Explanation-Guided Minimum Adversarial Attack

Liu, Mingting; Liu, Xiaozhang; Yan, Anli; Qi, Yuan; Li, Wei

doi:10.1007/978-3-031-20096-0_20

Cited by 1 publication

(5 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We present a performance comparison of our method with other attack methods on the NIPS-17 dataset 33 when attacking some typical DNNs. We chose two modified attack methods (ColorFool 23 and NCF), 15 and three additive attack methods (including AdvLight, 19 AdvRD, 21 and RFLA 17 ) for the comparative experiment. In the experiment, we limited the query counts for RFLA and AdvLight to 100, while all other implementations followed their original optimal settings.…”

Section: Methodsmentioning

confidence: 99%

“…We demonstrate the performance comparison of our method with other attack methods on the GTSRB traffic dataset 34 . We compared our method with OnePixel, 41 Jitter, 42 Pixel, 43 Advlight, 19 Shadow attack, 18 and AdvRD 21 (since the AdvRD code is not open-source, we directly use the publicly available data from their paper). Table 2 shows the ASR, LPIPS values, and the average time required to generate an adversarial example.…”

Section: Methodsmentioning

confidence: 99%

“…Recently, natural phenomena have been examined for adversarial examples in the physical world. For example, AdvRD 21 attacks classification networks by simulating perturbations caused by raindrops. Advhaze 22 proposes using adversarial haze to attack DNNs.…”

Section: Related Workmentioning

confidence: 99%

“…Another type of physical attack 17 , 19 is projecting or emitting light or laser onto the target object for the attack. Moreover, to make the added physical elements seem more natural and less noticeable, some researchers 21 , 22 propose the use of natural phenomena to generate adversarial examples with a realistic style, such as adversarial raindrops or haze.…”

Section: Introductionmentioning

confidence: 99%

“…(a) Modified attack methods that modify generic attributes of images (DRA, 13 STM, 14 and NCF) 15 . (b) Additive attack methods that add specific content to images (Shadow attack, 18 AdvRD, 21 and RFLA) 17 . (c) Our proposed restorative attack method, which adds adversarial perturbations to the image during the restoration process.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Deceptive deraining attack: a restorative adversarial attack by rain removal

Liu,

Shao,

Meng

et al. 2024

J. Electron. Imag.

View full text Add to dashboard Cite

Restoring images captured in adverse weather conditions can significantly enhance their visual quality, with widespread applications in fields such as autonomous driving. However, we observed a potential threat after image restoration: while the restored images are visually better, they may be adversarial for deep neural networks (DNNs). In light of this discovery, in this work, we explore a restorative attack approach, aiming to introduce adversarial perturbations in insensitive regions of the image while restoring images. In particular, we propose the deceptive deraining attack (DDA) method to generate more natural adversarial examples in the deraining scenario, denoted as DDA. In contrast to existing adversarial attack methods that degrade image quality, our DDA can efficiently introduce adversarial perturbations while enhancing the visual quality of rainy images. Specifically, we first restore the rainy image and derive the rain streak mask. Then the adversarial perturbations are added to the rain streak areas of the image according to the mask, and the perturbations are optimized by maximizing the classification loss to generate the adversarial image. Extensive experiments on synthetic rain datasets and real rain datasets indicate that the adversarial examples generated by our DAA are visually natural and maintain a high attack success rate on state-of-the-art DNNs.

show abstract