Abstract:Y Recent studies demonstrated that deep neural networks (DNNs) are vulnerable to adversarial examples, which would seriously threaten security-sensitive applications. Existing works synthesized the adversarial examples by perturbing the original/benign images by leveraging the L-p-norm to penalize the perturbations, which restricts the pixel-wise distance between the adversarial images and correspondingly benign images. However, they added perturbations globally to the benign images without explicitly considering their content/spacial structure, resulting in noticeable artifacts especially in those originally clean regions, e.g., sky and smooth surface. In this paper, we propose an invisible adversarial attack, which synthesizes adversarial examples that are visually indistinguishable from benign ones. We adaptively distribute the perturbation according to human sensitivity to a local stimulus in the benign image, i.e., the higher insensitivity, the more perturbation. Two types of adaptive adversarial attacks are proposed: 1) coarse-grained and 2) fine-grained. The former conducts L-p-norm regularized by the novel spatial constraints, which utilizes the rich information of the cluttered regions to mask perturbation. The latter, called Just Noticeable Distortion (JND)-based adversarial attack, utilizes the proposed JND(p) metric for better measuring the perceptual similarity, and adaptively sets penalty by weighting the pixel-wise perceptual redundancy of an image. We conduct extensive experiments on the MNIST, CIFAR-10 and ImageNet datasets and a comprehensive user study with 50 participants. The experimental results demonstrate that JND(p) is a better metric for measuring the perceptual similarity than L-p-norm, and the proposed adaptive adversarial attacks can synthesize indistinguishable adversarial examples from benign ones and outperform the state-of-the-art methods.

Sigma-UAP: An Invisible Semi-Universal Adversarial Attack Against Deep Neural Networks

Double Targeted Universal Adversarial Perturbations

Joint Universal Adversarial Perturbations with Interpretations

Improving Transferability of Universal Adversarial Perturbation with Feature Disruption.

Crafting Targeted Universal Adversarial Perturbations: Considering Images as Noise

Robust Universal Adversarial Perturbations

Generalizing universal adversarial perturbations for deep neural networks

Simple iterative method for generating targeted universal adversarial perturbations

Universal Adversarial Perturbation Via Prior Driven Uncertainty Approximation

A Survey on Universal Adversarial Attack

Real-time Detection of Practical Universal Adversarial Perturbations

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Universal Attack against Automatic Modulation Classification DNNs Under Frequency and Data Constraints

Universal 3-Dimensional Perturbations for Black-Box Attacks on Video Recognition Systems

On the Universal Adversarial Perturbations for Efficient Data-free Adversarial Detection

Comparative Evaluation of Recent Universal Adversarial Perturbations in Image Classification

Invisible Adversarial Attack Against Deep Neural Networks: an Adaptive Penalization Approach

Universal adversarial perturbation for remote sensing images

Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective

Black-Box Universal Adversarial Attack for DNN-Based Models of SAR Automatic Target Recognition

Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity