Feature Space Perturbations Yield More Transferable Adversarial Examples

Inkawhich, Nathan; Wen, Wei; Li, Hai; Chen, Yiran

doi:10.1109/cvpr.2019.00723

Cited by 148 publications

(88 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is mainly achieved by reducing the dispersion in the feature maps of the internal layers of the surrogate model with the help of a specialized loss. Inkawhich et al [111] also claimed that feature space perturbations are particularly helpful in computing adversarial examples that are more transferable across models.…”

Section: B Black-box Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: B Black-box Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…Both gradient ascent and descent are combined for more diversity [35]. Another thread of works focus on the feature level to improve transferability [45,23]. The intuition is to induce a similar intermediate feature via perturbing image pixels, by assuming that different models generate identical feature-level representations.…”

Section: Black-box Adversarial Attacksmentioning

confidence: 99%

“…The intuition is to induce a similar intermediate feature via perturbing image pixels, by assuming that different models generate identical feature-level representations. Intermediate loss is introduced to optimize l 2 norm between feature maps from all layers in [45,23]. Our work taps into this line to enhance black-box transferability for image retrieval systems and will compare with these techniques in Sec.…”

Section: Black-box Adversarial Attacksmentioning

confidence: 99%

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

Xiao

Wang

2021

2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

View full text Add to dashboard Cite

“…Alternatively transfer-based approaches rely on similar models being susceptible to the same adversarial samples [10]. Recent studies [11,12,13] have demonstrated successful transfer of attacks, but only in situations where the networks are extremely similar in structure and parameters.…”

Section: Introductionmentioning

confidence: 99%

Universal Adversarial Attacks on Spoken Language Assessment Systems

Vyas¹,

Gales²,

Knill³

2020

Interspeech 2020

View full text Add to dashboard Cite

There is an increasing demand for automated spoken language assessment (SLA) systems, partly driven by the performance improvements that have come from deep learning based approaches. One aspect of deep learning systems is that they do not require expert derived features, operating directly on the original signal such as a speech recognition (ASR) transcript. This, however, increases their potential susceptibility to adversarial attacks as a form of candidate malpractice. In this paper the sensitivity of SLA systems to a universal black-box attack on the ASR text output is explored. The aim is to obtain a single, universal phrase to maximally increase any candidate's score. Four approaches to detect such adversarial attacks are also described. All the systems, and associated detection approaches, are evaluated on a free (spontaneous) speaking section from a Business English test. It is shown that on deep learning based SLA systems the average candidate score can be increased by almost one grade level using a single six word phrase appended to the end of the response hypothesis. Although these large gains can be obtained, they can be easily detected based on detection shifts from the scores of a "traditional" Gaussian Process based grader.

show abstract

Feature Space Perturbations Yield More Transferable Adversarial Examples

Cited by 148 publications

References 8 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

Universal Adversarial Attacks on Spoken Language Assessment Systems

Contact Info

Product

Resources

About