Bounded Attacks and Robustness in Image Transform Domains
Authors: Mohamed-Hicham LEGHETTAS
Markus Püschel
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial example
white-box attack
neural networks
discrete linear transforms
DCT
JPEG
wavelet

Abstract: Classical image transformation such as the discrete cosine transform (DCT) and the discrete wavelet transforms (DWTs) provide semantically meaningful representations of images. In this paper we propose a general method for adversarial attacks in such transform domains that, in contrast to prior work, obey the $L^\infty$ constraint in the pixel domain. The key idea is to replace the standard attack based on projections with the barrier method. Experiments with DCT and DWTs produce adversarial examples that are significantly more similar to the original than with prior attacks. Further, through adversarial training we show that robustness against our attacks transfers to robustness against a broad class of common image perturbations.

Under review as a conference paper at ICLR 2023
BOUNDED ATTACKS AND ROBUSTNESS IN IMAGE TRANSFORM DOMAINS
Anonymous authors Paper under double-blind review
ABSTRACT
Classical image transformation such as the discrete cosine transform (DCT) and the discrete wavelet transforms (DWTs) provide semantically meaningful repre- sentations of images. In this paper we propose a general method for adversarial attacks in such transform domains that, in contrast to prior work, obey the d constraint in the pixel domain. The key idea is to replace the standard attack based on projections with the barrier method. Experiments with DCT and DWT's produce adversarial examples that are significantly more similar to the original than with prior attacks. Further, through adversarial training we show that robust- ness against our attacks transfers to robustness against broad class of common image perturbations.
INTRODUCTION
Adversarial attacks Biggio et al. (2013) Szegedy et al. (2014); Papernot et al. (2016a) have raised concerns about the safety and robustness of deploying neural networks in critical decision-making processes. Given neural network that makes accurate predictions clean data, these attacks modify inputs in a way indiscernible to humans to produce erroneous predictions.
Adversarial attacks can be broadly grouped into black-box and white-box Papernot et al. (016a);;
Tramer et al. (2018). White-box attacks have full access to the neural network architecture, its weights, the training data and the learning algorithm Goodfellow et al. 2015);
2 Kurakin et al.) (2017):
Papernot et al. 22); Madry et al. (2018); CCrce & Hein (2020). B Black-box attacks are only al-
lowed to perform queries the target network and observe the input-output relationship/ relationshiipNNrrddyysks Narodytskaa
& Kasiviswanathan (2017): [Bendel et al. (2017); [Su et al. (2019): Andriushhhenko et al. (2020).
Many approaches have been proposed to detect adversarial examples Xu et al. (2018); Ma et
Feinman et al. (2017); Metzen et al. (2017) and defend against them Gu & Rigazio (2014);
Papernot et al. (2016b); Liao et al. (2018); Xie et al. (2019): Zhou et al. (2021). However, most
of these defenses can again be broken by suitable adaptive attacks Tramer et al. (2020): Carlini &
Wagner (017))
Adversarial training Kurakin et al. (2017) Madry et al. (2018), seminal approach that augments the training data with adversarial examples, reveals to be effective in training empirically [Zhang et al. (2019) and provably Salman et al. 2019) robust neural networks. Another approach proposed by |Balunovic & Vechev (2019) combines adversarial training with provable defenses to boost the certified robustness. Further, the robustness of trained neural networks can be verified formally
through abstract interpretations and relaxations (Singh et al. 2019): Xu et al. (2020): Bunel et al. (200 Müller al. (2022).
Typically, the distance between a clean and a perturbed input is measured by an LP norm ular, (a pseudonorm) and e have been argued be necessary adversarial robustness metrics for images Kotyan & Vargas (202)) since they are easily interpretable: number of modified pixels and pixel-wise threshold, respectively. Further, Henddyyck & Dietterich (2019) noticed an interesting interaction between the - adversarial robustness and common image corruptions such as motion blur, shot noise, and frost. An additional argument for I and L perturbations are the closed for- mulas for projections needed in common attacks like the Projected Gradient Descent (PGD) Shafahi
In partic-
All norms in this paper vector norms, i.c., an H x W RGB image is considered as vector in R 3/W. not matnx.

---

Under review as a conference paper at ICLR 2023
et al. (2019); Wong et al. (2020); Madry al. (2018). A different set of techniques aims to perturb in semantically more meaningful ways, e.g., by inserting a carefully chosen patch into the image Thys et al. (2019) Zolfi et al. (202T); Eykholt all (2018). The high level idea of bringing image processing knowledge to the problem also motivates our contribution explained next.
Motivation and Contributions Images are not random grids of pixels but can be approximately modeled as first-order Gauss-Markov random fields, which enables JPEG compression. Concretely, when decomposed into frequencies by discrete cosine transforms (DCT) Rao & Yip (2001) at the heart of JPEG or the hierarchical discrete wavelet transforms (DWT) [aubechies]] (1992) for JPEG 2000, most of the norm concentrates around the low frequencies, which is a key characteristic of images. Prior work have used some of these transforms
defense to attenuate the additive per- turbation noise injected by adversarial attacks Das et al. (2017) Guo et al. (2018), or as a form of data augmentation Duan et al. (202T;; Hossain et al. (219)) Furthermore. perturbations in the transformed domain were used to defend against pixel attacks Bafna et al. (2018) or to carry attacks in the transformed domains Duan al. (202T); /ossain et al. (2019;; Deng & Karam (2020); [Shi et al. (2021a); Luo et al. (0022). However, these attacks did not bound the effect of the change in the pixel domain.
The goal of our work is to provide adversarial attacks in transform domains, which thus can exploit their expressiveness, while at the same time obeying the common - bounds in the pixel domain. Doing so makes the amount of change interpretable, enables comparison to prior attacks, and lever- ages the interaction with various common image corruptions [endrrycks Dietterich (2019). The challenge is in the -igeenimnns geometry, which makes it difficult to derive the projections needed PGD-based attacks and thus a different approach needed. Specifically, we contribute:
A novel white-box attack based on the barrier method from nonlinear programming that does not require any closed-form projections and can be instantiated for a large class of transforms. Our focus is on DCT and DWTs.
An evaluation of our attacks against prior work on ImageNet. In particular, given the same _ bound, we show that our attacks consistently yield adversarial examples with significantly higher similarity to the original, as verified by the Learned Perceptual Image Patch Similarity (LPIPS) metric. As baseline we also include a hand-crafted PGD-based attack for DCT's to illustrate the challenges in obtaining projections that obey L bounds.
Adversarial training using the adversarial examples produced by our attack run on Ima- geNet. We show that the obtained networks provide better robustness against common im- age corruptions on CIFAR- 10 spanning different categories including noise, blur, weather and digital corruptions.
2 THE ATTACK FORMULATION
Many image transforms have been invented to provide expressive representations of images Rao & Yipl (2001). Widely used examples include the DCT and DWTs the heart of the JPEG and JPEG 2000 compression standards Wallace (1992); Adams (2001). Both are linear and invertible and decompose an image into a notion of frequencies, which high frequencies capture details that often can be removed with little visual impact. An example is shown in Fig. [] We aim to leverage such expressive transform representations for adversarial attacks while, contrast to prior work, obeying the widely used - box defined in the pixel space. Our approach is applicable to large number of transforms; thus, we first present it in a general way before instantiating it to DCT and DWTs.
Let x E [0, 1]" be a clean image correctly classified as c by a classification model f (pixel color channel values assumed normalized to [0, 1)). is loss function, for example cross-entropy. Let é be an invertible and differentiable image transform that maps the original image from the pixel space to a domain with a desirable expressiveness. In this ø-domain, version y' of yd x(x") such that x' = & (3y') gets misclassified and || - = < in the pixel domain. y', and thus x', can be computed by solving the following constrained optimization problem:
seek find perturbed
min -1(00 subject to (1) 2211,n Sc
(1)
2

---

Under review as a conference paper at ICLR 2023
original image
DCT coetricients
DWT conmicionts at level
DWI coefricints at level
Figure I: Example of block DCT and multi-level DWT decompositions (in our work we use up to five levels) of an ImageNet sample in grayscale. In the transform domains, magnitude is encoded by darkness, with white being zero. The DCT concentrates the values each block in the top left, the DWT recursively decomposes into downscaled version of the image plus horizontal and vertical details at different levels.
In principle, this problem can be resolved by a projected gradient descent (PGD) scheme, analogous to Madry et al. (2018). This amounts to iterating over two phases:
z++1 y¹ nsign( v (()").)),
(2)
p*(2*+1,c))
(3)
Equation 2 minimizes the inverse loss function. It requires computing the gradient of the loss with respect to the imput Vy '(y"), c). taking its sign, and moving in the opposite direction with a the -box defined in the pixel space but operates in the ø- domain. The derivation of such a p is challenging since e is not L -preserri, || x² Il. * ()(x) - <(x")
step size nj. Equation projects
Given & it may be possible to hand-craft a suitable p We do this later in Section 4 for the BCT show the issues involved. However, our main contribution is an approach different from PGD that eliminates the need for such projections and is applicable to large set of transforms with minor modifications.
THE BARRIER METHOD
In this section, propose method entirely different from the PGD approach from Madry et al. (2018) to solve problem 0 based on the so-called barrier method Nocedal & Wright (2006) from nonlinear programming. In the context of adversarial attacks, the barrier method was used before by Finlay et al.] (2019) to enforce a decision boundary constraint, which fundamentally different from the box constraint in the transform domain that are targeting.
At the heart of barrier methods is the harrier function that incorporates the inequality constraints in conjunction with the objective function in way that minimizing yields solution the original problem. Formally, problem i solved as min [(o (z). c)
plog(e Sogg(e-les 11Φ (3) x Il.
y/
The formulation depends on the free parameter y which controls the balance between the loss term -I(..)) and the logarithmic term that embeds the box constraint. The log term can be seen smooth approximation of the indicator function that is = 1 if (z)) - x x0|| otherwise. serves as penalty since grows very large near the boundary of the box.
< e is fulfilled and
A straightforward approach computes the gradient that is zero for all dimensions expect the one dimension that yields the maximum absolute value. For instance, if x (-2.5, 1.5) with 1 (x=)= = 2.5 the gradient will be 7. (xx") (1, This causes slow convergence since only one dimension updated per iteration. Fig. 2a shows an illustration of the barrier function
in two dimensions. The log term -/u - log(e- - | (t) x="
IIx.) smoothly enforces the constraint
max; 10 (z); x! < e that also satisfied when (Φ (w)) xx! < for all i. Using the latter condition with the log barrier method in each dimension we obtain the formulation that we use
1
min -is (1))
log(c - 10 (v); =x(l).
(5)
3

---

Under review as a conference paper at ICLR 2023
llogg1 (xel (ell./oo (xyl))
== - [log]] [Kol] log(1 (aaD)
1.0
10
10
0.5
0.8
0.
2.6
066
04
04
0.0
02
19.8s 1088 02
10 10 0200 02
2.8
10
(a) Enforcing the constraint ||a: x. 11 Sc.
(b) Enforcing a.
x! S
c for all
Figure 2: A two dimensional illustration of the continuous functions enforcing the L box straint for = x. = (0, , I = O, and á is the identity function.
two dimensional illustration of this barrier function is shown in Fig. 2b
After this continuous relaxation of the discrete condition, our new formulation does not need further projections and can be solved by generic standard gradient descent-based optimizer. Just like the original PGD attack, there is no formal guarantee of convergence for an arbitrary classifier f. In practice, we obtained the best results using the difference of logits ratio loss function as loss ( proposed by CCroee& & Hein (2020) while being optimized by Adam Kingma & Ba (2015).
In this paper, we instantiate the barrier method for L preservvng attacks in the domains of the DCT and several DWT families, applied up to five levels. For DWTs, we leverage in addition their semantics by preserving the down-scaled version the original image in the top-left corner (see Fig. in our attacks.
4 PROJECTION APPROXIMATION FOR THE DCT
We briefly sketch the challenges deriving suitable projection operator P* in equation enable a PGD-based attack in transform domain, by doing so for the DCT. The general problem is that commonly used transforms are not -peseeriii and thus P has to derived specifically from the transform definition using high-dimensional geometry, which may even become infeasible.
Let HI be the _ box radius e defined the pixel space around a given clean image x²::
B (x e). Applying DCT preserves the volume (due to orthogonality) but rotates HH. As result, the maximal _ norm of dct(HH is substantially larger than e. Thus when projecting z1+1 in equation we have to define P* as a standard L projection (clipping) but the box we are projecting onto must have an adequate width. This radius is given by the following lemma. The proof is technical and based the definition of the DCT as linear transform whose matrix consists of cosine values. Details about the definition and the proof are in the supplements B and
2
that again that the inverse idct P (=*** .)) E IH. To this end,
Lemma 1. Let (1 2 2- 1b 2. //2 with & -1/2 sin(N + 22 3 Then
idct(Boo ( E/K)) Boo (x))))
and there is no smaller K with this property.
The situation is sketched in Fig. in two dimensions N = 2 (instead of 64 as for the JPEG standard), On the left we have y and x" in DCT- and pixel-space, respectively. A step of size rj in direction of the gradient with maximal loss is determined to obtain 2'+ On the right 2 1 is projected onto idct( (y) e/k)) to obtain y and ensure that *++1 1 is in H, which general in the interior, in contrast to the original PGD attack.
4

---

Under review as a conference paper at ICLR 2023
(3)
det((1)
chosen gradiemt
y
projection
DCT-domain
y
y
G
B 2 .ck))
idet(G)
x
Pixel space
R (x
(x
Figure 3: One iteration of PGD in DCT space. The figure serves intuition for the effect of rotations on the -nom by considering only 2 (instead of 8 8 = 64) dimensions.
EXPERIMENTAL EVALUATION
In this section, we first evaluate our attacks the DCT and DWT transform domains and compare to prior attacks. Then we investigate their for adversarial training and, in particular, the robust- ness of the obtained networks against common image corruptions. All of our code and scripts to reproduce the experiments will be made available open source.
We evaluate our attacks in Section 5.2 with images from ImageNet using a trained vision trans- former architecture Dosoviiskiy al. (2020). In Section 5.2 for adversarial training and evaluation of robustness towards common image corruptions, we used a smaller ConvNet model trained on CIFAR-10. 10. Its architecture consists of 16 convolutional layers, 5 max pooling layers, and fully connected layers. Convolutions are followed by batch normalization and ReLU activation functions. The fully connected layers are preceded by dropout layers. This architecture similar that used by Zhu al. (2021).
5.1
COMPARISON OF THE DIFFERENT ATTACKS
We compare attacks against four baselines: standard PGD, the two variants of the automatic pro- jected gradient descent attack (APGD) Croce & Hein (2020) and the square attack Andriushchenko al. (2020). All attacks have the same budget of k 100 iterations. The step size the standard PGD attack is set to () x Zr The other attacks we invoke as implemented in the AutoAttack suit Croce Hein (202)) We discuss the instantiation and the parameterization of our attacks more
detail next.
Instantiation of our attacks Our barrier attack from Section 3 is instantiated for the DCT in a way compatible with JPEG compression pipeline, and called det barrier. This means, first perform a color conversion from RGB to YCrCH before the DCT is applied block-wise on 8 x blocks.
Similarly,
is the instantiation of our attack compatible with JPEG-2000, where consider two types of wavelets: with levels. Unless noted otherwise, the default is CDF 9/7 with one level. The parameter μ in equation
(CDF) 9/7 and LeGall 5/3, applied
5 is initially set to μ 10/n n (n is the dimension of the image) and is doubled further strengthen the log term if the constraint is violated or having an underflow problem. We minimize the barrier functions with the Adam optimizer Kingma & Ba (2015) with an initial step size rate of 0.01 and the default beta parameters of (0.9, 0.999).
The conversion from RGB to YCrCbA is pixel-wise affine transformation. Further details can be found in the supplement Al

---

Under review as a conference paper at ICLR 2023
Buseline
barrier barrier
barrier
6:02
1,5902
0.1822
0.107
0.1917
0.1986
4.3551
5,13
6,209
similaity distance
0.0013
0.0001
0,002
0.0265
0.0175
0.0568
0.400
Maccoo male (8)
7.30
28.77
10.17
99.9
0.044
2,1926
0,5422
5,4517
similantty
0,0122
77.11
0.0078
0.083
0.8111
0.0937
2,4656
similmity
0.1639
0.1533
0.151
0.1672
7,7755
6.2671
5.3749
5,3982
20,0369
40.1665
60.5106
similarity distaanc
0,5069
0,0739
0.0558
0,0582
0.5327
0,6375
0.3498
0,5161
100.0
100.0
100.0
100,0
100.0
120
0.3055
0,2288
0.3367
0.2244
0.2237
0.3
0.2522
0,2522
0.2522
1.2
9,3083
9,1894
7.5644
7.9484
7,8962
28.3351
59,088
66.9566
$8,0085
similanty distance
0.0628
0,1352
0.1072
0.1104
0.1101
0,4717
0,8381
0.92
0,6805
100.0
100.0
99.5
100.0
100.0
100.0
100.0
100.0
100.0
Table 1: Evaluation of our four proposed attacks alongside with five baseline attacks for multiple 0 box radii 6. We show the average 1, and T,2 norm of the retrieved adversarial examples, the success rate of the attacks and the similarity distance that these adversarial images have with respect to the clean images using the LPIPS metric (lower values mean better similarity). The success rate over 1000 test images randomly sampled from ImageNet, and the distance metrics are means.
det pod
dct barrier dat (CDF 9/7) del (Gell5/3)
ped
apodice
apgd-dir
Squaro
original
Figure 4: An illustration of different adversarial examples found by our proposed attacks compared the baseline all rum with - box radius value of 0.3. Each row of adversarial images is followed by row of heatmaps representing the pixelwise difference w.r.t the corresponding clean image the first column. In these, white and black
Our PGD-based attack presented from Section is called det dct_ppgd. The standard PGD attack uses step size parameter 7 the size of the box multiplied by 5_ Taking into account our shrinkage factor of induced by the DCT (Lemma 1) and a second scaling factor p = 2.772, caused by the color conversion from RGB YCbCr, we choose 7) 5e/ 62/(2p))).

---

Under review as a conference paper at ICLR 2023
(ooa])
[ptee]
Allack
Adaic Syp
MML Ligggg
Ri,, pop
dit, banter
thet, bamert
Citt Jarroor
chet, Jarrer
dirt Carnec_
thet barwer
dirt, carrec
sppoles
sppol os
Pall
not
0.055
0.000
0.1
6.1
Simiorly distance (UP
Sinlartty dislane (PPP3)
Figure 5: Visualization of a part of the results presented Table | The two plots correspond to a largeted 2 box of radius 0.03. The success rate is encoded with the marker size.
Results We ran all the mentioned attacks sample of 1000 correctly classified test images and show the mean of the results in Table [T] For three randomly selected images, we provide a visualization of the adversarial examples and their difference to the original in Fig. 4 In addition, we plot subset of this tables's entries that correspond to e = 0.03 in Fig. 1..5 to show the interplay of -bond, LPIPS similarity distance, and attack success rate.
From Fig. we notice visually that the adversarial examples found are significantly less modified compared to those reported by the pixel-based attacks, even when targeting relatively large 7 box radii, while still using almost the full slack provided by the bound. Table confirms this higher visual similarity by a consistently higher similarity in the LPIPS metric across all experiments. The trade-off for this higher similarity is in lower success rate for very small e, whereas the prior benchmarks almost always succeed. For example, for the DCT, run for 0.03, it drops to about 75%. For the DWT with one level it is then only 39%, which is likely due to us freezing the scaled- down version of the original image in the top left corner (see Fig. D. which effectively freezes one quarter of all DWT values. Indeed for decompositions with more levels the success increases significantly to 69% cdwt_barrier__ substantially small similarities distance in contrast the attacks operating in the pixel domain. For the even smaller = 0.02, the trend to lower success rates continues. Thus, for very small our DCT and DWT attacks are not suited.
and 77%
while still maintaining
We remark that the adversarial examples retrieved by the dct_pgd have, on average, an I norm smaller than the radius of the targeted box. In other words, these attacks, in most cases, do not necessarily reach the boundary of the box, unlike pgd which always ends up at this extreme. This phenomenon is most likely due the rotation caused by DCT which leads the elimination of part of the search space that we conjecture contains more noisy images on which the pgd attack lands.
Analysis of the barrier-based attack against PGD As we have seen above, the barrier-basel attacks usually do not reach the boundary of the -bx. To analyze this behaviour, we also imple- mented barrier-based attack in the pixel domain, called barrier. We performed an experiment tracking the evolution of the I norm, and also the I/2 norm, of the explored images throughout the iterations the barrier and the pgd attacks targeting an - box of radius 0.2. The results are shown in Fig. 6 The pgd attack is likely to reach the loc box boundary in the first few itera- tions due to the frequent projections on the boundary. The barrier method, in contrast reaches the boundary only slowly due to the logarithmic term and usually not entirely. This term encourages the attack to explore the vicinity of the original image before moving away towards the boundary. The comparison of the 7.2 norms show that the overall noise introduced by the barrier method is smaller.

---

Under review as a conference paper at ICLR 2023
0.20
pgd Barrier
pgd
0.15
5
0.10
0.05
2
0.00
10
20
30
attack Iterations
attack Iterations
Figure 6: Comparison between our barrier attack and the standard pgd by tracking the evolution of the norm value through the iterations.
5.2 ADVERSARIAL TRAINING
The high similarity of the adversarial examples produced by our attacks motivates their use as prox- ies to achieve robustness against yet another class of image perturbations that also preserves visual similarity: common image corruptions. To this end, we use our attacks for adversarial training (AT), technique which the neural network is trained on adversarial examples aiming to increase ro- bustness against this adversary. We train for robustness against two adversaries; the standard PGD and our DCT-based attack. We choose to focus on the dct dct_pgd variant given its identical compu- tational cost to the standard PGD. Both attacks are granted the same number of iterations k = 30 with step sizes identical to those discussed in Section [5.] For each adversary, we perform ad- versarial training targeting three 0 box radii. This means that in total six ConvNets (of the same architecture outlined earlier) are shown in Table
Adversarial robustness First, we report the natural accuracy of these networks. Then, we eval- uate their robustness against the corresponding adaptive attack that is used for training and their robustness against the other attack. The results Table 2 show that the neural networks trained with PGD in the RGB space (standard AT) have significantly lower natural accuracy, in contrast to the networks trained with our attack in the DCT space (AT with DCT). For large values of e, the accuracy of standard adversarial training remains low around 10 %. which is indistinguishable to random predictions given that the dataset contains 10 classes. contrast, our adversarial training largely preserves the natural accuracy. We notice that the robustness against the DCT attack does not imply robustness against the PGD attack.
Adversarial robustness transferability towards common image corruptions We consider the CIFAR-10-C Gataset[Hendryee & Dietterich 2019), benchmark constructed by applying common image corruptions to the CIFAR-10 test set. These corruptions are only used for evaluation and not to augment the data during training. There is near perfect correlation between the adversarial accuracy in the DCT space and the accuracy associated with these corruptions. evaluating neural network using attack offers good approximation of the accuracy against variety common image corruptions. More importantly, the results shown in Table 2 show that the adversarial robustness against our proposed DCT-based attacks transfers. Neural networks trained using our DCT-based attacks are found to always be more robust to common image corruptions across all categories noise, blur, weather and digital. This means the expressiveness of the DCT representation is well-suited to increase robustness against these corruptions.
other words,
6 RELATED WORK
We provide more details prior work robustness related to discrete image transforms. Most aimed at defending against pixel-based adversarial attacks or improving the generalization neu- ral networks towards common image comuptions. The work of Dziugaite et al. (2016); Das et al.
8

---

Under review as a conference paper at ICLR 2023
Adversarial
Noise
Weather
Digitl
RGB
DCT Gouss Shot Impuise Defocus Gauss Motion Zoom
Snow Fost Fog Bright Contrast Elastic Pixel JPEG
0:00
Standard AT
39
62
58
57
43
62
AT with DCT (ours)
85
80
77
79
73
77
73
70
74
78
78
70
83
55
76
81
83
0.1 Standard AT
20
24
25
24
26
26
24
23
23
22
26
AT with DCT (ours)
80
70
79
79
76
74
72
68
72
74
71
59
76
47
72
78
79
Standard AT
10
10
10
10
10
10
10
10
10
AT with DCT (ours)
76
62
76
76
75
71
69
66
68
70
65
51
72
41
68
74
75
Table 2: A summary of the accuracies of different neural networks trained with either the standard PGD (standard AT) our DCT attack (AT with DCT) for multiple box radii.
2017]: Guo et al. (2018) aims to filter out noise from the adversarial examples by adjusting var- tous quality factor values during JPEG compression/deccopresiii
which amounts reducing the magnitude of the DCT coefficients. Closely related. [Bafna et al. (2018) sought L" robustness through projecting the largest DCT coefficients. These defenses has been shown be breakable through adaptive attacks |Shin & Song (2017): [Tramer et al. (2020), specifically, by approximating the non-differentiable rounding operator the JPEG compression and running a gradient-based at- tack. Other fast and iterative rounding schemes have been proposed in [Shi et al. (2021b). Yin et al.) 2019 :
Guo et al. 2019) considers L perturbations that preserve norms due to orthogonality of the used transforms, discrete Fourier transform (DFT) and DCT respectively.
The work in Duan et al. (2021) generates adversarial examples by removing information in the DCT domain. The - box used is on the JPEG quantization matrix instead of the input image. Since the DCT coefficients of the clean image are element-wise divided by this matrix before rounding, larger box radii allow their technique eliminate more frequencies from the image. In the same direction, Hossain et al.] (2019) preceded the neural network by a DCT based layer that randomly crops some DCT coefficintss during training. This can be interpreted as an extension of the dropout technique aiming at its regularization effects. YYahya et al.) (2020) propose a gradient-fri -rreettt-feeeeeee method that obtains adversarial examples by mixing the frequencies of a clean image with the frequencies of another auxiliary image that they call watermark. In addition to FFT and DCT, they make use two wavelets: Haar and Daubechies 3. [Sharma et al. (2019) applies masks to selectively perturb low and high frequencies. Much like Deng & Karam 2020); Shi et al. (2021a), all these works do not provide any guarantee on the bounds the pixel space, which is the primary contribution in our work.
Luo et al. (202)) explicitly uses a similarity distance in the optimization problem formulation in the pursuit of semantically similar adversarial examples. In work, only enforce an - box and still achieve a high semantic similarity that is not explicitly used in the optimization. FFinaay et al. (2019) invokes the barrier function the loss while minimizing the norm in manner similar to Carlini & Wagner (2017) without accounting for the box.
Finally, the work in Gueguen al. (2018); dos Santos & Almeida (2021) proposed neural network architectures that operate directly on the JPEG format to avoid decompression before classification. Our work could be used study the robustness of such architectures.
CONCLUSION
We proposed the first method to adversarially attack image elassification networks in transform domains while observing an T,0--ound in the pixel domain. Our approach is based on the barrier method, which eliminates the need for projections and can thus be easily instantiated for a large class of transforms, linear and beyond. The results with DCT and DWTs show the relevance of our attacks: we obtain adversarial examples that are more similar to the original than prior work. Further, when used for training, the obtained robustness transfers to common image perturbations, which demonstrates the expressiveness of the considered transforms. We see our contribution as a step towards leveraging decades of research on image representations for better robustness.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Michael D. Adams. The jpeg-2000 still image compression standard, 2001.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square at- tack: a query-efficieet black-box adversarial attack via random search. In European Conference on Computer Vision, pp. 484-501. Springer, 2020.
Mitali Bafna, Jack Murtagh, and Nikhil Vyas. Thwarting adversarial examples: An L0-robust sparse fourier transform. Advances in Neural Information Processing Systems, 31, 2018.
Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2019.
Battista Biggio, Igino Corona, Davide Maiorea, Blaine Nelson, Nedim Smndić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Joint European conference on machine learning and knowledge discovery databases, pp. 387-402. Springer, 2013.
Wieland Brendel, Jonas Rauber, and Matthias Bethge. Decision- based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv preprint arXiv:1712.04244 2017.
Rudy R Bunel, Oliver Hinder, Srinadh Bhojanapalli, and Krishnamurthy Dvijotham. An stagewise convex optimization problems. In
efficient nonconvex reformulation H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.). Advances in Neural Information Processing Systems, volume 33, pp. ciates, Inc., 2020. URL https: hattps::/pproceedinggg wwwpediiiinnneuussssseee.... nwwrinnuiis... wttp:e/ppppp/////EE.... 5d97f4dd 44 4b2 (ww000099999611109966eeee. Papeeeee000eeeeeeeeee.epee pdff
Curran Asso-
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium Security and Privacy (SP), pp. 39-57, 2017. doi: 10.1 10.1109//P.0017.99
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fiee attacks. In ICML, 2020.
Nilaksh Das, Madhuri Shanbhogue, Shang-Tse Chen, Fred Hohman, Li Chen, Michael E Kounavis, and Duen Horng Chau. Keeping the bad guys out: Protecting and vaccinating deep learning with ipeg compression. arXiv preprint arXiv: 17Xv:1705.02900 2017.
Ingrid Daubechies. Ten Lectures on Wavelets. Society for Industrial and Applied Mathematics, USA, 1992. ISBN 0898712742.
Yingpeng Deng and Lina J. Karam. Frequency-tuned universal adversarial perturbations. In Adrien Bartoli and Andrea Fusiello (eds.), Computer Vision ECCV 2020 Workshops, pp. 494-510, Cham, 2020. Springer International Publishing. ISBN 978-3-030-68238-5,
Samuel Felipe dos Santos and Jurandy Almeida. Less is more: Accelerating faster neural networks straight from jpeg. In Iberoamerican Congress on Pattern Recognition, pp. 237-247, Springer, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at seale. arXiv preprint arXiv:2010.11922 11999 2020.
Ranjie Duan, Yuefeng Chen, Dantong Niu, Yun Yang, A Kai Qin, and Yuan He. Advdrop: Ad- versarial attack dnns by dropping information. Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 7506-7515, 2021.
Gintare Karolina Dziugaite, Zoubin Ghahramani, and Daniel M Roy. A study of the effect of jpg compression adversarial images. arXiv preprint arXiv:1608 00850, 2016.
10

---

Under review as a conference paper at ICLR 2023
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 1625-1634, 2018.
Reuben Feinman, Ryan R. Curtin, Saurabh Shintre, and Andrew B. Gardner. Detecting adversarial samples from artifacts. In International Conference on Machine Learning, 2017.
Chris Finlay, Aram-Alexandre Pooladian, and Adam Oberman. The logbarrier adversarial attack: Making effective use of decision boundary information. In 2019 IEEE/CVF International Con- ference on Computer Vision (ICCV), pp. 4861-4869, 2019, doi: 10. 119/11CC
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In Yoshua Bengio and Yann LeCun (eds.). 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL http: arxia. http://axxvvvv..///a/// / 1412 21112.6.77722
Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples, arXiv preprint arXiv:1412.5006 2014.
Lionel Gueguen, Alex Sergeev, Ben Kadlec, Rosanne Liu, and Jason Yosinski. Faster neural net- works straight from jpeg. Advances in Neural Information Processing Systems, 31, 2018.
Chuan Guo. Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using imput transformations. In International Conference on Learning Representations, 2018. URL
net. Set.tt/oooooumaaaSSS/CCCCC.
Chuan Guo, Jared S. Frank, and Kilian Q. Weinberger. Low frequency adversarial perturba- tion. In Amir Globerson and Ricardo Silva (eds.), Proceedings of the Thirty-Fifhh Conference on Uncertainty in Artificial Intelligence, UAI 2019, Tel Aviv, Israel, July 22-25, 2019, volume 115 of Proceedings of Machine Learning Research, pp. 1127-1137. AUAI Press, 2019. URL http::/prroceeding: mllr www...pees/..1.///eee..
html
Dan Hendrycks and Thomas Dietterich. Benchmarking neural network robustness to common cor- ruptions and perturbations. In International Conference on Learning Representations, 2019, URL
https:://pperevill
net ForumiiddlUJ2ticco
Md Tahmid Hossain, Shyh Wei Teng, Dengsheng Zhang, Suryani Lim, and Guojun Lu. Distor- tion robust image classification using deep convolutional neural network with discrete cosine transform. In 2019 IEEE International Conference Image Processing, ICIP 2019, Taipei, Tai- wan, September 22- 2019, pp. 659 663. IEEE, 2019. doi: 10.1109/C1122219.8833
URL
https: /ttp::://do...o or wrgg/rg///oo /10 109 ICIP 201 9. 8803787
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference on Learning Representations, ICLR 2015, San Diego CA, USA, May 7-9, 2015, Conference Track Proceedings. 2015. h //arxiv. /41.. 6980
Shashank Kotyan and Danilo Vargas. Adversarial robustness assessment: Why both l_0 and 1_ oo attacks are necessary. PLOS ONE, 17:e0265723, 04 2022. doi: 10. 1.177//jomall..om.226577777 026.575.......
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. 2017. URL htttp:://pppeeeeeeees net. net http://enneeeeeeeeeeerrrrrrrramp
forum? Bat.rrummmddBBm44444AA.
Fangzhou Liao, Ming Liang. Yinpeng Dong. Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1778-1787, 2018
Cheng Luo, Qinliang Lin, Weicheng Xie, Bizhu Wu, Jinheng Xie, and Linlin Shen. Frequency- driven imperceptible adversarial attack on semantic similarity. In Proceedings of the IEÉE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022.

---

Under review as a conference paper at ICLR 2023
Xingjun Ma, Bo Li, Yisen Wang. Sarah M. Erfani, Sudanthi N. R. Wijewickrema, Michael E. Houle, Grant Schoenebeck, Dawn Song, and James Bailey, Characterizing adversarial subspaces using local intrinsic dimensionality. CoRR, abs/1801.02613, 2018. URL http://azxiv.ort
abb//801. 02613
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant adversarial attacks. In International Conference on Learn- ing Representations, 2018. URL httptttst///oereeeeeees
Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations. ICLR, 2017.
Mark Niklas Müller, Gleb Makarchuk, Gagandeep Singh, Markus Püschel, and Martin Vechev. Prima: General and precise neural network certification via scalable convex hull approximations. Proc. ACM Program. Lang., 6(POPL), jan 2022. doi: 10. 10.1145/3498704. URL URL //tps://ooo.
Btq//0..114/3449877
Nina Narodytska and Shiva Kasiviswanathan. Simple black-box adversarial attacks on deep neural networks. pp. 1310-1318, 2017. doi: 10.110//VVP...2117..12
Jorge Nocedal and Stephen Wright. Numerical Optimization. Springer, New York, NY, USA, 2e edition, 2006.
Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European sympo- sium on security and privacy (EuroS&P P), pp. 372-387. IEEE, 2016a.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pp. 382-597. IEEE, 2016b.
K. R. Rao and C. Yip. The Transform and Data Compression Handbook. CRC Press, 2001.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang. Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classi- fiers. H. Wallach, H. Larochelle, A. Beygelzimer, d'Alché-Bue, E. Fox, and Gar- nett (eds.), Advances in Neural Information Processing Systems, volume 32. Curran Asso- ciates, Inc., 2019, URL httts:: /tttp:::/proceednngsseeeee httpp/ppss..pppprr///////// 3a24b25a 7b0.2aaabb00a252555 612226661l80 641 221222222222661111111666-------0
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Ad- vances in Neural Information Processing Systems, 32, 2019.
Yash Sharma, Weiguang Ding, and Mareus Brubaker. On the effectiveness of low frequency pertur- bations. pp. 3389-3396, 08 2019. doi: 10.24966//jecai2211/4477
Mengte Shi, Sheng Li, Zhaoxia Yin, Xinpeng Zhang, and Zhenxing Qian. On generating ipeg adversarial images. In 2021 IEEE International Conference on Multimedia and Expo (ICME), 2TT.:/EE5222...22..99292
pp. 1-6, 2021a. doi: 10.
Mengte Shi, Sheng Li, Zhaoxia Yin, Xinpeng Zhang, and Zhenxing Qian. On generating jpeg adversarial images. In 2021 IEEE International Conference on Multimedia and Expo (ICME), pp. 1-6. IEEE, 2021b.
Richard Shin and Dawn Song. Jpeg-resistant adversarial images. In NIPS 2017 Workshop Ma- chine Learning and Computer Security, volume 1, 2017.
Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev. An abstract domain for certi- fying neural networks. Proc. ACM Program. Lang., 3(POPL), jan 2019. doi: 10. 10.1145/3290354,
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828 841, 2019.
12

---

Under review as a conference paper at ICLR 2023
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. January 2014. 2nd International Conference on Learning Representations, ICLR 2014 Conference date: 14-04-2014 Through 16-04-2014.
Simen Thys, Wiehe Van Ranst, and Toon Goedeme. Fooling automated surveillance cameras: Ad- versarial patches to attack person detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, June 2019.
Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. CoRR, abs/2002.08347,, 2020. URL httpps://axxii.....////
foos/202.000 08347
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Confer- ence on Learning Representations, 2018. URL
net form??dr
rk2vSe-RZ
G.K. Wallace. The jpeg still picture compression standard. IEEE Transactions on Consumer Elec- tronics, -xvxxxxviiix 1992. doi: 10.1 0099/30.125722
Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020. URL BRLLitttpp://peeeeiies
net /
Cihang Xie, Yuxin Wu, Laurens van der Maaten, Alan Yuille, and Kaiming He. Feature denoising for improving adversarial robustness. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 501-509, 2019.
Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsich. Automatic perturbation analysis for scalable certified robustness and beyond. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 1129-1141. Curran Asso- ciates, Inc., 2020. URL htttts::/pproceedingg..oo newrips....ppp...p wwwppipp.pppppp..ppeeeepepe pttpsccapaape//22//22222 (0cbc567le 7ee6671126666 6 1767776777777 78 www.o91111e8fffo. Papee. pdf
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: in deep neural networks. In 25th Annual Network and Distributed System Security Sympo- sium, NDSS 2018, San Diego California, USA, February 18-21, 2018. The Internet Soci-
Detecting adversarial examples
ety, 2018. URL htRthtt:://// //wp. wwt.::..neetttniiiiim.mmmmmm Internetsociety.. baccy.org/nng wwg//ddas wwwpg//da///pccoeeeeeee wwp-cootent/uplloatt 2sttss2552018/022
03A- 1_10_______ ht__appr.ppae
Zakia Yahya, Muhammad Hassan, Shahzad Younis, and Muhammad Shafique. Probabilistic analysis of targeted attacks using transfomm- adversarial examples. IEEE Access, 8:33855-33869, 2020. doi: 10. D0.1099AACESSS2220..0000
Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier per- spective model robustness in computer vision. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Bue Buc, E. Fox, and R. Gareett (eds.), Advances in Neural Information Processing Sys- tems, volume 32. Curran Associates, Inc., 2019. URL https: http::::s//p/coceeienggee neurips. pdd
7 0
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Kamalika Chaudhuri and Ruslan Salakhutdinov (eds.), Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Muchine Leurning Research, pp. 7472-7482. PMLR, 09-15 Jun 2019. URL htttt:::///pooceedinge
wwr...smm.r...m press vttesss/9//haagg9...r
Dawei Zhou, Tongliang Liu, Bo Han, Nannan Wang, Chunlei Peng, and Xinbo Gao. Towards defending against adversarial examples via tntack-invarialt features. In International Conference Machine Learning, pp. 12835-12844 PMLR, 2021.
13

---

Under review as a conference paper at ICLR 2023
Chen Zhu, Renkun Ni, Zheng Xu, Kezhi Kong, W Ronny Huang, and Tom Goldstein. Gradinit: Learning to initialize neural networks for stable and efficient training. Advances in Neural Infor- mation Processing Systems, 34, 2021.
Alon Zolfi, Moshe Kravchik, Yuval Elovici, and Asaf Shabtai. The translucent patch: physical and universal attack on object detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.
June 2021.
A COLOR CONVERSION
YCbCr a color system where each pixel is represented by three values: the brightness Y and a pair encoding the of color spectrum CbCr. Let the RGB triplet of pixel in the position (i,j). Then d, YCbCr values at this same pixel, are given by d c + b, where
0.299
0.587
0.114
0
0.1687
-0.3312
0.5
and b
128 255 128/2553
0.5
-0.4186
-0.0813/
B THE DEFINITION DCT
Let X be 2D block of an image of size N N. The DCT transform of X is matrix Yof size N x N where the coefficient at the position (p, q) is given by:
N-1
N-1
Y
apaq
X Cos
(2i + 1)PT
Cos
(2j + 1)qT
ag = 1 and V2, <
N
2NV
2N
1=
1=0
(6)
C PROOF OF LEMMA
Proof. Let æ and x' be two pixel images in some color system. and x' are subdivided into blocks X and X" of size N x N. Y and Y' are the DCT block coefficients of X and X', respectively. Y and Y' are blocks of the DCT transforms
dct(x:) and y = dct(x'). It is clear that if y' (x, e') then Y' Boo (Y,c') Now, let find the smallest c" such as X' B (x, c").
[ X'yl=
1 N
Σ
Σ
apa
kngg cos
(2i + 1)pT
cos
(2j 1)gT
2N
2N
N
N-1
(2i + 1)PT
(2) + 1)qT
ag
Y
Y
cos
cos
N
2N
2N
N-1N N-1
N
prt
QT
Cos
COS
N
2N
2N
prT
q
Og
COS
COS
2N
2N
P=0
0
N-1
N- N-1
p
pn
agay COS
+
ag
cOS
+
Opprg
COS
N
2N
2N
2N
2N
E'
1 2
cos
+2
2
N
Σ
COS
DT
é'
(1+2 2+22// + 24²²
=6'
N
2N
2N
pm
14

---

Under review as a conference paper at ICLR 2023
Now, let's simplify v E N-1
pt COS
2N
[N+1)e
2N
1
e
e
p=0 0
e e (N-1))
(N+
e' e -i
2i sin (N+1))
= =(cos
cos
π
+ issi
4N
4
2i sin
sin (N+1)) cos
sin (N+1))
4N
i sin
X
4N
4
sin 4N
4
sin 4N
2008 sin (N+
sin [N+1)) 4N
4NV
isn
x 2sin
4
sin π
IN
4N
sin(N 2) T
+ sin
sin (N- 1)x
+
isin
2sin 4N
sin IN
1
sin(N 1) T
sin (N+1))m
+
2N
+ isin
X
4N
2
2sin
4
sin AN
whence
N-1
N
1
COS
px
Real
Σ p=0
c
IN
2N
p=1
sin
N 2)
sin 1N
So we have found e" ="=él c'K. To show that this the smallest e" (and thus smallest x) with this property, suffices to set Y' at a corner of the hypercube, for instance Y = Ynn - for all p and q. Then we follow this same derivation that gives equalities instead of inequalities.
Finally, since (d (Y, e')) S Bx (X, c'K) holds for all the corresponding blocks Y and X, this property also holds for the totality of the image and its transforms y: id S Bo (x, d)).
15


Reviews:
[{"review_id": "hxWU8y1PPap", "reviewer": "Reviewer_LwcG", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper tackles the problem of generating adversarial images in the image transformation domain. In particular the authors are interested in the transformations used in JPEG compressions: discrete cosine transform (DCT) and discrete wavelet transforms (DWTs). While doing so, they still maintain the usual condition used in adversarial image generation which is to bound the perturbation in an L-inf domain. This is not straight forward in the transform domain as the norms do not translate directly. Thus the authors develop a barrier method to mitigate the issue. The authors then run experiments on the imagenet dataset to show the effectiveness of the proposed approach. The results show that even though the success rate of the barrier method can be lower than the other baselines in particular for lower epsilon bounds, the generate adversarial images are more similar to the original image.", "summary_of_the_review": "The authors provide a novel way to generate adversarial images in the transform domain while still being inside L-inf bounding boxes. The results show that the generated adversarial images are more similar to the original images when compared to attacks on the pixel space. However, my main concern about this paper is the use case. If similarity is something that the authors care the most about then the bounding box should also be on the inverse of this similarity score. This takes away hugely from the contribution of this work in my opinion.", "strength_and_weaknesses": "Strengths\n1. The authors propose the barrier method which allows image perturbations to take place in the transform space while still being in the L-inf bounding box. This approach allows the authors to generate such perturbations for both DCT and DWTs.\n2. Experimental results show that even though the success rate of the proposed method is lower than regular attacks (in particular for smaller epsilon values), the generated images are more visually similar to the original unperturbed images.\n3. The authors also show that generate perturbed images can be useful for adversarial training as well.\n\n\nWeaknesses\n1. The generated adversarial images are very similar to the original ones. Furthermore, we see that actual L-inf norms are much smaller than the epsilon boundary. Given this is the case, my question is why do we bother with L-inf bounding box for the barrier methods? Shouldn't dct_pgd be enough when we only care about similarity? Given that there are multiple works that show that L-p bounds are not representative of similarity, I am unsure of the purpose of using it in the barrier method.   \n2. As mentioned in the last point, there are multiple works that show L-p norms are not good in terms of visual similarity. The authors might consider citing such works. Furthermore, as the goal is similarity matching the authors might want to consider works that try to keep the visual similarity in mind when comparing.\n3. Table 1 caption reads: \"Evaluation of our four proposed attacks alongside with five baseline attacks for...\". But in the table, dct_pgd is listed under \"Our attacks\". This should be part of the baselines if I am not mistaken? Also there is no mention of dct_pgd before this table.\n4. Table 2 compares dct_barrier only against standard pgd. This is a weak comparison in particular given the absence of dct_pgd as a baseline here. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "Not applicable"}, "extra_text": {}}, {"review_id": "_v35WuYiKv", "reviewer": "Reviewer_GeiG", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper introduces an l-infinity norm bounded adversarial attack that operates in some transformation space rather than input space. In particular, the authors use the discrete cosine transform (DCT) or the discrete wavelet transform (DWT) to map from the input space to the corresponding domain, solve for the perturbed example in this domain, and map this perturbed example back to the original input space via the inverse transform such that the l-infinity norm constraint is satisfied in the original input space. The authors show that the resulting perturbed image (in the original input space) is closer in distance (according to L2 and LPIPS metrics) to the original image than the perturbed image found using projected gradient descent (PGD) given the same l-infinity norm constraints. The authors provide two different methods for constructing the attack in this manner, one based on PGD and one based on the barrier method. The authors compare their proposed attacks to existing attack methods on a standard trained ImageNet classifier in terms of distance from the original image, and show the results of adversarial training using the DCT PGD-based attack method. ", "summary_of_the_review": "I am leaning towards reject because the motivation for using the proposed attack methods is unclear to me, given that these methods do not seriously compete with standard PGD in terms of attack strength for the typical choice of epsilon. The evaluations of the proposed methods (for both attacking a trained model, and adversarially training a model), could also be more extensive to support the paper's claims, such as the stated improvement on common corruptions. ", "strength_and_weaknesses": "Strengths\n- The authors show that their proposed attacks result in perturbed images that are closer to the original image while still resulting in high attack success rate for large values of epsilon (radius of the l-infinity norm constraint). \n- The paper is fairly straightforward to read, and includes helpful visualizations. \n- The proposed method is potentially generalizable to other types of transformations. \n\nWeaknesses\n- The motivation for the paper is not made very clear, as in why this formulation of attack would be preferable to standard PGD. The introduction could be reworked to better incorporate this motivation, as the beginning of the introduction is mostly just a summary of adversarial robustness, much of which could be moved to the related work section. \n- Evaluating the different attacks (Table 1) may be more interesting when comparing on an adversarially trained model. The attack success rate for the proposed attacks is also significantly lower than existing attacks for the standard choice of epsilon (0.03). \n- The adversarial accuracy seems rather low for standard adversarial training in Table 2? Reporting the average common corruptions accuracy in this table would also be beneficial. The model adversarially trained with the DCT PGD-based method is not robust to standard PGD attacks -- again the motivation for using the proposed approach is not totally clear to me here if still considering the same threat model as standard PGD. The paper also makes the claim that the use of DCT in the proposed attack is what results in improved common corruptions accuracy for the model adversarially trained with DCT, however, it seems likely that the improved common corruptions accuracy is just due to the natural/standard accuracy being much higher for this model as compared to the standard adversarially trained model. To make this claim, it’d be useful to compare to a standard non-adversarially trained model.  \n- It's unclear to me how generalizable this is to other types of transformations given the projection approximation required. \n\nAdditional comments/suggestions:\n- The readability may be improved if sections 2 and 4 are rearranged to be sequential. \n- Table 1 is a little small.\n- Make use of parenthetical citations (\\citep) when appropriate for better readability.\n- The use of the variable y as the transformed input throughout (i.e. in Equation 1) is somewhat confusing due to the usual choice of y to represent the ground truth label. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "PYRI3uo3Zu", "reviewer": "Reviewer_2yuU", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a method for white-box adversarial attacks which is bounded in l_infinity constraint. The method uses a barrier formulation together with DCT formulation.  ", "summary_of_the_review": "Due to concerns over the experiments, I recommend rejection. ", "strength_and_weaknesses": "Strengths: \nThe paper is easy to follow and the proposed method is explained clearly. \n\nWeaknesses: \nMy main concerns are with the experiments. Details listed below. \n\n1. From the experiments, it is unclear what advantage the proposed methods have over regular PGD. The authors claim that their method produces images of better quality and do not violate the l_infty contraint. But you can do this easily with PGD by clipping to satisfy some l_infty constraint. Table 1 shows that the proposed method has a weaker success rate compared to PGD, but has a better visual quality. However, the proper way to compare would be to plot the curves of \"visual-distortion\" (measured by PSNR, LPIPS, or L_infty) vs \"attack success rate\" for both methods. Currently we are just looking at individual points on the two curves and have no way of distinguishing which method is better. \n\n2. Why DCT? The paper claims DCT is for JPEG compatibility, but I do not see any evaluations where the attacked images are post-processed through JPEG or JPEG 2000. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "-U_bh7y3wJc", "reviewer": "Reviewer_RQTp", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This work aims to propose a novel adversarial attack method. The authors propose introducing a barrier method to generate adversarial examples. Then, the authors conduct some experiments.", "summary_of_the_review": "The paper's motivation, method, and experiments are unclear.", "strength_and_weaknesses": "Strength:\n- Exploring imperceptible adversarial examples is promising.\n- Introducing the barrier method to craft adversarial examples is novel to me.\n- Various scenarios are considered in the experimental setting.\n\nWeakness:\n- The motivation to introduce an image transformation is unclear.\n- The motivation of the method is unclear. It is unclear for me to figure out the connection between Eq. (4) and the barrier function, given Eq. (1). Moreover, it is also unclear why the authors consider the gradient computation after introducing the barrier function. It is unclear to me whether Eq. (5) has the same impact on the effectiveness as a \\ell_0 norm.\n- The motivation of the experiments is unclear. Specifically, the authors claim that they evaluate the proposed attacks. Built upon it, I cannot figure out which part and which kinds of superiority are supported by the conducted experiments.\n- Related works are missing. The authors claim to increase the perceptibility of adversarial examples. A similar work is [1], which designs perceptual adversarial examples. However, this work does not discuss and compare with it.\n- The paper is hard to follow. For example, the contribution part is confusing. It is confusing that ‘Our focus is on DCT and DWTs.’ is listed in the contribution. In addition, the authors do not explain the mentioned barrier method before the use in contribution. \n\n\nSuggestions:\n1 I do suggest the author improve the writing. \n2 The introduction makes me have to revisit the abstract, as the abstract provides limited information about the work, and the relation to the introduction is weak. \n\n[1] Perceptual adversarial robustness: Defense against unseen threat models.\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject