Exploiting Vulnerabilities of Deep Neural Networks for Privacy Protection

Abstract

Adversarial perturbations can be added to images to protect their content from unwanted inferences. These perturbations may, however, be ineffective against classifiers that were not seen during the generation of the perturbation, or against defenses based on re-quantization, median filtering or JPEG compression. To address these limitations, we present an adversarial attack that is specifically designed to protect visual content against unseen classifiers and known defenses. We craft perturbations using an iterative process that is based on the Fast Gradient Signed Method and that randomly selects a classifier and a defense, at each iteration. This randomization prevents an undesirable overfitting to a specific classifier or defense. We validate the proposed attack in both targeted and untargeted settings on the private classes of the Places365-Standard dataset. Using ResNet18, ResNet50, AlexNet and DenseNet161 as classifiers, the performance of the proposed attack exceeds that of eleven state-of-the-art attacks. The implementation is available at https://github.com/smartcameras/RP-FGSM/. Index Terms-Deep learning, adversarial images, privacy protection. 1 FGSM is the iterative attack proposed by Kurakin et al. [10]. Note that this attack is also known as Basic Iterative Method (BIM) [10] and as Projected Gradient Descent (PGD) attack with L∞ norm [11].

Combining Multi-Dimensional Convolutional Neural Network (CNN) With Visualization Method for Detection of Aphis gossypii Glover Infection in Cotton Leaves Using Hyperspectral Imaging

“…There are differences in these five parts of the current mainstream CNN models ( Khan et al, 2019 ). Since Resnet solves the problem of network degradation in DL, it becomes the backbone network for subsequent research ( Sanchez-Matilla et al, 2020 ; Veit and Belongie, 2020 ; Zhang et al, 2020b ). In this study, Resnet-18 was used as the backbone network to construct CNNs ( He et al, 2016 ).…”

Adversarial Relighting against Face Recognition

“…Given an image as input, the adversarial attack can be realized by adding imperceptible noises or applying natural transformations. On the one hand, several adversarial noise attack methods got promising attack results, such as gradient computation based fast gradient sign method (FGSM) [28], iterative-version FGSM [29], momentum iterative FGSM [30], different distance metrics based C&W method [31], attended regions and features based TAA method [32], randomization based [33], perceptually aware and stealthy adversarial denoise [34], and so on. On the other hand, some natural transformations that are imperceptible to humans can be applied for image attack.…”

Adversarial Robustness Against Image Color Transformation within Parametric Filter Space

“…Recognizing scenes is challenging since it involves understanding the context of the characteristic concepts in different scene categories. We consider a specific task called Pixel Privacy [70], which was introduced by the MediaEval Multimedia Benchmark, and has been explored in the following work on adversarial images [32], [71], [72]. This task is focused on developing image modification techniques that can protect privacy-sensitive scene information of users against automatic inference of privacy-sensitive scene information.…”