Generative Adversarial Perturbations

By Omid Poursaeed, Isay Katsman, Bicheng Gao, Serge J. Belongie. 2017

410 citations recorded by the source corpus.

In this paper, we propose novel generative models for creating adversarial examples, slightly perturbed images resembling natural images but maliciously crafted to fool pre-trained models. We present trainable deep neural networks for transforming images to adversarial perturbations. Our proposed models can produce image-agnostic and image-dependent perturbations for targeted and non-targeted attacks. We also demonstrate that similar architectures can achieve impressive results in fooling both classification and semantic segmentation models, obviating the need for hand-crafting attack methods for each task. Using extensive experiments on challenging high-resolution datasets such as ImageNet and Cityscapes, we show that our perturbations achieve high fooling rates with small perturbation norms. Moreover, our attacks are considerably faster than current iterative methods at inference time.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Adversarial Training for Free! (2019, background): “Some recent works replace the perturbation generation in adversarial training with a parameterized generator network [Baluja and Fischer, 2018, Poursaeed et al., 2018, Xiao et al., 2018].”
Robust Feature-Level Adversaries are Interpretability Tools (2021, background): “This has been done to synthesize imperceptible attacks that are transferable, universal, or efficient to produce [20, 41, 42, 51, 73, 19, 72].”
Universal Adversarial Attacks with Natural Triggers for Text Classification (2020, methodology): “Poursaeed et al. (2018) consider both input-dependent and universal attacks in the image domain by training a generator to fool the target model without using the discrimi-nator.”
A Survey On Universal Adversarial Attack (2021, methodology): “(1) A popular choice is to set p =∞, and to set the value of to 10/255, assuming images to be in the range [0, 1] [MoosaviDezfooli et al., 2017a; Poursaeed et al., 2018; Mopuri et al., 2018a].”
Adversarial Examples on Object Recognition (2020, background): “Moreover, certified defenses can be bypassed using generative models [135] or with perturbations outside the pixel norm ball [107].”
When Machine Learning Meets Privacy (2020, background): “with a different set of parameters and architecture [152]. This is even true if the other model is trained on a different training set or model [117]. This leads to the idea of universal perturbation [102, 128]. It is even possible to “generate adversarial examples that fool both human and computer ”
Learning Transferable Adversarial Examples via Ghost Networks (2018, background): “Some works [1, 24, 35] suggest re-training neural networks, e.”
Learning Universal Adversarial Perturbations with Generative Models (2017, methodology): “[26] pre-print was made available online 12 hours before our first version was made available, while Mopuri et al’s.”
Knockoff Nets: Stealing Functionality of Black-Box Models (2018, background): “h recognize and control privacy-sensitive information in visual content. The community has also recently studied security concerns entailing real-world usage of models e.g., adversarial perturbations [2,20,25,26,29,34] in black- and whitebox attack scenarios. In this work, we focus on functionality ”
Cross-Domain Transferability of Adversarial Perturbations (2019, methodology): “To enhance the transferability of instance-agnostic approaches, recent generative models attempt to directly craft perturbations using an adversarially trained function [15, 16].”
Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses (2019, methodology): “Researchers also explore to produce universal adversarial perturbations by different methods [27, 39] or on different tasks [24, 42].”
Universal Adversarial Training (2018, background): “The cost of the inner PGD loop is high, although this can sometimes be replaced with neural models for attack generation [3, 26, 36].”
Adversarial Generative Nets: Neural Network Attacks on State-of-the-Art Face Recognition (2018, background): “Except for a few attacks [5], [14], [51], [56], [67], in traditional evasion attacks against DNNs the attacker directly alters benign inputs to maximize or minimize a pre-defined function related to the desired misclassification (see Sec.”
Perceptual-Sensitive GAN for Generating Adversarial Patches (2019, background): “2013; Athalye and Sutskever 2017) and network-based techniques (Xiao et al. 2018; Poursaeed et al. 2018).”
Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models (2023, positive): “Our attacks do not require access to the language model, as the attack is launched based on the cross-modality embeddings within a black-box setup (Poursaeed et al., 2018; Zhang et al., 2022).”
On Improving Adversarial Transferability of Vision Transformers (2021, methodology): “However, combining the intermediate feature response with final classification loss is non-trivial as it might require optimization to find the best performing layers [34, 35], and d) Generative Approach: Orthogonal to iterative attacks, generative methods [37, 38, 39] train an autoencoder against t”