user: text: Write a concise one-sentence TLDR summary of the scientific paper content below.

Title: ADef: an Iterative Algorithm to Construct Adversarial Deformations

Paper content:
While deep neural networks have proven to be a powerful tool for many recognition and classification tasks, their stability properties are still not well understood.
In the past, image classifiers have been shown to be vulnerable to so-called adversarial attacks, which are created by additively perturbing the correctly classified image.
In this paper, we propose the ADef algorithm to construct a different kind of adversarial attack created by iteratively applying small deformations to the image, found through a gradient descent step.
We demonstrate our results on MNIST with convolutional neural networks and on ImageNet with Inception-v3 and ResNet-101.
In a first observation in BID25 it was found that deep neural networks exhibit unstable behavior to small perturbations in the input.
For the task of image classification this means that two visually indistinguishable images may have very different outputs, resulting in one of them being misclassified even if the other one is correctly classified with high confidence.
Since then, a lot of research has been done to investigate this issue through the construction of adversarial examples: given a correctly classified image x, we look for an image y which is visually indistinguishable from x but is misclassified by the network.
Typically, the image y is constructed as y = x + r, where r is an adversarial perturbation that is supposed to be small in a suitable sense (normally, with respect to an p norm).
Several algorithms have been developed to construct adversarial perturbations, see BID9 BID18 ; BID14 ; BID16 ; BID5 and the review paper BID0 .Even
though such pathological cases are very unlikely to occur in practice, their existence is relevant since malicious attackers may exploit this drawback to fool classifiers or other automatic systems. Further
, adversarial perturbations may be constructed in a black-box setting (i.e., without knowing the architecture of the DNN but only its outputs) BID19 BID17 and also in the physical world BID14 BID1 BID3 BID24 . This has
motivated the investigation of defenses, i.e., how to make the network invulnerable to such attacks, see BID13 ; BID4 ; BID16 ; BID27 ; BID28 ; BID20 ; BID2 ; BID12 . In most
cases, adversarial examples are artificially created and then used to retrain the network, which becomes more stable under these types of perturbations.Most of the work on the construction of adversarial examples and on the design of defense strategies has been conducted in the context of small perturbations r measured in the ∞ norm. However
, this is not necessarily a good measure of image similarity: e.g., for two translated images x and y, the norm of x−y is not small in general, even though x and y will look indistinguishable if the translation is small. Several
papers have investigated the construction of adversarial perturbations not designed for norm proximity BID21 BID24 BID3 BID6 BID29 .In this
work, we build up on these ideas and investigate the construction of adversarial deformations. In other
words, the misclassified image y is not constructed as an additive perturbation y = x + r, but as a deformation y = x • (id + τ ), where τ is a vector field defining the transformation. In this
case, the similarity is not measured through a norm of y − x, but instead through a norm of τ , which quantifies the deformation between y and x.We develop an efficient algorithm for the construction of adversarial deformations, which we call ADef. It is based
on the main ideas of DeepFool BID18 , and iteratively constructs the smallest deformation to misclassify the image. We test the
procedure on MNIST (LeCun) (with convolutional neural networks) and on ImageNet (Russakovsky et al., 2015) (with Inception-v3 BID26 and ResNet-101 BID10 ). The results
show that ADef can succesfully fool the classifiers in the vast majority of cases (around 99%) by using very small and imperceptible deformations. We also test
our adversarial attacks on adversarially trained networks for MNIST. Our implementation
of the algorithm can be found at https://gitlab.math. ethz.ch/tandrig/ADef.The
results of this work have initially appeared in the master's thesis BID8 , to which we refer for additional details on the mathematical aspects of this construction. While writing this paper
, we have come across BID29 , in which a similar problem is considered and solved with a different algorithm. Whereas in BID29 the authors
use a second order solver to find a deforming vector field, we show how a first order method can be formulated efficiently and justify a smoothing operation, independent of the optimization step. We report, for the first time
, success rates for adversarial attacks with deformations on ImageNet. The topic of deformations has
also come up in BID11 , in which the authors introduce a class of learnable modules that deform inputs in order to increase the performance of existing DNNs, and BID7 , in which the authors introduce a method to measure the invariance of classifiers to geometric transformations.
In this work, we proposed a new efficient algorithm, ADef, to construct a new type of adversarial attacks for DNN image classifiers.
The procedure is iterative and in each iteration takes a gradient descent step to deform the previous iterate in order to push to a decision boundary.We demonstrated that with almost imperceptible deformations, state-of-the art classifiers can be fooled to misclassify with a high success rate of ADef.
This suggests that networks are vulnerable to different types of attacks and that simply training the network on a specific class of adversarial examples might not form a sufficient defense strategy.
Given this vulnerability of neural networks to deformations, we wish to study in future work how ADef can help for designing possible defense strategies.
Furthermore, we also showed initial results on fooling adversarially trained networks.
Remarkably, PGD trained networks on MNIST are more resistant to adversarial deformations than ADef trained networks.
However, for this result to be more conclusive, similar tests on ImageNet will have to be conducted.
We wish to study this in future work.
T from the MNIST experiments.
Deformations that fall to the left of the vertical line at ε = 3 are considered successful.
The networks in the first column were trained using the original MNIST data, and the networks in the second and third columns were adversarially trained using ADef and PGD, respectively.

assistant: text: We propose a new, efficient algorithm to construct adversarial examples by means of deformations, rather than additive perturbations.