Improving Perceptual Quality of Adversarial Images Using Perceptual Distance Minimization and Normalized Variance Weighting
Abstract
Neural networks are known to be vulnerable to adversarial examples, which are obtained by adding intentionally crafted perturbations to original images.
However, these perturba- tions degrade their perceptual quality and make them more difﬁcult to perceive by humans.
In this paper, we propose two separate attack agnostic methods to increase the perceptual quality, measured in terms of perceptual distance met- ric LPIPS, while preserving the target fooling rate.
The ﬁrst method intensiﬁes the perturbations in the high variance ar- eas in the images.
This method could be used in both whitebox and black-box settings for any type of adversarial exam- ples with only the computational cost of calculating the pixel based image variance.
The second method aims to minimize the perturbations of already generated adversarial examples independent of the attack type.
In this method, the distance between benign and adversarial examples are reduced until adversarial examples reach the decision boundaries of the true class.
We show that these methods could also be used in conjunction to improve the perceptual quality of adversar- ial examples and demonstrate the quantitative improvements on CIFAR-10 and NIPS2017 Adversarial Learning Challenge datasets.
Introduction
While Deep Neural Networks (DNNs) are being used in a variety of domains, there are several studies that show their vulnerabilities.
An initial study, L-BFGS method (Szegedy et al. 2014), revealed that neural networks are not robust to adversarial attacks speciﬁcally produced to fool the networks.
After the discovery of adversarial attacks, several different methods have been proposed such as Fast Gradient Sign Method (FGSM) (Goodfellow, Shlens, and Szegedy 2015), Projected Gradient Descent (PGD) (Madry et al.
, DeepFool (Moosavi-Dezfooli, Fawzi, and Frossard 2016), Jacobian Saliency Map Attack (JSMA) (Papernot et al. 2016), Spatially Transformed Adversarial Examples (stAdv) (Xiao et al.
and
Carlini&Wagner Attack (Carlini and Wagner 2017).
As adversarial examples can fool the networks, they can be used for the purpose of distinguishing humans from algorithms.
While humans could still perceive the content of
Benign Example
Vanilla Attack
Var.
Map
Var.
Method
[Equation]
these images, algorithms would be deceived by the adversarial input.
For such a system be effective, the perturbation that will be added to the image should be reasonably small and, while still misleading the algorithm, human vision should not be distracted from by the perturbation.
Completely Automated Public Turing test to tell Computers and
Humans Apart - CAPTCHA, is one of the most common examples where human users are distinguished from computer algorithms (Aksoy and Temizel 2019).
The main motivation of this study is to improve successful adversarial attacks while reducing the perturbations that are distracting to humans.
So, we propose two separate methods to improve the perceptual quality while keeping the attacks successful.
The ﬁrst method is based on intensifying the perturbation in high-variance zones and suppressing in low-variance zones using the variance map of input images for any type of attack.
In effect, disguising the adversarial noise in highvariance areas and limiting the high-frequency noise added to low-variance areas where they would be more distracting.
The second method is based on minimization of the perturbation until it reaches the boundary.
While variance weighting is applied during the attack, minimization method could be considered as post processing after acquiring the adversarial example with any type of adversarial attack.
As seen in Figure 1, localized and minimized perturbations improve the perceptual quality while keeping the fooling rate stable.
Related Work Adversarial Attacks
L-BFGS is the initial method for generating adversarial examples using box-constrained optimization method (Szegedy et al. 2014).
However, this method is computationally very costly.
FGSM (Goodfellow, Shlens, and Szegedy 2015) is an efﬁcient gradient-based attack algorithm, which computes the gradient only once, and adds perturbation in the gradient ascending direction of the loss function.
Iterative Fast Gradient Sign Method (I-FGSM) (Kurakin, Goodfellow, and Bengio 2017) extends FGSM by iteratively attacking with a small step size and calculating the gradient at each step.
C&W attack (Carlini and Wagner 2017) minimizes L 2 norm with an improved optimization method.
DeepFool (Moosavi-Dezfooli, Fawzi, and Frossard 2016) efﬁciently computes the smallest perturbations according to closest decision boundary.
Jacobian-based Saliency Map
Attack (JSMA) (Papernot et al. 2016) generates sparse perturbations via generating saliency map and rank the contribution of each input variable to the adversarial objective.
A perturbation is then selected from the saliency map at each iteration.
Perceptual Metrics
All adversarial attack methods essentially aim to fool the network while minimizing the dissimilarity between benign and adversarial examples (i.e., minimizing the added perturbation).
While the similarity metrics vary according to attack type, the most widely used distance metrics are L p norms ( p = 0, 1, 2, ∞ ).
In particular, FGSM is an L ∞ , JSMA is an L 0 , and C&W is an L 2 norm based attack.
Even though L p norms are very convenient and commonly used, several studies state that L p norms do not reﬂect the human perception accurately (Sharif, Bauer, and Reiter 2018; Jordan et al. 2019).
Besides, there are some attack types such as (Jordan et al.
Laidlaw and Feizi 2019; Laidlaw, Singla, and Feizi 2021;
Aydin et al. 2021) for which L p norms are not fully suitable to evaluate the attack success.
Thus these studies employ different and more recent perceptual metrics such as Learned Perceptual Image Patch
Similarity (LPIPS) metric (Zhang et al. 2018) or Deep Image Structure and Texture Similarity (DISTS) index (Ding et al. 2020).
Both of these methods use an additional neural network to measure the distance.
LPIPS is calibrated with human perception and measures the Euclidean distance of deep representations.
Likewise, DISTS optimizes human perception while using the combination of deep image structure and texture similarity.
Variance Map on Adversarial Attacks
Human perception is affected more by perturbations in the low variance areas compared to high variance areas and this information is exploited in various image processing applications (Legge and Foley 1980;
Lin, Dong, and Xue 2005;
Liu et al. 2010).
Regarding this fact, variance map has been used in previous studies (Luo et al. 2018; Croce and Hein 2019) to generate adversarial examples.
In this work variance map is used to produce a variance based componentwise box constraints to generate sparse adversarial examples (Croce and Hein 2019).
In another study, variance map is applied for the selection of high variance pixels (Luo et al.
Using only L p norms for these variance based sparse attacks do not accurately reﬂect the perceptual quality (Luo et al. 2018), thus variance based sparse adversarial examples either use mean and median values of pixels or introduce a new distance metric that is more suited for the evaluation of their proposed attacks.
Methodology Normalized Variance Weighting
In our study, we use variance map to intensify the perturbations in the high variance zones, instead of selecting high variance pixels or variance boundaries in an attack agnostic manner.
We adopt the variance map method in (Croce and
Hein 2019) to produce variance map of input images.
In this method, standard deviation of both axes with 2 neighbour pixels and main pixel for each color channel are calculated ( σ ( x ) ij and σ ( y ) ij for x and y axis respectively) and the square root of the minimum of standard deviation of axes is taken to obtain variance map σ ij (Equation 1).
The variance map is then normalized to obtain normalized variance map V i,j (Equation 2).
[Equation]
Var
[Figure]
Map
Initial Adv.
Example
Normalized Var
[Figure]
Perturbation
[Figure]
Adv.
Example (Improved by Var Method)
MinimizeDistance
Normalized Variance Weighting Method
Minimization Method
Minimized Perturbation
Final Adv.
Example
VarianceMap( x )
L 2 N o r m a li ze ( v ) ( y - x )* v x + p var x + p min y v x p var p min y best y var Since our method does not involve selecting pixels or generating variance box constraints, it does not require any additional threshold or coefﬁcient variable.
Normalizing and weighting procedures remove the need for an additional variable.
As seen in Algorithm 1, the proposed method initially generates the variance map of input images for only once (Equation 1), then normalizes the variance map using
L 2 -norm (Equation 2) and applies variance map by weighting the perturbation with normalized variance map at each iteration (if adversarial attack is iterative).
This method could be adapted for both white-box and black-box setting and does not require any optimization, or additional gradientbased steps.
Therefore it does not bring any additional computational cost except the calculation of variance map for once.
Minimization Method
The proposed minimization method is applied after generating the initial adversarial example and aims to reduce the distance between benign and adversarial examples using an optimizer.
Optimizer minimizes the distance until adversarial examples reach the decision boundaries of true classes or maximum iteration number (Algorithm 2).
We apply our minimization technique to minimize with regards to two different:
L 2 -norm and LPIPS (It has to be noted that some attacks are not fully suitable for L 2 distance metric (Aydin et al. 2021)).
As LPIPS measures the perceptual distance using an additional neural network (i.e., VGG16 (Simonyan and Zisserman 2015)), it has higher processing time and higher number of parameters compared to L 2 -norm minimization.
In (Aksoy and Temizel 2019), the attack strength is iteratively adjusted to obtain the minimal perturbation needed in an attack agnostic manner after the generation of adversarial example, our proposed method improves this by directly optimizing the minimization of perturbation.
Input : x : original image, Adv : one iteration of adversarial attack
Parameter : i max : maximum iteration of adversarial attack
Output : y : adversarial example 1: Let i =2: v = V arianceMap ( x ) 3: v = L 2 Normalize ( v ) 4: y
= x 5: while i < i max do 6:
y =
Adv ( y ) 7: p = ( y − x ) × v 8:
y = x
+ p 9: i
= i +10: end while 11: return y Normalized Variance Weighting + Minimization Normalized variance weighting method is applied during the adversarial attack while minimization method is applied after the generation of adversarial example. So both methods could be integrated and used in association for generation of adversarial examples.
The complete pipeline integrating both methods is illustrated in Figure 2.
We ﬁrst generate adversarial examples, apply the variance weighting method and after the generation of variance weighted adversarial example, we apply minimization method as a post processing to obtain improved adversarial examples
. Experiments
Datasets.
We used CIFAR-10 and NIPS2017 Adversarial
Learning Challenge datasets in the experiments.
CIFARtestset contains 10000 images with 32 × 32 resolution.
We conducted our experiments on a subset of CIFAR-10 testset with 1000 images (100 random images from each category).
NIPS2017 dataset is a subset of Imagenet dataset and
[Table] [Table]
L0.
+ - 0.
+
LPIPS 0.
+
L0.
Input : x : original image, y : adversarial example
Parameter : lr : learning rate, i max : maximum iteration
Output : y best : improved adversarial example else
9: end if 10:
= MinimizeDIST ( opt lr
11: end while 12: return y best contains 1000 images (one images from each category) with 299 × 299 resolution.
Attack Types. We have tested the proposed methods using 3 different untargeted attack types: a single step gradient based attack (FGSM) (Goodfellow, Shlens, and Szegedy 2015), an iterative gradient based attack (I-FGSM) (Kurakin, Goodfellow, and Bengio 2017) and an optimization based attack (C&W) (Carlini and Wagner 2017) on CIFAR10 and NIPS2017 datasets.
We have used ResNet (He et al. 2016) and Inception-V3 (Szegedy et al. 2016) for
NIPS2017 dataset; only ResNet50 (He et al. 2016) for CIFAR10 dataset.
We have used CleverHans (Papernot et al.
2018) implementation for default attacks and we integrated the proposed methods into these attacks.
Experimental Settings for Normalized Variance Weighting
For variance map, we used 2 neighbour pixels and main pixel for every color channel in the generation of variance map similar to (Croce and Hein 2019).
We observed that using variance weighting method considerably decreases the fooling rate when the attack strength is ﬁxed.
Thus, to compare on a fair ground, we ﬁxed the fooling rate and let the (cid:15) (for FGSM and I-FGSM attacks) or initial cost (for C&W attack) vary.
This allowed reaching the target fooling rate within a ± 0 .
5% error tolerence.
We targeted 4 different fooling rates for FGSM: 30%, 40%, 50%, 60% and I-FGSM: 60%, 70%, 80%, 90% on both datasets.
We used a single fooling rate for C&W attack on each dataset: 95% on
CIFAR10 and 100% on NIPS2017 (for both ResNet50 and
Inception-V3), since there is L 2 -normalization after producing variance map, measuring L p norms would be misleading for variance weighting method.
Therefore, we mainly used
LPIPS perceptual distance metric, which is calibrated with human vision, for its evaluation.
Experimental Settings for Minimization Method
For the experimental settings of the proposed minimization method, we used Adam (Kingma and Ba 2015) as the optimizer and set the maximum iteration number as 10.
We set the learning rate as 0.0001 for CIFAR10 dataset for both minimization methods.
We set learning rate as 0.0001 for
L 2 -Minimization and 0.00001 for LPIPS-minimization on
NIPS2017 (for both ResNet50 and Inception-V3), since they were not converging with the same learning rate.
[Table] [Table]
[Table] [Table]
LPIPS
[Table] [Table]
L0.
+ - 0.
+
LPIPS 0.
+
L0.
Results
Normalized Variance Weighting.
The effect of variance weighting method on FGSM attack can be observed in
Table 1 and Table 3 for CIFAR10 (using ResNet50) and
NIPS2017 (using ResNet50 and Inception-V3) datasets respectively.
The method reduces the LPIPS distances considerably in all cases, i.e. without minimization and when used together with minimization with respect to both L 2 and
LPIPS.
The corresponding results in Table 2 and Table 4 for
I-FGSM and Table 5 and Table 6 for C&W attack conﬁrm that these ﬁndings are pertinent to these attacks as well and variance weighting is effective in reducing the LPIPS distance for all attack types in question.
Minimization Methods.
LPIPS-Minimization method applied on FGSM attack decreases the LPIPS distances considerably when used individually as well as when it is combined together with variance weighting for both CI-
[Table]
FAR10 (using ResNet50) and NIPS2017 (using ResNet and Inception-V3) datasets (Table 1 and Table 3).
The corresponding results in Table 2 and Table 4 for I-FGSM and
Table 5 and Table 6 for C&W attack conﬁrm that these ﬁndings are pertinent to these attacks as well and LPIPS is effective in reducing the LPIPS distance for all attack types in question.
In addition to these results, LPIPS-Minimization method also improves L 2 distance considerably.
Though, as expected, L 2 -Minimization method results in the best L 2 distance improvements for FGSM and I-FGSM on both CIFAR10 (using ResNet50) and NIPS2017 (using ResNet and Inception-V3) datasets.
Considering C&W is already optimizing L2 distance, the improvement is relatively limited for C&W attack on both datasets.
Fooling Rates of FGSM L P I PS ( ×2 ) r e s u lt s regular FGSM var.
box-constr. FGSM var.
weighting FGSM       0 .0 .0 .0 . Fooling Rates of I-FGSM L P I
PS ( ×2 ) r e s u lt s regular I [Figure]
Variance + Minimization Methods.
The best results (i.e. lowest LPIPS distances) are obtained when we combine variance weighting method with LPIPS-Minimization and the results show that there is considerable improvement for
FGSM, I-FGSM and C&W attack types on both CIFAR (using ResNet50) and NIPS2017 (using both ResNet50 and
Inception-V3).
Discussion
From the experiments, it is seen that both variance weighting and minimization methods individually improve the perceptual quality and the best LPIPS results are obtained when they are integrated.
However, this improvement is relatively limited for attacks that are inherently able to produce adversarial examples with quantitatively lower perceptual distances, such as C&W. Results in Tables 1 to 6 show that NIPS2017 dataset results have smaller perceptual disUmbrella Vanilla Adv. [Figure] Flag
[Figure] tances yet improvement percentages are higher compared to CIFAR10 dataset datasets respectively I-FGSM against
ResNet50).
We have also investigated variance-based box-constrained method (Croce and Hein 2019) for our attack type agnostic white-box setting as an alternative to variance weighting.
While variance-based box-constrained adversarial examples are improved in terms of perceptual quality as well, it is seen in Figure 3 that variance weighting method has lower LPIPS perceptual distances compared to variance-based box-constrained method at all fooling rates compared to FGSM and I-FGSM attacks on NIPS2017. Variance-based box-constrained method also requires an additional coefﬁcient parameter for each adversarial attack type, dataset and network.
In Figure 3, epsilon value is used as the additional coefﬁcient parameter of variance-based boxconstrained method to select adaptive coefﬁcient.
Even when parameters for threshold levels are optimized, in most instances, we have observed that variance weighted perturbations have better perceptual quality, which makes variance weighting a better choice.
We have conducted our experiments based on L 2 and
LPIPS distance metrics.
Since traditional L p norm based measures are based on pixel based differences, they are not effective indicators for perceptual quality, hence, we consider use LPIPS perceptual distance as the primary metric in our evaluation.
With regards to the proposed minimization methods, LPIPS-Minimization can be used in conjunction with any type of attack, while L 2 -Minimization is less effective in some attack types such as the ones based on shift- ing of pixels (e.g., (Aydin et al. 2021)).
Nevertheless, we have measured the distances of L 2 and LPIPS minimization methods with both L 2 and LPIPS metrics.
It is seen that both distance metrics usually decrease with any of minimization method.
Though, as expected, the measured metric beneﬁts more when it is the same metric as the one used in minimization (e.g., LPIPS-minimization method minimizes LPIPS distance proportionally more compared to L 2 distance).
Ourempirical observations show that the variance weighting method signiﬁcantly improves perceptual quality of images which have low variance backgrounds (e.g., sky, wall or sea) as it could be seen in Figure 1.
However it is less effective for images with dominantly high variance zones (e.g., umbrella image in Figure 4) and for images having dominantly low variance zones (e.g., ﬂag image in Figure 4).
In the ﬂag image, the variance of the background is highly low and high variance region is very narrow, hence variance weighting method could not improve the ﬂag image adequately.
Conclusion
We have proposed two separate attack agnostic techniques to improve perceptual quality of adversarial examples while preserving the fooling rate.
We have shown that applying our variance weighting improves the perceptual quality of different types of adversarial attacks without any signiﬁcant computational cost in white-box setting.
We have also shown that perturbations produced by different types of adversarial attacks could be minimized while preserving the fooling rate.
Integration of the variance weighting and minimization generates adversarial examples with the best perceptual quality measured by LPIPS.
Other attack agnostic improvements (e.g., generating adversarial attacks on
YUV color space (Aksoy and Temizel 2019) could be combined with these two proposed methods to enhance perceptual quality further in the future. Acknowledgments
{+This work has been funded by The Scientiﬁc and Technological Research Council of Turkey, ARDEB 
+}
Research
Projects Programme project no: 120E