Deep Neural Network Attacks and Defense: The Case of Image Classification

Zhang, Hanwei; Furon, Teddy; Amsaleg, Laurent; Avrithis, Yannis

doi:10.1002/9781119901808.ch2

Cited by 1 publication

(1 citation statement)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Adversarial Attack. Formally, adversarial attacks can be framed as optimization problems that adhere to the attack goals and constraints, leading to efficient strategies for crafting adversarial examples (Moosavi-Dezfooli, Fawzi, and Frossard 2016;Zhang et al 2020bZhang et al , 2022. The complexity of an adversarial attack depends on the adversary's knowledge level.…”

Section: Related Workmentioning

confidence: 99%

NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack

Jiang,

Zhang,

Wang

et al. 2024

AAAI

View full text Add to dashboard Cite

Adversarial attacks, i.e., generating adversarial perturbations with a small magnitude to deceive deep neural networks, are important for investigating and improving model trustworthiness. Traditionally, the topic was scoped within 2D images without considering 3D multiview information. Benefiting from Neural Radiance Fields (NeRF), one can easily reconstruct a 3D scene with a Multi-Layer Perceptron (MLP) from given 2D views and synthesize photo-realistic renderings of novel vantages. This opens up a door to discussing the possibility of undertaking to attack multiview NeRF network with downstream tasks from different rendering angles, which we denote Neural Radiance Fiels-based multiview adversarial Attack (NeRFail). The goal is, given one scene and a subset of views, to deceive the recognition results of agnostic view angles as well as given views. To do so, we propose a transformation mapping from pixels to 3D points such that our attack generates multiview adversarial perturbations by attacking a subset of images with different views, intending to prevent the downstream classifier from correctly predicting images rendered by NeRF from other views. Experiments show that our multiview adversarial perturbations successfully obfuscate the downstream classifier at both known and unknown views. Notably, when retraining another NeRF on the perturbed training data, we show that the perturbation can be inherited and reproduced. The code can be found at https://github.com/jiang-wenxiang/NeRFail.

show abstract

Section: Related Workmentioning

confidence: 99%