Adversarial Examples for Semantic Segmentation and Object Detection

By Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, Alan L. Yuille. 2017

1,033 citations recorded by the source corpus.

It has been well demonstrated that adversarial examples, i.e., natural images with visually imperceptible perturbations added, cause deep networks to fail on image classification. In this paper, we extend adversarial examples to semantic segmentation and object detection which are much more difficult. Our observation is that both segmentation and detection are based on classifying multiple targets on an image (e.g., the target is a pixel or a receptive field in segmentation, and an object proposal in detection). This inspires us to optimize a loss function over a set of targets for generating adversarial perturbations. Based on this, we propose a novel algorithm named Dense Adversary Generation (DAG), which applies to the state-of-the-art networks for segmentation and detection. We find that the adversarial perturbations can be transferred across networks with different training data, based on different architectures, and even for different recognition tasks. In particular, the transfer ability across networks with the same architecture is more significant than in other cases. Besides, we show that summing up heterogeneous perturbations often leads to better transfer performance, which provides an effective method of black-box adversarial attack.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Safety, Robustness & Interpretability

Citations in the corpus

Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning (2017, background): “…date is implicitly acknowledged in a growing number of recent papers in the area of computer security [5, 7, 10, 12–16] and computer vision [8, 9, 17], which only consider recent work on the security of deep networks against adversarial examples, almost completely ignoring previous work in…”
Mitigating adversarial effects through randomization (2017, background): “, 2017) and semantic segmentation (Xie et al., 2017; Fischer et al., 2017; Cisse et al., 2017).”
MagNet: A Two-Pronged Defense against Adversarial Examples (2017, neutral): “, classification[22] and semantic segmentation [37].”
Theoretically Principled Trade-off between Robustness and Accuracy (2019, background): “, 2017), computer vision (Song et al., 2018; Xie et al., 2017; Meng & Chen, 2017), natural language processing (Jia & Liang, 2017), and many other domains.”
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey (2018, methodology): “[115] showed that random resizing of the adversarial examples reduces their effectiveness.”
Universal Adversarial Perturbations Against Semantic Image Segmentation (2017, methodology): “Concurrent with this work, adversarial examples have been extended to semantic image segmentation and object detection [27, 8].”
Constructing Unrestricted Adversarial Examples with Generative Models (2018, background): “This has raised concerns for safety-critical AI applications because, for example, attackers could use them to mislead autonomous driving vehicles [3, 4, 5] or hijack voice controlled intelligent agents [6, 7, 8].”
Houdini: Fooling Deep Structured Prediction Models (2017, background): “Xie et al. [37] have previously explored adversarial attacks in the context of semantic segmentation.”
Towards Fast Computation of Certified Robustness for ReLU Networks (2018, background): “, 2013), researchers have successfully found adversarial examples in many machine learning tasks applied to different areas, including object detection (Xie et al., 2017), image captioning (Chen et al.”
Seq2Sick: Evaluating the Robustness of Sequence-to-Sequence Models with Adversarial Examples (2018, background): “on-based methods [20]. In addition to image classiﬁcation, attacks to other CNN-related tasks have also been actively investigated. Typical examples include semantic segmentation and object detection [21, 22, 23, 24, 25], image captioning [26], and visual QA [27]. Besides, recent studies have also c”
Deep Nets: What have They Ever Done for Vision? (2018, background): “3 Figure taken from Xie et al. (2018). A deep network can correctly classify the left image as king penguin.”
Detecting Adversarial Attacks on Neural Network Policies with Visual Foresight (2017, background): “Adversarial examples have been extensively studied in the context of image classiﬁcation [12, 39], object detection and semantic segmentation [7, 41], and their existences in the physical world were recently revealed by Kurakin et al. [18].”
Generative Adversarial Examples (2018, background): “This has raised concern for safety-critical AI applications because attackers could use them to, for example, mislead autonomous driving vehicles [3, 4, 5] or hijack voice controlled intelligent agents [6, 7, 8].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, methodology): “The main victim model is based on the architecture in (Parkhi et al.)”
Physical Adversarial Examples for Object Detectors (2018, background): “ﬁndings presented here, and will create attacks that generalize across physical settings (e.g., real autonomous vehicles), and across classes of object detection networks (e.g., semantic segmentation [23]). 2 Related Work Adversarial examples for deep learning were ﬁrst introduced by Szegedy et al. ”
Boosting Decision-Based Black-Box Adversarial Attacks with Random Sign Flip (2020, background): “Deep neural networks are susceptible to adversarial examples [6, 48, 51].”
Designing a Moral Compass for the Future of Computer Vision Using Speculative Analysis (2017, neutral): “By targeting common CV tasks, such as segmentation and detection, it is possible to create systems that can generate adversarial examples against arbitrary blackbox CV systems [62].”
Improving Transferability of Adversarial Examples With Input Diversity (2018, background): “Besides image classification, adversarial examples also exist in object detection [38], semantic segmentation [38, 5], speech recognition [5], deep reinforcement learning [19], etc.”
Simple Black-box Adversarial Attacks (2019, background): “Computer vision models for image segmentation and object detection have also been shown to be vulnerable against adversarial perturbations (Cisse et al., 2017a; Xie et al., 2017).”