Adversarial Diversity and Hard Positive Generation

By Andras Rozsa, Ethan M. Rudd, Terrance E. Boult. 2016

268 citations recorded by the source corpus.

State-of-the-art deep neural networks suffer from a fundamental problem – they misclassify adversarial examples formed by applying small perturbations to inputs. In this paper, we present a new psychometric perceptual adversarial similarity score (PASS) measure for quantifying adversarial images, introduce the notion of hard positive generation, and use a diverse set of adversarial perturbations – not just the closest ones – for data augmentation. We introduce a novel hot/cold approach for adversarial example generation, which provides multiple possible adversarial perturbations for every single image. The perturbations generated by our novel approach often correspond to semantically meaningful image structures, and allow greater flexibility to scale perturbation-amplitudes, which yields an increased diversity of adversarial images. We present adversarial images on several network topologies and datasets, including LeNet on the MNIST dataset, and GoogLeNet and ResidualNet on the ImageNet dataset. Finally, we demonstrate on LeNet and GoogLeNet that fine-tuning with a diverse set of hard positives improves the robustness of these networks compared to training with prior methods of generating adversarial images.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Representation & Self-Supervised Learning, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Representation & Self-Supervised Learning

In Safety, Robustness & Interpretability

Citations in the corpus

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods (2017, background): “There has been a significant amount of work studying methods to construct adversarial examples [5, 8, 13, 26, 30, 39] and to make networks robust against adversarial examples [3, 16, 20, 21, 31, 33, 34, 41].”
Adversarial Examples: Attacks and Defenses for Deep Learning (2017, methodology): “proposed a Hot/Cold method to find multiple adversarial examples for every single image input [59].”
Universal Adversarial Perturbations (2016, background): “The robustness of image classiﬁers to structured and un-structured perturbations have recently attracted a lot of attention [19, 16, 20, 3, 4, 12, 13, 14].”
One Pixel Attack for Fooling Deep Neural Networks (2017, background): “very sensitive images) collected might be useful for generating better artificial adversarial samples for augmenting the training data set for the purpose of learning more robust models[26], which is left for future work.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[97] empirically analyzed the correlation between the accuracy of eight deep network classifiers and their robustness to three adversarial attacks introduced in [23] and [94].”
Robustness to Adversarial Examples through an Ensemble of Specialists (2017, background): “To increase the robustness of CNNs, it has been proposed to train them on a diverse set of adversaries, generating adversarial examples for any single images with various algorithms (Rozsa et al., 2016).”
Adversarial Image Perturbation for Privacy Protection A Game Theory Perspective (2017, methodology): “Depending on the loss function L and the optimisation algorithm, we recover most of the existing AIP methods such as Fast Gradient Vector [31], Fast Gradient Sign [6], Basic Iterative [12], and DeepFool [21].”
Evaluation and Design of Robust Neural Network Defenses (2018, background): “How should we quantify the distortion introduced by a perturbation δ? In the space of images, despite some debate [109], most of the community has settled on lp metrics as discussed earlier, most often using l∞ [34, 77], the maximum amount any pixel has been changed.”
Provably Minimally-Distorted Adversarial Examples (2017, background): “Input images with width W and height H are represented as points in the space [0 , 1] Exactly which distance metric to use to properly evaluate the “closeness” between x and x (cid:48) is a difﬁcult question (Rozsa et al., 2016; Xiao et al., 2018; Zhengli Zhao, 2018).”
ConSERT: A Contrastive Framework for Self-Supervised Sentence Representation Transfer (2021, methodology): “We implement this strategy with Fast Gradient Value (FGV) (Rozsa et al., 2016), which directly uses the gradient to compute the perturbation and thus is faster than two-step alternative methods.”
Gradient-Based Adversarial Factual Consistency Evaluation for Abstractive Summarization (2021, methodology): “Instead, we apply Fast Gradient Value (FGV) (Rozsa et al., 2016) to approximate a worst-case perturbation: The gradient g is the ﬁrst-order differential of L ce , representing the direction that rapidly increases the loss.”
On the Suitability of Lp-Norms for Creating and Preventing Adversarial Examples (2018, background): “, [10, 26]) may be considered to replace Lp-norms.”
Are Accuracy and Robustness Correlated (2016, methodology): “[6] formalized the fast gradient value (FGV) method and introduced the hot/cold (HC) approach, which is capable of efficiently producing multiple adversarial examples for each input.”
Fast Feature Fool: A data independent approach to universal adversarial perturbations (2017, background): “Later, multiple other [6, 7, 8, 12, 14, 15, 18] investigations studied this interesting property called, adversarial perturbations.”
Towards Robust Detection of Adversarial Examples (2017, background): “Therefore, various defenses have been proposed attempting to correctly classify adversarial examples [14, 25, 31, 32, 33, 36].”
When Machine Learning Meets Privacy (2020, background): “Other algorithms to generate such noise can be found in [72, 103, 131].”
Audio Adversarial Examples: Targeted Attacks on Speech-to-Text (2018, background): “How should we quantify the amount of distortion introduced by a perturbation δ? In the space of images, despite some debate about what metrics truly mirror perceptual distance [36], most of the community has settled on lp metrics [8], most often using l∞ [14, 30], the maximum amount any pixel has be”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “[47] mainly removes the sign function from (5) to launch the attack.”