PaperlayerView exact revision on arXiv

Source-linked AI summary

SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing

Haonan Qiu, Chaowei Xiao, Lei Yang, Xinchen Yan, Honglak Lee, Bo Li

arXiv:1906.07927v4cs.LGcs.CRcs.CVeess.IV

TL;DR

The paper asks how DNNs respond to semantically meaningful perturbations beyond Lp-bounded pixel changes. SemanticAdv uses disentangled semantic factors, attribute-conditioned image editing, and feature-space interpolation to create controlled adversarial examples. It fools face verification, landmark detection, and semantic segmentation systems, including a 67.7% query-free black-box attack success rate on a real-world face verification platform.

  • Problem

    Lp-bounded perturbations do not fully capture semantic variations or guarantee semantic realism, motivating study of DNN failure modes under semantic perturbations.

  • Method

    SemanticAdv edits controlled visual attributes using disentangled representations and interpolates source and edited images in generator feature-map space.

  • Results

    SemanticAdv fools face verification, landmark detection, and semantic segmentation models, with a 67.7% query-free black-box attack success rate on a real-world face verification platform.

  • Takeaways & Limitations

    Controlled semantic adversarial examples support fine-grained, interpretable analysis of DNN vulnerabilities and motivate further work on semantic defenses.

  • Takeaways & Limitations

    The generated adversarial examples are expected to remain close to the data manifold, reflecting the method's reliance on image-pair-based semantic editing.

Abstract

from arXiv · show

Deep neural networks (DNNs) have achieved great success in various applications due to their strong expressive power. However, recent studies have shown that DNNs are vulnerable to adversarial examples which are manipulated instances targeting to mislead DNNs to make incorrect predictions. Currently, most such adversarial examples try to guarantee "subtle perturbation" by limiting the $L_p$ norm of the perturbation. In this paper, we aim to explore the impact of semantic manipulation on DNNs predictions by manipulating the semantic attributes of images and generate "unrestricted adversarial examples". In particular, we propose an algorithm \emph{SemanticAdv} which leverages disentangled semantic factors to generate adversarial perturbation by altering controlled semantic attributes to fool the learner towards various "adversarial" targets. We conduct extensive experiments to show that the semantic based adversarial examples can not only fool different learning tasks such as face verification and landmark detection, but also achieve high targeted attack success rate against \emph{real-world black-box} services such as Azure face verification service based on transferability. To further demonstrate the applicability of \emph{SemanticAdv} beyond face recognition domain, we also generate semantic perturbations on street-view images. Such adversarial examples with controlled semantic manipulation can shed light on further understanding about vulnerabilities of DNNs as well as potential defensive approaches.

1 Introduction

SemanticAdv studies DNN vulnerabilities under semantically meaningful, attribute-controlled image changes rather than only pixel-bounded perturbations. It uses disentangled image editing and feature-space interpolation to generate interpretable attacks across recognition and segmentation-related tasks.

  • Motivation: Lp-bounded attacks capture raw-pixel variations but may not guarantee semantic realism or handle changes such as lighting conditions.These limitations motivate studying DNN failure modes beyond raw pixel variations.
  • Method: SemanticAdv edits one visual attribute or a subset of attributes while keeping the remaining image content unchanged.Examples include changing hair color or adding glasses, preserving an interpretable semantic meaning.
  • Method: Disentangled representations vary a specific semantic factor while preserving other factors, enabling controlled attribute-conditioned image editing.The method first constructs a source-like edited image and then interpolates between the pair in generator feature-map space.
  • Results: SemanticAdv achieves high targeted attack success while preserving input-image semantics in face verification and landmark detection experiments.The framework was also extended to generate adversarial street-view images that fool semantic segmentation models.
  • Results: 67.7% query-free black-box attack success rate was achieved on a real-world face verification platform.The reported transferability result concerns a real-world face verification service.
  • Implications: Per-pixel and attribute-based defenses fail against SemanticAdv compared with Lp attacks, exposing an unexplored vulnerability landscape for DNNs.The paper also presents SemanticAdv as a controllable tool for analyzing robustness across visual attributes.

2 Related Work

Related work spans semantic image generation and manipulation, conventional Lp-bounded adversarial attacks, and earlier generative or color-and-texture-based semantic attacks. SemanticAdv differs by using specific visual attributes and feature-space manipulation for controllable adversarial examples.

  • Semantic image editing: Semantic image editing research includes high-fidelity generation, attribute-to-image generation, text-to-image generation, and image-to-image translation.These advances come from deep generative models across several image synthesis and manipulation settings.
  • Adversarial examples: Lp-bounded adversarial perturbations have been extensively studied as a conventional approach to generating adversarial examples.Related work also investigates diverse attacks to help analyze vulnerabilities and inspire defenses.
  • Semantic adversarial attacks: Earlier methods used unconditional generative models or semantic transformations limited to color and texture spaces.SemanticAdv instead manipulates specific visual attributes in feature space and analyzes robustness across those attributes.

3 SemanticAdv

SemanticAdv generates controllable semantic adversarial examples by editing selected attributes with a conditional generator and interpolating in attribute or feature space. Its feature-map design adds flexibility while preserving perceptual quality, and its objective balances attack success against smoothness.

  • Attribute-conditioned image editing: SemanticAdv uses attribute-conditioned image editing to alter one semantic aspect while keeping the remaining appearance unchanged.The semantic attacker uses a conditional generator G to produce controllable adversarial examples through semantic editing.
  • Attribute-conditioned image editing: The edited image is expected to remain close to the data manifold when the disentangled attribute change is sufficiently small.The framework can generate many similar images by interpolating between the source and edited image.
  • Attribute-conditioned image editing: Attribute-space interpolation blends original and new attributes using c* = α · c + (1 − α) · cnew, with α ∈[0, 1].
  • Attribute-conditioned image editing: Feature-map interpolation instead optimizes a tensor β matching the intermediate feature map’s shape, providing more flexibility than scalar attribute interpolation.Empirical results indicate this flexibility is critical for maintaining both attack success and perceptual quality.
  • Generating semantically meaningful adversarial examples: The adversarial objective minimizes an attack metric while imposing a smoothness constraint, with λ balancing these terms.The target may be an identity representation, landmark coordinates, or semantic label maps depending on the task.
  • Generating semantically meaningful adversarial examples: SemanticAdv evaluates identity verification with embedding distance and structured prediction with the Houdini objective.For identity verification, the setting uses normalized L2 distance and an FPR-threshold-related parameter κ.

4 Experiments

Experiments evaluate SemanticAdv on face verification, landmark detection, and street-view segmentation, emphasizing controllable semantic attacks, transferability, perceptual quality, and defense robustness.

  • Experimental setup: SemanticAdv is evaluated on face verification and landmark detection using CelebA, then extended to adversarial street-view semantic segmentation.The face experiments use state-of-the-art recognition systems and StarGAN-based attribute-conditioned editing.
  • Qualitative analysis: SemanticAdv produces reasonably realistic, attribute-localized perturbations, whereas CW perturbations lack specific patterns and are distributed across the image.The comparison includes both multi-attribute examples and corresponding residual visualizations.
  • Perceptual quality: 39.14 ± 1.96% of AMT trials judged SemanticAdv images reasonably looking, versus 30.27 ± 1.96% for CW under G-FPR < 10^-4.The study collected 2,620 annotations from 77 participants.
  • Single attribute analysis: At T-FPR = 10^-3, SemanticAdv achieves almost 100% attack success across attributes, while performance at T-FPR = 10^-4 varies by attribute.Mouth Slightly Open and Arched Eyebrows achieve less than 50% success at the smaller threshold, whereas Pale Skin and Eyeglasses are less affected.

5 Conclusions

SemanticAdv generates controllable, semantically meaningful adversarial perturbations guided by single attributes. Experiments on face verification and landmark detection demonstrate attack transferability, while the authors identify semantic information as a direction for future defenses.

  • Compared with existing methods, SemanticAdv operates in a more controllable fashion.
  • Experiments on face verification and landmark detection demonstrate attack transferability.
  • Leveraging semantic information for defense is identified as a potential direction in adversarial learning.

A Implementation details

The implementation uses Adam optimization for SemanticAdv and CW, with task-specific iteration settings and evaluation metrics. Face verification attacks are assessed across 17 attributes, while landmark attacks use NME and an out-of-region ratio.

  • Implementation details: SemanticAdv and CW adversarial examples are generated with Adam optimization.SemanticAdv uses up to 200 or 500 steps depending on G-FPR; CW uses up to 1,000 steps.
  • Evaluation metrics: Face verification evaluation reports Best, Average, and Worst attack success rates across 17 attributes.Best requires one successful attribute, Average averages across attributes, and Worst requires all 17 attributes to succeed.
  • Evaluation metrics: The Best metric enables comparison with pixel-wise attack success rates, while Average and Worst assess robustness across semantic attributes.Both SemanticAdv (Best) and CW achieve 100% attack success rate in practice.
  • Evaluation metrics: Landmark detection uses NME for Rotating Eyes and the out-of-region ratio for Out of Region.NME normalizes landmark error by the square-root area of the ground-truth bounding box; the out-of-region ratio counts predictions outside the predefined region.

A.3 Ablation study: feature-space interpolation

The ablation study evaluates feature-space interpolation using StarGAN feature maps. Interpolating on f0, the feature map before up-sampling, achieves the highest attack success rate.

  • A.3 Ablation study: feature-space interpolation: The ablation study analyzes attack success rates from interpolation on different StarGAN feature maps.
  • A.3 Ablation study: feature-space interpolation: StarGAN feature maps fi are taken after the i-th up-sampling operation, while f0 precedes up-sampling.
  • A.3 Ablation study: feature-space interpolation: Interpolation on f0 achieves the highest attack success rate.The paper attributes this result to f0 being the feature map before up-sampling.

B.1 Face identity verification

The face identity verification experiments compare ResNet models and SemanticAdv against CW across multiple benchmarks and semantic attacks. Results show attribute-dependent robustness, successful landmark attacks, and vulnerability differences between cosine-objective and softmax models.

  • B.1 Face identity verification: The experiments evaluate ResNet face verification performance on LFW, AgeDB-30, and CFP benchmarks.LFW contains 13,233 images from 5,749 identities, while AgeDB contains 12,240 images from 440 identities.
  • B.1 Face identity verification: Face verification models show different robustness levels across semantic attributes.Models are more robust to local shape variations than color variations; pale skin has higher attack success rate than mouth open.
  • B.1 Face identity verification: The cosine-objective face model has higher face recognition performance but is more vulnerable to adversarial attack than the softmax model.
  • B.1 Face identity verification: SemanticAdv’s intermediate outputs before adversarial perturbation do not successfully attack, indicating that interpolation adds the adversarial perturbation.
  • B.1 Face identity verification: SemanticAdv efficiently attacks landmark detection models, with reasonably good performance for Eyeglasses and Pale Skin attributes.The evaluated tasks are Rotating Eyes and Out of Region.

B.3 User study

The user study found SemanticAdv images were judged reasonably-looking more often than CW images, including at stricter attack settings. SemanticAdv also remained distinct from combining semantic editing with pixel-wise CW attacks.

  • User study: 39.14 ± 1.96% of trials selected SemanticAdv images as reasonably-looking, compared with 30.27 ± 1.96% for CW images.Both methods used G-FPR<10^-4 in this study.
  • User study: 45.42 ± 1.96% of trials selected SemanticAdv images as reasonably-looking at G-FPR=10^-3.This result was described as very close to random guessing at 50%.
  • Transferability: Under G-FPR = 10^-4 and T-FPR = 10^-4, transferability became lower across models when the verification criterion was stricter.The passage attributes the change to lowering T-FPR.
  • Transferability: The StarGAN+CW baseline showed a noticeable performance gap relative to SemanticAdv in attack transferability.StarGAN+CW applies semantic editing first and then standard Lp-bounded CW attacks.

B.5 Query-free black-box API attack

SemanticAdv was evaluated as a query-free black-box attack against online face-verification APIs. It outperformed CW and StarGAN+CW across the tested APIs and FPR thresholds, with Azure examples illustrating the attack.

  • API evaluation: SemanticAdv outperformed CW and StarGAN+CW on all three APIs under all tested FPR thresholds.The evaluation reports attack success rates for query-free black-box attacks.
  • API evaluation: Lower-G-FPR samples achieved higher attack success rates than higher-G-FPR samples under the same T-FPR.Original x and generated xnew served as reference points for evaluating online verification performance.
  • API evaluation: Figure 10 shows examples of SemanticAdv attacks on Microsoft Azure face verification, whose likelihood threshold was set to 0.5.Azure does not provide accept thresholds for different T-FPRs; confidence denotes the likelihood that two faces belong to the same person.

B.6 SemanticAdv against adversarial training

Against adversarial training, SemanticAdv produced substantially lower accuracy than PGD-based examples on the robust model. This indicates that the evaluated defense was less effective against SemanticAdv.

  • Robust-model evaluation: The robust model achieved 10% accuracy against SemanticAdv examples, versus 46.7% against PGD examples.Table 12 compares standard and adversarially trained models.
  • Robust-model evaluation: Existing adversarial-training defense was less effective against SemanticAdv than against PGD examples.The comparison concerns the evaluated robust model and the two adversarial-example types.
  • Implication: The results position SemanticAdv as an unexplored attack area beyond previous Lp-based adversarial examples.The paper contrasts semantic perturbations with earlier pixel-space perturbations.
Loading 1906.07927v4…