论文标题
用单个图像生成对抗性但不起眼的补丁
Generating Adversarial yet Inconspicuous Patches with a Single Image
论文作者
论文摘要
深度神经网络已显示出脆弱的to to to toperversial斑块，外来模式可以导致模型错误的预测。然而，现有的对逆贴剂生成的AP范围几乎不能降低贴片和图像背景之间的上下文一致性，从而使此类补丁被检测到，并且对抗性攻击失败。另一方面，这些方法需要大量的数据进行训练，这在计算上很昂贵。为了过度解决这些挑战，我们提出了一种用结图像来解决Gen-对抗性但不起眼的斑块的方法。在我们的方法中，对抗斑块是用多个发电机和歧视器的多尺度的粗到定义方式生产的。在Min-Max培训中编码上下文信息，以使其与周围环境一致。 Patch位置的选择基于Victim模型的感知灵敏度。通过广泛的实验，我们的AP搜索在白色框和黑色盒子设置中都显示出强大的攻击能力。关于显着性脱离和用户评估的实验表明，我们的对手斑块可以逃避人类的观察，表明我们的方法不明显。最后，我们炫耀我们的方法保留了物理世界中的攻击能力。
Deep neural networks have been shown vulnerable toadversarial patches, where exotic patterns can resultin models wrong prediction. Nevertheless, existing ap-proaches to adversarial patch generation hardly con-sider the contextual consistency between patches andthe image background, causing such patches to be eas-ily detected and adversarial attacks to fail. On the otherhand, these methods require a large amount of data fortraining, which is computationally expensive. To over-come these challenges, we propose an approach to gen-erate adversarial yet inconspicuous patches with onesingle image. In our approach, adversarial patches areproduced in a coarse-to-fine way with multiple scalesof generators and discriminators. Contextual informa-tion is encoded during the Min-Max training to makepatches consistent with surroundings. The selection ofpatch location is based on the perceptual sensitivity ofvictim models. Through extensive experiments, our ap-proach shows strong attacking ability in both the white-box and black-box setting. Experiments on saliency de-tection and user evaluation indicate that our adversar-ial patches can evade human observations, demonstratethe inconspicuousness of our approach. Lastly, we showthat our approach preserves the attack ability in thephysical world.
