Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces

Ayberk Aydin,Alptekin Temizel

DOI: https://doi.org/10.1016/j.patrec.2023.09.003

2023-10-21

Abstract:Deep neural networks are known to be vulnerable to adversarial perturbations. The amount of these perturbations are generally quantified using $L_p$ metrics, such as $L_0$, $L_2$ and $L_\infty$. However, even when the measured perturbations are small, they tend to be noticeable by human observers since $L_p$ distance metrics are not representative of human perception. On the other hand, humans are less sensitive to changes in colorspace. In addition, pixel shifts in a constrained neighborhood are hard to notice. Motivated by these observations, we propose a method that creates adversarial examples by applying spatial transformations, which creates adversarial examples by changing the pixel locations independently to chrominance channels of perceptual colorspaces such as $YC_{b}C_{r}$ and $CIELAB$, instead of making an additive perturbation or manipulating pixel values directly. In a targeted white-box attack setting, the proposed method is able to obtain competitive fooling rates with very high confidence. The experimental evaluations show that the proposed method has favorable results in terms of approximate perceptual distance between benign and adversarially generated images. The source code is publicly available at <a class="link-external link-https" href="https://github.com/ayberkydn/stadv-torch" rel="external noopener nofollow">this https URL</a>

Computer Vision and Pattern Recognition,Image and Video Processing

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: how to generate adversarial samples so that these samples can deceive deep image recognition networks while being almost imperceptible to human vision. Specifically, the paper proposes a method of creating adversarial samples by applying local spatial transformations to the chrominance channels in the perceptual color space. This method can reduce the perturbations that interfere with human vision, thereby achieving more effective adversarial attacks.

The paper points out that existing adversarial sample generation methods usually use \(L_p\) distance metrics (such as \(L_0\), \(L_2\) and \(L_\infty\)) to quantify the size of perturbations, but these metrics do not conform to human visual perception. Even if the metric values are small, human observers may notice these perturbations. Therefore, the paper proposes a new method, that is, by changing the pixel positions of the chrominance channels in the perceptual color space (such as YCbCr and CIELAB), rather than directly adding perturbations or manipulating pixel values, to generate adversarial samples. This method can significantly reduce the perceptual differences between adversarial samples and the original images while maintaining a high - confidence deception rate.

Experimental results show that this method can obtain a deception rate comparable to existing methods in the target white - box attack setting, and the generated adversarial samples are very close to the original images in perception, especially when using the CIELAB color space. In addition, this method does not require additional regularization terms and has strong practicality.