在感知色彩空间中通过空间变换生成对抗图像
Adversarial Image Generation by Spatial Transformation in Perceptual Colorspaces
AI总结：
本文提出一种在感知色彩空间（如 $YC_{b}C_{r}$ 和 $CIELAB$）中通过独立改变色度通道像素位置的空间变换生成对抗图像的方法，在白盒攻击下取得了高置信度欺骗率和良好的感知距离表现。
摘要：
深度神经网络极易受到对抗扰动的影响。这些扰动的大小通常使用 $L_p$ 范数进行量化，例如 $L_0$、$L_2$ 和 $L_\infty$。然而，即使测量到的扰动很小，人类观察者往往也能察觉到，因为 $L_p$ 距离度量不能很好地代表人类感知。另一方面，人类对色彩空间的变化较不敏感。此外，在受限邻域内的像素偏移也难以被察觉。受这些观察的启发，我们提出了一种通过应用空间变换来创建对抗样本的方法。该方法通过独立改变感知色彩空间（如 $YC_{b}C_{r}$ 和 $CIELAB$）的色度通道的像素位置来生成对抗样本，而不是直接进行加性扰动或操纵像素值。在目标白盒攻击设置下，所提出的方法能够以极高的置信度获得具有竞争力的欺骗率。实验评估表明，在良性图像与对抗生成图像之间的近似感知距离方面，所提出的方法取得了良好的结果。源代码已在 https://github.com/ayberkydn/stadv-torch 公开发布。
英文摘要：
Deep neural networks are known to be vulnerable to adversarial perturbations. The amount of these perturbations are generally quantified using $L_p$ metrics, such as $L_0$, $L_2$ and $L_\infty$. However, even when the measured perturbations are small, they tend to be noticeable by human observers since $L_p$ distance metrics are not representative of human perception. On the other hand, humans are less sensitive to changes in colorspace. In addition, pixel shifts in a constrained neighborhood are hard to notice. Motivated by these observations, we propose a method that creates adversarial examples by applying spatial transformations, which creates adversarial examples by changing the pixel locations independently to chrominance channels of perceptual colorspaces such as $YC_{b}C_{r}$ and $CIELAB$, instead of making an additive perturbation or manipulating pixel values directly. In a targeted white-box attack setting, the proposed method is able to obtain competitive fooling rates with very high confidence. The experimental evaluations show that the proposed method has favorable results in terms of approximate perceptual distance between benign and adversarially generated images. The source code is publicly available at https://github.com/ayberkydn/stadv-torch
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
