PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Examples for Semantic Image Segmentation

Volker Fischer, Mummadi Chaithanya Kumar, Jan Hendrik Metzen, Thomas Brox

arXiv:1703.01101v1stat.MLcs.CRcs.CVcs.LGcs.NE

TL;DR

Adversarial perturbations have mainly been studied for whole-image classification, leaving their effect on semantic segmentation less explored. This paper adapts targeted attacks to segmentation and finds that person pixels can be cloaked while predictions outside them are largely preserved. At ε about 10, whole-image noise hides over 85% of person pixels while preserving over 97% of background pixels.

  • Problem

    Adversarial perturbations were studied mainly for whole-image classification, and their effect on semantic segmentation is the question addressed here.

    Source: §1 · p. 1

  • Method

    The paper adapts targeted iterative classification attacks to segmentation, assigning selected-class pixels a nearest-neighbor target while retaining other pixels’ original predictions.

    Source: §2 · p. 2

  • Results

    At ε about 10, whole-image perturbations hid over 85% of person pixels while preserving over 97% of background pixels.

    Source: §3 · p. 3

  • Takeaways & Limitations

    Imperceptible perturbations can cloak almost all pixels of a target class while leaving other classes across the image nearly unchanged.

    Source: §4 · p. 3

    The method assumes a segmentation label map matching image dimensions across classes and a classification loss differentiable with respect to the network parameters and input.

    Source: §2 · p. 1

Abstract

from arXiv · show

Machine learning methods in general and Deep Neural Networks in particular have shown to be vulnerable to adversarial perturbations. So far this phenomenon has mainly been studied in the context of whole-image classification. In this contribution, we analyse how adversarial perturbations can affect the task of semantic segmentation. We show how existing adversarial attackers can be transferred to this task and that it is possible to create imperceptible adversarial perturbations that lead a deep network to misclassify almost all pixels of a chosen class while leaving network prediction nearly unchanged outside this class.

1 INTRODUCTION

Adversarial perturbations can change a classifier’s predictions while remaining nearly imperceptible, but most prior work studied whole-image classification. This paper investigates their effect on semantic segmentation.

  • Prior adversarial-example research focused mainly on whole-image classification, while this work examines semantic segmentation.Source: §1 · p. 1
  • The paper evaluates a common deep neural network for segmentation and adapts existing perturbation-generation methods to the task.Source: §1 · p. 1
  • On Cityscapes, perturbations can misclassify entire image regions while substituting a convenient class.Source: §1 · p. 1

2 METHODS

The method adapts targeted iterative attacks to segmentation by constructing a target across pixels and measuring changes to a selected class against preserved background. It applies perturbations under a bounded magnitude and uses the network’s original prediction to define the target.

Generating adversarial examples

  • Each image pixel has a ground-truth label, and the differentiable classification loss is cross-entropy.Source: §2 · p. 1
  • The attack iteratively updates a perturbation for a specified target label using the classification loss and clips perturbations to a bounded range.Source: §2 · pp. 1–2

Definition of adversarial target for semantic segmentation

  • The target spans the image: pixels of a chosen class are reassigned to a nearest-neighbor class, while other pixels retain their original prediction.Source: §2 · p. 2
  • Attack effectiveness is measured by the percentage of selected-class pixels changed and background pixels preserved; targets use the unaltered network prediction, not ground truth.Source: §2 · p. 2
  • Figure 2 summarizes mean and standard deviation of fooled person pixels and preserved background pixels across perturbation magnitudes, comparing whole-image and person-only noise.Source: Figure 2 · p. 3

3 RESULTS & DISCUSSION

On Cityscapes, targeted perturbations can cloak person pixels while largely preserving predictions elsewhere. The results also show a trade-off when noise is restricted to person pixels.

  • Experiments used a VGG16-based FCN8 trained to 55.5% intersection over union on downscaled 1024 × 512 Cityscapes images.Source: §3 · p. 3
  • A representative Cityscapes example nearly eliminated person recognition, preserved background predictions outside the people, and produced hard-to-detect perturbations.Source: §3 · p. 3
  • With noise restricted to person pixels, a majority of person pixels could be cloaked while background was preserved.Source: §3 · p. 3
  • At ε about 10, whole-image perturbations hid over 85% of person pixels while preserving over 97% of background pixels.Source: §3 · p. 3
  • For person-only noise, background preservation holds at smaller ε, while cloaking decreases at small ε and recovers at larger values.Source: §3 · p. 3

4 CONCLUSION

The paper adapts classification attacks to semantic segmentation and concludes that imperceptible perturbations can cloak almost all pixels of a target class while leaving other classes nearly unchanged.

  • Existing classification attack approaches can be transferred to semantic segmentation.Source: §4 · p. 3
  • Imperceptible perturbations can cloak almost all pixels of a target class while leaving other classes across the image nearly unchanged.Source: §4 · p. 3
  • Open topics include stronger networks, architecture comparisons, improved effectiveness measures, and physical-world applicability.Source: §4 · p. 3
Loading 1703.01101v1…