Exact Adversarial Attack to Image Captioning via Structured Output Learning With Latent Variables

By Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen. 2019

61 citations recorded by the source corpus.

In this work, we study the robustness of a CNN+RNN based image captioning system being subjected to adversarial noises. We propose to fool an image captioning system to generate some targeted partial captions for an image polluted by adversarial noises, even the targeted captions are totally irrelevant to the image content. A partial caption indicates that the words at some locations in this caption are observed, while words at other locations are not restricted. It is the first work to study exact adversarial attacks of targeted partial captions. Due to the sequential dependencies among words in a caption, we formulate the generation of adversarial noises for targeted partial captions as a structured output learning problem with latent variables. Both the generalized expectation maximization algorithm and structural SVMs with latent variables are then adopted to optimize the problem. The proposed methods generate very successful attacks to three popular CNN+RNN based image captioning models. Furthermore, the proposed attack methods are used to understand the inner mechanism of image captioning systems, providing the guidance to further improve automatic image captioning systems towards human captioning.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Natural Language Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Zhe Gan
2. Jingjing Liu
3. Linjie Li
4. Yu Cheng
5. Yen-Chun Chen
6. Jianfeng Gao
7. Mohit Bansal
8. Lijuan Wang

In Computer Vision and Pattern Recognition

1. Zhe Gan
2. Dacheng Tao
3. Luc Van Gool
4. Linjie Li
5. Cordelia Schmid
6. Jingjing Liu
7. Yu Cheng
8. Ming-Hsuan Yang

In Natural Language Processing

1. Zhe Gan
2. Yu Cheng
3. Jingjing Liu
4. Linjie Li
5. Yen-Chun Chen
6. Yujiu Yang
7. Chen Zhu
8. Baoyuan Wu

Citations in the corpus

• Large-Scale Adversarial Training for Vision-and-Language Representation Learning (2020, background): “[2, 16] studied how to craft adversarial examples for image captioning, and [10] investigated how to derive adversarial rules to attack VQA systems.”
• Sparse Adversarial Attack via Perturbation Factorization (2020, methodology): “However, the 100% ASR values of C&W-(cid:96) 0 and our method tell that the above adversarial training is still not robust enough to defend the sparse attack.”
• Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, background): “Deep neural networks are susceptible to adversarial examples [6, 48, 51].”
• On Evaluating Adversarial Robustness of Large Vision-Language Models (2023, background): “…are devoted to investigating adversarial attacks against visual question answering [6, 11, 37, 38, 43, 77, 89, 97, 105] and image caption [1, 14, 99], with the majority of these efforts focusing on conventional CNN-RNN-based models, assuming white-box access or untargeted adversarial goals, and…”
• Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “[231] also proposed a targeted partial caption attack that formulates the underlying task of generating adversarial partial captions as a structured output learning task with latent variables.”