Scene Privacy Protection

Li, Chau Yi; Shamsabadi, Ali Shahin; Sánchez-Matilla, Ricardo; Mazzon, Riccardo; Cavallaro, Andrea

doi:10.1109/icassp.2019.8682225

Cited by 23 publications

(38 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The target class can be determined randomly [1], [12], systematically as the least-likely class [12], or adaptively from the prediction vector [1]. Defenses against adversarial attacks aim to eliminate, prior to inputting images to the classifier, the effect of possible adversarial perturbations using a transformation, φ(•), namely median filtering [7], re-quantization [7] or JPEG compression [8].…”

Section: Reference Attack Normmentioning

confidence: 99%

“…Targeted RP-FGSM selects the target class from a set that is more likely to exclude the true class, by leveraging the fact that the true class is often among the top classes predicted by a classifier [1]. Moreover, we reduce the risk that an attack is reversed by randomly selecting the target class.…”

Section: Robust and Private Fgsmmentioning

confidence: 99%

“…number of bits for re-quantization, kernel dimension for median filtering and compression factor for JPEG compression) from the same sets used for the defense. As Li et al [1], in targeted attacks, we use γ = 0.99 for target class selection.…”

Section: B Implementation Detailsmentioning

confidence: 99%

“…Method (FGSM) framework 1 [12]. This random selection avoids the creation of perturbations that overfit to a specific classifier or defense, and improves the misleading rate for seen and unseen classifiers.…”

Section: Introductionmentioning

confidence: 99%

“…However, as the goal of the adversarial attacks is to hide the true class, which may not be the same as the predicted class (see Table II), this strategy can result in the selection of the true class as the target. Private-FGSM (P-FGSM) [1] avoids targeting the true class by discarding from the selection process the top predicted classes, which are more likely to contain the true class. The selection from the remaining classes is still random, thus limiting the risk of reversibility.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Exploiting Vulnerabilities of Deep Neural Networks for Privacy Protection

Sánchez-Matilla

Shamsabadi

et al. 2020

IEEE Trans. Multimedia

Self Cite

View full text Add to dashboard Cite

Adversarial perturbations can be added to images to protect their content from unwanted inferences. These perturbations may, however, be ineffective against classifiers that were not seen during the generation of the perturbation, or against defenses based on re-quantization, median filtering or JPEG compression. To address these limitations, we present an adversarial attack that is specifically designed to protect visual content against unseen classifiers and known defenses. We craft perturbations using an iterative process that is based on the Fast Gradient Signed Method and that randomly selects a classifier and a defense, at each iteration. This randomization prevents an undesirable overfitting to a specific classifier or defense. We validate the proposed attack in both targeted and untargeted settings on the private classes of the Places365-Standard dataset. Using ResNet18, ResNet50, AlexNet and DenseNet161 as classifiers, the performance of the proposed attack exceeds that of eleven state-of-the-art attacks. The implementation is available at https://github.com/smartcameras/RP-FGSM/. Index Terms-Deep learning, adversarial images, privacy protection. 1 FGSM is the iterative attack proposed by Kurakin et al. [10]. Note that this attack is also known as Basic Iterative Method (BIM) [10] and as Projected Gradient Descent (PGD) attack with L∞ norm [11].

show abstract

Section: Reference Attack Normmentioning

confidence: 99%

Section: Robust and Private Fgsmmentioning

confidence: 99%

Section: B Implementation Detailsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Exploiting Vulnerabilities of Deep Neural Networks for Privacy Protection

Sánchez-Matilla

Shamsabadi

et al. 2020

IEEE Trans. Multimedia

Self Cite

View full text Add to dashboard Cite

show abstract

The Importance of Image Interpretation: Patterns of Semantic Misclassification in Real-World Adversarial Images

Zhao¹,

Dang²,

Larson³

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Adversarial images are created with the intention of causing an image classifier to produce a misclassification. In this paper, we propose that adversarial images should be evaluated based on semantic mismatch, rather than label mismatch, as used in current work. In other words, we propose that an image of a "mug" would be considered adversarial if classified as "turnip", but not as "cup", as current systems would assume. Our novel idea of taking semantic misclassification into account in the evaluation of adversarial images offers two benefits. First, it is a more realistic conceptualization of what makes an image adversarial, which is important in order to fully understand the implications of adversarial images for security and privacy. Second, it makes it possible to evaluate the transferability of adversarial images to a real-world classifier, without requiring the classifier's label set to have been available during the creation of the images. The paper carries out an evaluation of a transfer attack on a real-world image classifier that is made possible by our semantic misclassification approach. The attack reveals patterns in the semantics of adversarial misclassifications that could not be investigated using conventional label mismatch.

show abstract