SemanticAdv: Generating Adversarial Examples via Attribute-Conditional Image Editing

1 INTRODUCTION . Deep neural networks ( DNNs ) have demonstrated great successes in advancing the state-of-the-art performance of discriminative tasks ( Krizhevsky et al. , 2012 ; Goodfellow et al. , 2016 ; He et al. , 2016 ; Collobert & Weston , 2008 ; Deng et al. , 2013 ; Silver et al. , 2016 ) . However , recent research found that DNNs are vulnerable to adversarial examples which are carefully crafted instances aiming to induce arbitrary prediction errors for learning systems . Such adversarial examples containing small magnitude of perturbation have shed light on understanding and discovering potential vulnerabilities of DNNs ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Xiao et al. , 2018b ; c ; a ; 2019 ) . Most existing work focused on constructing adversarial examples by adding Lp bounded pixel-wise perturbations ( Goodfellow et al. , 2014b ) or spatially transforming the image ( Xiao et al. , 2018c ; Engstrom et al. , 2017 ) ( e.g. , in-plane rotation or out-of-plane rotation ) . Generating unrestricted perturbations with semantically meaningful patterns is an important yet under-explored field . At the same time , deep generative models have demonstrated impressive performance in learning disentangled semantic factors through data generation in an unsupervised ( Radford et al. , 2015 ; Karras et al. , 2018 ; Brock et al. , 2019 ) or weakly-supervised manner based on semantic attributes ( Yan et al. , 2016 ; Choi et al. , 2018 ) . Empirical findings in ( Yan et al. , 2016 ; Zhu et al. , 2016a ; Radford et al. , 2015 ) demonstrated that a simple linear interpolation on the learned image manifold can produce smooth visual transitions between a pair of input images . In this paper , we introduce a novel attack SemanticAdv which generates unrestricted perturbations with semantically meaningful patterns . Motivated by the findings mentioned above , we leverage an attribute-conditional image editing model ( Choi et al. , 2018 ) to synthesize adversarial examples by interpolating between source and target images in the feature-map space . Here , we focus on changing a single attribute dimension to achieve adversarial goals while keeping the generated adversarial image reasonably-looking ( e.g. , see Figure 1 ) . To validate the effectiveness of the proposed attack method , we consider two tasks , namely , face verification and landmark detection , as face recognition field has been extensively explored and the commercially used face models are relatively robust +blonde hair Adversarial Image Synthesized Image Target Image Mr. Bob Mr. BobAttribute-conditional Image Generator Identity VerificationOriginal Image Miss Alice Reconstruction via Generation Original Attribute Augmented Attribute Attribute-conditional Image Editing via Generation Feature-map Interpolation Adversarial Image Original Image Target Image SemanticAdv +pale skin Figure 1 : Left : Overview of the proposed SemanticAdv . Right : Illustration of our SemanticAdv in the real world face verification platform . Note that the confidence denotes the likelihood that two faces belong to the same person . since they require a low false positive rate . We conduct both qualitative and quantitative evaluations on CelebA dataset ( Liu et al. , 2015 ) . To demonstrate the applicability of SemanticAdv beyond face domain , we further extend SemanticAdv to generate adversarial street-view images . We treat semantic layouts as input attributes and use the image editing model ( Hong et al. , 2018 ) pre-trained on Cityscape dataset ( Cordts et al. , 2016 ) . Please find more visualization results on the anonymous website : https : //sites.google.com/view/generate-semantic-adv-example . The contributions of the proposed SemanticAdv are three-folds . First , we propose a novel semanticbased attack method to generate unrestricted adversarial examples by feature-space interpolation . Second , the proposed method is able to generate semantically-controllable perturbations due to the attribute-conditioned modeling . This allows us to analyze the robustness of a recognition system against different types of semantic attacks . Third , as a side benefit , the proposed attack exhibits high transferability and leads to a 65 % query-free black-box attack success rate on a real-world face verification platform , which outperforms the pixel-wise perturbations in attacking existing defense methods . 2 RELATED WORK . Semantic image editing . Semantic image synthesis and manipulation is a popular research topic in machine learning , graphics and vision . Thanks to recent advances in deep generative models ( Kingma & Welling , 2014 ; Goodfellow et al. , 2014a ; Oord et al. , 2016 ) and the empirical analysis of deep classification networks ( Krizhevsky et al. , 2012 ; Simonyan & Zisserman , 2014 ; Szegedy et al. , 2015 ) , past few years have witnessed tremendous breakthroughs towards high-fidelity pure image generation ( Radford et al. , 2015 ; Karras et al. , 2018 ; Brock et al. , 2019 ) , attribute-to-image generation ( Yan et al. , 2016 ; Choi et al. , 2018 ) , text-to-image generation ( Mansimov et al. , 2015 ; Reed et al. , 2016 ; Van den Oord et al. , 2016 ; Odena et al. , 2017 ; Zhang et al. , 2017 ; Johnson et al. , 2018 ) , and imageto-image translation ( Isola et al. , 2017 ; Zhu et al. , 2017 ; Liu et al. , 2017 ; Wang et al. , 2018b ; Hong et al. , 2018 ) . Adversarial examples . Generating Lp bounded adversarial perturbation has been extensively studied recently ( Szegedy et al. , 2013 ; Goodfellow et al. , 2014b ; Moosavi-Dezfooli et al. , 2016 ; Papernot et al. , 2016 ; Carlini & Wagner , 2017 ; Xiao et al. , 2018b ) . To further explore diverse adversarial attacks and potentially help inspire defense mechanisms , it is important to generate the socalled “ unrestricted '' adversarial examples which contain unrestricted magnitude of perturbation while still preserve perceptual realism Brown et al . ( 2018 ) . Recently , Xiao et al . ( 2018c ) ; Engstrom et al . ( 2017 ) propose to spatially transform the image patches instead of adding pixel-wise perturbation , while such spatial transformation does not consider semantic information . Our proposed semanticAdv focuses on generating unrestricted perturbation with semantically meaningful patterns guided by visual attributes . Relevant to our work , Song et al . ( 2018 ) proposed to synthesize adversarial examples with an unconditional generative model . Bhattad et al . ( 2019 ) studied semantic transformation in only the color or texture space . Compared to these works , semanticAdv is able to generate adversarial examples in a controllable fashion using specific visual attributes by performing manipulation in the feature space . We further analyze the robustness of the recognition system by generating adversarial examples guided by different visual attributes . Concurrent to our work , Joshi et al . ( 2019 ) proposed to generate semantic-based attacks against a restricted binary classifier , while our attack is able to mislead the model towards arbitrary adversarial targets . They conduct the manipulation within the attribution space which is less flexible and effective than our proposed feature-space interpolation . 3 SEMANTIC ADVERSARIAL EXAMPLES . 3.1 PROBLEM DEFINITION . LetM be a machine learning model trained on a dataset D = { ( x , y ) } consisting of image-label pairs , where x ∈ RH×W×DI and y ∈ RDL denote the image and the ground-truth label , respectively . Here , H , W , DI , andDL denote the image height , image width , number of image channels , and label dimensions , respectively . For each image x , our modelM makes a prediction ŷ =M ( x ) ∈ RDL . Given a target image-label pair ( xtgt , ytgt ) and y 6= ytgt , a traditional attacker aims to synthesize adversarial examples { xadv } by adding pixel-wise perturbations to or spatially transforming the original image x such thatM ( xadv ) = ytgt . In this work , we introduce the concept of semantic attacker that aims at generating adversarial examples by adding semantically meaningful perturbation with a conditional generative model G. Compared to traditional attacker that usually produces pixel-wise perturbations , the proposed method is able to produce semantically meaningful perturbations . Semantic image editing . For simplicity , we start with the formulation where the input attribute is represented as a compact vector . This formulation can be directly extended to other input attribute formats including semantic layouts . Let c ∈ RDC be an attribute representation reflecting the semantic factors ( e.g. , expression or hair color of a portrait image ) of image x , where DC indicates the attribute dimension and ci ∈ { 0 , 1 } indicates the appearance of i-th attribute . Here , our goal is to use the conditional generator for semantic image editing . For example , given a portrait image of a girl with black hair and blonde hair as the new attribute , our generator is supposed to synthesize a new image that turns the girl ’ s hair from black to blonde . More specifically , we denote the new attribute as cnew ∈ RDC such that the synthesized image is given by xnew = G ( x , cnew ) . In the special case when there is no attribute change ( c = cnew ) , the generator simply reconstructs the input : x = G ( x , c ) . Supported by the findings mentioned in ( Bengio et al. , 2013 ; Reed et al. , 2014 ) , our synthesized image xnew should fall close to the data manifold if we constrain the change of attribute values to be sufficiently small ( e.g. , we only update one semantic attribute at a time ) . In addition , we can potentially generate many such images by linearly interpolating between the semantic embeddings of the conditional generator G using original image x and the synthesized image xnew with the augmented attribute . Attribute-space interpolation . We start with a simple solution ( detailed in Eq . 1 ) assuming the adversarial example can be found by directly interpolating in the attribute-space . Given a pair of attributes c and cnew , we introduce an interpolation parameter α ∈ ( 0 , 1 ) to generate the augmented attribute vector c∗ ∈ RDC ( see Eq . 1 ) . Given augmented attribute c∗ and original image x , we produce the synthesized image by the generator G. For our notation purpose , we also introduce a delegated function TG as a re-parametrization for the generator G. Our formulation is also supported by the empirical results on attribute-conditioned image progression ( Yan et al. , 2016 ; Radford et al. , 2015 ) that a well-trained generative model has the capability to synthesize a sequence of images with smooth attribute transitions . xadv = argminαL ( TG ( α ; x , c , cnew ) ) where TG ( α ; x , c , cnew ) = G ( x , c∗ ) and c∗ = α · c + ( 1− α ) · cnew ( 1 ) Feature-map interpolation . Alternatively , we propose to interpolate using the feature map produced by the generator G = Gdec ◦ Genc . Here , Genc is the encoder module that takes the image as input and outputs the feature map . Similarly , Gdec is the decoder module that takes the feature map as input and outputs the synthesized image . Let f∗ = Genc ( x , c ) ∈ RHF×WF×CF be the feature map of an intermediate layer in the generator , where HF , WF and CF indicate the height , width , and number of channels in the feature map . xadv = argminαL ( TG ( α ; x , c , cnew ) ) where TG ( α ; x , c , cnew ) = Gdec ( f∗ ) , f∗ = α Genc ( x , c ) + ( 1− α ) Genc ( x , cnew ) ( 2 ) Compared to attribute-space interpolation which is parameterized by a scalar , we parameterize feature-map interpolation by a tensor α ∈ RHF×WF×CF ( αh , w , k ∈ ( 0 , 1 ) , where 1 ≤ h ≤ HF , 1 ≤ w ≤ WF , and 1 ≤ k ≤ CF ) with the same shape as the feature map . Compared to linear interpolation over attribute-space , such design introduces more flexibility when interpolating between the original image and the synthesized image . Empirical results in Section 4.2 show our design is critical to the adversarial attack success rate .

Summary: This paper proposes to generate "unrestricted adversarial examples" via attribute-conditional image editing. Their method, SemanticAdv, leverages disentangled semantic factors and interpolates feature-map with higher freedom than attribute-space. Their adversarial optimization objectives combine both attack effectiveness and interpolation smoothness. They conduct extensive experiments for several tasks compared with CW-attack, showing broad applicability of the proposed method.