Skip to content
Original

Adversarial Patch: a printable universal, robust, targeted adversarial image patch

Adversarial Patch

arXiv· arXiv:1712.09665· Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, Justin GilmerGoogleIndexed by this site · 16 days ago· Originally publishedSelected AttacksSelectedAttention47

Translation in progress — untranslated text is omitted.

Quick read

Attacks

Based on the paper PDF (AI-generated); refer to the original

AI summaryThe paper proposes a universal adversarial image patch that can be printed and used in the real world; when placed in any scene, it makes the classifier ignore other objects in the image and output a specified class. The patch is trained under random position, scale and rotation, using the Expectation over Transformation framework to optimize the expected probability of the target class, and therefore does not depend on background content or lighting. The authors perform white-box ensemble training on five ImageNet models: inceptionv3, resnet50, xception, VGG16, VGG19, and train on four models and evaluate black-box transfer on the fifth model that did not participate in training. In a physical demonstration, a photo of a desk with a banana and a laptop is classified by VGG16 as banana with 97% confidence; after a sticker targeting toaster is placed on the desk, the photo is classified as toaster with 99% confidence. The authors accordingly point out that defenses targeting only small Lp perturbations are insufficient against such large-area local perturbations.

Questions
Existing adversarial example research mostly focuses on small or imperceptible perturbations; the authors explore what an attacker can do when no longer constrained in perturbation size: whether a scene-independent, printable patch can be created that makes a classifier ignore the scene content and output a specified class.
Methods
Using a variant of the Expectation over Transformation (EOT) framework, train a patch under random images, random positions, and random rotation and scaling transformations to maximize the expected log probability of the target class; it supports three training modes: white-box single-model, white-box five-model ensemble, and black-box (leave-one-model-out), and can also add an L∞ constraint for camouflage.
Experiments and results
In the digital experiments, the patch is tested at random positions and multiple sizes (400 images per size); the authors state that the patch is far more effective than directly inserting a real image of the target class; in the real-world experiment, the printed patch makes VGG16 classify the banana photo as toaster with 99% confidence; on the third-party application Demitasse, there is some transferability only when the patch occupies a large proportion of the image.
Limitations and future work
The authors note that, unlike Sharif et al., they did not optimize the patch for printability, and that in the black-box plus real-world setting the patch must occupy a fairly large proportion of the image to be effective; the paper does not report specific success-rate values for each method (only figures), nor does it evaluate any defense.
Why it was selectedThe paper presents a printable universal adversarial patch and reproduces it in a real desk scene, showing that defenses targeting only small perturbations struggle to cover such large-area local perturbations.

The paper presents a printable universal adversarial patch and reproduces it in a real desk scene, showing that defenses targeting only small perturbations struggle to cover such large-area local perturbations.

Related events and news

0 events · 2 news mentions

News that mentions this paper

Related papers

Both use: ImageNet
Show 3 more papers
Both use: ImageNet
Read originalarxiv.org