Benchmarking Adversarial Robustness on Image Classification

Dong, Yinpeng; Fu, Qian; Yang, Xiao; Pang, Tianyu; Su, Hang; Xiao, Zihao; Zhu, Jun

doi:10.1109/cvpr42600.2020.00040

Cited by 202 publications

(169 citation statements)

References 16 publications

Supporting

Mentioning

166

Contrasting

Order By: Relevance

“…Image-agnostic universal perturbations are also discovered [31], [32]. Moreover, scorebased and decision-based black-box attacks are proposed [33] to overcome practical limitations such as inaccessibility of gradients. It is even possible to create physical adversarial examples [34], [35], [7].…”

Section: Related Workmentioning

confidence: 99%

“…Adversarial Defense consistently engages in arms race with adversarial attacks [33], [43]. Gradient masking-based defenses can be circumvented [44].…”

Section: Related Workmentioning

confidence: 99%

“…Other types of defenses may involve input transformation [47], input reconstruction [48], input replacement [49], randomization [50], [51], feature denoising [52], but many of them are still susceptible to adaptive attack [43]. As an early defense [2], adversarial training [3], [10], [53], [54] remains very effective [33].…”

Section: Related Workmentioning

confidence: 99%

“…To solve the optimization problem, Projected Gradient Descent (PGD) method [10] (a.k.a the iterative version of FGSM [3]) can be used. Note that PGD is one of the most effective first-order gradient-based algorithms [33], popular among related works about adversarial attack.…”

Section: Candidate Attackmentioning

confidence: 99%

See 3 more Smart Citations

Adversarial Ranking Attack and Defense

Zhou

Niu²,

Wang³

et al. 2020

Computer Vision – ECCV 2020

View full text Add to dashboard Cite

Deep Neural Network classifiers are vulnerable to adversarial attack, where an imperceptible perturbation could result in misclassification. However, the vulnerability of DNN-based image ranking systems remains under-explored. In this paper, we propose two attacks against deep ranking systems, i.e., Candidate Attack and Query Attack, that can raise or lower the rank of chosen candidates by adversarial perturbations. Specifically, the expected ranking order is first represented as a set of inequalities, and then a triplet-like objective function is designed to obtain the optimal perturbation. Conversely, an anti-collapse triplet defense is proposed to improve the ranking model robustness against all proposed attacks, where the model learns to prevent the positive and negative samples being pulled close to each other by adversarial attack. To comprehensively measure the empirical adversarial robustness of a ranking model with our defense, we propose an empirical robustness score, which involves a set of representative attacks against ranking models. Our adversarial ranking attacks and defenses are evaluated on MNIST, Fashion-MNIST, CUB200-2011, CARS196 and Stanford Online Products datasets. Experimental results demonstrate that a typical deep ranking system can be effectively compromised by our attacks. Nevertheless, our defense can significantly improve the ranking system robustness, and simultaneously mitigate a wide range of attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

“…Adversarial Defense consistently engages in arms race with adversarial attacks [33], [43]. Gradient masking-based defenses can be circumvented [44].…”

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Candidate Attackmentioning

confidence: 99%

See 2 more Smart Citations

Adversarial Ranking Attack and Defense

Zhou

Niu²,

Wang³

et al. 2020

Computer Vision – ECCV 2020

View full text Add to dashboard Cite

show abstract

“…Recent works on adversarial attacks mainly focus on image classification [8][9][10][11][12], while only a small amount of works [13][14][15] studied how to effectively attack the object detector. Xie et al [13] investigated the transferability of adversarial perturbations across different detection networks.…”

Section: Introductionmentioning

confidence: 99%

Adversarial Attacks on Object Detectors with Limited Perturbations

Shi

Yang

et al. 2021

ICASSP 2021 - 2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

View full text Add to dashboard Cite

Deep convolutional neural networks are widely witnessed vulnerable to adversarial attacks. Recently, great progress has been achieved in attacking object detectors. However, current attacks neglect the practical utility and rely on global perturbations on the target image with a large number of patches or pixels. In this paper, we present a novel attack framework named DTTACK to fool both one-stage and two-stage object detectors with limited perturbations. A novel divergent patch shape consisting of four intersecting lines is proposed to effectively affect deep convolutional feature extraction with limited pixels. In particular, we introduce an instance-aware heat map as a self-attention module to help DTTACK focus on salient object areas, which further improves the attacking performance. Extensive experiments on PASCAL-VOC, MS-COCO, as well as an online detection system demonstrate that DTTACK surpasses the state-of-the-art methods by large margins.

show abstract