Abstract:There has been a rise in the use of Machine Learning as a Service (MLaaS) Vision APIs as they offer multiple services including pre-built models and algorithms, which otherwise take a huge amount of resources if built from scratch. As these APIs get deployed for high-stakes applications, it's very important that they are robust to different manipulations. Recent works have only focused on typical adversarial attacks when evaluating the robustness of vision APIs. We propose two new aspects of adversarial image generation methods and evaluate them on the robustness of Google Cloud Vision API's optical character recognition service and object detection APIs deployed in real-world settings such as <a class="link-external link-http" href="http://sightengine.com" rel="external noopener nofollow">this http URL</a>, <a class="link-external link-http" href="http://picpurify.com" rel="external noopener nofollow">this http URL</a>, Google Cloud Vision API, and Microsoft Azure's Computer Vision API. Specifically, we go beyond the conventional small-noise adversarial attacks and introduce secret embedding and transparent adversarial examples as a simpler way to evaluate robustness. These methods are so straightforward that even non-specialists can craft such attacks. As a result, they pose a serious threat where APIs are used for high-stakes applications. Our transparent adversarial examples successfully evade state-of-the art object detections APIs such as Azure Cloud Vision (attack success rate 52%) and Google Cloud Vision (attack success rate 36%). 90% of the images have a secret embedded text that successfully fools the vision of time-limited humans but is detected by Google Cloud Vision API's optical character recognition. Complementing to current research, our results provide simple but unconventional methods on robustness evaluation.

Scaling Camouflage: Content Disguising Attack Against Computer Vision Applications

Seeing Is Not Believing: Camouflage Attacks On Image Scaling Algorithms

Wolf in Sheep's Clothing - The Downscaling Attack Against Deep Learning Applications

Call White Black: Enhanced Image-Scaling Attack in Industrial Artificial Intelligence Systems

Learning Coated Adversarial Camouflages for Object Detectors

Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles

Image Scaling Attack Simulation: A Measure of Stealth and Detectability

CamoNet: A Target Camouflage Network for Remote Sensing Images Based on Adversarial Attack

Exploiting vulnerabilities of deep neural networks for privacy protection

Building Towards "Invisible Cloak": Robust Physical Adversarial Attack on YOLO Object Detector

To Make Yourself Invisible with Adversarial Semantic Contours

DTA: Physical Camouflage Attacks using Differentiable Transformation Network

Downscaling Attack and Defense: Turning What You See Back Into What You Get

Robust Adversarial Examples Against Scale Transformation Via Generative Network

Defense against adversarial attacks based on color space transformation

Physical Adversarial Examples for Multi-Camera Systems

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity

Adversarial Color Projection: A Projector-Based Physical-World Attack to DNNs

Simple Transparent Adversarial Examples

Adversarial scratches: Deployable attacks to CNN classifiers

Improving transferability of 3D adversarial attacks with scale and shear transformations