Improving the invisibility of adversarial examples with perceptually adaptive perturbation

Zhang, Yaoyuan; Tan, Yuan; Sun, Haipeng; Zhao, Yuhang; Zhang, Quanxing; Li, Yuanzhang

doi:10.1016/j.ins.2023.03.139

Cited by 7 publications

(1 citation statement)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Wang et al [16] are concerned about the neglect of global perturbation for image content/spatial structure, which can result in leaving obvious artifacts in otherwise clean regions of the original image, and therefore propose to adaptively assign perturbations based on the Just Noticeable Difference (JND) of the human eye by adaptively adjusting the perturbation strength by using the pixelby-pixel perceptual redundancy of the adversarial example as a loss function. Similarly, Zhang et al [17] add the JND of the image as a priori information to the adversarial attack and project the perturbation into the JND space of the original image. Furthermore, they add a visual coefficient to adjust the projection direction of the perturbation to consciously equalize the transferability and invisibility of the adversarial example.…”

Section: Related Work 21 Black-box Adversarial Attacksmentioning

confidence: 99%

Exploiting Frequency Characteristics for Boosting the Invisibility of Adversarial Attacks

Li,

Liu,

Zhang

et al. 2024

Applied Sciences

View full text Add to dashboard Cite

Mainstream transferable adversarial attacks tend to introduce noticeable artifacts into the generated adversarial examples, which will impair the invisibility of adversarial perturbation and make these attacks less practical in real-world scenarios. To deal with this problem, in this paper, we propose a novel black-box adversarial attack method that can significantly improve the invisibility of adversarial examples. We analyze the sensitivity of a deep neural network in the frequency domain and take into account the characteristics of the human visual system in order to quantify the contribution of each frequency component in adversarial perturbation. Then, we collect a set of candidate frequency components that are insensitive to the human visual system by applying K-means clustering and we propose a joint loss function during the generation of adversarial examples, limiting the frequency distribution of perturbations during attacks. The experimental results show that the proposed method significantly outperforms existing transferable black-box adversarial attack methods in terms of invisibility, which verifies the superiority, applicability and potential of this work.

show abstract

Section: Related Work 21 Black-box Adversarial Attacksmentioning

confidence: 99%