Frequency-Tuned Universal Adversarial Perturbations

Deng, Yingpeng; Karam, Lina J.

doi:10.1007/978-3-030-68238-5_36

Cited by 11 publications

(3 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given the lack of UAP schemes specifically tailored for face recognition, in our comparative analysis, we compared our proposed method KRT-FUAP with existing solutions in other fields, including UAP [10], FG-UAP [41], and FTGAP [42], which are used for natural and texture images. Although these methods are initially designed for other tasks, we modified them to suit the face recognition task in this study.…”

Section: Comparison Experimentsmentioning

confidence: 99%

KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation

Jin,

Liu,

Sun

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

It has been established that convolutional neural networks are susceptible to elaborate tiny universal adversarial perturbations (UAPs) in natural image classification tasks. However, UAP attacks against face recognition systems have not been fully explored. This paper proposes a spatial perturbation method that generates UAPs with local stealthiness by learning variable flow field to fine-tune facial key regions (KRT-FUAP). We ensure that the generated adversarial perturbations are positioned within reasonable regions of the face by designing a mask specifically tailored to facial key regions. In addition, we pay special attention to improving the effectiveness of the attack while maintaining the stealthiness of the perturbation and achieve the dual optimization of aggressiveness and stealthiness by accurately controlling the balance between adversarial loss and stealthiness loss. Experiments conducted on the frameworks of IResNet50 and MobileFaceNet demonstrate that our proposed method achieves an attack performance comparable to existing natural image universal attack methods, but with significantly improved stealthiness.

show abstract

Section: Comparison Experimentsmentioning

confidence: 99%

KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation

Jin,

Liu,

Sun

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

show abstract

“…Hayes and Danezis [21] trained a generative model to learn an implicit distribution over the set of perturbations, minimizing a margin-based loss function for learning the model. Other prominent methods for generating perturbations include Fast Feature Fool [50], singular vectors [51], and frequency-tuned UAPs [52].…”

Section: Universal Adversarial Perturbationsmentioning

confidence: 99%

Fast Locally Optimal Detection of Targeted Universal Adversarial Perturbations

Goel

Moulin

2022

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

This paper proposes a locally-optimal generalized likelihood ratio test (LO-GLRT) for detecting targeted attacks on a classifier, where the attacks add a norm-bounded targeted universal adversarial perturbation (UAP) to the classifier's input. The paper includes both an analysis of the test as well as its empirical evaluation. The analysis provides an expression for the approximate lower bound of the detection probability, and the empirical evaluation shows this approximation to be similar to the actual detection probability. Since the LO-GLRT requires the score function of the input distribution, which is usually unknown in practice, we study the LO-GLRT for a learned surrogate input distribution. Specifically, we use a Gaussian distribution over the input subvectors as the surrogate distribution, for its mathematical tractability and computational efficiency. We evaluate the detector for several popular image classifiers and datasets, and compare the statistical and computational performance with the perturbation rectifying network (PRN) detector, another successful approach for detecting the UAPs. The LO-GLRT outperforms the PRN detector on both counts, with a running time at least 100 times lower than that of the PRN detector.

show abstract

“…Ehrlich and Davis (2019) first explored benefits of frequency-domain deep learning. Guo, Frank, and Weinberger (2019), Sharma, Ding, and Brubaker (2019), and Deng and Karam (2020) exploit low-frequency image features to optimize perturbation within a predefined, constant low-frequency region. However, the assumption that DNN sensitivity maps to fixed frequency regions is disclaimed in Maiya et al (2021), where different frequency regions yield varying sensitivity, with a higher sensitivity tendency towards lower coefficients.…”

Section: Introductionmentioning

confidence: 99%

Towards Transferable Adversarial Attacks with Centralized Perturbation

Wu,

Tan,

Wang

et al. 2024

AAAI

View full text Add to dashboard Cite

Adversarial transferability enables black-box attacks on unknown victim deep neural networks (DNNs), rendering attacks viable in real-world scenarios. Current transferable attacks create adversarial perturbation over the entire image, resulting in excessive noise that overfit the source model. Concentrating perturbation to dominant image regions that are model-agnostic is crucial to improving adversarial efficacy. However, limiting perturbation to local regions in the spatial domain proves inadequate in augmenting transferability. To this end, we propose a transferable adversarial attack with fine-grained perturbation optimization in the frequency domain, creating centralized perturbation. We devise a systematic pipeline to dynamically constrain perturbation optimization to dominant frequency coefficients. The constraint is optimized in parallel at each iteration, ensuring the directional alignment of perturbation optimization with model prediction. Our approach allows us to centralize perturbation towards sample-specific important frequency features, which are shared by DNNs, effectively mitigating source model overfitting. Experiments demonstrate that by dynamically centralizing perturbation on dominating frequency coefficients, crafted adversarial examples exhibit stronger transferability, and allowing them to bypass various defenses.

show abstract

Frequency-Tuned Universal Adversarial Perturbations

Cited by 11 publications

References 30 publications

KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation

KRT-FUAP: Key Regions Tuned via Flow Field for Facial Universal Adversarial Perturbation

Fast Locally Optimal Detection of Targeted Universal Adversarial Perturbations

Towards Transferable Adversarial Attacks with Centralized Perturbation

Contact Info

Product

Resources

About