Demiguise Attack：用感知相似度制作不可见的语义对抗扰动
Demiguise Attack: Crafting Invisible Semantic Adversarial Perturbations with Perceptual Similarity
摘要：
深度神经网络（DNN）被发现容易受到对抗性样本的攻击。对抗性示例是具有视觉上无法察觉的扰动的恶意图像。虽然这些精心制作的扰动受到严格的$\Lp$范数界限的限制，但它们仍然很容易被人类感知。当攻击黑盒模型或具有降噪滤波器等防御措施的模型时，这些扰动的成功率也有限。为了解决这些问题，我们提出了伪装攻击，用感知相似度制作“不受限制”的扰动。具体来说，我们可以通过基于感知相似度操纵语义信息来创建强大且逼真的对抗性示例。我们生成的对抗性示例对人类视觉系统（HVS）是友好的，尽管扰动是很大的。我们扩展了广泛使用的攻击与我们的方法，提高对抗的有效性令人印象深刻，同时有助于不可感知。大量的实验表明，该方法不仅优于各种国家的最先进的攻击在欺骗率，可转移性，对防御的鲁棒性，但也可以有效地改善攻击。此外，我们还注意到，我们的实现可以模拟真实场景中发生的照明和对比度变化，这将有助于暴露DNN的盲点。
英文摘要：
Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples. Adversarial examples are malicious images with visually imperceptible perturbations. While these carefully crafted perturbations restricted with tight $\Lp$ norm bounds are small, they are still easily perceivable by humans. These perturbations also have limited success rates when attacking black-box models or models with defenses like noise reduction filters. To solve these problems, we propose Demiguise Attack, crafting ``unrestricted'' perturbations with Perceptual Similarity. Specifically, we can create powerful and photorealistic adversarial examples by manipulating semantic information based on Perceptual Similarity. Adversarial examples we generate are friendly to the human visual system (HVS), although the perturbations are of large magnitudes. We extend widely-used attacks with our approach, enhancing adversarial effectiveness impressively while contributing to imperceptibility. Extensive experiments show that the proposed method not only outperforms various state-of-the-art attacks in terms of fooling rate, transferability, and robustness against defenses but can also improve attacks effectively. In addition, we also notice that our implementation can simulate illumination and contrast changes that occur in real-world scenarios, which will contribute to exposing the blind spots of DNNs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
