LaVAN: Localized and Visible Adversarial Noise

By Danny Karmon, Daniel Zoran, Yoav Goldberg. 2018

306 citations recorded by the source corpus.

Most works on adversarial examples for deep-learning based image classifiers use noise that, while small, covers the entire image. We explore the case where the noise is allowed to be visible but confined to a small, localized patch of the image, without covering any of the main object(s) in the image. We show that it is possible to generate localized adversarial noises that cover only 2% of the pixels in the image, none of them over the main object, and that are transferable across images and locations, and successfully fool a state-of-the-art Inception v3 model with very high success rates.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Dan Boneh
2. Florian Tramèr
3. Giancarlo Pellegrino
4. Dacheng Tao
5. Wei Yang
6. Anh Totti Nguyen
7. Aishan Liu
8. Wei-Shinn Ku

In Computer Vision and Pattern Recognition

1. Dacheng Tao
2. Xianglong Liu
3. Long Mai
4. Florian Tramèr
5. Wei Yang
6. Anh Totti Nguyen
7. Aishan Liu
8. Dan Boneh

In Safety, Robustness & Interpretability

1. Florian Tramèr
2. Dan Boneh
3. Dacheng Tao
4. Wei Yang
5. Anh Totti Nguyen
6. Anki Chauhan
7. Mirazul Haque
8. Cong Liu

Citations in the corpus

• Strike (With) a Pose: Neural Networks Are Easily Fooled by Strange Poses of Familiar Objects (2018, background): “, by synthesizing an entire image [29], a small patch [18, 13], a few pixels [8], or only a single pixel [40].”
• SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, background): “These attacks are generated by performing back-propagation on the target class to calculate gradient noise localized to a region of the image. A related attack—Localized and Visible Adversarial Noise [26]— operates under a similar principle with smaller but less robust attacks. Robust Physical-World”
• ILFO: Adversarial Attack on Adaptive Neural Networks (2020, methodology): “[19] propose a technique to attack CNNs in which a localized patch is introduced in an image instead of adding noise to the full image.”
• SentiNet: Detecting Physical Attacks Against Deep Learning Systems (2018, background): “A re-lated attack—Localized and Visible Adversarial Noise [26]— operates under a similar principle with smaller but less robust attacks.”
• Perceptual-Sensitive GAN for Generating Adversarial Patches (2019, methodology): “Note that the weak distortion constraint makes PS-GAN∗, GoogleAp and LaVAN perform well, and our PS-GAN∗ get the best performance.”