Source-linked AI summary
CycleGAN, a Master of Steganography
Casey Chu, Andrey Zhmoginov, Mark Sandler
TL;DR
CycleGAN addresses unpaired image translation by learning bidirectional mappings whose outputs look realistic while cyclic consistency preserves source information. Experiments show that it hides that information in nearly imperceptible, high-frequency signals, making the model especially vulnerable to adversarial attacks and motivating changes to cyclic-consistency losses in serious applications.
Problem
CycleGAN must translate between image domains whose distributions can have unequal entropy, making a perfect one-to-one correspondence impossible in cases where one target image matches many source images.
Method
The paper analyzes CycleGAN's reconstructions and corruption sensitivity, then connects its information-hiding behavior to adversarial attacks on the learned transformation G.
Results
CycleGAN hides source-image information in a low-amplitude, high-frequency output signal, and perturbations as small as ϵ ≥ 3/256 ≈ 0.01 can nearly maximize reconstruction change.
Takeaways & Limitations
The cyclic consistency loss makes CycleGAN especially vulnerable: low-amplitude perturbations to a chosen source image can make a learned transformation produce an image of the attacker's choosing.
Takeaways & Limitations
In serious applications, the cyclic consistency loss should be modified to prevent these attacks, whose vulnerability is attributed to the loss and entropy differences between domains.
Abstract
from arXiv · showhide
CycleGAN (Zhu et al. 2017) is one recent successful approach to learn a transformation between two image distributions. In a series of experiments, we demonstrate an intriguing property of the model: CycleGAN learns to "hide" information about a source image into the images it generates in a nearly imperceptible, high-frequency signal. This trick ensures that the generator can recover the original sample and thus satisfy the cyclic consistency requirement, while the generated image remains realistic. We connect this phenomenon with adversarial attacks by viewing CycleGAN's training procedure as training a generator of adversarial examples and demonstrate that the cyclic consistency loss causes CycleGAN to be especially vulnerable to adversarial attacks.
1 Introduction
Image-to-image translation renders images from one domain in the style of another, and CycleGAN learns bidirectional transformations between unpaired image domains while enforcing realistic outputs and cyclic reconstruction. In a maps experiment, it generated realistic maps and reconstructions from aerial photographs.
- Image-to-image translation transforms an image from one class into the style of another class.
- CycleGAN learns transformations F: X → Y and G: Y → X using only unpaired examples from two image domains.
- The adversarial condition makes generated images resemble the target domains, while cyclic consistency encourages reconstruction of each source image.The cyclic consistency loss is ||GFx − x|| + ||FGy − y||.
- Approximately 1,000 aerial photographs and 1,000 maps were used to train CycleGAN for 500 epochs, producing realistic samples from both domains.
2 Hidden Information
CycleGAN reconstructs source-image details that are absent from its intermediate generated maps, indicating that it hides source information in those outputs. The hidden signal appears as amplified high-frequency variation, including in visually empty regions.
- Figure 1 shows source-image details reconstructed in GFx despite their absence from the intermediate map Fx.
- Nearly every tested aerial photograph had details reconstructed in GFx even when those details were not visible in the intermediate map Fx.The pattern of black dots on a white roof was reconstructed although the corresponding map region appeared solid gray.
- CycleGAN is described as learning an encoding scheme that hides information about the aerial photograph within the generated map.This addresses the impossibility of learning a perfect one-to-one photograph-to-map correspondence when one map can match many aerial photographs.
- Apparently solid regions of generated maps contain variation that becomes visible after adaptive histogram equalization, unlike their naked-eye appearance.The comparison indicates an extra high-frequency signal in the generated map.
3 Sensitivity to Corruption
CycleGAN’s hidden encoding is highly sensitive to small, high-frequency corruptions, yet perturbations produced by F can combine to reconstruct multiple image features. The encoding is non-local and fails to transfer reliably across unrelated maps.
- Sensitivity to noise: 3/256 ≈0.01 noise amplitude nearly maximizes reconstruction change, despite corresponding to only 3 levels in an 8-bit image.The expectation is averaged over 50 aerial photographs.
- Sensitivity to noise: JPEG compression destroys the reconstruction, indicating that source information is stored in a high-frequency, low-amplitude signal.
- Sensitivity to noise: σ ≥2 rapidly reduces reconstruction change to its minimum, showing that the encoding is robust to low-frequency content, including the perceived map.
- Perturbation structure: Adding perturbations associated with two edited trees produces a reconstruction containing both trees without unexpected artifacts.
- Perturbation structure: The perturbation effects are approximately linear, so map perturbation addition corresponds to independent addition of features in the reconstructed aerial image.
- Perturbation structure: The tree-related encoding extends far beyond the edited region, but masking those nonlocal pixels still leaves the tree reconstructable.
- Perturbation structure: A perturbation added to an entirely different image does not necessarily reconstruct the tree and sometimes produces artifacts.
4 Information Hiding as an Adversarial Attack
The paper constructs target aerial photographs by optimizing specially crafted maps, framing CycleGAN training as an adversarial attack on G. These attacks require only low-amplitude, visually imperceptible map changes, and training makes G increasingly susceptible.
- Targeted reconstruction: Gradient descent finds a specially crafted map y∗ that makes G reconstruct any desired aerial photograph x∗ from an initial source map y0.
- Targeted reconstruction: A low-amplitude signal added to virtually any initial map y0 produces the target image while leaving the crafted map visually indistinguishable from y0.
- Adversarial interpretation: The cyclic consistency objective resembles the adversarial attack objective, so F can be viewed as generating adversarial maps that force G toward desired outputs.
- Adversarial interpretation: The required difference y∗−y0 decreases during training, indicating that G cooperates by becoming increasingly susceptible to adversarial maps.
5 Discussion
When the two image distributions differ in complexity or entropy, CycleGAN can satisfy cyclic consistency by hiding source information in a low-amplitude, high-frequency output signal. This behavior creates adversarial vulnerability and motivates caution with composition-based loss functions.
- Different-entropy image domains may not admit a one-to-one transformation, so CycleGAN hides input information in the output.The paper describes this hidden information as a low-amplitude, high-frequency signal added to the generated image.
- CycleGAN becomes especially vulnerable to adversarial attacks because perturbing a chosen source image can make a learned transformation produce an image of the attacker’s choosing.The paper recommends modifying cyclic consistency loss to prevent such attacks.
- Adding an additional hidden variable, such as a fourth map channel, is proposed as a possible defense against attacks caused by entropy differences and cyclic consistency.The proposed channel could store information without requiring it to be hidden in the image.
- Preventing imperceptible adversarial encoding may force CycleGAN transformations to learn more semantically meaningful correspondences.The paper presents this as a possible route for improving generated-image quality.
- Loss functions involving compositions of neural networks require caution because one component may exploit another component’s ability to support adversarial examples.The paper extends this concern to frameworks including generative adversarial networks and perceptual losses.