Adversarial Attacks on Face Detectors Using Neural Net Based Constrained Optimization
By Avishek Joey Bose, Parham Aarabi. 2018
95 citations recorded by the source corpus.
Adversarial attacks involve adding, small, often imperceptible, perturbations to inputs with the goal of getting a machine learning model to misclassifying them. While many different adversarial attack strategies have been proposed on image classification models, object detection pipelines have been much harder to break. In this paper, we propose a novel strategy to craft adversarial examples by solving a constrained optimization problem using an adversarial generator network. Our approach is fast and scalable, requiring only a forward pass through our trained generator network to craft an adversarial sample. Unlike in many attack strategies we show that the same trained generator is capable of attacking new images without explicitly optimizing on them. We evaluate our attack on a trained Faster R-CNN face detector on the cropped 300-W face dataset where we manage to reduce the number of detected faces to 0.5% of all originally detected faces. In a different experiment, also on 300-W, we demonstrate the robustness of our attack to a JPEG compression based defense typical JPEG compression level of 75% reduces the effectiveness of our attack from only 0.5% of detected faces to a modest 5.0%.
Subfields: Artificial Intelligence, Molecular Biology, Safety, Robustness & Interpretability
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Gauthier Gidel
- Simon Lacoste-Julien
- Pascal Vincent
- William L. Hamilton
- Yoshua Bengio
- Avishek Joey Bose
- Ziwei Liu
- Peter Richtárik
In Molecular Biology
- Avishek Joey Bose
- Simon Lacoste-Julien
- Pascal Vincent
- Hugo Berrard
- Andre Cianflone
- William L. Hamilton
- Yiran Chen
- Gauthier Gidel
In Safety, Robustness & Interpretability
- Simon Lacoste-Julien
- Vanessa Buhrmester
- Pascal Vincent
- Hugo Berrard
- Ziwei Liu
- Michael Arens
- Avishek Joey Bose
- David Münch
Citations in the corpus
- Adversarial Example Games (2020, background): “Adversarial attacks on deep neural nets expose critical vulnerabilities in traditional machine learning systems [53, 3, 61, 8].”
- DPATCH: An Adversarial Patch Attack on Object Detectors (2018, background): “Hence, the number of targets that need to be attacked in this case is much larger than that in a pure classification application (Avishek and Parham 2018).”
- Analysis of Explainers of Black Box Deep Neural Networks for Computer Vision: A Survey (2019, background): “Changing only one pixel in an input image or one letter in a sentence could change the prediction, or even adding small-magnitude perturbations, [8], [9], [10], see also Figure 2.”