Source-linked AI summary
Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A. K. Qin, Yun Yang
TL;DR
DNNs are vulnerable to adversarial examples, but existing approaches trade off digital imperceptibility against physical-world realism. AdvCam combines adversarial attacks with neural style transfer to hide large perturbations in customizable natural styles, and experiments find them stealthy and effective across digital and physical-world settings.
Problem
Existing attacks either use small perturbations suited to digital settings or large, less realistic physical-world distortions, leaving flexible natural-style camouflage missing.
Method
AdvCam combines adversarial and neural style-transfer techniques to generate large perturbations in attacker-customized styles and regions.
Results
AdvCam examples are highly stealthy while remaining effective at fooling state-of-the-art DNN image classifiers in digital and physical-world scenarios.
Takeaways & Limitations
AdvCam provides a flexible approach for crafting stealthy attacks to evaluate DNN robustness and can camouflage objects from human observers and DNN equipment.
Takeaways & Limitations
AdvCam requires attackers to manually specify the attack region and target style, with automatic specification left for future work.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. Existing works have mostly focused on either digital adversarial examples created via small and imperceptible perturbations, or physical-world adversarial examples created with large and less realistic distortions that are easily identified by human observers. In this paper, we propose a novel approach, called Adversarial Camouflage (\emph{AdvCam}), to craft and camouflage physical-world adversarial examples into natural styles that appear legitimate to human observers. Specifically, \emph{AdvCam} transfers large adversarial perturbations into customized styles, which are then "hidden" on-target object or off-target background. Experimental evaluation shows that, in both digital and physical-world scenarios, adversarial examples crafted by \emph{AdvCam} are well camouflaged and highly stealthy, while remaining effective in fooling state-of-the-art DNN image classifiers. Hence, \emph{AdvCam} is a flexible approach that can help craft stealthy attacks to evaluate the robustness of DNNs. \emph{AdvCam} can also be used to protect private information from being detected by deep learning systems.
1. Introduction
DNNs are vulnerable to adversarial examples, while physical-world attacks often require large, conspicuous perturbations. AdvCam addresses this gap by camouflaging large attacks into customizable natural styles while retaining attack effectiveness and stealthiness.
- DNNs support many applications but remain vulnerable to carefully crafted adversarial perturbations, raising security concerns for critical systems.
- Digital and physical-world attacks differ in access conditions, while attack quality involves strength, human stealthiness, and camouflage flexibility.
- Existing attacks achieve stealthiness through small perturbations or semantic modifications, but lack a flexible mechanism for hiding attacks in natural styles.
- AdvCam uses customizable attack regions and camouflage styles to craft large perturbations that appear natural rather than artificially distorted.
- AdvCam is not restricted to small perturbations and instead induces natural-looking perturbations, producing more realistic images than previous methods.
- Experiments in digital and physical-world settings show AdvCam examples are highly stealthy while still fooling state-of-the-art DNN image classifiers.
2. Related Work
Prior adversarial attacks largely target digital inputs with small perturbations, whereas physical-world attacks require robust, larger modifications. AdvCam fills the missing role of flexible camouflage by combining adversarial optimization with neural style transfer.
- Adversarial attacks may be targeted or untargeted and can operate digitally or through camera-captured physical-world inputs.
- Gradient-based and optimization-based methods such as FGSM, BIM, PGD, CW, and EAD generate adversarial examples through perturbation or direct minimization.
- Unrestricted attacks modify attributes such as color or texture, but may create unnatural distortions, require semantic annotations, or fail to produce complex patterns.
- Existing attacks generally obtain stealthiness through small perturbations or semantic attribute changes, leaving flexible natural-style camouflage unresolved.
- Physical-world attacks must tolerate viewpoint shifts, camera noise, lighting, rotation, and perspective changes, requiring large perturbations and transformation adaptations.
- Neural style transfer recombines style information with target-image structure, enabling complex image stylization beyond traditional pixel-replacement texture transfer.
3. Our Adversarial Camouflage Approach
AdvCam combines adversarial optimization with style transfer to create large-perturbation examples that preserve content, appear natural, and can be adapted to physical conditions.
- Approach overview: AdvCam combines adversarial, style, content, and smoothness losses to balance attack strength, customized appearance, content preservation, and local smoothness.The final loss is L = (Ls + Lc + Lm) + λ · Ladv.
- Approach overview: The attacker can specify the target image, attack region, and expected style, while AdvCam generates the styled perturbation in the selected area.Masking restricts modification to the attack region; style can be placed on-target or off-target.
- Style loss: Style distance replaces traditional pixel-distance stealthiness by comparing Gram-matrix style representations of the adversarial and reference images.The feature extractor may differ from the target model, and all convolutional layers are used as style layers.
- Content loss: Content preservation is optional for small regions without particular content but helps reduce semantic differences when the attack region contains meaningful content.Deeper feature-extractor layers provide content representations.
- Smoothness loss: The smoothness loss reduces adjacent-pixel variation, although its stealthiness benefit is limited when the target and style surfaces are already smooth.The paper still recommends it for physical settings because smoothness can improve robustness there.
- Physical adaptation: Physical adaptation trains generated images against random backgrounds and transformations such as rotation, resizing, color shifts, and lighting changes.These adaptations target viewpoint shifts, camera noise, and other physical-world fluctuations.
- Camouflage objective: Adjusting the style reference according to the target and background images is intended to make examples stealthy to both human observers and DNNs.The approach leverages vision as the primary perceptual channel for both observers and models.
4. Experimental Evaluation
The evaluation analyzes AdvCam through ablation, human-perception studies for digital attacks, visual examples, and physical-world attacks.
- Evaluation program: The experiments include ablation analysis, digital human-perception studies, highly stealthy adversarial examples, and physical-world attacks.These components are presented in sequence as the paper’s evaluation program.
4.1. Experimental Setup
The setup compares AdvCam with PGD and AdvPatch across targeted and untargeted digital and physical-world attacks under a gray-box threat model.
- Baselines: The study compares AdvCam with PGD and AdvPatch using attack success rate and visual effect as evaluation criteria.PGD represents digital attacks, while AdvPatch represents unrestricted attacks applicable to physical-world settings.
- Threat model and settings: Targeted and untargeted attacks are tested in both digital and physical-world settings under a gray-box model with separately trained VGG-19 source and target networks.For physical tests, images are captured with a Google Pixel2, digitally attacked, and printed for presentation to the camera.
4.2. Ablation Study
The ablation study examines how camouflage-region selection, optional camouflage losses, adversarial strength, and region size affect AdvCam attacks. Larger strength and regions improve success, while content and smoothness losses mainly refine appearance.
- Camouflage region: shape and location: Region shape and location affect adversarial strength, yet attacks succeed with high confidence for regions centered on or away from the target object.The study also reports that attacks can be hidden in background regions off the target object.
- Camouflage losses: Content preservation helps retain original content, while smoothness enhancement produces smoother object surfaces.Both are optional because their visual improvements are slight for some examples.
- Adversarial strength and region size: Larger attack regions can improve success rate by up to 40% when λ is fixed.Region sizes range from 40*40 to 120*120, and the result holds for the reported targeted and untargeted evaluations.
- Adversarial strength and region size: Untargeted attacks are easier to succeed than targeted attacks, while top-1 targeted attacks are harder than top-5 targeted attacks.The reported standard errors across strengths and region sizes range from 0.07% to 1.13%.
4.3. Digital Attacks
The digital-attack evaluation compares AdvCam with PGD-16 and AdvPatch using targeted ImageNet attacks and human judgments of naturalness. AdvCam combines effective attack construction with stealthiness comparable to PGD-16.
- Human perception study results: AdvCam achieved stealthiness comparable to small-perturbation PGD-16 despite using unrestricted perturbation size.The authors characterize this result through a human perception study rather than classifier accuracy alone.
- Customized examples: AdvCam camouflages attacks both on target objects and in carefully chosen background areas.Examples include hiding attacks in a price tag, background flowers, and wall posters to induce classifier misclassification.
4.4. Physical-world Attacks
The physical-world evaluation tests AdvCam on printed patterns photographed across viewing conditions and customized natural styles. The examples show stealthy, flexible camouflage that can preserve attack effectiveness in physical scenarios.
- Physical-world evaluation: The physical-world evaluation prints adversarial patterns on A3 or A4 paper and photographs them from varied viewing angles and distances.AdvCam is compared with AdvPatch and PGD, with PGD tested across several perturbation magnitudes.
- Street-sign camouflage: AdvCam camouflages a street-sign attack into tree texture, whereas physical PGD requires ε = 128/255 and appears less stealthy.The street-sign scenario targets problems for self-driving cars.
- Customized camouflage styles: AdvCam applies a customized “pikachu” fashion logo to a jersey, and all three attacks perform the “jersey” to “Irish terrier” attack.PGD fails in this scenario even with the largest tested perturbation.
- Customized camouflage styles: AdvCam uses three natural styles to make a street sign misclassified as a barbershop with smooth patterns that are difficult for humans to detect.The authors present this as evidence of stealthiness and flexibility for evaluating physical-world DNN robustness.
5. Conclusion and Future Work
The paper presents AdvCam as a stealthy camouflage approach combining neural style transfer with adversarial attacks, while identifying manual setup and broader task coverage as future work.
- AdvCam combines neural style transfer and adversarial attack techniques to camouflage adversarial examples into stealthy, natural-looking styles.It is proposed as a flexible approach for crafting stealthy attacks to evaluate DNN robustness and as a camouflage technique against human and DNN detection.
- AdvCam may also protect objects or people from detection by human observers and DNN-based equipment.
- The current method requires attackers to manually specify the attack region and target style.The authors plan to investigate semantic segmentation for automatic specification, alongside applications to other vision tasks and defenses against camouflaged attacks.