Source-linked AI summary
Semantic Adversarial Examples
Hossein Hosseini, Radha Poovendran
TL;DR
Deep neural networks can be fooled by small, artificial perturbations that defenses may detect or remove. This paper introduces semantic adversarial examples and generates them through HSV color shifts guided by shape bias. On CIFAR10, VGG16 accuracy falls to 5.7% on these images.
Problem
Existing adversarial-example generation mainly seeks small perturbations, producing artificial changes that can be distinguishable from natural images and targeted by defenses.
Method
The paper formulates semantic adversarial examples as constrained, semantic-preserving attacks and generates them by randomly shifting HSV hue and saturation while retaining value.
Results
5.7% accuracy was achieved by VGG16 on CIFAR10 adversarial color-shifted images.
Takeaways & Limitations
Semantic adversarial examples can preserve recognizable objects while causing substantial misclassification, including against a model described as robust to adversarial examples.
Takeaways & Limitations
The initial random-search constructions can produce images with visible noise.
Abstract
from arXiv · showhide
Deep neural networks are known to be vulnerable to adversarial examples, i.e., images that are maliciously perturbed to fool the model. Generating adversarial examples has been mostly limited to finding small perturbations that maximize the model prediction error. Such images, however, contain artificial perturbations that make them somewhat distinguishable from natural images. This property is used by several defense methods to counter adversarial examples by applying denoising filters or training the model to be robust to small perturbations. In this paper, we introduce a new class of adversarial examples, namely "Semantic Adversarial Examples," as images that are arbitrarily perturbed to fool the model, but in such a way that the modified image semantically represents the same object as the original image. We formulate the problem of generating such images as a constrained optimization problem and develop an adversarial transformation based on the shape bias property of human cognitive system. In our method, we generate adversarial images by first converting the RGB image into the HSV (Hue, Saturation and Value) color space and then randomly shifting the Hue and Saturation components, while keeping the Value component the same. Our experimental results on CIFAR10 dataset show that the accuracy of VGG16 network on adversarial color-shifted images is 5.7%.
1. Introduction
The paper introduces semantic adversarial examples: heavily modified images that preserve the original object's semantics while fooling classifiers. It proposes color shifts guided by human shape bias and reports severe VGG16 degradation on CIFAR10.
- Motivation: Unlike small-perturbation attacks, these examples target transformations that human vision treats as semantically invariant.Small artificial perturbations can be distinguishable from natural images and addressed by denoising or robustness training.
- Method: Human shape bias motivates preserving object shape while changing color, because humans weight shape more heavily than color or texture.The paper notes that ImageNet-trained models also display shape bias.
- Contributions: Semantic adversarial examples are arbitrarily perturbed images that fool models while semantically representing the original objects.The paper formulates their generation as constrained optimization requiring smooth, natural-looking outputs.
- Method: The proposed method converts RGB images to HSV, randomly shifts hue and saturation, and keeps value unchanged.The resulting images retain the original object with different colors and colorfulness.
- Results: 5.7% accuracy was achieved by VGG16 on CIFAR10 adversarial color-shifted images.The experiments use CIFAR10 and VGG16; modified images are reported to remain recognizable as the same objects.
2. Problem Statement
The paper extends adversarial-example generation from small perturbations to semantic-preserving transformations. It frames the task as finding natural-looking images that retain the original object for human vision but are misclassified by the model.
- Adversarial examples: Standard adversarial attacks minimize perturbation while forcing the classifier to change its label.The formulation uses classifier F and image x, with a non-equal prediction constraint.
- Semantic adversarial examples: Semantic attacks permit larger transformations, provided the human vision system preserves the image's semantics while the model misclassifies it.The paper denotes the human vision system by Ω and imposes semantic preservation alongside classifier disagreement.
- Semantic adversarial examples: The semantic formulation maps an image into natural-looking, misclassified images that still contain the original object.Under this view, wrongly classified clean images are adversarial examples with zero perturbation.
- Motivation: Identifying semantic adversarial transformations supports comparisons between model behavior and human vision and may evade defenses that reverse added perturbations.The paper presents these motivations from both learning and security perspectives.
3. Proposed Method
The method generates semantic adversarial examples by changing hue and saturation while preserving image structure through the HSV value component. It uses constrained random search to find misclassified, smooth-looking color-shifted images.
- Shape Bias Property of Human Cognitive System: Shape bias motivates changing color while preserving the original object’s structure, because humans categorize objects more by shape than color.
- HSV Color Space: HSV separates hue and saturation from brightness, enabling color and colorfulness changes while keeping the value component unchanged.
- Color-Shifted Images as Semantic Adversarial Examples: Randomly shifting all pixels’ hue and saturation produces smooth, natural-looking color-shifted images rather than visible pixelwise noise.
- Color-Shifted Images as Semantic Adversarial Examples: The optimization minimizes the saturation shift while requiring the modified image to preserve value and receive a different classifier label.
- Algorithm: The algorithm samples hue uniformly and expands the saturation-shift interval linearly across trials until misclassification occurs or the maximum trial count N is reached.
4. Experimental Results
Experiments on CIFAR10 evaluate color-shift attacks against VGG16 and related models. The results show substantial vulnerability, while training with color-shifted images improves robustness within that attack setting.
- Experimental setup: The experiments evaluate pretrained VGG16, a robust network, and VGG16 trained with original and color-shifted images on CIFAR10.The maximum number of trials was set to N = 1000.
- Untargeted attack: 5.7% accuracy was obtained for pretrained VGG16 on adversarial color-shifted images.The original objects remained recognizable in the corresponding adversarial images.
- Attack efficiency: More than 14% of images fooled the model after one hue-only color-shift trial.The attack success rate is evaluated as the number of trials increases.
- Targeted attack: 35.4% targeted-attack success was achieved on images correctly classified by VGG16.The attack searches over only two parameters and changed predictions to an average of more than three classes.
- Robust model: 8.4% accuracy was observed for the robust CNN on adversarial color-shifted images.The result indicates robustness to worst-case perturbations did not provide robustness to these semantic adversarial examples.
- Augmented training: 69.1% accuracy was achieved by VGG16 trained with original and color-shifted images.The authors note that this augmentation-based robustness may not indicate learning higher-level semantic features and may not transfer to other semantic attacks.
5. Related Work
Prior work primarily uses small perturbations, while other approaches employ fixed transformations, Fourier filtering, geometric changes, or generative models. The paper positions its method as a tunable transformation that preserves image semantics despite large pixel-wise changes.
- Small-perturbation attacks: FGSM, Deep-Fool, PGD, and Carlini–Wagner attacks typically optimize small perturbations that maximize model prediction error.These perturbations can make adversarial images distinguishable from natural images.
- Semantic transformation: The proposed transformation may introduce large pixel-wise perturbations while preserving the image semantics.Its tunable parameters can be searched to generate adversarial images.
- Fixed color transformations: Negative images are less recognizable to humans, while image complementing is fixed and cannot be adjusted to force misclassification.These limitations distinguish them from the paper’s color-shifted approach.
- Fourier filtering: Fourier filtering preserves high-level abstractions while changing surface statistics, but reduced CNN accuracy by more than 20% in the worst case.The paper reports its method reduces model accuracy by about 90% in comparison.
- Other natural-looking attacks: Translation and rotation attacks can fool CNNs, but rotated images may look unnatural, while GAN-generated images may belong to a different class.The paper excludes such cases from its definition of semantic adversarial examples.
6. Conclusion
The paper defines semantic adversarial examples as semantically preserved but misclassified images and generates them through HSV color shifting. On CIFAR10, state-of-the-art CNN accuracy falls below 10% on these images.
- Conclusion: Semantic Adversarial Examples preserve the original object’s semantics while causing model misclassification.The paper introduces this as a new class of adversarial examples.
- Conclusion: The method shifts color components in HSV space to generate smooth, natural-looking adversarial images.The reported evaluation uses CIFAR10.