

(26 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given a face pair and a deep face model, [75] proposed feature-level attacks to compare the face pair via calculating the distance between their normalized deep representations. These representations are similar to the embedding features, except that they are normalized and extracted from the deep face model.…”

Section: ) Feature Fast and Iterative Attack Methodsmentioning

confidence: 99%

“…The empirical results validated the effectiveness of the proposed method on the LFW benchmark dataset. Zhong and Deng [75] offered to recover the local smoothness of the representation space by integrating a margin-based triplet embedding regularization (MTER) term into the classification objective so that the acquired model learns to resist adversarial examples. The regularization term consists of a two-phase optimization that detects probable perturbations and punishes those using a large margin in an iterative approach.…”

Section: ) Changing the Networkmentioning

confidence: 99%

“…As described in this study, several image-, face-, and featurelevel adversarial example generation methods have been proposed to fool FR systems; however, these methods are challenging to construct a generalized adversarial example and can only achieve good performance in a certain evaluation metrics. These evaluation metrics are mainly divided into three categories: The SR to generate adversarial examples, the robustness of the FR models, and specific attributes of the attacks, such as the perturbation amount and [14] Changing the network Filter responses of CNN; dropout of filter responses [108] Changing the network Conversion of traditional blocks of deep learning models into blocks similar to the blocks in the blockchain [109] Changing the network Design of ResGN model + employment of a pixel loss, a texture loss, and a verification loss for parameter optimization [75] Changing the network Integration of MTER term into the classification objective for detection and punishment of perturbations [111] Changing the network Exploration of the adversary's evolution by tracking the trajectory of deep features representations [112] Changing the network Design of a low-power and highly secure always-on FR processor [113] Supplementing external network(s)…”

Section: A Particularization/specification Of Adversarial Examplesmentioning

confidence: 99%

See 2 more Smart Citations

Adversarial Attacks Against Face Recognition: A Comprehensive Study

2021

View full text Add to dashboard Cite

Face recognition (FR) systems have demonstrated reliable verification performance, suggesting suitability for real-world applications ranging from photo tagging in social media to automated border control (ABC). In an advanced FR system with deep learning-based architecture, however, promoting the recognition efficiency alone is not sufficient, and the system should also withstand potential kinds of attacks. Recent studies show that (deep) FR systems exhibit an intriguing vulnerability to imperceptible or perceptible but natural-looking adversarial input images that drive the model to incorrect output predictions. In this article, we present a comprehensive survey on adversarial attacks against FR systems and elaborate on the competence of new countermeasures against them. Further, we propose a taxonomy of existing attack and defense methods based on different criteria. We compare attack methods on the orientation, evaluation process, and attributes, and defense approaches on the category. Finally, we discuss the challenges and potential research direction.

show abstract

Section: ) Feature Fast and Iterative Attack Methodsmentioning

confidence: 99%

Section: ) Changing the Networkmentioning

confidence: 99%

Section: A Particularization/specification Of Adversarial Examplesmentioning

confidence: 99%

See 1 more Smart Citation

Adversarial Attacks Against Face Recognition: A Comprehensive Study

2021

View full text Add to dashboard Cite

show abstract

“…Regarding regularization [37,38,39,40] and normalization [41,42,43,44] techniques, they can help to achieve a better input abstraction or faster convergence. In [37], for example, a region dropout is applied to the network input as a data augmentation strategy.…”

Section: Related Workmentioning

confidence: 99%

“…In [37], for example, a region dropout is applied to the network input as a data augmentation strategy. The authors of [38], instead, develop an elastic regularization strategy to capture differences among diverse inputs; while in [39], a regularization term is applied to smooth the network output and avoid misclassifying wrong inputs. Regularization procedures can also be defined for internal layers as shown by [40], where a parametrized regularization is designed to improve the model performance by accounting for both network filters and penalty functions.…”

Section: Related Workmentioning

confidence: 99%

SIRe-Networks: Skip Connections over Interlaced Multi-Task Learning and Residual Connections for Structure Preserving Object Classification

Avola,

Cinque,

Fagioli

et al. 2021

Preprint

View full text Add to dashboard Cite

Improving existing neural network architectures can involve several design choices such as manipulating the loss functions, employing a diverse learning strategy, exploiting gradient evolution at training time, optimizing the network hyper-parameters, or increasing the architecture depth. The latter approach is a straightforward solution, since it directly enhances the representation capabilities of a network; however, the increased depth generally incurs in the well-known vanishing gradient problem. In this paper, borrowing from different methods addressing this issue, we introduce an interlaced multi-task learning strategy, defined SIRe, to reduce the vanishing gradient in relation to the object classification task. The presented methodology directly improves a convolutional neural network (CNN) by enforcing the input image structure preservation through interlaced auto-encoders, and further refines the base network architecture by means of skip and residual connections. To validate the presented methodology, a simple CNN and various implementations of famous networks are extended via the SIRe strategy and extensively tested on the CIFAR100 dataset; where the SIRe-extended architectures achieve significantly increased performances across all models, thus confirming the presented approach effectiveness.

show abstract

Adversarial Ranking Attack and Defense

Zhou

Niu²,

Wang³

et al. 2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Deep Neural Network classifiers are vulnerable to adversarial attack, where an imperceptible perturbation could result in misclassification. However, the vulnerability of DNN-based image ranking systems remains under-explored. In this paper, we propose two attacks against deep ranking systems, i.e., Candidate Attack and Query Attack, that can raise or lower the rank of chosen candidates by adversarial perturbations. Specifically, the expected ranking order is first represented as a set of inequalities, and then a triplet-like objective function is designed to obtain the optimal perturbation. Conversely, an anti-collapse triplet defense is proposed to improve the ranking model robustness against all proposed attacks, where the model learns to prevent the positive and negative samples being pulled close to each other by adversarial attack. To comprehensively measure the empirical adversarial robustness of a ranking model with our defense, we propose an empirical robustness score, which involves a set of representative attacks against ranking models. Our adversarial ranking attacks and defenses are evaluated on MNIST, Fashion-MNIST, CUB200-2011, CARS196 and Stanford Online Products datasets. Experimental results demonstrate that a typical deep ranking system can be effectively compromised by our attacks. Nevertheless, our defense can significantly improve the ranking system robustness, and simultaneously mitigate a wide range of attacks.

show abstract

Adversarial Learning With Margin-Based Triplet Embedding Regularization

Cited by 40 publications

References 39 publications

Adversarial Attacks Against Face Recognition: A Comprehensive Study

Adversarial Attacks Against Face Recognition: A Comprehensive Study

SIRe-Networks: Skip Connections over Interlaced Multi-Task Learning and Residual Connections for Structure Preserving Object Classification

Adversarial Ranking Attack and Defense

Contact Info

Product

Resources

About