Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions

Mopuri, Konda Reddy; Uppala, Phani Krishna; Babu, R. Venkatesh

doi:10.48550/arxiv.1808.01153

Cited by 2 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The norm loss L n is the same as (22), so the total loss L t of the targeted attack can be derived as follows: All the experiments were performed under standard operating conditions (SOC), which included ten ground target classes, such as self-propelled howitzers (2S1); infantry fighting vehicles (BMP2); armored reconnaissance vehicles (BRDM2); wheeled armored transport vehicles (BTR60, BTR70); bulldozers (D7); main battle tanks (T62, T72); cargo trucks (ZIL131); and self-propelled artillery (ZSU234). The training dataset contains 2747 images collected at a 17 • depression angle, and the testing dataset contains 2426 images captured at a 15 • depression angle.…”

Section: Design Of Loss Functionsmentioning

confidence: 99%

“…Mopuri et al [21] argue that it is difficult for attackers to obtain the training dataset of the victim model, so to reduce the dependence on the dataset, they proposed a data-free method to generate UAPs by destroying the features extracted by convolutional layers. Another data-free work [22] used class impressions to simulate a real data distribution, generating UAPs with high transferability. In the field of remote sensing, Xu et al [23] were the first to investigate the adversarial attack and defense in safety-critical remote sensing tasks.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation

Du¹,

Bi²,

Du³

et al. 2022

Remote Sensing

View full text Add to dashboard Cite

Recent studies have proven that synthetic aperture radar (SAR) automatic target recognition (ATR) models based on deep neural networks (DNN) are vulnerable to adversarial examples. However, existing attacks easily fail in the case where adversarial perturbations cannot be fully fed to victim models. We call this situation perturbation offset. Moreover, since background clutter takes up most of the area in SAR images and has low relevance to recognition results, fooling models with global perturbations is quite inefficient. This paper proposes a semi-white-box attack network called Universal Local Adversarial Network (ULAN) to generate universal adversarial perturbations (UAP) for the target regions of SAR images. In the proposed method, we calculate the model’s attention heatmaps through layer-wise relevance propagation (LRP), which is used to locate the target regions of SAR images that have high relevance to recognition results. In particular, we utilize a generator based on U-Net to learn the mapping from noise to UAPs and craft adversarial examples by adding the generated local perturbations to target regions. Experiments indicate that the proposed method effectively prevents perturbation offset and achieves comparable attack performance to conventional global UAPs by perturbing only a quarter or less of SAR image areas.

show abstract

Section: Design Of Loss Functionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation

Du¹,

Bi²,

Du³

et al. 2022

Remote Sensing

View full text Add to dashboard Cite

show abstract

“…The norm loss L n is the same as (22), so the total loss L t of the targeted attack can be derived as follows: angle. More details about the dataset are shown in Table 2, and Figure 6 shows the optical images and corresponding SAR images of ten ground target classes.…”

Section: Design Of Loss Functionsmentioning

confidence: 99%

“…Mopuri et al [21] argue that it is difficult for attackers to obtain the training dataset of the victim model, so to reduce the dependence on the dataset, they propose a data-free method to generate UAPs by destroying the features extracted by convolutional layers. Another data-free work [22] uses class impressions to simulate real data distribution, generating UAPs with high transferability. In the field of remote sensing, Xu et al [23] are the first to investigate the adversarial attack and defense in safety-critical remote sensing tasks.…”

Section: Introductionmentioning

confidence: 99%

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-wise Relevance Propagation

Du¹,

Bi²,

Du³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent studies have proven that synthetic aperture radar (SAR) automatic target recognition (ATR) models based on deep neural networks (DNN) are vulnerable to adversarial examples. However, existing attacks are easily failed in the case where adversarial perturbations cannot be fully fed to victim models. We call this situation perturbation offset. Moreover, since background clutter takes up most of the areas in SAR images and has low relevance to recognition results, fooling models with global perturbations is quite inefficient. This paper proposes a semi-whitebox attack network, called Universal Local Adversarial Network (ULAN), to generate universal adversarial perturbations (UAP) for the target regions of SAR images. In the proposed network, we calculate the model’s attention heatmaps through layer-wise relevance propagation (LRP), which is used to locate the target regions of SAR images that have high relevance to recognition results. In particular, we utilize a generator based on the U-Net to learn the mapping from noise to UAPs and craft adversarial examples by adding the generated local perturbations to target regions. Experiments indicate that the proposed method fundamentally prevents perturbation offset and achieves comparable attack performance to conventional global UAPs by perturbing only a quarter or less of SAR image areas.

show abstract

Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions

Cited by 2 publications

References 0 publications

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-Wise Relevance Propagation

ULAN: A Universal Local Adversarial Network for SAR Target Recognition Based on Layer-wise Relevance Propagation

Contact Info

Product

Resources

About