Spatially Transformed Adversarial Examples

By Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, M. Liu, Dawn Song. 2018

572 citations recorded by the source corpus.

Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the $\mathcal{L}_p$ distance for penalizing perturbations. Researchers have explored different defense methods to defend against such adversarial attacks. While the effectiveness of $\mathcal{L}_p$ distance as a metric of perceptual quality remains an active research area, in this paper we will instead focus on a different type of perturbation, namely spatial transformation, as opposed to manipulating the pixel values directly as in prior works. Perturbations generated through spatial transformation could result in large $\mathcal{L}_p$ distance measures, but our extensive experiments show that such spatially transformed adversarial examples are perceptually realistic and more difficult to defend against with existing defense systems. This potentially provides a new direction in adversarial example generation and the design of corresponding defenses. We visualize the spatial transformation based perturbation for different examples and show that our technique can produce realistic adversarial examples with smooth image deformation. Finally, we visualize the attention of deep networks with different types of adversarial examples to better understand how these examples are interpreted.

Subfields: Hardware and Architecture, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Hardware and Architecture

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

Natural Adversarial Examples (2019, background): “Several other forms of adversarial attacks have been considered in the literature, including elastic deformations [47], adversarial coloring [4, 26], and synthesis via generative models [3, 43] and evolutionary search [38], among others.”
Making Convolutional Networks Shift-Invariant Again (2019, background): “These perturbations can be on pixels (Goodfellow et al., 2014a;b), a single pixel (Su et al., 2019), small deformations (Xiao et al., 2018), or even afﬁne transformations (Engstrom et al., 2017).”
Do ImageNet Classifiers Generalize to ImageNet? (2019, background): “However, we note that more forms of adversarial robustness such as spatial transformations or color space changes have been studied [12, 14, 24, 30, 57].”
Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “[54] generated spatially transformed adversarial examples that are perceptually realistic and more difficult to defend against, but the technique still directly operates on pixels.”
Certified Robustness to Adversarial Examples with Differential Privacy (2018, background): “Other attacks that are not amenable to norm bounding exist [67], [54], [66], but this paper deals exclusively with norm-bounded attacks.”
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, background): “Other work uses flows to generate spatially transformed adversarial examples, but lacks a well-defined threat model (Xiao et al., 2018) and hasn’t been used in adversarial training.”
A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations (2017, background): “Recently, (Xiao et al., 2018) and (Tramèr & Boneh, 2017) observed independently that it is possible to use various spatial transformations to construct adversarial examples for naturally and adversarially trained models.”
Generating Adversarial Examples with Adversarial Networks (2018, background): “Adversarial Examples A number of attack strategies to generate adversarial examples have been proposed in the white-box setting, where the adversary has full access to the classifier [Szegedy et al., 2014; Goodfellow et al., 2015; Carlini and Wagner, 2017b; Xiao et al., 2018].”
The Robust Manifold Defense: Adversarial Training using Generative Models (2017, background): “Very recent work however has shown that small rotations [15] or spatial transformations [4] can also fool classiﬁers.”
Towards Robust Neural Networks via Random Self-ensemble (2017, background): “Deep neural networks have demonstrated their success in many machine learning and computer vision applications, including image classiication [14, 7, 35, 9, 34], object recognition [30] and image captioning [38].”
Robustness May Be at Odds with Accuracy (2018, background): “…has there been progress towards models that achieve robustness that can be demonstrated empirically and, in some cases, even formally veriﬁed (Madry et al., 2017; Kolter & Wong, 2017; Sinha et al., 2017; Tjeng & Tedrake, 2017; Raghunathan et al., 2018; Dvijotham et al., 2018a; Xiao et al., 2018b).”
Adversarially Robust Generalization Requires More Data (2018, background): “[55] Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song.”
Theoretically Principled Trade-off between Robustness and Accuracy (2019, background): “, 2013), or unrestricted attacks such as adversarial rotations, translations, and deformations (Brown et al., 2018; Engstrom et al., 2017; Gilmer et al., 2018; Xiao et al., 2018; Alaifari et al., 2019; Zhang et al., 2019a).”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, neutral): “(2018).”
Disentangling Adversarial Robustness and Generalization (2018, background): “In practice, this can, for example, be accomplished using adversarial deformations [1, 105, 22], i.”
Few-shot learning of neural networks from scratch by pseudo example optimization (2018, background): “In addition, the stochastic gradient part can be replaced by other types of adversarial examples, such as natural [40] and spatially transformed adversary [35].”
Transfer of Adversarial Robustness Between Perturbation Types (2019, methodology): “L ∞ (Goodfellow et al., 2014), L 2 (Carlini & Wagner, 2017), L 1 (Chen et al., 2018), elastic deformations (Xiao et al., 2018), and JPEG (Shin & Song, 2017)–against adversarially trained ResNet-50 models on a 100-class subset of full-resolution ImageNet.”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, unknown): “, 2015), the CW attack (Carlini & Wagner, 2017), deformation attack (Alaifari et al., 2019; Xiao et al., 2018), and Hamming distance method (Shamir et al.”
DPATCH: An Adversarial Patch Attack on Object Detectors (2018, background): “Most of the previous research on adversarial attack are about pixel-wise additive noise (Goodfellow et al. 2014; Moosavi-Dezfooli, Fawzi, and Frossard 2016; Carlini and Wagner 2016; Xiao et al. 2018).”