Spatially Localized Perturbation GAN (SLP-GAN) for Generating Invisible Adversarial Patches

Kim, Yong‐Su; Kang, Hyoeun; Mukaroh, Afifatul; Suryanto, Naufal; Larasati, Harashta Tatimma; Kim, Howon

doi:10.1007/978-3-030-65299-9_1

“…Table 4 shows examples of traffic sign mock ups with and without adversarial patches and the classification results. The previous SLP-GAN version had an attack performance that reduced the classification accuracy of the target model from 97.8% to 38.0% [18]. We observe in Table 3 that the enhanced version, eSLP-GAN, had a higher attack performance than the previous version.…”

Section: Classification Modelsmentioning

confidence: 89%

“…In our previous work, we proposed a spatially localized perturbation GAN (SLP-GAN) [18] that generated a spatially localized perturbation as an adversarial patch to attack classifiers. It had the advantage that it could generate visually natural patches while maintaining a high attack success rate.…”

Section: Introductionmentioning

confidence: 99%

Extended Spatially Localized Perturbation GAN (eSLP-GAN) for Robust Adversarial Camouflage Patches

Kim

¹

,

Kang

²

,

Suryanto

³

et al. 2021

Sensors

Self Cite

View full text Add to dashboard Cite

Deep neural networks (DNNs), especially those used in computer vision, are highly vulnerable to adversarial attacks, such as adversarial perturbations and adversarial patches. Adversarial patches, often considered more appropriate for a real-world attack, are attached to the target object or its surroundings to deceive the target system. However, most previous research employed adversarial patches that are conspicuous to human vision, making them easy to identify and counter. Previously, the spatially localized perturbation GAN (SLP-GAN) was proposed, in which the perturbation was only added to the most representative area of the input images, creating a spatially localized adversarial camouflage patch that excels in terms of visual fidelity and is, therefore, difficult to detect by human vision. In this study, the use of the method called eSLP-GAN was extended to deceive classifiers and object detection systems. Specifically, the loss function was modified for greater compatibility with an object-detection model attack and to increase robustness in the real world. Furthermore, the applicability of the proposed method was tested on the CARLA simulator for a more authentic real-world attack scenario.

show abstract

“…Some researchers have used modified GANs to create adversarial examples and examples include AdvGAN [21], SLP-GAN [10], and Attack-Inspired GAN (AI-GAN) [1].…”

Section: Related Workmentioning

confidence: 99%

Using a GAN to Generate Adversarial Examples to Facial Image Recognition

Andrew¹,

F.²

2022

ei

4

0

View full text Add to dashboard Cite

Images posted online present a privacy concern in that they may be used as reference examples for a facial recognition system. Such abuse of images is in violation of privacy rights but is difficult to counter. It is well established that adversarial example images can be created for recognition systems which are based on deep neural networks. These adversarial examples can be used to disrupt the utility of the images as reference examples or training data. In this work we use a Generative Adversarial Network (GAN) to create adversarial examples to deceive facial recognition and we achieve an acceptable success rate in fooling the face recognition. Our results reduce the training time for the GAN by removing the discriminator component. Furthermore, our results show knowledge distillation can be employed to drastically reduce the size of the resulting model without impacting performance indicating that our contribution could run comfortably on a smartphone. 1

show abstract

“…Some researchers have used modified GANs to create adversarial examples and examples include AdvGAN [21], SLP-GAN [10], and Attack-Inspired GAN (AI-GAN) [1].…”

Section: Related Workmentioning

confidence: 99%

Using a GAN to Generate Adversarial Examples to Facial Image Recognition

Merrigan,

Smeaton

2021

Preprint

0

View full text Add to dashboard Cite

Images posted online present a privacy concern in that they may be used as reference examples for a facial recognition system. Such abuse of images is in violation of privacy rights but is difficult to counter. It is well established that adversarial example images can be created for recognition systems which are based on deep neural networks. These adversarial examples can be used to disrupt the utility of the images as reference examples or training data. In this work we use a Generative Adversarial Network (GAN) to create adversarial examples to deceive facial recognition and we achieve an acceptable success rate in fooling the face recognition. Our results reduce the training time for the GAN by removing the discriminator component. Furthermore, our results show knowledge distillation can be employed to drastically reduce the size of the resulting model without impacting performance indicating that our contribution could run comfortably on a smartphone. 1

show abstract

Spatially Localized Perturbation GAN (SLP-GAN) for Generating Invisible Adversarial Patches

Cited by 4 publications

References 10 publications

Extended Spatially Localized Perturbation GAN (eSLP-GAN) for Robust Adversarial Camouflage Patches

Extended Spatially Localized Perturbation GAN (eSLP-GAN) for Robust Adversarial Camouflage Patches

Using a GAN to Generate Adversarial Examples to Facial Image Recognition

Using a GAN to Generate Adversarial Examples to Facial Image Recognition

Contact Info

Product

Resources

About