Semantic Adversarial Examples

By Hossein Hosseini, Radha Poovendran. 2018

219 citations recorded by the source corpus.

Deep neural networks are known to be vulnerable to adversarial examples, i.e., images that are maliciously perturbed to fool the model. Generating adversarial examples has been mostly limited to finding small perturbations that maximize the model prediction error. Such images, however, contain artificial perturbations that make them somewhat distinguishable from natural images. This property is used by several defense methods to counter adversarial examples by applying denoising filters or training the model to be robust to small perturbations. In this paper, we introduce a new class of adversarial examples, namely "Semantic Adversarial Examples," as images that are arbitrarily perturbed to fool the model, but in such a way that the modified image semantically represents the same object as the original image. We formulate the problem of generating such images as a constrained optimization problem and develop an adversarial transformation based on the shape bias property of human cognitive system. In our method, we generate adversarial images by first converting the RGB image into the HSV (Hue, Saturation and Value) color space and then randomly shifting the Hue and Saturation components, while keeping the Value component the same. Our experimental results on CIFAR10 dataset show that the accuracy of VGG16 network on adversarial color-shifted images is 5.7%.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

Natural Adversarial Examples (2019, background): “Several other forms of adversarial attacks have been considered in the literature, including elastic deformations [47], adversarial coloring [4, 26], and synthesis via generative models [3, 43] and evolutionary search [38], among others.”
Do Image Classifiers Generalize Across Time? (2019, background): “In the machine learning community, model robustness has typically been analyzed on images perturbed by an adversary [11, 2], or by hand-designed strategies, such as rotations or blurs [7, 6, 14, 13].”
Do ImageNet Classifiers Generalize to ImageNet? (2019, background): “[24] Hossein Hosseini and Radha Poovendran.”
Bypassing Backdoor Detection Algorithms in Deep Learning (2019, background): “It has also been shown to be possible to generate adversarial images by perturbing the color space of the image, thus preserving the smoothness of the image, in order to evade detection methods that rely on the abrupt pixel changes found in many adversarial image detection methods [12].”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, background): “[44] proposes converting the color space from RGB to HSV and shifting H, S components.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “The works related to achieving perturbation imperceptibility based on preserving semantics of the target image [122]–[125] and preserving the structural information [126], [127] are motivated by this argument, see Fig.”
Generative Adversarial Examples (2018, background): “[40] proposes converting the color space from RGB to HSV and shifting H, S components.”
Model Vulnerability to Distributional Shifts over Image Transformation Sets (2019, background): “The same research group, in an other work [23], shows that we can ﬁnd hue and saturation shifts for a given image that a model is vulnerable to.”
Baseline Defenses for Adversarial Attacks Against Aligned Language Models (2023, methodology): “…to be restricted to a certain ℓp bound, but a truly adaptive attacker would likely bypass such a defense by selecting a different perturbation type, for example bypassing defenses against ℓp-bounded adversarial examples using a semantic attack (Hosseini & Poovendran, 2018; Ghiasi et al., 2019).”
A systematic framework for natural perturbations from videos (2019, methodology): “We note the similarity of this plot to Figure 1 in [10].”
The Origins and Prevalence of Texture Bias in Convolutional Neural Networks (2019, background): “Although their performance in several of these tasks approaches that of humans, recent ﬁndings show that CNNs differ in intriguing ways from human vision, indicating fundamental deﬁciencies in our understanding of these models [87, 70, 32, 23, 76, 37, 3, 44, 46, 1, 48].”