Adversarial Vision Challenge

Brendel, Wieland; Rauber, Jonas; Kurakin, Alexey; Papernot, Nicolas; Behar, Veliqi,; Mohanty, Sharada P.; Laurent, Florian; Salathé, Marcel; Bethge, Matthias; Yu, Yang; Zhang, Hongyang; Xu, Susu; Zhang, Hongbao; Xie, Pengtao; Xing, Eric P.; Brunner, Thomas; Diehl, Frederik; Rony, Jérôme; Hafemann, Luiz G.; Cheng, Shuyu; Dong, Yinpeng; Ning, Xuefei; Li, Wenshuo; Wang, Yu

doi:10.1007/978-3-030-29135-8_5

Cited by 34 publications

(34 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The methods presented in this paper were used in NIPS 2018 Adversarial Vision Challenge [3], ranking first in untargeted attacks, and third in targeted attacks and robust models (both attacks and defense in a black-box scenario). These results highlight the effectiveness of the defense mechanism, and suggest that attacks using adversarially-trained surrogate models can be effective in black-box scenarios, which is a promising future direction.…”

Section: Resultsmentioning

confidence: 99%

“…As in [5], we generated attacks on the first 1 000 images of the test set for MNIST and CIFAR-10, while for ImageNet we randomly chose 1 000 images from the validation set that are correctly classified. For the untargeted attacks, we report the success rate of the attack (percentage of samples for which an attack was found), the mean L 2 norm of the adversarial noise (for successful attacks), and the median L 2 norm over all attacks while considering unsuccessful attacks as worst-case adversarial (distance to a uniform gray image, as in [3]). We also report the average number (for batch execution) of gradient computations and the total run-times (in seconds) on a NVIDIA Table 4: Comparison of the DDN attack to the C&W L 2 attack on ImageNet.…”

Section: Attack Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Rony¹,

Hafemann²,

Oliveira³

et al. 2019

2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

182

188

View full text Add to dashboard Cite

Research on adversarial examples in computer visiontasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems. Considering L 2 norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature. However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations. In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low L 2 norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image. Experiments conducted on the MNIST, CIFAR-10 and ImageNet datasets indicate that our attack achieves comparable results to the state-of-the-art (in terms of L 2 norm) with considerably fewer iterations (as few as 100 iterations), which opens the possibility of using these attacks for adversarial training. Models trained with our attack achieve state-of-the-art robustness against whitebox gradient-based L 2 attacks on the MNIST and CIFAR-10 datasets, outperforming the Madry defense when the attacks are limited to a maximum norm. * Equal contribution.1 This also affects other machine learning classifiers, but we restrict our analysis to CNNs, that are most commonly used in computer vision tasks.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Attack Evaluationmentioning

confidence: 99%

Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Rony¹,

Hafemann²,

Oliveira³

et al. 2019

2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

182

188

View full text Add to dashboard Cite

show abstract

“…Adversarial attacks is an area of research which recently gained popularity after the seminal work of Szegedy et al [68], showing that small perturbations in the input image can switch the neural network prediction outcome. There exist several works showing that CNN-based solutions for classification [69], segmentation [70], object detection [71] and image retrieval [72] are all prone to such attacks. The only paper about attack on local feature matching is [73], which proposed to place special noisy patches on response peak locations, killing the matching process for matching pairs.…”

Section: Targeted Adversarial Attack On Sift-matchingmentioning

confidence: 99%

“…Yet, the authors do not know of any paper devoted to targeted adversarial attacks on local features-based image matching. Most attack methods are "white-box" [69], which means they require access to the model gradients w.r.t the input. This makes them an excellent choice for a kornia.features differentiability demonstration.…”

Section: Targeted Adversarial Attack On Sift-matchingmentioning

confidence: 99%

Kornia: an Open Source Differentiable Computer Vision Library for PyTorch

Riba¹,

Mishkin

Ponsa

et al. 2020

2020 IEEE Winter Conference on Applications of Computer Vision (WACV)

208

View full text Add to dashboard Cite

This work presents Kornia, an open source computer vision library built upon a set of differentiable routines and modules that aims to solve generic computer vision problems. The package uses PyTorch as its main backend, not only for efficiency but also to take advantage of the reverse autodifferentiation engine to define and compute the gradient of complex functions. Inspired by OpenCV, Kornia is composed of a set of modules containing operators that can be integrated into neural networks to train models to perform a wide range of operations including image transformations, camera calibration, epipolar geometry, and low level image processing techniques, such as filtering and edge detection that operate directly on high dimensional tensor representations on graphical processing units, generating faster systems. Examples of classical vision problems implemented using our framework are provided including a benchmark comparing to existing vision libraries.

show abstract

“…Evaluation setting. The AVC is an open competition between image classifiers and adversarial attacks in an iterative blackbox decision-based setting [4]. Participants can choose between three tracks:…”

Section: Submission To Neurips 2018 Adversarial Vision Challengementioning

confidence: 99%

Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks

Brunner

Diehl

et al. 2019

2019 IEEE/CVF International Conference on Computer Vision (ICCV)

Self Cite

View full text Add to dashboard Cite

We consider adversarial examples for image classification in the black-box decision-based setting. Here, an attacker cannot access confidence scores, but only the final label. Most attacks for this scenario are either unreliable or inefficient. Focusing on the latter, we show that a specific class of attacks, Boundary Attacks, can be reinterpreted as a biased sampling framework that gains efficiency from domain knowledge. We identify three such biases, image frequency, regional masks and surrogate gradients, and evaluate their performance against an ImageNet classifier. We show that the combination of these biases outperforms the state of the art by a wide margin. We also showcase an efficient way to attack the Google Cloud Vision API, where we craft convincing perturbations with just a few hundred queries. Finally, the methods we propose have also been found to work very well against strong defenses: Our targeted attack won second place in the NeurIPS 2018 Adversarial Vision Challenge.

show abstract

Adversarial Vision Challenge

Cited by 34 publications

References 19 publications

Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Kornia: an Open Source Differentiable Computer Vision Library for PyTorch

Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks

Contact Info

Product

Resources

About