Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers

Abstract

Deep neural networks have been shown to exhibit an intriguing vulnerability to adversarial input images corrupted with imperceptible perturbations. However, the majority of adversarial attacks assume global, fine-grained control over the image pixel space. In this paper, we consider a different setting: what happens if the adversary could only alter specific attributes of the input image? These would generate inputs that might be perceptibly different, but still natural-looking and enough to fool a classifier. We propose a novel approach to generate such "semantic" adversarial examples by optimizing a particular adversarial loss over the range-space of a parametric conditional generative model. We demonstrate implementations of our attacks on binary classifiers trained on face images, and show that such natural-looking semantic adversarial examples exist. We evaluate the effectiveness of our attack on synthetic and real data, and present detailed comparisons with existing attack methods. We supplement our empirical results with theoretical bounds that demonstrate the existence of such parametric adversarial examples.Outline: We begin with a review of relevant literature in Section 2. We describe our proposed framework, Semantic Adversarial Generation, in section 3. In Section 4 we describe two variants of our framework to show different methods of ensuring the semantic constraint. We provide empirical analysis of our work in Section 5. We further present

Adversarial Item Promotion: Vulnerabilities at the Core of Top-N Recommenders that Use Images to Address Cold Start

“…More work is needed to understand approaches such as SEMA, which do not involve trading off image quality and attack strength. Alternatively, approaches that make adversarial images effective yet non-suspicious, such as [22,48], can also be studied.…”

Towards Verifying Robustness of Neural Networks Against A Family of Semantic Perturbations

“…In [2], the authors introduce texture and colorization to induce semantic perturbation with a large p norm perturbation to the raw pixel space while remaining visual imperceptibility. In [9], an adversarial network composed of an encoder and a generator conditioned on attributes are trained to find semantic adversarial examples. In [6,5], the authors show that simple operations such as image rotation or object translation can result in a notable mis-classification rate.…”

“…Beyond the p -norm bounded threat model, recent works have shown the possibility of generating semantic adversarial examples based on semantic perturbation techniques such as color shifting, lighting adjustment and rotation [8,13,2,9,6,5]. We refer the readers to Figure 1 for the illustration of some semantic perturbations for images.…”

Spatiotemporally Constrained Action Space Attacks on Deep Reinforcement Learning Agents

“…This is especially true when deep neural networks (DNNs) are used as key components (e.g., to represent policies) of RL agents. Recently, a wealth of results in the ML literature demonstrated that DNNs can be fooled to misclassify images by perturbing the input by an imperceptible amount (Goodfellow, Shlens, and Szegedy 2015) or by introducing specific natural looking attributes (Joshi et al 2019). Such adversarial perturbations have also demonstrated the impacts of attacks on an RL agent's state space as shown by (Huang et al 2017).…”