Robust Superpixel-Guided Attentional Adversarial Attack

Dong, Xiaoyi; Han, Jie Cai; Chen, Dongdong; Liu, Jiayang; Bian, Huanyu; Ma, Zehua; Li, Hongsheng; Wang, Xiaogang; Zhang, Weiming; Yu, Nenghai

doi:10.1109/cvpr42600.2020.01291

Cited by 60 publications

(30 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Naturally, these methods can be seen as downstream fine-tuning of first generation attacks like FGSM or PGD. For instance, Dong et al [64] proposed to focus the gradient-based perturbation computed in an FGSM-like manner on the salient regions of images with the help of super-pixel guided attention. Such perturbations are claimed to be more robust against image processing based defenses.…”

Section: A Advanced Gradient Based Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

Deep learning is at the heart of the current rise of artificial intelligence. In the field of Computer Vision, it has become the workhorse for applications ranging from self-driving cars to surveillance and security. Whereas deep neural networks have demonstrated phenomenal success (often beyond human capabilities) in solving complex problems, recent studies show that they are vulnerable to adversarial attacks in the form of subtle perturbations to inputs that lead a model to predict incorrect outputs. For images, such perturbations are often too small to be perceptible, yet they completely fool the deep learning models. Adversarial attacks pose a serious threat to the success of deep learning in practice. This fact has recently lead to a large influx of contributions in this direction. This article presents the first comprehensive survey on adversarial attacks on deep learning in Computer Vision. We review the works that design adversarial attacks, analyze the existence of such attacks and propose defenses against them. To emphasize that adversarial attacks are possible in practical conditions, we separately review the contributions that evaluate adversarial attacks in the real-world scenarios. Finally, drawing on the reviewed literature, we provide a broader outlook of this research direction.

show abstract

Section: A Advanced Gradient Based Attacksmentioning

confidence: 99%

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

2018

View full text Add to dashboard Cite

show abstract

“…pixels of background). What's more, global perturbations modify the smoother background that leads the perturbation is more easily to be detected [21]. Local Perturbation.…”

Section: Black-box Attacksmentioning

confidence: 99%

“…Second, the adversary perturbs the discriminative pixels by querying the targeted model until the target model is fooled. Several works [5], [20], [21] have proposed attacks to generate local perturbations. In particular, for the first step, they adopt salient object detection techniques to identify the discriminative areas.…”

Section: Introductionmentioning

confidence: 99%

“…In particular, for the first step, they adopt salient object detection techniques to identify the discriminative areas. For example, Dong et al [21] leverage the class activation mapping (CAM) [22] to produce salience maps. Li et al [20] utilize a pre-trained semantic segmentation model to divide a clean example into foreground and background.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Local Black-box Adversarial Attacks: A Query Efficient Approach

Xiang¹,

Liu²,

Guo³

et al. 2021

Preprint

View full text Add to dashboard Cite

Adversarial attacks have threatened the application of deep neural networks in security-sensitive scenarios. Most existing blackbox attacks fool the target model by interacting with it many times and producing global perturbations. However, global perturbations change the smooth and insignificant background, which not only makes the perturbation more easily be perceived but also increases the query overhead. In this paper, we propose a novel framework to perturb the discriminative areas of clean examples only within limited queries in black-box attacks. Our framework is constructed based on two types of transferability. The first one is the transferability of model interpretations. Based on this property, we identify the discriminative areas of a given clean example easily for local perturbations. The second is the transferability of adversarial examples. It helps us to produce a local pre-perturbation for improving query efficiency. After identifying the discriminative areas and pre-perturbing, we generate the final adversarial examples from the pre-perturbed example by querying the targeted model with two kinds of black-box attack techniques, i.e., gradient estimation and random search. We conduct extensive experiments to show that our framework can significantly improve the query efficiency during black-box perturbing with a high attack success rate. Experimental results show that our attacks outperform state-of-the-art black-box attacks under various system settings.

show abstract

“…We introduce several attack methods in terms of imperceptibility. The authors of [28] proposed a superpixel-guided attentional adversarial attack method capable of preserving the local smoothness property along with the original attack ability. It was applied in L ∞ attacks such as FGSM [7], iterative FGSM [8], or momentum iterative FGSM [29] with superpixel algorithm and class activation mapping.…”

Section: ) Perceptual Color Distance (Perc) Attackmentioning

confidence: 99%

Adversarial Attack Based on Perturbation of Contour Region to Evade Steganalysis-Based Detection

Ryu

Choi

2021

IEEE Access

View full text Add to dashboard Cite

Deep neural networks (DNN) are applied in various fields because they afford good performance. However, they seem vulnerable to adversarial examples. Therefore, studies are actively investigating adversarial defenses to improve the robustness of DNNs as well as adversarial attacks to generate more intensive adversarial perturbations. Most existing attack methods excessively modify images by generating overly large distortions or adding perturbations to regions with little impact on the DNN. As a result, the local smoothness of images is not maintained, and changes can be easily detected using a steganalysis-based detector. In this study, we propose a contour attack method to evade steganalysisbased detection. This method extracts the contour region from an image and adds perturbations only to applicable regions, thus maintaining the local smoothness. It can solve the problems mentioned above and effectively evade steganalysis-based detectors. Our experimental results demonstrate that the local smoothness is better than that in the case of original attack methods and that the detection evasion rate for a steganalysis detector is up to 19.9% higher. Further, structural similarity (SSIM) measurements and image comparisons demonstrate the improved imperceptibility of perturbations. In particular, the SSIM values for images subjected to the contour attack are close to 1.0.

show abstract

Robust Superpixel-Guided Attentional Adversarial Attack

Cited by 60 publications

References 22 publications

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Local Black-box Adversarial Attacks: A Query Efficient Approach

Adversarial Attack Based on Perturbation of Contour Region to Evade Steganalysis-Based Detection

Contact Info

Product

Resources

About