Spatially Transformed Adversarial Examples

2018/01/08 by Chaowei Xiao, Xiao, Chaowei, Jun-Yan Zhu +9 · 20 citations
Computer Science · #Advanced Malware Detection Techniques #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (stat.ML) #Physical Unclonable Functions (PUFs) and Hardware Security

paper · pdf · doi:10.48550/arxiv.1801.02612

openalex publication_date 2018/01/08 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the L_p distance for penalizing perturbations. Researchers have explored different defense methods to defend against such adversarial attacks. While the effectiveness of L_p distance as a metric of perceptual quality remains an active research area, in this paper we will instead focus on a different type of perturbation, namely spatial transformation, as opposed to manipulating the pixel values directly as in prior works. Perturbations generated through spatial transformation could result in large L_p distance measures, but our extensive experiments show that such spatially transformed adversarial examples are perceptually realistic and more difficult to defend against with existing defense systems. This potentially provides a new direction in adversarial example generation and the design of corresponding defenses. We visualize the spatial transformation based perturbation for different examples and show that our technique can produce realistic adversarial examples with smooth image deformation. Finally, we visualize the attention of deep networks with different types of adversarial examples to better understand how these examples are interpreted.

Cited by

• Calibrated Adversarial Sampling: Multi-Armed Bandit-Guided Generalization Against Unforeseen Attacks
• Diffusion Guided Adversarial State Perturbations in Reinforcement Learning
• KoALA: KL-L0 Adversarial Detector via Label Agreement
• On the Adversarial Robustness of Learning-based Conformal Novelty Detection
• Generating Adversarial Examples with Adversarial Networks
• Hardware Trojan Attacks on Neural Networks
• Generating 3D Adversarial Point Clouds
• Understanding and Enhancing the Transferability of Adversarial Examples
• Robustness of Rotation-Equivariant Networks to Adversarial Perturbations
• FAWA: Fast Adversarial Watermark Attack on Optical Character Recognition (OCR) Systems
• Overfitting in adversarially robust deep learning
• An Investigation of Visual Foundation Models Robustness
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
• Understanding the Error in Evaluating Adversarial Robustness
• Recurrent Attention Model with Log-Polar Mapping is Robust against Adversarial Attacks
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Efficient Project Gradient Descent for Ensemble Adversarial Attack
• Playing it Safe: Adversarial Robustness with an Abstain Option
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Transfer of Adversarial Robustness Between Perturbation Types
• Generating Unrestricted Adversarial Examples via Three Parameters

Related

• Perturbations are not Enough: Generating Adversarial Examples with Spatial Distortions
• Region-Wise Attack: On Efficient Generation of Robust Physical Adversarial Examples
• Adversarial Attacks Beyond the Image Space
• Quantifying Perceptual Distortion of Adversarial Examples
• Perceptual Adversarial Robustness: Defense Against Unseen Threat Models