LabelFool: A Trick in the Label Space

1 INTRODUCTION . Deep neural networks are powerful learning models that achieve state-of-the-art pattern recognition performance in classification tasks ( Krizhevsky et al. , 2012b ; LeCun et al. , 2010 ; He et al. , 2016 ) . Nevertheless , it is found that adding well-designed perturbations to original samples can make classifiers of deep neural networks fail ( Szegedy et al. , 2013 ) . These kinds of samples are called adversarial samples . Techniques for generating adversarial samples are called attackers . We think the ideal attacker should satisfy three levels of requirements . The first requirement is fooling networks which means making classifiers fail to classify an image successfully . For example , a dog image can be classified as a cat after added some well-designed perturbations . There are a number of methods for achieving a high attack rate ( Goodfellow et al. , 2015 ; Carlini & Wagner , 2017 ; Dong et al. , 2018 ) . The second requirement for the ideal attacker is the imperceptibility in the image space . This means the magnitude of perturbations in the pixel level needs to be as tiny as possible so that it is imperceptible to human eyes . For example , additive perturbations are minimized with lp norm to generate imperceptible adversarial samples ( Seyed-Mohsen et al. , 2016 ) . Extreme cases also exist where only changing one or a few pixels ( Su et al. , 2019 ; Modas et al. , 2019 ) can make classifiers fail . Moosavi-Dezfooli et al . ( 2017 ) even show the existence of universal ( image-agnostic ) perturbations . The third requirement for the ideal attacker , which is newly proposed in this paper , is the imperceptibility of the error made by the classifier in the label space . It means making the classifier to mis-classify an image as the label which is similar to its ground truth , so that people won ’ t notice the misclassification . For example , in Figure 1 , a human user will probably ignore the mis-classification if an attacker caused a “ church ” to be mis-classified as a “ monastery ” as the third attacker does . However , a human user will easily notice the mistake if an attacker caused a “ church ” to be misclassified as a “ dome ” as the second attacker does or caused an apparent perturbation in the image space as the first attacker does . In real applications , a human user will take defensive measures as soon as he notices the attack . Therefore making the whole attack process imperceptible is crucial for letting observers ’ guard down . Tiny perturbations in the image space but large perturbations in the label space can muddle through on the input terminal . But as soon as observers check on the output terminal and see the obviously-incorrect label for an input , they will realize that the classifier fail due to some attacks and take defensive measures immediately , just as Figure 1 shows . This justifies the power of attacks which also confuse people in the label space . So the imperceptibility in the label space is quite important . However , to our best knowledge , few attackers have realized this point . In this paper , we propose an untargeted-attack algorithm called LabelFool , to perturb an image to be mis-classified as the label which is similar to its ground truth , so that people won ’ t notice the misclassification . In the meantime , LabelFool also guarantees the imperceptibility in the image space as well as maintaining a high attack rate in fooling classifiers . There are two steps by which we accomplish our goal . The first step is to choose a target label which is similar to the input image ’ s ground truth . The second step is to perturb the input to be classified as this target label . The way is finding the classification boundary between the current label and the target label , and then moving the input towards this boundary until it is classified as the target label . We conduct a subjective experiment on ImageNet ( Deng et al. , 2009 ) which shows that adversarial samples generated by our method are indeed much less recognizable in the label space by human observers than other attacks . We also perform objective experiments on ImageNet to demonstrate that adversarial samples generated by LabelFool still guarantee the imperceptibility in the image space as well as maintaining a high attack rate in fooling classifiers . 2 RELATED WORK . The phenomenon that neural networks are sensitive to adversarial samples was proposed by Szegedy et al . ( 2013 ) . Since then , many researchers have studied how to generat adversarial samples . FGSM ( Goodfellow et al. , 2015 ) was proposed to maximize the classification error subject to l∞-norm based distortion constraints . CW attack ( Carlini & Wagner , 2017 ) generates adversarial samples by solving an optimization problem based on l0/l2/l∞ constraint , and l0 CW attack is the first proposed method that can cause targeted misclassification on the ImageNet dataset , meaning that we can specify the label of adversarial samples . But this designation of the target label is arbitrary . Until this paper , there has no guide about how to choose a target label such that it is difficult for a person to notice that the network has failed . Besides achieving the goal of misclassification , many researchers realize the importance of imperceptibility in the image space ( Xu et al. , 2019 ) . One-pixel attack ( Su et al. , 2019 ) and SparseFool ( Modas et al. , 2019 ) attack networks in a scenario where perturbing only one/a few pixels can make a big difference . Moosavi-Dezfooli et al . ( 2017 ) show the existence of universal image-agnostic perturbations for state-of-the-art deep neural networks . DeepFool ( Seyed-Mohsen et al. , 2016 ) seeks the minimum image-level distortion . And for generating adversarial samples , it directly moves the input sample to the nearest class in the feature space . This is the most closely related work to ours , because features extracted from classification models can reflect images ’ perceptual information and the classes which are close in the feature space are often perceptually similar . However , DeepFool approximates the multi-dimensional classification boundaries in two dimensions and this might make big errors on finding the nearest class . All these attacks generate adversarial samples by iteration and the algorithm stops as soon as an adversarial sample is born no matter what label it belongs to . This will lead to an apparent misclassification so that observers will sound the defensive alarm quickly . In this paper , we will compare our method with three attacks : FGSM , DeepFool and SparseFool to show the advantage of our method in the imperceptibility in the label space . We will also demonstrate that the performance gain in the label space is not at the expense of the loss in the image space or attack rate . 3 LABELFOOL . In this section , we will introduce our method about how to choose a target label which is undetectable by human observers and how we can perturb the input image so that the classifier assigns this specific label . The whole pipeline is shown in Figure 2 . All the symbols and notations used in this paper are summarized in Table 1 . We use the same notation i ( i = 1 , 2 , . . . ) for “ class ” and “ label ” , because “ class ” and “ label ” are interchangeable in this paper . LabelFool contains two steps . The first step is to choose a target label for the input image which is similar to its ground truth . The second step is to perturb the input image to be classified as this label . Inspired by DeepFool ( Seyed-Mohsen et al. , 2016 ) , we make modifications at the feature level . We keep moving the input towards this chosen class at the feature level until it is classified as the label we want . 3.1 CHOOSE A TARGET LABEL . The first step of our method is choosing the target label tx for an input image x . As we want the target label to be imperceptible in the label space to human observers , we need to find the most “ similar ” label to the input image ’ s ground truth lx where the most “ similar ” means the nearest in the perceptual distance metric . However , lx is usually unknown when an input image is given . So it is important to estimate the probability distribution P of an input ’ s ground truth lx , based on which , we can compute the distance between each class in the dataset and lx , then choose the nearest one as the target class . We propose a weighted distance model to achieve this goal . Before introducing the model , there are some preparations . Given two image x , y , we choose pre-trained image classification models to extract features φx , φy because these features can reflect some perceptual information . As we want to calculate the distance in the perceptual distance metric and cosine distance has been used to measure perceptual similarity in many works ( Lin et al. , 2016 ; Wang et al. , 2019 ) , we compute the distance between x and y as d ( x , y ) = 1 − cos ( φx , φy ) . After having the distance between two images , we can compute the distance between classes . Each class is a set of images . To measure the distance between two sets , we choose Hausdorff distance ( Henrikson , 1999 ) . The distance between class i and class j is denoted as Di , j . Suppose a dataset has n classes . Then , we can construct a matrix D ∈ Rn×n by calculating the distance between all pairs of classes in the dataset , and it will be used in the following probability model to provide the distance we need . After these preparations , we can start to decide the target label for an input image . As introduced before , we need to estimate the probability distribution P of the ground truth lx because we want to find the nearest label to lx which is unknown in the beginning . When an image x is put into a classifier f , state-of-the-art machine learning classifiers usually output a predicted label l̂x and a probability vector p̂ whose elements mean P ( x ∈ class i ) = p̂i . For simplicity , we suppose the elements in p̂ are sorted in the descending order . Meanwhile , p̂ can be thought as P ’ s approximation . Furthermore , we define a distance function between lx and the class i in a n-classes dataset asDi ( lx ) . In order to choose the nearest label to lx as the target label tx , we need to estimate the expectation of Di ( lx ) which is denoted as Elx∼P [ Di ( lx ) ] ( i = 1 , . . . , n ) . In general , our target function is Eq . ( 1 ) . tx = arg min i=1 , ... , n Elx∼P [ Di ( lx ) ] ( 1 ) Specifically , when p̂1 is larger than some threshold δ1 , we use Maximum Likelihood Estimation ( MLE ) ( Pfanzagl , 2011 ) which means we believe the classifier and take the predicted label l̂x as the ground truth lx , then choose the label ( except l̂x ) nearest to l̂x as the target label tx . So in this circumstance , we assume lx = l̂x and Elx∼P [ Di ( lx ) ] = Di , l̂x . Therefore , tx is tx = arg min i 6=l̂x , i=1 , ... , n Di , l̂x if p̂1 > δ1 . ( 2 ) When p̂1 is smaller than the threshold δ1 , we are not sure whether lx is equal to l̂x . Instead , we sample some labels and compute the weighted distance between each label i and these labels . We sample all labels whose probability are larger than a threshold δ2 and we use M to represent the number of sampled labels . We think the input image might belong to one of these M labels . The labels whose probability are smaller than δ2 will be abandoned because we think the input image can hardly fall into these categories . The weight and the distance is provided by the vector p̂ and matrix D respectively . So in this circumstance , as we are not sure which label is the ground truth , we want to find a target label which has the minimum expected distance with all these possible labels . Therefore , the value of Elx∼P [ Di ( lx ) ] can be approximated as ∑M j=1 p̂j ·Di , j and the target label tx is shown in Eq . ( 3 ) . This can be explained by Importance Sampling ( Owen & Zhou , 2000 ) because it is hard to sample from the real probability distribution P . We can only use the probability distribution p̂ which is an approximation of P to estimate the value of Elx∼P [ Di ( lx ) ] . tx = arg min i=1 , ... , n M∑ j=1 p̂j ·Di , j if p̂1 ≤ δ1 ( 3 ) In conclusion , the whole strategy for choosing the target label tx of an input image x is computed as Eq . ( 4 ) . The target label tx minimizes Elx∼P [ Di ( lx ) ] just as Figure 2 shows . tx = arg min i6=l̂x , i=1 , ... , n Di , l̂x if p̂1 > δ1 arg min i=1 , ... , n M∑ j=1 p̂j ·Di , j otherwise ( 4 )

Summary: This paper proposes a method to create adversarial perturbations whose target labels are similar to their ground truth. The target labels are selected using an existing perceptual similarity measure for images.  Perturbations are generated using a DeepFool-like algorithm. Human evaluation supports that the pair of the generated images and target labels are more natural to humans than prior attack algorithms.