Lidé

Mgr. Vojtěch Čermák

Všechny publikace

Adversarial Examples by Perturbing High-level Features in Intermediate Decoder Layers

  • Autoři: Mgr. Vojtěch Čermák, Mgr. Lukáš Adam, Ph.D.,
  • Publikace: ICAART: PROCEEDINGS OF THE 14TH INTERNATIONAL CONFERENCE ON AGENTS AND ARTIFICIAL INTELLIGENCE - VOL 2. Porto: SciTePress - Science and Technology Publications, 2022. p. 496-507. ISSN 2184-433X. ISBN 978-989-758-547-0.
  • Rok: 2022
  • DOI: 10.5220/0010892800003116
  • Odkaz: https://doi.org/10.5220/0010892800003116
  • Pracoviště: Katedra počítačů, Centrum umělé inteligence
  • Anotace:
    We propose a novel method for creating adversarial examples. Instead of perturbing pixels, we use an encoder-decoder representation of the input image and perturb intermediate layers in the decoder. This changes the high-level features provided by the generative model. Therefore, our perturbation possesses semantic meaning, such as a longer beak or green tints. We formulate this task as an optimization problem by minimizing the Wasserstein distance between the adversarial and initial images under a misclassification constraint. We employ the projected gradient method with a simple inexact projection. Due to the projection, all iterations are feasible, and our method always generates adversarial images. We perform numerical experiments by fooling MNIST and ImageNet classifiers in both targeted and untargeted settings. We demonstrate that our adversarial images are much less vulnerable to steganographic defence techniques than pixel-based attacks. Moreover, we show that our method modifies key features such as edges and that defence techniques based on adversarial training are vulnerable to our attacks.

Za stránku zodpovídá: Ing. Mgr. Radovan Suk