Source-linked AI summary
AVA: Adversarial Vignetting Attack against Visual Recognition
Binyu Tian, Felix Juefei-Xu, Qing Guo, Xiaofei Xie, Xiaohong Li, Yang Liu
TL;DR
Prior attacks have used noise or other realistic patterns, but have not exploited vignetting naturally generated in optical systems. This paper models vignetting to create adversarial examples and reports advantages over strong baselines, especially in transferability and image quality.
Problem
Prior attack patterns included noise and other realistic effects, but did not exploit patterns naturally generated in optical systems, such as common photographic vignetting.
Source: §1 · pp. 1–2Method
The paper models vignetting in RI-AVA, extends it to shape-free radial-anisotropic regions in RA-AVA, and uses geometry-aware level-set optimization to jointly solve regions and physical parameters.
Source: §1 · p. 2, §3.3 · p. 3Results
Takeaways & Limitations
The study demonstrates that vignetting can carry adversarial information in natural-looking examples without noise patterns.
Source: §1 · p. 2
Abstract
from arXiv · showhide
Vignetting is an inherited imaging phenomenon within almost all optical systems, showing as a radial intensity darkening toward the corners of an image. Since it is a common effect for photography and usually appears as a slight intensity variation, people usually regard it as a part of a photo and would not even want to post-process it. Due to this natural advantage, in this work, we study vignetting from a new viewpoint, i.e., adversarial vignetting attack (AVA), which aims to embed intentionally misleading information into vignetting and produce a natural adversarial example without noise patterns. This example can fool the state-of-the-art deep convolutional neural networks (CNNs) but is imperceptible to humans. To this end, we first propose the radial-isotropic adversarial vignetting attack (RI-AVA) based on the physical model of vignetting, where the physical parameters (e.g., illumination factor and focal length) are tuned through the guidance of target CNN models. To achieve higher transferability across different CNNs, we further propose radial-anisotropic adversarial vignetting attack (RA-AVA) by allowing the effective regions of vignetting to be radial-anisotropic and shape-free. Moreover, we propose the geometry-aware level-set optimization method to solve the adversarial vignetting regions and physical parameters jointly. We validate the proposed methods on three popular datasets, i.e., DEV, CIFAR10, and Tiny ImageNet, by attacking four CNNs, e.g., ResNet50, EfficientNet-B0, DenseNet121, and MobileNet-V2, demonstrating the advantages of our methods over baseline methods on both transferability and image quality.
1 Introduction
Vignetting is a naturally occurring photographic effect that the paper repurposes to embed misleading information in adversarial examples. It introduces physical-model and shape-flexible attacks, reporting advantages over strong baselines in transferability and image quality.
- Vignetting is a common photographic effect that darkens image borders, arising from camera settings or lens limitations and occurring naturally during photo capture.The paper describes mechanical, optical, and natural causes, including light blockage and illumination falloff.Source: §1 · p. 1
- AVA embeds misleading information in natural-looking vignetting; RI-AVA tunes physical parameters, while RA-AVA allows radial-anisotropic, shape-free regions for higher transferability.A geometry-aware level-set method jointly solves the adversarial regions and physical parameters.Source: §1 · p. 2
- Across DEV, CIFAR10, and Tiny ImageNet attacks on four CNNs, the proposed methods show advantages over strong baselines, especially in transferability and image quality.Source: §1 · p. 2
2 Related Work
Prior work studies attacks using imperceptible noise or other sparse, real-life, and non-additive patterns, while vignetting research has focused on correction. The paper distinguishes its approach by exploiting patterns generated naturally in optical systems.
- Adversarial noise attacks add imperceptible perturbations to fool DNNs, while the paper contrasts them with attacks using patterns that may arise in natural optical systems.The passage describes FGSM, BIM, momentum-based iterative attacks, and translation-invariant attacks.Source: §2 · p. 2
- Other attacks use sparse, Wasserstein-bounded, semantic, motion-blur, rain, haze, exposure, bias-field, denoising, or face-morphing patterns, but do not address naturally generated optical-system patterns.Source: §2 · p. 2
- Vignetting-correction studies model or remove the effect, providing a basis for the paper’s use of vignetting as an adversarial attack.The cited work includes physical and empirical modeling approaches.Source: §2 · p. 2
3 Adversarial Vignetting Attack (AVA)
AVA turns a physical model of vignetting into an attack by tuning its factors to fool CNNs, then extends geometry control to create more flexible adversarial regions.
3.1 Physical Model of Vignetting
- The physical model represents vignetting as pixel-wise illumination, geometric, and tilt factors applied to a clean image.The illumination factor darkens with distance from the image center, while the geometric and tilt factors model off-axis projection and camera tilt.Source: §3.1 · p. 3
3.2 Radial-Isotropic AVA
- RI-AVA tunes four physical parameters under norm-ball constraints, using classification loss and regularizers to guide gradient-based updates.The regularizers encourage a larger focal length and smaller geometry coefficient; RI-AVA tunes pixels equally at the same radius.Source: §3.2 · p. 3
3.3 Radial-Anisotropic AVA
- RA-AVA independently tunes elements of G and jointly optimizes G, the boundary curve C, and physical parameters.The region inside C stays similar to the physical geometry function, while the darker outside region offers more flexibility for embedding adversarial information.Source: §3.3 · p. 3
3.4 Geometry-aware Level-Set Optimization
- Geometry-aware level-set optimization represents G as a surface whose level-set curve defines the regions, then optimizes G and physical parameters by gradient descent.The differentiable Heaviside formulation supports optimization of these variables without directly evolving the curve.Source: §3.4 · p. 4
3.5 Implementation Details
- The implementation initializes physical parameters and G, then iteratively updates G and the parameters until the model is fooled or the iteration limit is reached.Experiments use 40 iterations and choose hyperparameters to balance attack success with image quality.Source: §3.5 · p. 4
4 Experimental Results
Experiments evaluate the attacks on DEV, CIFAR10, and Tiny ImageNet using four CNNs, comparing attack success, image quality, transferability, and correction. RA-AVA outperforms RI-AVA in attack success across datasets, while transfer results and visual examples assess additional performance dimensions.
Comparison with baseline attacks
- Across every dataset, RA-AVA achieves higher success rates than RI-AVA, while noise-based attacks have higher success rates but poorer image quality and RA-AVA significantly outperforms cAdv.RA-AVA can still be competitive in success rate on some models and datasets, such as DEV.Source: Table 1 · p. 5, §4 · pp. 5–6
Analysis of physical parameters
- With a larger focal-length bound, attack success decreases; with a larger geometric-factor bound, it increases, and lower focal length with higher geometric factor makes vignetting more obvious.The authors conclude that a stronger vignetting effect can increase attack success.Source: §4 · p. 5, Figure 4 · p. 5
Analysis of different objective functions
- Increasing λg or λf decreases attack success, while changing λα has almost no effect, indicating minimal constraint from that energy term.The authors report that energy-term restrictions constrain the attack.Source: §4 · p. 5
Comparison with baseline attacks
- RA-AVA examples are described as smooth and realistic, unlike noise-based examples with obvious noise or cAdv examples with perceptible changes.The figure compares original images with adversarial examples from different methods.Source: Figure 5 · p. 6, §4 · p. 6
Comparison on transferability
- 37.21%, 40.75%, and 40.89% transfer success rates were achieved on EfficientNet, DenseNet, and MobileNet by ResNet50-crafted DEV examples, with BRISQUE 11 and NIQE 37.04.Table 2 reports the transfer-attack results and image-quality scores.Source: Table 2 · p. 6, §4 · p. 6
AVAs against vignetting corrections
- Zero-DCE correction improves accuracy by only about 10%, leaving it below the original-image accuracy and indicating that the attack remains robust to this correction.The comparison concerns accuracy before attack, after RA-AVA, and after Zero-DCE correction on Tiny ImageNet.Source: Table 3 · p. 6, §4 · p. 7, Figure 6 · p. 7
5 Conclusion
The paper presents RI-AVA and RA-AVA, which embed adversarial information in vignetting, and reports that the resulting examples fool state-of-the-art CNNs while remaining imperceptible to people. It also points to studying the attack’s interplay with downstream perception tasks.
5 Conclusion
- RI-AVA tunes physical parameters under target-CNN guidance, while RA-AVA uses radial-anisotropic, shape-free regions for higher transferability and level-set optimization jointly solves regions and parameters.Source: §5 · p. 7
- AVA examples fool state-of-the-art CNNs with high success rates while remaining imperceptible to humans, and experiments show advantages over strong baselines.The evaluation covers three datasets and four CNNs.Source: §5 · p. 7
- The authors identify robust tracking, autonomous driving, and DeepFake detection as downstream tasks for future study of AVA’s interplay with perception.Source: §5 · p. 7