ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches

Pintor, Maura; Angioni, Daniele; Sotgiu, Angelo; Demetrio, Luca; Demontis, Ambra; Biggio, Battista; Roli, Fabio

doi:10.1016/j.patcog.2022.109064

Cited by 35 publications

(18 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Given the practical implications of p robustness, there has been growing interest in studying broader threat models that allow for large, perceptible perturbations to images. Examples include robustness to spatial transformations [29,30] and adversarial patches [31,32,33,34,35]. The majority of the work in this category considers local or simple transformations that retain most of original pixel content.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Benchmarking Robustness to Adversarial Image Obfuscations

Stimberg¹,

Chakrabarti²,

Lu³

et al. 2023

Preprint

View full text Add to dashboard Cite

Automated content filtering and moderation is an important tool that allows online platforms to build striving user communities that facilitate cooperation and prevent abuse. Unfortunately, resourceful actors try to bypass automated filters in a bid to post content that violate platform policies and codes of conduct. To reach this goal, these malicious actors may obfuscate policy violating images (e.g. overlay harmful images by carefully selected benign images or visual patterns) to prevent machine learning models from reaching the correct decision. In this paper, we invite researchers to tackle this specific issue and present a new image benchmark. This benchmark, based on IMAGENET, simulates the type of obfuscations created by malicious actors. It goes beyond IMAGENET-C and IMAGENET-C by proposing general, drastic, adversarial modifications that preserve the original content intent. It aims to tackle a more common adversarial threat than the one considered by pnorm bounded adversaries. We evaluate 33 pretrained models on the benchmark and train models with different augmentations, architectures and training methods on subsets of the obfuscations to measure generalization. We hope this benchmark will encourage researchers to test their models and methods and try to find new approaches that are more robust to these obfuscations.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Adversarial Patches The image is shrunk and one of 3 different adversarial patches are overlayed onto the corners of the image. The patches are taken from [35].…”

Section: A5 Machine-learning-based Obfuscationsmentioning

confidence: 99%

Benchmarking Robustness to Adversarial Image Obfuscations

Stimberg¹,

Chakrabarti²,

Lu³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…We introduce the first study on a new minimum-budget topology attack. In addition, different from the previous simple convex constraint on budget, we need to solve an intractable non-convex constraint on GNN which cannot be directly solved by PGD [23].…”

Section: Related Workmentioning

confidence: 99%

“…While the attacker with an adaptive budget will learn a minimum perturbation (green dotted circle Δ ★ 𝑣 ) for crossing the decision boundary, which is challenging. With misclassification guarantee of non-convex GNN, the minimum-budget topology attack is essentially a non-convex constrained optimization problem, where PGD-based model can not be directly used [23]. And the greedy-based model is too myopic to find a good solution [20].…”

Section: Introductionmentioning

confidence: 99%

Minimum Topology Attacks for Graph Neural Networks

Zhang

Wang

Shi

et al. 2023

Proceedings of the ACM Web Conference 2023

View full text Add to dashboard Cite

With the great popularity of Graph Neural Networks (GNNs), their robustness to adversarial topology attacks has received significant attention. Although many attack methods have been proposed, they mainly focus on fixed-budget attacks, aiming at finding the most adversarial perturbations within a fixed budget for target node. However, considering the varied robustness of each node, there is an inevitable dilemma caused by the fixed budget, i.e., no successful perturbation is found when the budget is relatively small, while if it is too large, the yielding redundant perturbations will hurt the invisibility. To break this dilemma, we propose a new type of topology attack, named minimum-budget topology attack, aiming to adaptively find the minimum perturbation sufficient for a successful attack on each node. To this end, we propose an attack model, named MiBTack, based on a dynamic projected gradient descent algorithm, which can effectively solve the involving non-convex constraint optimization on discrete topology. Extensive results on three GNNs and four real-world datasets show that MiBTack can successfully lead all target nodes misclassified with the minimum perturbation edges. Moreover, the obtained minimum budget can be used to measure node robustness, so we can explore the relationships of robustness, topology, and uncertainty for nodes, which is beyond what the current fixed-budget topology attacks can offer. CCS CONCEPTS• Computer systems organization → Embedded systems; • Networks → Network reliability.

show abstract

“…To comprehensively assess the robustness of these models, we conducted rigorous experiments involving a diverse set of classifiers and detectors, representing a wide range of mainstream methods. Through this extensive evaluation, we have uncovered insightful and intriguing findings that illuminate the relationship between the crafting of [32] IEEE Access ✓ ✕ ✕ ✕ ✕ ✕ 2018 [34] Computer Science Review ✓ ✕ ✕ ✕ ✕ ✕ 2018 [31] arXiv ✓ ✕ ✕ ✕ ✕ ✕ 2019 [33] Applied Science ✓ ✕ ✕ ✕ ✕ ✕ 2020 [42] ACM Computing Surveys ✓ ✕ ✕ ✕ ✕ ✕ 2021 [35] IEEE Access ✓ ✕ ✕ ✕ ✕ ✕ 2021 [41] ACM Computing Surveys ✓ ✕ ✕ ✕ ✕ ✕ 2021 [40] TII ✓ ✕ ✕ ✕ ✕ ✕ 2022 [47] arXiv ✓ * ✕ ✕ ✕ ✕ 2022 [48] INJOIT ✓ ✕ ✕ ✕ ✕ ✕ 2022 [49] Artificial Intelligence Review ✓ ✕ ✓ ✕ ✓ ✕ 2022 [39] TPAMI ✓ ✕ ✕ ✕ ✕ ✕ 2022 [38] TII ✕ ✕ ✕ ✕ ✕ ✕ 2022 [49] arXiv ✓ * ✕ ✕ ✕ ✕ 2022 [25] arXiv ✓ ✕ ✕ ✕ ✕ ✕ 2022 [44] arXiv ✓ * ✕ ✕ ✕ ✕ 2022 [45] arXiv * ✓ ✕ ✕ ✕ ✕ 2022 [37] Neurocomputing ✓ ✕ ✕ ✕ ✕ ✕ 2023 [50] ACM Computing Surveys * ✕ ✕ ✕ ✕ ✕ 2023 [28] arXiv ✓ ✕ ✕ ✕ ✕ ✕ 2023 [46] ICAI * ✓ ✕ ✕ ✕ ✕ Benchmarks 2020 [29] CVPR ✕ ✕ ✓ ✕ ✓ ✕ 2021 [27] arXiv ✕ ✕ ✓ ✕ ✓ ✓ 2022 [51] IJCAI ✕ ✕ ✕ ✓ ✓ ✕ 2022 [26] NIPS ✕ ✕ ✓ ✕ ✓ ✕ 2022 [52] arXiv ✕ ✕ ✕ ✓ ✓ ✕ 2022 [36] Pattern Recognition ✕ ✕ ✓ ✕ ✓ ✕ 2023 [30] arXiv ✕ ✕ ✓ ✕ ✓ ✓ 2023 [53] Pattern Recognition ✕ ✕ ✓ ✕ ✓ ✕ 2023 [54] CVPR…”

Section: Introductionmentioning

confidence: 99%

Benchmarking Adversarial Patch Against Aerial Detection

Lian

Mei

Zhang

et al. 2022

IEEE Trans. Geosci. Remote Sensing

View full text Add to dashboard Cite

Deep neural networks (DNNs) have found widespread applications in interpreting remote sensing (RS) imagery. However, it has been demonstrated in previous works that DNNs are vulnerable to different types of noises, particularly adversarial noises. Surprisingly, there has been a lack of comprehensive studies on the robustness of RS tasks, prompting us to undertake a thorough survey and benchmark on the robustness of image classification and object detection in RS. To our best knowledge, this study represents the first comprehensive examination of both natural robustness and adversarial robustness in RS tasks. Specifically, we have curated and made publicly available datasets that contain natural and adversarial noises. These datasets serve as valuable resources for evaluating the robustness of DNNs-based models. To provide a comprehensive assessment of model robustness, we conducted meticulous experiments with numerous different classifiers and detectors, encompassing a wide range of mainstream methods. Through rigorous evaluation, we have uncovered insightful and intriguing findings, which shed light on the relationship between adversarial noise crafting and model training, yielding a deeper understanding of the susceptibility and limitations of various models, and providing guidance for the development of more resilient and robust models

show abstract

ImageNet-Patch: A dataset for benchmarking machine learning robustness against adversarial patches

Cited by 35 publications

References 28 publications

Benchmarking Robustness to Adversarial Image Obfuscations

Benchmarking Robustness to Adversarial Image Obfuscations

Minimum Topology Attacks for Graph Neural Networks

Benchmarking Adversarial Patch Against Aerial Detection

Contact Info

Product

Resources

About