Perceptual-Sensitive GAN for Generating Adversarial Patches

By Aishan Liu, Xianglong Liu, Jiaxin Fan, Yuqing Ma, Anlan Zhang, Huiyuan Xie, Dacheng Tao. 2019

365 citations recorded by the source corpus.

Deep neural networks (DNNs) are vulnerable to adversarial examples where inputs with imperceptible perturbations mislead DNNs to incorrect results. Recently, adversarial patch, with noise confined to a small and localized patch, emerged for its easy accessibility in real-world. However, existing attack strategies are still far from generating visually natural patches with strong attacking ability, since they often ignore the perceptual sensitivity of the attacked network to the adversarial patch, including both the correlations with the image context and the visual attention. To address this problem, this paper proposes a perceptual-sensitive generative adversarial network (PS-GAN) that can simultaneously enhance the visual fidelity and the attacking ability for the adversarial patch. To improve the visual fidelity, we treat the patch generation as a patch-to-patch translation via an adversarial process, feeding any types of seed patch and outputting the similar adversarial patch with high perceptual correlation with the attacked image. To further enhance the attacking ability, an attention mechanism coupled with adversarial generation is introduced to predict the critical attacking areas for placing the patches, which can help producing more realistic and aggressive patches. Extensive experiments under semi-whitebox and black-box settings on two large-scale datasets GTSRB and ImageNet demonstrate that the proposed PS-GAN outperforms state-of-the-art adversarial patch attack methods.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Generative Models, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Jason Aaron Edward Weston
2. Emily Dinan
3. Kurt Shuster
4. Y-Lan Boureau
5. Eric Michael Smith
6. Samuel Humeau
7. Douwe Kiela
8. Arthur Szlam

In Computer Vision and Pattern Recognition

1. Jason Aaron Edward Weston
2. Emily Dinan
3. Yujiu Yang
4. Baoyuan Wu
5. Samuel Humeau
6. Zhifeng Li
7. Peng Cui
8. Yanbo Fan

In Generative Models

1. Yujiu Yang
2. Peng Cui
3. Baoyuan Wu
4. Jason Aaron Edward Weston
5. Yue He
6. Yanbo Fan
7. Yong Zhang
8. Emily Dinan

In Safety, Robustness & Interpretability

1. Jason Aaron Edward Weston
2. Emily Dinan
3. Bharath Chintagunta
4. Dylan Hadfield-Menell
5. Peng Cui
6. Baoyuan Wu
7. Yue He
8. Gabriel Kreiman

Citations in the corpus

• Build it Break it Fix it for Dialogue Safety: Robustness from Adversarial Human Attack (2019, background): “Use cases include training image generators (Brock et al., 2018) as well as image classifiers to be robust to adversarial examples (Liu et al., 2019).”
• Robust Feature-Level Adversaries are Interpretability Tools (2021, background): “More recently, [57, 6, 15, 2, 37, 67, 32, 31] created adversarial clothing, stickers, or objects.”
• Sparse Adversarial Attack via Perturbation Factorization (2020, methodology): “However, the 100% ASR values of C&W-(cid:96) 0 and our method tell that the above adversarial training is still not robust enough to defend the sparse attack.”
• Towards Non-I.I.D. image classification: A dataset and baselines (2019, background): “In recent years, machine learning has achieved remarkable progress in a wide range of applications [1–4] , mainly owing to the development of deep neural networks [5,6] .”