Source-linked AI summary
Adversarial Patch
Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, Justin Gilmer
TL;DR
The paper addresses whether adversarial attacks must be small or imperceptible by constructing a universal, targeted patch that replaces part of an image and is trained across scenes and transformations. The resulting patch fools classifiers across scales and locations, works in the physical world, and can be disguised as a sticker, while the authors note that large local perturbations remain a boundary for defenses focused only on small perturbations.
Problem
Existing adversarial-attack and defense work largely focuses on small or imperceptible perturbations, leaving larger, noticeable perturbations relevant to malicious attackers insufficiently addressed.
Method
The authors train a salient patch across images, locations, and transformations, replacing part of each image to produce a universal targeted physical-world attack.
Results
The authors generate a universal, robust, targeted patch that fools classifiers regardless of patch scale or location, without requiring knowledge of other scene items, and works in the real world.
Takeaways & Limitations
The results show that an attack can be created offline, broadly shared, and disguised as an innocuous sticker while remaining effective against classifiers.
Takeaways & Limitations
In a third-party physical-world black-box test, transferability occurred only when the patch occupied a significant fraction of the image, and printability was not optimized.
Abstract
from arXiv · showhide
We present a method to create universal, robust, targeted adversarial image patches in the real world. The patches are universal because they can be used to attack any scene, robust because they work under a wide variety of transformations, and targeted because they can cause a classifier to output any target class. These adversarial patches can be printed, added to any scene, photographed, and presented to image classifiers; even when the patches are small, they cause the classifiers to ignore the other items in the scene and report a chosen target class. To reproduce the results from the paper, our code is available at https://github.com/tensorflow/cleverhans/tree/master/examples/adversarial_patch
1 Introduction
The paper moves beyond small or imperceptible perturbations by constructing a salient, image-independent patch that targets any class across scenes. Because it requires no knowledge of the scene or classifier conditions, the patch supports offline creation and physical-world use.
- Prior adversarial-example research primarily focused on small or imperceptible input changes.
- The proposed attack replaces part of an image with an image-independent patch that causes a classifier to output a targeted class.
- The patch can be placed anywhere in the classifier’s field of view without prior knowledge of lighting, camera angle, classifier type, or scene contents.
- A physical sticker targeted to toaster changed VGG16’s prediction from banana at 97% confidence to toaster at 99% confidence.
- Because the patch uses a large perturbation, defenses focused on small perturbations may not remain robust to it.
2 Approach
The method replaces part of an image with a transformed patch and trains it across images, locations, and transformations to maximize the target-class probability. This expectation over varied backgrounds makes the resulting patch universal, while an optional constraint produces camouflaged patches.
- The patch application operator transforms a patch and places it at a chosen location, replacing part of the input image.
- Training uses random translations, scaling, and rotations across varied images so the patch remains effective under those conditions.
- The objective averages target-class probability over training images, patch transformations, and image locations.
- Taking the expectation over images encourages the patch to work regardless of the background, making the perturbation universal across scenes.
- A constraint ||p − p_orig||∞ < ϵ can force the trained patch to remain visually close to a chosen starting image.
- The authors expect the patch’s salience to dominate image-classification labels, while object detection or segmentation may localize the patch’s target object without affecting other regions.
3 Experimental Results
The experiments compare white-box, black-box, and control patches under randomized placement and transformations, then test disguises and physical-world transfer. The patch remains effective across varied settings, though third-party physical transfer requires a large image fraction.
- Attack comparisons: The evaluation compares white-box ensemble, white-box single-model, black-box, and control patches across ImageNet models.The ensemble trains across five models, while the black-box patch trains on four and evaluates on an unseen fifth model.
- Attack comparisons: During training and evaluation, patches are rescaled and digitally inserted at random locations in random ImageNet images.This tests performance across varied patch scales and placements.
- Attack comparisons: The universal targeted setting requires a significantly larger patch than a non-targeted white-box attack on one image and location.The comparison highlights the added difficulty of black-box, targeted operation across images, locations, and transformations.
- Attack comparisons: Real toaster insertion performs relatively poorly compared with the adversarial attacks.The result indicates that simply inserting an image of the target class is less effective than the learned patch.
- Disguised patches: Disguised patches retain much of their ability to fool the classifier.The disguises minimize L2 distance to a tie-dye pattern and use a peace-sign mask during training.
- Physical-world transfer: Printed patches successfully fool the classifier in real-world scenes containing other objects.Transfer to the third-party Demitasse application is observed only when the patch occupies a significant fraction of the image.
4 Conclusion
The paper presents universal, robust, targeted patches that work across scene content, scale, and location, including in the physical world and with disguises. It argues that defenses focused only on small perturbations are insufficient because large local patches can also break classifiers.
- 4 Conclusion: The method generates universal, robust, targeted patches that fool classifiers across patch scales and locations without knowing other scene items.The patches can also operate in the real world and be disguised as innocuous stickers.
- 4 Conclusion: The attack can be created offline and broadly shared because its construction does not depend on the particular image being attacked.This follows from the patch's image-independent, universal design.
- 4 Conclusion: Defenses focused only on small perturbations are insufficient because large, local perturbations can also break classifiers.The paper notes that attackers may accept noticeable perturbations when human validation is absent.
5 Appendix
The appendix presents a printable sticker version of the attack and specifies alignment and size conditions for effective use.
- 5 Appendix: The printable sticker works best when kept within 20 degrees of the shown vertical alignment.The sticker was generated with the white-box ensemble method.
- 5 Appendix: The sticker shows some transferability to the third-party Demitasse application, although it was not designed to fool it.Effective transfer requires a larger patch than the white-box attack demonstrated in Figure 1.