Houdini: Fooling Deep Structured Prediction Models

2017/07/17 by Moustapha Cissé, Yossi Adi, Cisse, Moustapha +5 · 4 citations
Computer Science · #Adversarial Robustness in Machine Learning #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Topic Modeling

paper · pdf · doi:10.48550/arxiv.1707.05373

openalex publication_date 2017/07/17 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Generating adversarial examples is a critical step for evaluating and improving the robustness of learning machines. So far, most existing methods only work for classification and are not designed to alter the true performance measure of the problem at hand. We introduce a novel flexible approach named Houdini for generating adversarial examples specifically tailored for the final performance measure of the task considered, be it combinatorial and non-decomposable. We successfully apply Houdini to a range of applications such as speech recognition, pose estimation and semantic segmentation. In all cases, the attacks based on Houdini achieve higher success rate than those based on the traditional surrogates used to train the models while using a less perceptible adversarial perturbation.

Citations

• Long Short-Term Memory
• A tutorial on hidden Markov models and selected applications in speech recognition
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Examples for Semantic Segmentation and Object Detection
• Practical Black-Box Attacks against Machine Learning

Cited by

• PAC-learning in the presence of evasion adversaries
• Defending Your Voice: Adversarial Attack on Voice Conversion
• Defensive Adversarial CAPTCHA: A Semantics-Driven Framework for Natural Adversarial Example Generation
• Patch-wise++ Perturbation for Adversarial Targeted Attacks

Related

• Measuring the Contribution of Multiple Model Representations in\n Detecting Adversarial Instances
• Plausible Counterfactuals: Auditing Deep Learning Classifiers with Realistic Adversarial Examples
• Stochastic Combinatorial Ensembles for Defending Against Adversarial Examples
• Towards Robust Detection of Adversarial Examples
• White-to-Black: Efficient Distillation of Black-Box Adversarial Attacks