Generate More Imperceptible Adversarial Examples for Object Detection
Abstract
Object detection methods based on deep neural networks are vulnerable to adversarial examples.
The existing attack methods have the following problems: 1) the training generator takes a long time and is difﬁcult to extend to a large dataset; 2) the excessive destruction of the image features does not improve black-box attack effect(the generated adversarial examples have poor transferability) and brings about visible perturbations.
In response to these problems, we proposed a more imperceptible attack(MI attack) with a stopping condition of feature destruction and a noise cancellation mechanism.
Finally, the generator generates subtle adversarial perturbations, which can not only attack the object detection models that are based on proposal and regression but also boost the training speed by 4-6 times.
Experiments show that the MI method has achieved the state-of-the-art attack performance in the large datasets PASCAL VOC.
1. Introduction
In recent years a large number of research and applications have proven that deep networks can achieve stateof-the-art performance in various ﬁelds, including object detection(Lin et al., 2017)(He et al., 2017), semantic segmentation (Long et al., 2015)(Ronneberger et al., 2015), self-driving cars(Chen
et al., 2015), face recognition (Shu et al., 2016)(Zhang et al., 2016), image-to-image translation (Isola et al., 2017)(Liu et al., 2017), etc.
Although deep learning has achieved great success, recent studies (Szegedy et al., 2013)(Kurakin et al., 2016)(Madry et al., 2017) have conﬁrmed that classiﬁers based on deep neural networks have serious security problems.
Object detection can be roughly divided into two categories: models based on proposal(Faster R-CNN (Ren et al., 2015)) and models based on regression(SSD (Liu et al., 2016)).
As a critical subtask in computer vision, it is equally vulnerable to adversarial perturbation.
The DAG (Xie et al., 2017) attacks the Faster R-CNN by optimizing to generate adversarial examples.
The Bose’s method (Bose & Aarabi, 2018) trains a generator to attack the face detector based on the Faster R-CNN.
To attack proposal-based and regressionbased models, the UEA (Wei et al., 2018) proposes a uniﬁed framework to generate a transferable adversarial example by combining the feature loss and the class loss.
However, these methods have apparent shortcomings.
The
DAG (Xie et al., 2017) serves as an iterative optimization method, which is very time-consuming.
The Bose’s method can not attack object detection models based on regression.
The UEA method (Wei et al., 2018) has the following problems: Firstly, the generator needs to iterate at least ﬁfty hours to make network convergence when the training images are 2511(VOC2007 (Everingham et al., 2007)).
The time for the training signiﬁcantly limits the extension of this approach to more massive datasets.
Secondly, the unrestricted destruction of image features does not improve the black-box affect(the generated adversarial examples have poor transferability) and makes adversarial examples have excessive noise.
UEA method which is blindly minimizing the feature layer of the clean image and the Gaussian noise is unreasonable.
We hope to ﬁnd an adversarial example that is less noisy but still effective for two types of detection models.
We call it the MI(more imperceptible) attack.
The contributions of this paper can be summarized as follows:
• We have found that blindly destroying the target feature does not improve the transferability of adversarial examples.
We ﬁnd a stopping condition of the feature destruction.
Under the same experimental conditions we improve the transferability of adversarial examples and accelerate training speed by 4-6 times.
• For excessive noise, we use a noise cancellation mechanism(the group optimization and the random elimination) to generate more imperceptible adversarial perturbations.
2. Methodology
In this section, We will analyze the problems caused by over-destructive features in the UEA methods and introduce the MI attack approach.
2.1. Problem Deﬁnition
Given a image x , which have n objects O = { o 1 , o 2 , ..., o n } in a speciﬁc dataset D .
For objects in ith image, it is represented by binary groups Γ = { ( b i 1 , y i 1 ) , ( b i 2 , y i 2 ) , ..., ( b in , y in ) } , where b in represents the coordinates of the nth object in ith image, and y in represents the label of the nth object in ith image.
Assuming that object detection models are M = { m 1 , m 2 , ..., m j } , then object detection can be expressed as M : R w × h × c −→
R | Γ | .
The M set includes both proposal-based models and regression-based models.
For an arbitrary detection model m j , the correct classiﬁcation label f y ( x, o n ) and the bounding-box function f b ( x, o n ) denote the detection results of the nth object on the clean image x .
We add a slight perturbation δ to generate an adversarial example x + δ .
When the adversarial example makes the labels of all objects go wrong or
the
IOU between predicted boxes and the ground truth is less than 0.5, i.e. , ∀ n, f y ( x + δ, o n ) (cid:54) =
f y ( x, o n ) ∨ IOU ( f b ( x + δ, o n ) , f b ( x, o n )) < 0 .
5 , we think object detection model
m j can be fooled successfully.
For adversarial attacks, we conduct the white-box attack on the Faster-RCNN model.
In the training phase, we know the network architecture and parameters of the Faster-RCNN to train our generator.
In contrast, we only know the output of the SSD model.
Therefore, the adversarial attack for the
SSD model is the black-box attack.
The transferability of the adversarial example refers that the adversarial example has a good performance on the black-box attack.
2.2. Problems caused by feature destruction
In general, the transferability of the adversarial example for the black-box model has poor performance.
For mainstream object detection methods, they utilize the deep neural network as a feature extractor.
The Sabour’s (Sabour et al., 2015) approach shows that the image features in a deep neural network (DNN) can be manipulated to generate adversarial examples.
Thus, we can destroy image features to improve the transferability of adversarial examples for mainstream object detections, e.g., We can manipulate the image features to make it close to Gaussian noise.
Problem 1 Do not improve the black-box affect(the adversarial example have poor transferability)
Problem 2 Generated adversarial examples bring about visible perturbations.
Problem
The training takes a lot of time.
[Equation]
To minimize the loss function, we need to ﬁnd a trade-off between image similarity and feature destruction.
The Eq.represents the gain of the noise amplitude, and the T represents the number of iterations.
Eventually, image similarity will tend to be stable, which means that the disturbance will have a minimum upper bound θ .
The higher the iterations
T , the smaller the gain ρ .
In other words, the increment of each iteration ρ is inversely proportional to the total number of iterations T .
2.3. Stopping Condition for the Feature Destruction
In the previous section, excessive feature destruction is not only useless for improving transferability and brings abount evident perturbations.
Thus, ﬁnding a suitable stopping condition is essential.
Instead of iterating 20 times for each sample’s feature loss, we use the SSD model as an indicator, and it will indicate to the stop of the feature destruction.
We only need to send each generated adversarial example to the SSD model to get the labels of targets y ssd in the input.
If y ssd / ∈ y ground − truth , then we think that the feature destruction is enough to attack the regression model.
To generate an adversarial example quickly, we still use a
GAN to generate an adversarial example.
The generation network is used to generate adversarial examples that can fool the classiﬁer.
The discriminator takes an image as input and attempts to predict it as the original image or the output image of the generator.
It determines that the real picture is 1, and the generated picture is 0.
[Equation]
The GAN loss can be represented by Eq. 2, D stands for discriminator, and G stands for generator.
By minimizing
GAN loss, we can make the generated adversarial examples as close as possible to the spatial distribution of real images.
Besides, for the detection task, we only need to perturb the critical target area so that the target area can not be detected.
Therefore, during the training and testing process, we can get an attention matrix A through the Faster R-CNN.
[Equation]
We use the L 2 distance as a metric, by minimizing the L 2 distance between the adversarial example and the input picture, as shown in Eq.
[Equation]
The Eq. 4 deﬁne the classiﬁcation loss function.
Where the x represents the input and the o n can be deﬁned as the nth target area in the picture x .
y n and y (cid:48)
n represent the classiﬁcation label for the nth target area on the clean image and the adversarial image.
The f represents the network of object detection.
[Equation]
In Eq.
5, the X i represents the ith image features of network and the GN i represents the ith Gaussian noise features.
The A i represents attention matrix A in the ith layer in deep neural network.
The (Wei et al., 2018) achieves the purpose of destroying the feature of the image object region by minimizing the L 2 distance between the input and the
Gaussian noise feature layer.
[Equation]
such thatf
[Equation]
Therefore, the ﬁnal loss function can be expressed by Eq. 6.
It consists of GAN loss, similarity loss, classiﬁcation loss, feature loss, and iteratively optimizes under the condition that the generated adversarial example can still effectively attack the SSD model.
We set α is 0.05, β is 1.
We choose the ﬁfteenth layer and the twenty layer in the feature loss, and the γ is [0.00010, 0.00020].
The learning rates of the generator and the discriminator are 0.0002.
We train the generator and the discriminator on a single GPU Titan XP.
Under the same condition of the hardware, the adversarial examples have good attack performance on the mainstream object detection model, and the training time signiﬁcantly shortens by 4-6 times compared with the UEA method.
2.4. Eliminate Noise Redundancy
When we use the Eq. 6, we can prevent over-destruction features to a certain extent and generate less-noise adversarial examples.
However, the generated adversarial examples still have excessive noise.
Similar to the method (Shi et al., 2019), we can get an adversarial example which has a smaller visual difference with the input by using the noise cancellation technique, and it can still attack the proposalbased model and the regression-based model.
There is a better adversarial example x 4 around x 3 , which not only attacks both detection models at the same time but is closer to the original sample x .
[Equation]
The Eq. 7 represents the objective function of the optimal adversarial example x 4 .
Where x represents the original image, x 3 represents the suboptimal adversarial example, and x 4 represents the optimal adversarial example.
We only need to optimize on suboptimal solution x 3 in the previous section.
Removing too much noise will cause the adversarial example to fail, so the optimal solution x 4 exists in a sphere with a radius of Ψ in the center of the suboptimal solution x 3 .
Group Optimization
[Equation]
The initial noise z 0 can be represented by Eq 8, and the number of iterations of the group optimization is T g .
We can divide the noise into T g groups and deﬁne the noise group
Z = z n , z n − 1 , ...
z 1 , where z n = n/T g [Equation] 0 , n = 1 , 2 , ...
[Equation]
In the test phase, we send clean images to the generator to generate the adversarial example x 3 and to the two types of detection models to get the initial labels Y .
Next, we obtain the initial noise z 0 and calculate the noise group Z .
The noise group Z is sequentially added to the clean image and sent to the two types of detection models to obtain the adversarial classiﬁcation labels Y (cid:48) .
When ∃ y ∈ Y (cid:48) , y ∈ Y , stop iteration and return the last group noise z g .
Random Elimination
[Equation]
The noise after group optimization is called z g , but the noise still has some redundancy.
Therefore, we adopt a random elimination method.
Assuming that the random iteration optimization number is T r , we initialize a matrix R 0 that is all 1 and randomly selects an element with a ratio of less than the threshold π to be 0.
The resulting new matrix R is then multiplied by the group noise z g to obtain a new noise z r , as shown by Eq.9.
Next, the noise obtained from each iteration is added to the clean picture and sent to the object detector to obtain the adversarial classiﬁcation labels Y’.
When ∃ y ∈ Y (cid:48) , y ∈ Y , the iteration stops and returns the previous noise.
3. Experiments 3.1. Datasets
For object detection in the image, we used 5011 images from the PASCAL VOC 2007 training set to train the generator.
We will evaluate our approach from three perspectives: success rate, time, and image quality. Success Rate:
For object [Table] [Table] detection, we use mAP to judge our attack effect.
Time:
The time here is the time to train the generator.
PSNR: we evaluate the image quality by using the Peak Signal to Noise
Ratio, PSNR.
3.2. Ablation Study
We discuss the ablation study of this method.
+GO, +RE,
MI respectively represent that only the grouping optimization algorithm is used on the basis of the original method, only use the random elimination algorithm, and use both of them.
In Table 1, after using the noise cancellation algorithm, the image quality will be signiﬁcantly improved, but the attack effect on the SSD will also decrease, which means that the image quality is negatively correlated with the transferability of adversarial examples.
The grouping optimization algorithm is better than the random elimination algorithm.
In the same attack effect, the group optimization algorithm generates adversarial examples which have better image quality.
When we use both of them, we will get adversarial examples that have the best image quality, and its attack on SSD and FR will be worse.
3.3. Results on Adversarial Images
We mainly compare the performance of the UEA method and the MI method on clean images.
As shown in Table 2, the adversarial examples generated by the MI method are very effective for the Faster R-CNN model and the SSD model.
Compared with the UEA method, the mAP of adversarial examples generated by the MI method is only 0.
(5 percentage points lower) for the black-box attack on the
SSD model.
Thus, the adversarial examples by the MI method have better transferability compared with the UEA FR FR
SSD SSD
[Figure]
method.
For the training time, the average time for the MI method to train a sample is only 1.8s, which is nearly 5 times faster than the UEA method.
The shortening of training time makes it possible to extend the MI method to training on large datasets.
For PSNR, the image quality generated by the MI method is higher than that of the UEA method.
Therefore, the MI method generates more imperceptible adversarial examples, which are still valid for the Faster R-CNN model and the SSD model.
In Figure 1, the ﬁrst and second columns show the results of the Faster R-CNN model and the SSD model on the clean image x and the adversarial example x ∗ , respectively.
x ∗ − x represents the adversarial perturbations by the MI method.
As shown in the Figure 1, the adversarial examples generated by the MI method can successfully fool both types of detection models.
4. Conclusion
In this paper, we propose an attack method that can generate more imperceptible perturbations to the clean images and effectively attack two types of object detection methods.
Our proposed MI method shortens the training time of the
UEA method by 4-6 times, making it possible to train the generator on a large dataset.
At the same time, it can produce an adversarial example with higher image quality or more transferable.
We have experimentally validated on large datasets PASCAL VOC and ImageNet VID.
Considering the speed of training and the effect of the adversarial attack together, we believe that the MI method is superior to the existing adversarial attack methods for object detection on images.