SemanticAdv: Generating Adversarial Examples via Attribute-Conditional Image Editing

1 INTRODUCTION . Deep neural networks ( DNNs ) have demonstrated great successes in advancing the state-of-the-art performance of discriminative tasks ( Krizhevsky et al. , 2012 ; Goodfellow et al. , 2016 ; He et al. , 2016 ; Collobert & Weston , 2008 ; Deng et al. , 2013 ; Silver et al. , 2016 ) . However , recent research found that DNNs are vulnerable to adversarial examples which are carefully crafted instances aiming to induce arbitrary prediction errors for learning systems . Such adversarial examples containing small magnitude of perturbation have shed light on understanding and discovering potential vulnerabilities of DNNs ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Xiao et al. , 2018b ; c ; a ; 2019 ) . Most existing work focused on constructing adversarial examples by adding Lp bounded pixel-wise perturbations ( Goodfellow et al. , 2014b ) or spatially transforming the image ( Xiao et al. , 2018c ; Engstrom et al. , 2017 ) ( e.g. , in-plane rotation or out-of-plane rotation ) . Generating unrestricted perturbations with semantically meaningful patterns is an important yet under-explored field . At the same time , deep generative models have demonstrated impressive performance in learning disentangled semantic factors through data generation in an unsupervised ( Radford et al. , 2015 ; Karras et al. , 2018 ; Brock et al. , 2019 ) or weakly-supervised manner based on semantic attributes ( Yan et al. , 2016 ; Choi et al. , 2018 ) . Empirical findings in ( Yan et al. , 2016 ; Zhu et al. , 2016a ; Radford et al. , 2015 ) demonstrated that a simple linear interpolation on the learned image manifold can produce smooth visual transitions between a pair of input images . In this paper , we introduce a novel attack SemanticAdv which generates unrestricted perturbations with semantically meaningful patterns . Motivated by the findings mentioned above , we leverage an attribute-conditional image editing model ( Choi et al. , 2018 ) to synthesize adversarial examples by interpolating between source and target images in the feature-map space . Here , we focus on changing a single attribute dimension to achieve adversarial goals while keeping the generated adversarial image reasonably-looking ( e.g. , see Figure 1 ) . To validate the effectiveness of the proposed attack method , we consider two tasks , namely , face verification and landmark detection , as face recognition field has been extensively explored and the commercially used face models are relatively robust +blonde hair Adversarial Image Synthesized Image Target Image Mr. Bob Mr. BobAttribute-conditional Image Generator Identity VerificationOriginal Image Miss Alice Reconstruction via Generation Original Attribute Augmented Attribute Attribute-conditional Image Editing via Generation Feature-map Interpolation Adversarial Image Original Image Target Image SemanticAdv +pale skin Figure 1 : Left : Overview of the proposed SemanticAdv . Right : Illustration of our SemanticAdv in the real world face verification platform . Note that the confidence denotes the likelihood that two faces belong to the same person . since they require a low false positive rate . We conduct both qualitative and quantitative evaluations on CelebA dataset ( Liu et al. , 2015 ) . To demonstrate the applicability of SemanticAdv beyond face domain , we further extend SemanticAdv to generate adversarial street-view images . We treat semantic layouts as input attributes and use the image editing model ( Hong et al. , 2018 ) pre-trained on Cityscape dataset ( Cordts et al. , 2016 ) . Please find more visualization results on the anonymous website : https : //sites.google.com/view/generate-semantic-adv-example . The contributions of the proposed SemanticAdv are three-folds . First , we propose a novel semanticbased attack method to generate unrestricted adversarial examples by feature-space interpolation . Second , the proposed method is able to generate semantically-controllable perturbations due to the attribute-conditioned modeling . This allows us to analyze the robustness of a recognition system against different types of semantic attacks . Third , as a side benefit , the proposed attack exhibits high transferability and leads to a 65 % query-free black-box attack success rate on a real-world face verification platform , which outperforms the pixel-wise perturbations in attacking existing defense methods . 2 RELATED WORK . Semantic image editing . Semantic image synthesis and manipulation is a popular research topic in machine learning , graphics and vision . Thanks to recent advances in deep generative models ( Kingma & Welling , 2014 ; Goodfellow et al. , 2014a ; Oord et al. , 2016 ) and the empirical analysis of deep classification networks ( Krizhevsky et al. , 2012 ; Simonyan & Zisserman , 2014 ; Szegedy et al. , 2015 ) , past few years have witnessed tremendous breakthroughs towards high-fidelity pure image generation ( Radford et al. , 2015 ; Karras et al. , 2018 ; Brock et al. , 2019 ) , attribute-to-image generation ( Yan et al. , 2016 ; Choi et al. , 2018 ) , text-to-image generation ( Mansimov et al. , 2015 ; Reed et al. , 2016 ; Van den Oord et al. , 2016 ; Odena et al. , 2017 ; Zhang et al. , 2017 ; Johnson et al. , 2018 ) , and imageto-image translation ( Isola et al. , 2017 ; Zhu et al. , 2017 ; Liu et al. , 2017 ; Wang et al. , 2018b ; Hong et al. , 2018 ) . Adversarial examples . Generating Lp bounded adversarial perturbation has been extensively studied recently ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Xiao et al. , 2018b ) . To further explore diverse adversarial attacks and potentially help inspire defense mechanisms , it is important to generate the socalled “ unrestricted '' adversarial examples which contain unrestricted magnitude of perturbation while still preserve perceptual realism Brown et al . ( 2018 ) . Recently , Xiao et al . ( 2018c ) ; Engstrom et al . ( 2017 ) propose to spatially transform the image patches instead of adding pixel-wise perturbation , while such spatial transformation does not consider semantic information . Our proposed semanticAdv focuses on generating unrestricted perturbation with semantically meaningful patterns guided by visual attributes . Relevant to our work , Song et al . ( 2018 ) proposed to synthesize adversarial examples with an unconditional generative model . Bhattad et al . ( 2019 ) studied semantic transformation in only the color or texture space . Compared to these works , semanticAdv is able to generate adversarial examples in a controllable fashion using specific visual attributes by performing manipulation in the feature space . We further analyze the robustness of the recognition system by generating adversarial examples guided by different visual attributes . Concurrent to our work , Joshi et al . ( 2019 ) proposed to generate semantic-based attacks against a restricted binary classifier , while our attack is able to mislead the model towards arbitrary adversarial targets . They conduct the manipulation within the attribution space which is less flexible and effective than our proposed feature-space interpolation . 3 SEMANTIC ADVERSARIAL EXAMPLES . 3.1 PROBLEM DEFINITION . LetM be a machine learning model trained on a dataset D = { ( x , y ) } consisting of image-label pairs , where x ∈ RH×W×DI and y ∈ RDL denote the image and the ground-truth label , respectively . Here , H , W , DI , andDL denote the image height , image width , number of image channels , and label dimensions , respectively . For each image x , our modelM makes a prediction ŷ =M ( x ) ∈ RDL . Given a target image-label pair ( xtgt , ytgt ) and y 6= ytgt , a traditional attacker aims to synthesize adversarial examples { xadv } by adding pixel-wise perturbations to or spatially transforming the original image x such thatM ( xadv ) = ytgt . In this work , we introduce the concept of semantic attacker that aims at generating adversarial examples by adding semantically meaningful perturbation with a conditional generative model G. Compared to traditional attacker that usually produces pixel-wise perturbations , the proposed method is able to produce semantically meaningful perturbations . Semantic image editing . For simplicity , we start with the formulation where the input attribute is represented as a compact vector . This formulation can be directly extended to other input attribute formats including semantic layouts . Let c ∈ RDC be an attribute representation reflecting the semantic factors ( e.g. , expression or hair color of a portrait image ) of image x , where DC indicates the attribute dimension and ci ∈ { 0 , 1 } indicates the appearance of i-th attribute . Here , our goal is to use the conditional generator for semantic image editing . For example , given a portrait image of a girl with black hair and blonde hair as the new attribute , our generator is supposed to synthesize a new image that turns the girl ’ s hair from black to blonde . More specifically , we denote the new attribute as cnew ∈ RDC such that the synthesized image is given by xnew = G ( x , cnew ) . In the special case when there is no attribute change ( c = cnew ) , the generator simply reconstructs the input : x = G ( x , c ) . Supported by the findings mentioned in ( Bengio et al. , 2013 ; Reed et al. , 2014 ) , our synthesized image xnew should fall close to the data manifold if we constrain the change of attribute values to be sufficiently small ( e.g. , we only update one semantic attribute at a time ) . In addition , we can potentially generate many such images by linearly interpolating between the semantic embeddings of the conditional generator G using original image x and the synthesized image xnew with the augmented attribute . Attribute-space interpolation . We start with a simple solution ( detailed in Eq . 1 ) assuming the adversarial example can be found by directly interpolating in the attribute-space . Given a pair of attributes c and cnew , we introduce an interpolation parameter α ∈ ( 0 , 1 ) to generate the augmented attribute vector c∗ ∈ RDC ( see Eq . 1 ) . Given augmented attribute c∗ and original image x , we produce the synthesized image by the generator G. For our notation purpose , we also introduce a delegated function TG as a re-parametrization for the generator G. Our formulation is also supported by the empirical results on attribute-conditioned image progression ( Yan et al. , 2016 ; Radford et al. , 2015 ) that a well-trained generative model has the capability to synthesize a sequence of images with smooth attribute transitions . xadv = argminαL ( TG ( α ; x , c , cnew ) ) where TG ( α ; x , c , cnew ) = G ( x , c∗ ) and c∗ = α · c + ( 1− α ) · cnew ( 1 ) Feature-map interpolation . Alternatively , we propose to interpolate using the feature map produced by the generator G = Gdec ◦ Genc . Here , Genc is the encoder module that takes the image as input and outputs the feature map . Similarly , Gdec is the decoder module that takes the feature map as input and outputs the synthesized image . Let f∗ = Genc ( x , c ) ∈ RHF×WF×CF be the feature map of an intermediate layer in the generator , where HF , WF and CF indicate the height , width , and number of channels in the feature map . xadv = argminαL ( TG ( α ; x , c , cnew ) ) where TG ( α ; x , c , cnew ) = Gdec ( f∗ ) , f∗ = α Genc ( x , c ) + ( 1− α ) Genc ( x , cnew ) ( 2 ) Compared to attribute-space interpolation which is parameterized by a scalar , we parameterize feature-map interpolation by a tensor α ∈ RHF×WF×CF ( αh , w , k ∈ ( 0 , 1 ) , where 1 ≤ h ≤ HF , 1 ≤ w ≤ WF , and 1 ≤ k ≤ CF ) with the same shape as the feature map . Compared to linear interpolation over attribute-space , such design introduces more flexibility when interpolating between the original image and the synthesized image . Empirical results in Section 4.2 show our design is critical to the adversarial attack success rate .

Summary: The authors describe a method for adversarially modifying a given (test) example that 1) still retains the correct label on the example, but 2) causes a model to make an incorrect prediction on it. The novelty of their proposed method is that their adversarial modifications are along a provided semantic axis (e.g., changing the color of someone's skin in a face recognition task) instead of the standard $L_p$ perturbations that the existing literature has focused on (e.g., making a very small change to each individual pixel). The adversarial examples that the authors construct, experimentally, are impressive and striking. I'd especially like to acknowledge the work that the authors put in to construct an anonymous link where they showcase results from their experiments. Thank you!