SemanticAdv: 通过属性条件图像编辑生成对抗样本
SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
AI总结：
本文提出 SemanticAdv 算法，通过操纵解耦的语义属性生成无限制对抗样本，可有效欺骗人脸验证等任务，并对真实黑盒服务实现高成功率攻击，同时适用于街景图像，有助于理解 DNN 脆弱性与防御。
摘要：
深度神经网络（DNNs）凭借其强大的表达能力，在各种应用中取得了巨大成功。然而，近期研究表明，DNNs 容易受到对抗样本的攻击，这些对抗样本是经过操纵的实例，旨在误导 DNNs 做出错误的预测。目前，大多数此类对抗样本试图通过限制扰动的 $L_p$ 范数来保证“微小的扰动”。在本文中，我们旨在通过操纵图像的语义属性来探索语义操纵对 DNNs 预测的影响，并生成“无限制的对抗样本”。具体而言，我们提出了一种算法 \textit{SemanticAdv}，该算法利用解耦的语义因子，通过改变受控的语义属性来生成对抗性扰动，从而将学习器欺骗至各种“对抗性”目标。我们进行了大量实验，以表明基于语义的对抗样本不仅能欺骗不同的学习任务，如人脸验证和地标检测，而且还能基于可迁移性，对 \textit{真实世界的黑盒} 服务（如 Azure 人脸验证服务）实现高目标攻击成功率。为了进一步证明 \textit{SemanticAdv} 在人脸识别领域之外的适用性，我们还在街景图像上生成了语义扰动。这种具有受控语义操纵的对抗样本，可以进一步理解 DNNs 的脆弱性以及潜在的防御方法。
英文摘要：
Deep neural networks (DNNs) have achieved great success in various applications due to their strong expressive power. However, recent studies have shown that DNNs are vulnerable to adversarial examples which are manipulated instances targeting to mislead DNNs to make incorrect predictions. Currently, most such adversarial examples try to guarantee "subtle perturbation" by limiting the $L_p$ norm of the perturbation. In this paper, we aim to explore the impact of semantic manipulation on DNNs predictions by manipulating the semantic attributes of images and generate "unrestricted adversarial examples". In particular, we propose an algorithm \emph{SemanticAdv} which leverages disentangled semantic factors to generate adversarial perturbation by altering controlled semantic attributes to fool the learner towards various "adversarial" targets. We conduct extensive experiments to show that the semantic based adversarial examples can not only fool different learning tasks such as face verification and landmark detection, but also achieve high targeted attack success rate against \emph{real-world black-box} services such as Azure face verification service based on transferability. To further demonstrate the applicability of \emph{SemanticAdv} beyond face recognition domain, we also generate semantic perturbations on street-view images. Such adversarial examples with controlled semantic manipulation can shed light on further understanding about vulnerabilities of DNNs as well as potential defensive approaches.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
