Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity

Luo, Cheng; Lin, Qinliang; Xie, Weicheng; Wu, Bizhu; Xie, Jinheng; Shen, Linlin

doi:10.1109/cvpr52688.2022.01488

Cited by 53 publications

(21 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Moreover, its experimental results that AEs produced by AdvCam are well camouflaged and highly concealed in both digital and physical world scenarios while still being effective in deceiving state-of-the-art DNN image detectors. SSAH (Luo et al, 2022 ) crafts adversarial examples and disguises adversarial noise in a low-frequency constraints manner. This method limits the adversarial perturbations to the high-frequency components of the specific image to ensure low human perceptual similarity.…”

Section: Related Workmentioning

confidence: 99%

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

Liu

Jin²,

Hu³

et al. 2023

Front. Neurorobot.

View full text Add to dashboard Cite

Recent adversarial attack research reveals the vulnerability of learning-based deep learning models (DNN) against well-designed perturbations. However, most existing attack methods have inherent limitations in image quality as they rely on a relatively loose noise budget, i.e., limit the perturbations by Lp-norm. Resulting that the perturbations generated by these methods can be easily detected by defense mechanisms and are easily perceptible to the human visual system (HVS). To circumvent the former problem, we propose a novel framework, called DualFlow, to craft adversarial examples by disturbing the image's latent representations with spatial transform techniques. In this way, we are able to fool classifiers with human imperceptible adversarial examples and step forward in exploring the existing DNN's fragility. For imperceptibility, we introduce the flow-based model and spatial transform strategy to ensure the calculated adversarial examples are perceptually distinguishable from the original clean images. Extensive experiments on three computer vision benchmark datasets (CIFAR-10, CIFAR-100 and ImageNet) indicate that our method can yield superior attack performance in most situations. Additionally, the visualization results and quantitative performance (in terms of six different metrics) show that the proposed method can generate more imperceptible adversarial examples than the existing imperceptible attack methods.

show abstract

Section: Related Workmentioning

confidence: 99%

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

Liu

Jin²,

Hu³

et al. 2023

Front. Neurorobot.

View full text Add to dashboard Cite

show abstract

“…Adversaries often need to trade between attack strength and imperceptibility of perturbations, which inspires a lot of works [39], [7], [37], [23] to find a reasonable constraint for evaluating the imperceptibility. However, current attacks for ODs [63], [30], [33], [9], [11] clip perturbations based on image level (i.e., they only control the max magnitude of perturbations), which indicates potential uncontrollability (i.e., the position and distribution of learned perturbations is random [37], [46]). To circumvent this problem, [15] factorizes perturbations into magnitude and position vectors, and [37] limits perturbations in frequency space from the global image-based viewpoint against image classifiers.…”

Section: Related Workmentioning

confidence: 99%

“…However, current attacks for ODs [63], [30], [33], [9], [11] clip perturbations based on image level (i.e., they only control the max magnitude of perturbations), which indicates potential uncontrollability (i.e., the position and distribution of learned perturbations is random [37], [46]). To circumvent this problem, [15] factorizes perturbations into magnitude and position vectors, and [37] limits perturbations in frequency space from the global image-based viewpoint against image classifiers. They leverage implicitly the models' attention to guide the perturbations, which brings a big learning burden for neural networks and produces suboptimal results.…”

Section: Related Workmentioning

confidence: 99%

Towards Single-Pass and Transferable Gan-Based Attacks Against Object Detectors

Meyer

Kaloudi

2023

Preprint

View full text Add to dashboard Cite

“…Currently, most adversarial attacks are predominantly deployed in the visible light field [16][17][18][19]. Szegedy et al [4] first discovered that well-trained DNNs are susceptible to slight perturbations, leading to a multitude of related studies [20][21][22].…”

Section: Adversarial Attacks In the Visible Light Fieldmentioning

confidence: 99%

Adversarial Texture for Fooling Person Detectors in the Physical World

Huang

Zhu

et al. 2022

2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

View full text Add to dashboard Cite

Infrared imaging systems have a vast array of potential applications in pedestrian detection and autonomous driving, and their safety performance is of great concern. However, few studies have explored the safety of infrared imaging systems in real-world settings. Previous research has used physical perturbations such as small bulbs and thermal "QR codes" to attack infrared imaging detectors, but such methods are highly visible and lack stealthiness. Other researchers have used hot and cold blocks to deceive infrared imaging detectors, but this method is limited in its ability to execute attacks from various angles. To address these shortcomings, we propose a novel physical attack called adversarial infrared blocks (AdvIB). By optimizing the physical parameters of the adversarial infrared blocks, this method can execute a stealthy black-box attack on thermal imaging system from various angles. We evaluate the proposed method based on its effectiveness, stealthiness, and robustness. Our physical tests show that the proposed method achieves a success rate of over 80% under most distance and angle conditions, validating its effectiveness. For stealthiness, our method involves attaching the adversarial infrared block to the inside of clothing, enhancing its stealthiness. Additionally, we test the proposed method on advanced detectors, and experimental results demonstrate an average attack success rate of 51.2%, proving its robustness. Overall, our proposed AdvIB method offers a promising avenue for conducting stealthy, effective and robust black-box attacks on thermal imaging system, with potential implications for real-world safety and security applications.

show abstract

Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity

Cited by 53 publications

References 28 publications

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

DualFlow: Generating imperceptible adversarial examples by flow field and normalize flow-based model

Towards Single-Pass and Transferable Gan-Based Attacks Against Object Detectors

Adversarial Texture for Fooling Person Detectors in the Physical World

Contact Info

Product

Resources

About