Source-linked AI summary
Towards Imperceptible and Robust Adversarial Example Attacks against Neural Networks
Bo Luo, Yannan Liu, Lingxiao Wei, Qiang Xu
TL;DR
Neural networks are vulnerable to adversarial examples, but existing attacks may be visible and lose effectiveness after physical-world transformations. The paper introduces a perceptually informed crafting method that maximizes noise tolerance, with experiments reporting improved imperceptibility and robustness. Its allowed perturbation distance depends on a user-determined threshold.
Problem
Existing attacks use distance metrics that can produce perceptible perturbations and often lack robustness to physical-world noise and deviation.
Method
The method accounts for human perceptual sensitivity and maximizes the gap between target-class probability and the highest other-class probability to increase noise tolerance.
Results
The method is reported as most imperceptible among four compared methods and achieves 76% success under JPEG compression versus 52.3% for FGSM.
Takeaways & Limitations
The experiments demonstrate adversarial examples with high imperceptibility and robustness across image transformations and stronger Gaussian noise.
Takeaways & Limitations
The maximum allowed distance must be determined by users based on the input images.
Abstract
from arXiv · showhide
Machine learning systems based on deep neural networks, being able to produce state-of-the-art results on various perception tasks, have gained mainstream adoption in many applications. However, they are shown to be vulnerable to adversarial example attack, which generates malicious output by adding slight perturbations to the input. Previous adversarial example crafting methods, however, use simple metrics to evaluate the distances between the original examples and the adversarial ones, which could be easily detected by human eyes. In addition, these attacks are often not robust due to the inevitable noises and deviation in the physical world. In this work, we present a new adversarial example attack crafting method, which takes the human perceptual system into consideration and maximizes the noise tolerance of the crafted adversarial example. Experimental results demonstrate the efficacy of the proposed technique.
Introduction
Adversarial examples threaten security-sensitive neural-network systems by changing outputs through slight perturbations. Existing attacks remain limited because their perturbations can be perceptible and their effectiveness can degrade under physical-world noise and deviation.
- Adversarial example attacks modify legitimate inputs with slight perturbations that can substantially change neural-network outputs.
- Existing attacks seek targeted misclassification while minimizing perturbations with Lp-norm distance metrics.
- Lp norms treat perturbations across pixels equally, although human sensitivity varies with local image variance.
- Perturbations in low-variance regions are easier for people to detect than equally sized perturbations in visually complex regions.
- The proposed method models human perceptual sensitivity and maximizes adversarial noise tolerance to improve imperceptibility and physical-world robustness.
Related Work
Prior work developed several adversarial attacks across neural-network applications, including targeted image attacks and attacks designed for physical-world settings. These efforts establish the threat's breadth but leave general robust attack construction insufficiently addressed.
- Earlier methods such as L-BFGS, FGSM, and JSMA craft adversarial examples using optimization, gradients, or pixel-saliency modeling.
- Research on robustness includes physical-world attacks for face recognition and traffic-sign recognition, alongside earlier observations that some examples survive physical conditions.
- Adversarial attacks also affect speech recognition and malware detection, where inputs are crafted to trigger commands or evade classification.
Adversarial Example Attacks
Adversarial attacks alter machine-learning outputs through small input perturbations, with targeted attacks aiming at a specified class. The paper frames imperceptibility and robustness as central requirements and proposes a method addressing both.
- Adversarial Example Attacks: Targeted attacks seek a specified output class, whereas untargeted attacks only seek misclassification; targeted attacks are more difficult.
- Adversarial Example Attacks: Adversarial examples should remain visually similar to the original input, requiring a distance metric that reflects human perceptual sensitivity.
- Adversarial Example Attacks: Robustness measures whether an adversarial example remains misclassified as the target class after physical-world transformations involving noise or deviation.
- Adversarial Example Attacks: Previous methods often ignore robustness, so transformations can destroy their adversarial effect and cause physical-world attack failure.
- Adversarial Example Attacks: The paper proposes a crafting method intended to produce adversarial examples with both high imperceptibility and high robustness.
The Proposed Method
The method combines a human-perception-aware distance metric with probability-gap maximization to craft adversarial examples that are both imperceptible and robust to physical-world noise. A greedy optimization procedure selects effective, low-sensitivity pixels while enforcing a perceptual-distance constraint.
- Perception-aware distance: Human eyes are more sensitive to perturbations in low-variance regions, so the method favors perturbing pixels in high-variance zones.Figure 1 illustrates that equal-magnitude perturbations are harder to detect in visually disordered regions than on uniform areas.
- Perception-aware distance: For each pixel, local variance is estimated from the standard deviation within an n × n neighborhood; with n = 3, this uses the pixel and its eight neighbors.The neighborhood mean is used to calculate the local variability underlying the perceptual metric.
- Perception-aware distance: The perceptual distance sums each perturbation’s magnitude weighted by its pixel sensitivity, enabling constraints on changes likely to remain undetected.Low-variance pixels have higher perturbation sensitivity, so equal numerical changes need not have equal perceptual effects.
- Robustness objective: To improve physical-world robustness, the attack maximizes the gap between the target-class probability and the highest probability of competing classes.The paper links a larger probability gap to greater tolerance of transformations such as compression, resizing, and smoothing.
- Optimization: The optimization smooths the nondifferentiable maximum and uses a perturbation priority based on probability-gap gradients and perceptual sensitivity.The smoothing approximates the maximum with a differentiable expression, while priority estimates the gain from perturbing each pixel.
- Optimization: The greedy algorithm sorts pixels by priority, perturbs the first m pixels by a small magnitude, updates the example, and repeats until the perceptual-distance constraint is violated.This avoids the prohibitively long search for the best pixel subset at every iteration while preserving the imperceptibility constraint.
Experimental Evaluations
Experiments on MNIST and CIFAR10 evaluate the proposed attack against JSMA, FGSM, and L-BFGS for imperceptibility, human-perceptual distance, and robustness under image transformations and noise. The method produces the least perceptible examples and the strongest robustness across the reported tests.
- Experimental Setup: Experiments use MNIST and CIFAR10, comparing the proposed method with JSMA, FGSM, and L-BFGS attacks.The models achieve classification rates of 99.18% on MNIST and 84.21% on CIFAR10; attacks stop once the randomly assigned target class is reached.
- Imperceptibility: The proposed method generates the most imperceptible adversarial examples, nearly indistinguishable from the originals, while JSMA performs worst.The comparison uses original images followed by examples from the proposed method, L-BFGS, FGSM, and JSMA.
- Imperceptibility: 44.78 for MNIST and 51.98 for CIFAR10 are the proposed method’s human perceptual distances, the smallest among the compared methods.JSMA has the largest distances: 80.34 for MNIST and 92.25 for CIFAR10.
- Dataset Comparison: MNIST has larger human perceptual distances than CIFAR10, and the paper attributes the greater attack difficulty to uniform backgrounds and higher classification confidence.The MNIST classification rate is reported as about 15% higher than CIFAR10’s.
- Robustness: Under D_max = 70, the proposed method achieves the best robustness across JPEG compression, Gaussian blurring, contrast adjustment, and brightness adjustment.The threshold was selected empirically because distances below 70 were considered unlikely to attract much human attention; MNIST results were similar and are omitted.
- Robustness: 76% success attack rate under JPEG compression and 62% under Gaussian noise with standard deviation 0.25 exceed the reported baselines.FGSM reaches 52.3% under JPEG compression, while the baseline average is about 26% at Gaussian-noise standard deviation 0.25.
Conclusions
The proposed attack aims to combine high imperceptibility with robustness in the physical world. It uses a human-perception-aware metric and probability-gap optimization to improve adversarial-example effectiveness.
- The method proposes an adversarial-example attack designed for both high imperceptibility and physical-world robustness.
- Its distance metric evaluates image-pixel sensitivity to human eyes, guiding perturbations toward locations less likely to be detected.
- The optimization maximizes the probability gap between the adversarial target class and other classes to improve successful attacks in practice.
- Experimental results report that the method produces adversarial examples more imperceptible and robust than those generated by previous methods.