PaperlayerView exact revision on arXiv

Source-linked AI summary

Controlled Caption Generation for Images Through Adversarial Attacks

Nayyer Aafaq, Naveed Akhtar, Wei Liu, Mubarak Shah, Ajmal Mian

arXiv:2107.03050v1cs.CVcs.LG

TL;DR

Adversarial susceptibility in image captioning remains under-explored, despite the complexity of systems that combine visual and language models. The paper proposes a GAN-based attack on CNN internal representations to control generated captions without access to the language model. It reports high attack success, including higher success from internal-layer attacks than from classification-layer attacks.

  • Problem

    Adversarial attacks on image captioning are under-explored, and captioning combines CNN and RNN components with a large space of valid captions.

    Source: §1 · pp. 1–2

  • Method

    A GAN-based method perturbs images to match a target image’s internal CNN representation, controlling captions without language-model knowledge.

    Source: §1 · p. 2, §3.1 · p. 4, §3.2 · p. 5

  • Results

    The method fools captioning frameworks with high success rates, and internal-layer attacks succeed more often than classification-layer attacks.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Attacking only the visual encoder can control caption generation, and captioning attacks differ from attacks on image classifiers.

    Source: §1 · p. 2, §5 · p. 9

    The experiments use a gray-box setup with the CNN known but no details of the language model or its augmentation techniques.

    Source: §4.3 · p. 6

Abstract

from arXiv · show

Deep learning is found to be vulnerable to adversarial examples. However, its adversarial susceptibility in image caption generation is under-explored. We study adversarial examples for vision and language models, which typically adopt an encoder-decoder framework consisting of two major components: a Convolutional Neural Network (i.e., CNN) for image feature extraction and a Recurrent Neural Network (RNN) for caption generation. In particular, we investigate attacks on the visual encoder's hidden layer that is fed to the subsequent recurrent network. The existing methods either attack the classification layer of the visual encoder or they back-propagate the gradients from the language model. In contrast, we propose a GAN-based algorithm for crafting adversarial examples for neural image captioning that mimics the internal representation of the CNN such that the resulting deep features of the input image enable a controlled incorrect caption generation through the recurrent network. Our contribution provides new insights for understanding adversarial attacks on vision systems with language component. The proposed method employs two strategies for a comprehensive evaluation. The first examines if a neural image captioning system can be misled to output targeted image captions. The second analyzes the possibility of keywords into the predicted captions. Experiments show that our algorithm can craft effective adversarial images based on the CNN hidden layers to fool captioning framework. Moreover, we discover the proposed attack to be highly transferable. Our work leads to new robustness implications for neural image captioning.

1. Introduction

Adversarial attacks on image captioning are under-explored, and the CNN-RNN architecture makes the captioning objective and attack process more complex than classification. The paper proposes a GAN-based attack on the visual encoder to control generated captions without access to the language model.

1. Introduction

  • Captioning attacks pose a distinct challenge because many different captions can correctly describe an image and the system combines CNN and RNN components.Earlier captioning attacks require the language-model objective and may need to be recomputed when the visual model changes.Source: §1 · p. 2
  • A GAN-based attack alters visual representations to control subsequent captions, and is the first study of captioning attacks via the visual encoder alone.The attack does not require knowledge of the language model.Source: §1 · p. 2
  • Captioning models can be fooled more successfully by attacking visual-model internal layers than the classification layer.The authors also report high success rates against state-of-the-art captioning models.Source: §1 · p. 2
  • The authors explore the captioning framework’s internal mechanisms through adversarial attacks.Source: §1 · p. 2

2. Related Work

Related work covers visual captioning, adversarial examples for visual tasks, and attacks on captioning systems. It describes encoder-decoder captioning models and the distinct challenges of attacking their visual and language components.

2.1. Visual Captioning

  • Visual captioning commonly uses a CNN encoder to extract visual features and a recurrent network or transformer to generate natural-language descriptions.Some approaches add attention over visual cues, semantic concepts, or attributes.Source: §2.1 · p. 3

2.2. Adversarial Examples

  • Adversarial-example research has focused mainly on visual tasks, while attacks on recurrent networks face more complicated gradients and model objectives.The paper frames image captioning as requiring attacks across both CNN and RNN components.Source: §2.2 · p. 3

2.3. Adversarial Examples For Captioning Tasks

  • Prior captioning attacks target the RNN or specify target captions and keywords, but rely on language-model objectives and complete framework information.One approach can constrain targeted keywords to specific caption positions.Source: §2.3 · p. 3

3. Methodology

The method formulates caption control as matching a source image’s visual features to a target’s, then uses a GAN-generated perturbation to alter the CNN representation independently of the RNN. The discriminator’s feature-matching loss guides perturbation updates, and the trained generator is evaluated in gray-box captioning settings.

3.1. Problem Formulation

  • Caption attacks target a predefined caption sequence, while the method manipulates CNN internal representations rather than class labels or RNN gradients.The caption is represented as a variable-length sequence of vocabulary words with start and end symbols, subject to a maximum length.Source: §3.1 · p. 4

3.2. Computing Generative Perturbations

  • The generator perturbs the source image to match a target image’s selected CNN features, steering the resulting caption without requiring language-model information.A pretrained CNN discriminator provides the feature vectors; the generated perturbation is scaled before being added to the source image.Source: §3.2 · p. 5

3.3. Loss Functions

  • The discriminator compares source and target feature vectors, and back-propagated loss gradients update the perturbed image and generator.The generator loss is computed from the updated perturbation.Source: §3.3 · p. 5

3.4. Implementation Details

  • Experiments use ADAM at a 1 × 10−4 learning rate, train the generator for 300 epochs, and test under gray-box settings with three captioning models.The tested models include a vanilla CNN-LSTM combination, Show-and-Tell, and Show-Attend-and-Tell.Source: §3.4 · p. 5

4. Experiments and Results

Experiments evaluate visual-model-based attacks on captioning systems through targeted captions and keyword inclusion, across two captioners and LSTM sizes. The reported results include strong caption-match rates, partial keyword success, and similar attack trends across the tested LSTM sizes.

4.1. Dataset

  • The evaluation uses MS COCO 2014, split into 113287 training, 5000 validation, and 5000 test images.Source: §4.1 · p. 5

4.2. Metrics

  • Caption-match evaluation uses BLEU-1–4, CIDEr, METEOR, ROUGE, and SPICE.The authors note that CIDEr is designed specifically for image captioning, while other adopted metrics are widely used in NLP.Source: §4.2 · pp. 5–6

4.3. Gray-Box Attack

  • The attack targets images from a source class using a randomly selected target-class image, rather than requiring its caption as the target.The experiments assess Show-and-Tell and Show-Attend-and-Tell, whose internal architectures differ.Source: §4.3 · p. 6
  • Attack success is measured by exact caption identity or by whether the captions' METEOR score exceeds thresholds of 0.15, 0.20, or 0.25.The authors motivate METEOR because different captions for an image may both be correct.Source: §4.3 · p. 6
  • On Show-and-Tell, attack success varied from 39.3% to 66.7% by Exact Match and 81.5% to 95.3% by METEOR across ϵ values; Show-Attend-and-Tell performed slightly better.Source: §4.3 · p. 6
  • Almost 94% of failed examples include at least one target keyword, and almost 90% contain three keywords.The predicted captions may remain relevant despite low automated metric scores.Source: Table 3 · p. 7, §4.3 · p. 7

4.4. CNN Only Attack

  • The internal-layer attack outperforms Show-and-Fool despite its weaker success criterion; classification-layer attacks do not transfer well to captioning.A qualitative example shows an exact target-caption attack on Show-Attend-and-Tell.Source: Table 4 · p. 7, §4.4 · p. 7, Figure 3 · p. 8

4.5. Internal Layer Size Effect on Attack Success

  • Both LSTM sizes show similar attack trends as ε increases, so internal state size does not play a major defensive role.The 512-unit model performs slightly better across runs, with a difference attributed to state-size mismatch on benign images.Source: Table 5 · p. 8, §4.5 · pp. 8–9

5. Conclusion

The paper presents a gray-box attack that controls image captions by targeting only the visual encoder. Its experiments report high attack success, lower success from targeting the classification layer, and little effect of recurrent-network state size on robustness.

5. Conclusion

  • The proposed gray-box method attacks only the visual encoder to control captions, without requiring the captioning framework’s language model or other internal details.Source: §5 · p. 9
  • The authors report that the method generates adversarial examples against state-of-the-art captioning models with a high attack success rate.Source: §5 · p. 9
  • Attacking the feature extractor’s internal layer yields better success than attacking its classification layer.Source: §5 · p. 9
  • The authors report that recurrent-network internal state size does not play a major role in robustness against these attacks.Source: §5 · p. 9
  • The paper concludes that attacking image captioning systems differs from attacking image classifiers.Source: §5 · p. 9

Related papers

Loading 2107.03050v1…