Perceptual Evaluation of Adversarial Attacks for CNN-based Image\n Classification

2019/06/01 by Sid Ahmed Fezza, Yassine Bakhti, Fezza, Sid Ahmed +5 · 2 citations
Computer Science · Engineering · #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #FOS: Electrical engineering #Image and Video Processing (eess.IV) #Integrated Circuits and Semiconductor Failure Analysis #Machine Learning (cs.LG) #Machine Learning (stat.ML) #electronic engineering #information engineering

paper · pdf · doi:10.48550/arxiv.1906.00204

openalex publication_date 2019/06/01 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Deep neural networks (DNNs) have recently achieved state-of-the-art\nperformance and provide significant progress in many machine learning tasks,\nsuch as image classification, speech processing, natural language processing,\netc. However, recent studies have shown that DNNs are vulnerable to adversarial\nattacks. For instance, in the image classification domain, adding small\nimperceptible perturbations to the input image is sufficient to fool the DNN\nand to cause misclassification. The perturbed image, called \adversarial\nexample, should be visually as close as possible to the original image.\nHowever, all the works proposed in the literature for generating adversarial\nexamples have used the L_p norms (L₀, L₂ and L_\∞) as\ndistance metrics to quantify the similarity between the original image and the\nadversarial example. Nonetheless, the L_p norms do not correlate with human\njudgment, making them not suitable to reliably assess the perceptual\nsimilarity/fidelity of adversarial examples. In this paper, we present a\ndatabase for visual fidelity assessment of adversarial examples. We describe\nthe creation of the database and evaluate the performance of fifteen\nstate-of-the-art full-reference (FR) image fidelity assessment metrics that\ncould substitute L_p norms. The database as well as subjective scores are\npublicly available to help designing new metrics for adversarial examples and\nto facilitate future research works.\n

Cited by

• Image Quality Assessment for Machines: Paradigm, Large-scale Database, and Models
• Accelerating Targeted Hard-Label Adversarial Attacks in Low-Query Black-Box Settings

Related

• Benchmarking Adversarial Robustness
• An Explainable Adversarial Robustness Metric for Deep Learning Neural Networks
• Not So Robust After All: Evaluating the Robustness of Deep Neural Networks to Unseen Adversarial Attacks
• AdvJND: Generating Adversarial Examples with Just Noticeable Difference
• On Intrinsic Dataset Properties for Adversarial Machine Learning