Source-linked AI summary
AdvDrop: Adversarial Attack to DNNs by Dropping Information
Ranjie Duan, Yuefeng Chen, Dantong Niu, Yun Yang, A. K. Qin, Yuan He
TL;DR
DNNs may rely on image details that humans barely perceive, raising the question of whether removing those details can fool them. AdvDrop removes image information in the frequency domain, and the paper reports high attack success and weaker effectiveness of current defenses against its examples.
Problem
It remains challenging for DNNs to recognize visual objects when image information is lost, even though humans can recognize such objects.
Source: §1 · p. 1Method
AdvDrop crafts adversarial examples by dropping less-perceptible image details, reducing frequency components after transforming images to the frequency domain.
Source: §1 · pp. 2–3Results
AdvDrop achieves high attack success in targeted and untargeted ImageNet settings, and current defenses are less effective against its examples than against other attacks.
Source: §1 · pp. 2–3Takeaways & Limitations
AdvDrop provides a new approach to evaluating DNN robustness by dropping existing image details.
Source: §5 · p. 9The current method uses a relatively simple information-dropping approach focused on the frequency domain.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Human can easily recognize visual objects with lost information: even losing most details with only contour reserved, e.g. cartoon. However, in terms of visual perception of Deep Neural Networks (DNNs), the ability for recognizing abstract objects (visual objects with lost information) is still a challenge. In this work, we investigate this issue from an adversarial viewpoint: will the performance of DNNs decrease even for the images only losing a little information? Towards this end, we propose a novel adversarial attack, named \textit{AdvDrop}, which crafts adversarial examples by dropping existing information of images. Previously, most adversarial attacks add extra disturbing information on clean images explicitly. Opposite to previous works, our proposed work explores the adversarial robustness of DNN models in a novel perspective by dropping imperceptible details to craft adversarial examples. We demonstrate the effectiveness of \textit{AdvDrop} by extensive experiments, and show that this new type of adversarial examples is more difficult to be defended by current defense systems.
1. Introduction
AdvDrop explores whether DNNs can be fooled by removing image details that people barely notice, rather than adding adversarial perturbations. The paper reports strong attacks and reduced defense effectiveness, especially for denoising-based defenses.
1. Introduction
- Figure 1 contrasts PGD’s added details with AdvDrop’s fewer details and colors, while showing reduced image size for AdvDrop examples.The caption reports size decreases of 15% and 7%.Source: Figure 1 · p. 1, §1 · p. 1
- The motivation is to remove features that are imperceptible to humans but essential to DNNs, potentially causing the models to misrecognize the resulting images.The introduction contrasts this with adding adversarial perturbations or non-robust features.Source: §1 · pp. 1–2
- AdvDrop achieves high attack success in targeted and untargeted ImageNet settings, while current defenses are less effective against it than against other attacks.The paper also reports that denoising-based defenses have almost no effect on AdvDrop examples.Source: §1 · pp. 2–3
- The paper evaluates AdvDrop in targeted and untargeted attacks and examines its effectiveness against existing defenses.It also proposes visualizing dropped information and DNN attention to interpret the generated adversaries.Source: §1 · pp. 2–3
- AdvDrop crafts adversarial images by dropping existing, less perceptible details, unlike attacks that add disturbing information to clean images.The paper focuses on frequency-domain reductions of image components, beginning with subtle details such as textures.Source: §1 · pp. 1–3
2. Background and Related Work
The background contrasts conventional adversarial attacks and defenses with AdvDrop’s information-dropping approach, then motivates its image-compression design through JPEG’s frequency-domain quantization.
2.1. Adversarial attacks and defenses
- Most attacks add a perturbation to clean images, while AdvDrop frames its approach as dropping existing information; prior work also modifies secondary attributes or uses blurring and smoothing.The paper distinguishes its purpose from motion-blurring and smoothing attacks, which also lose image details.Source: §2.1 · p. 3
- The background describes adversarial training and preprocessing transformations as defense approaches, and says both types are evaluated against AdvDrop.Adversarial training fits DNNs on adversarial examples; preprocessing methods transform inputs to remove adversarial noise.Source: §2.1 · p. 3
2.2. Image compression methods
- JPEG applies DCT to image patches and quantizes frequency components, rounding many high-frequency components to zero; AdvDrop follows this design for efficiency and convenience.The paper notes that deep-learning compression methods require pre-training and are time-consuming.Source: §2.2 · p. 3
3. Approach
AdvDrop optimizes frequency-domain quantization to remove image information while producing adversarial examples. Its pipeline transforms images, quantizes selected frequencies, and returns them to the spatial domain; differential quantization makes the process amenable to gradient-based optimization.
3.1. Overview
- AdvDrop transforms clean images into the frequency domain, quantizes selected frequencies, then transforms them back while optimizing the quantization table q within an ε bound.Quantization is the information-dropping step; the DCT and inverse DCT are lossless.Source: §3.1 · p. 4
3.2. Adversarial loss
- For targeted and untargeted attacks, AdvDrop minimizes cross-entropy loss using the target-class or true-class probability, respectively.The resulting loss guides q optimization to drop information and mislead the target model.Source: §3.2 · p. 4
3.3. Transformation
- DCT converts image patches into frequency-domain blocks, allowing AdvDrop to select what and where information to drop; experiments use 8 × 8 patches.IDCT recovers spatial-domain signals, and information is lost during quantization rather than either transform.Source: §3.3 · pp. 4–5
3.4. Quantization
- A trainable quantization table q controls the quantization interval: enlarging it drops more details, while ε bounds q to constrain information loss and preserve visual similarity.The method uses differential quantization because the ordinary staircase quantizer is nondifferentiable; Qdiff approximates it with a continuously differentiable function.Source: §3.4 · p. 5
- During optimization, α decreases linearly so Qdiff approaches staircase quantization, while q is updated using the sign of the back-propagated gradient.The quantization interval increases gradually, asymptotically dropping information.Source: §3.4 · p. 5
4. Experimental Evaluation
Experiments evaluate AdvDrop’s perceptual quality, attack success, and performance under defenses, followed by ablations and analyses of dropped information. AdvDrop images are more perceptually aligned with clean images than PGD images, and the attack is more robust to current defenses than other attacks.
4.1. Experimental settings
- Experiments use 2,000 correctly classified ImageNet images on ResNet50, measuring attack success rate and perceptual quality with LPIPS against PGD and other attacks.The attack comparisons include l2 and l∞ settings; defenses include feature squeezing, pixel deflection, JPEG compression, and adversarial training.Source: §4.1 · p. 6
4.2. Perception study
- AdvDrop images are more perceptually aligned with clean images than PGD images in both l2 and l∞ settings, despite larger relative image-size changes.Figure 8 plots LPIPS perceptual loss against the change ratio in image size.Source: Figure 8 · p. 6, §4.2 · p. 6
4.3. Evaluation of AdvDrop
- At ϵ = 100, AdvDrop achieves almost 100% success rate, and success rates increase as the constraint ϵ is relaxed in targeted and untargeted settings.Targeted attacks require more steps; the authors report over 99% success after an average of 496 steps at ϵ = 20 versus 61 steps at ϵ = 100.Source: Table 1 · p. 6, §4.3 · pp. 6–7
4.4. Attack effectiveness under defense methods
- AdvDrop examples are more robust to current defenses than examples from other attacks; adversarial training remains the most effective defense, while denoising-based defenses have limited effectiveness.The authors suggest denoising may further distort images that already lack essential features.Source: Table 2 · p. 7, §4.4 · p. 7
4.5. Ablation study
- 97.20 ± 0.37% success rate is reported for AdvDrop’s quantization, versus 65.20 ± 2.13% for Shin et al.’s differential rounding and 5.00 ± 0.98% for typical rounding.The ablation changes the quantization method while keeping other components unchanged.Source: §4.5 · p. 8
- 11.10 ± 0.07% accuracy is reported when spatial-domain color depth is reduced to 2 bits; the authors state frequency-domain detail removal is more natural for human observers.The comparison evaluates accuracy as image color depth is reduced by different amounts.Source: Table 3 · p. 8, §4.5 · p. 8
- 30.00 ± 1.02% accuracy follows dropping low frequencies, compared with 84.40 ± 8.11% for middle frequencies and 86.50 ± 0.76% for high frequencies.The authors identify low frequencies as dominant features for the model.Source: Table 4 · p. 8, §4.5 · p. 8
4.6. Visualization and analysis
- AdvDrop drops information from regions that partly overlap model attention, while seeming to focus more on texture-rich regions and to remove more high- than low-frequency information.The examples include dropping both calyx and flower regions in a cardoon image, but mainly body texture in a penguin image.Source: §4.6 · pp. 8–9, Figure 11 · p. 9
5. Conclusion and Future Work
AdvDrop uses differential quantization and adversarial attack techniques to create adversarial examples by dropping existing image details. The authors frame it as a new perspective for evaluating DNN robustness, while noting the current method’s frequency-domain focus.
5. Conclusion and Future Work
- AdvDrop combines differential quantization and adversarial attack techniques to craft adversarial examples by dropping existing image details.Source: §5 · p. 9
- The current method uses a relatively simple approach focused on dropping information in the frequency domain.Source: §5 · p. 9
- The authors identify exploring other information-dropping techniques, applying AdvDrop to DNN interpretability, and developing effective defenses as future directions.Source: §5 · p. 9