Adversarial Attack Type I: Cheat Classifiers by Significant Changes

Abstract

Despite the great success of deep neural networks, the adversarial attack can cheat some well-trained classifiers by small permutations. In this paper, we propose another type of adversarial attack that can cheat classifiers by significant changes. For example, we can significantly change a face but well-trained neural networks still recognize the adversarial and the original example as the same person. Statistically, the existing adversarial attack increases Type II error and the proposed one aims at Type I error, which are hence named as Type II and Type I adversarial attack, respectively. The two types of attack are equally important but are essentially different, which are intuitively explained and numerically evaluated. To implement the proposed attack, a supervised variation autoencoder is designed and then the classifier is attacked by updating the latent variables using gradient information. Besides, with pretrained generative models, Type I attack on latent spaces is investigated as well. Experimental results show that our method is practical and effective to generate Type I adversarial examples on large-scale image datasets. Most of these generated examples can pass detectors designed for defending Type II attack and the strengthening strategy is only efficient with a specific type attack, both implying that the underlying reasons for Type I and Type II attack are different.

ADVMIX: Data Augmentation for Accurate Scene Text Spotting

“…Most researches [19,28] discuss adversarial attack in image classification tasks, where invisible perturbations are created to make the network give wrong predictions. But, in scene text spotting tasks, the target is to detect and recognize texts in scene images, instead of classifying the input image.…”

“…The proposed method is called AdvMix, which integrates the adversarial attack and mixup [18]. Adversarial attack [19], e.g., projected gradient descent (PGD) attack [20], can generate new realistic samples as shown in Fig. 2(b).…”

Double Backpropagation for Training Autoencoders against Adversarial Attack

“…Since the proposal of adversarial attack [14], its design, defense, and analysis have attracted much attention recently. Except for a new type of adversarial attack [33], the majority of the existing adversarial attacks aim at the over-sensitive part of a neural network such that slight distortions on the input lead to significant changes on the output.…”

GAMI-Net: An Explainable Neural Network based on Generalized Additive Models with Structured Interactions

“…However, the model may perform abnormally as the data is slightly changed, as its inner decision-making process is unknown. Some recent examples can be referred to as the adversarial attacks, where a convolutional neural network can be easily fooled by its attackers (Yuan et al, 2019, Tang et al, 2019, Su et al, 2019.…”

“…In xNN, 2 a fully-connected multi-layer perceptron is disentangled into many additive and independent subnetworks; each subnetwork represents a shape function which can be easily visualized and interpreted. Recently, the interpretability of xNN is further enhanced by inducing sparsity, orthogonality and smoothness constraints, see details in (Yang et al, 2019).…”