Abstract:Saliency detection is an effective front-end process to many security-related tasks, e.g. automatic drive and tracking. Adversarial attack serves as an efficient surrogate to evaluate the robustness of deep saliency models before they are deployed in real world. However, most of current adversarial attacks exploit the gradients spanning the entire image space to craft adversarial examples, ignoring the fact that natural images are high-dimensional and spatially over-redundant, thus causing expensive attack cost and poor perceptibility. To circumvent these issues, this paper builds an efficient bridge between the accessible partially-white-box source models and the unknown black-box target models. The proposed method includes two steps: 1) We design a new partially-white-box attack, which defines the cost function in the compact hidden space to punish a fraction of feature activations corresponding to the salient regions, instead of punishing every pixel spanning the entire dense output space. This partially-white-box attack reduces the redundancy of the adversarial perturbation. 2) We exploit the non-redundant perturbations from some source models as the prior cues, and use an iterative zeroth-order optimizer to compute the directional derivatives along the non-redundant prior directions, in order to estimate the actual gradient of the black-box target model. The non-redundant priors boost the update of some "critical" pixels locating at non-zero coordinates of the prior cues, while keeping other redundant pixels locating at the zero coordinates unaffected. Our method achieves the best tradeoff between attack ability and perturbation redundancy. Finally, we conduct a comprehensive experiment to test the robustness of 18 state-of-the-art deep saliency models against 16 malicious attacks, under both of white-box and black-box settings, which contributes a new robustness benchmark to the saliency community for the first time.

SAL: Salient Adversarial Attack with LRP Refinement

Fooling Neural Network Interpretations - Adversarial Noise to Attack Images.

RoLMA: A Practical Adversarial Attack Against Deep Learning-Based LPR Systems.

Adversarial Attacks against Deep Saliency Models

Detection defense against adversarial attacks with saliency map

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

SAD: Saliency-based Defenses Against Adversarial Examples

Improving Model Robustness Against Adversarial Examples with Redundant Fully Connected Layer.

Normal Vs. Adversarial: Salience-based Analysis of Adversarial Samples for Relation Extraction

Adversarial Attack Against Deep Saliency Models Powered by Non-Redundant Priors

ROSA: Robust Salient Object Detection Against Adversarial Attacks

Towards Robustness against Unsuspicious Adversarial Examples

Adversarial example detection based on saliency map features

Invisible Adversarial Attack Against Deep Neural Networks: an Adaptive Penalization Approach

Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks

A Simplified Heuristic Version of Raviv's Algorithm for Using Context in Text Recognition

ASP:A Fast Adversarial Attack Example Generation Framework based on Adversarial Saliency Prediction

Generating Imperceptible and Cross-Resolution Remote Sensing Adversarial Examples Based on Implicit Neural Representations

LeNo: Adversarial Robust Salient Object Detection Networks with Learnable Noise

Sparse and Imperceivable Adversarial Attacks

Detecting Localized Adversarial Examples: A Generic Approach Using Critical Region Analysis