Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space

• URL: http://arxiv.org/abs/2003.00883v1
• Date: Tue, 25 Feb 2020 02:41:42 GMT
• Title: Adversarial Perturbations Prevail in the Y-Channel of the YCbCr Color Space
• Authors: Camilo Pestana, Naveed Akhtar, Wei Liu, David Glance, Ajmal Mian
• Abstract summary: In a white-box attack, adversarial perturbations are generally learned for deep models that operate on RGB images. In this paper, we show that the adversarial perturbations prevail in the Y-channel of the YCbCr space. Based on our finding, we propose a defense against adversarial images.
• Score: 43.49959098842923
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Deep learning offers state of the art solutions for image recognition. However, deep models are vulnerable to adversarial perturbations in images that are subtle but significantly change the model's prediction. In a white-box attack, these perturbations are generally learned for deep models that operate on RGB images and, hence, the perturbations are equally distributed in the RGB color space. In this paper, we show that the adversarial perturbations prevail in the Y-channel of the YCbCr space. Our finding is motivated from the fact that the human vision and deep models are more responsive to shape and texture rather than color. Based on our finding, we propose a defense against adversarial images. Our defence, coined ResUpNet, removes perturbations only from the Y-channel by exploiting ResNet features in an upsampling framework without the need for a bottleneck. At the final stage, the untouched CbCr-channels are combined with the refined Y-channel to restore the clean image. Note that ResUpNet is model agnostic as it does not modify the DNN structure. ResUpNet is trained end-to-end in Pytorch and the results are compared to existing defence techniques in the input transformation category. Our results show that our approach achieves the best balance between defence against adversarial attacks such as FGSM, PGD and DDN and maintaining the original accuracies of VGG-16, ResNet50 and DenseNet121 on clean images. We perform another experiment to show that learning adversarial perturbations only for the Y-channel results in higher fooling rates for the same perturbation magnitude.

Related papers

• Evaluating Similitude and Robustness of Deep Image Denoising Models via Adversarial Attack [60.40356882897116]
  Deep neural networks (DNNs) have shown superior performance compared to traditional image denoising algorithms. In this paper, we propose an adversarial attack method named denoising-PGD which can successfully attack all the current deep denoising models.
  arXiv  Detail & Related papers  (2023-06-28T09:30:59Z)
• LeNo: Adversarial Robust Salient Object Detection Networks with Learnable Noise [7.794351961083746]
  This paper proposes a light-weight Learnble Noise (LeNo) to against adversarial attacks for SOD models. LeNo preserves accuracy of SOD models on both adversarial and clean images, as well as inference speed. Inspired by the center prior of human visual attention mechanism, we initialize the shallow noise with a cross-shaped gaussian distribution for better defense against adversarial attacks.
  arXiv  Detail & Related papers  (2022-10-27T12:52:55Z)
• Reverse Engineering of Imperceptible Adversarial Image Perturbations [43.87341855153572]
  We formalize the RED problem and identify a set of principles crucial to the RED approach design. We propose a new Class-Discriminative Denoising based RED framework, termed CDD-RED.
  arXiv  Detail & Related papers  (2022-03-26T19:52:40Z)
• BreakingBED -- Breaking Binary and Efficient Deep Neural Networks by Adversarial Attacks [65.2021953284622]
  We study robustness of CNNs against white-box and black-box adversarial attacks. Results are shown for distilled CNNs, agent-based state-of-the-art pruned models, and binarized neural networks.
  arXiv  Detail & Related papers  (2021-03-14T20:43:19Z)
• Image Restoration by Deep Projected GSURE [115.57142046076164]
  Ill-posed inverse problems appear in many image processing applications, such as deblurring and super-resolution. We propose a new image restoration framework that is based on minimizing a loss function that includes a "projected-version" of the Generalized SteinUnbiased Risk Estimator (GSURE) and parameterization of the latent image by a CNN.
  arXiv  Detail & Related papers  (2021-02-04T08:52:46Z)
• Color Channel Perturbation Attacks for Fooling Convolutional Neural Networks and A Defense Against Such Attacks [16.431689066281265]
  The Conalvolutional Neural Networks (CNNs) have emerged as a powerful data dependent hierarchical feature extraction method. It is observed that the network overfits the training samples very easily. We propose a Color Channel Perturbation (CCP) attack to fool the CNNs.
  arXiv  Detail & Related papers  (2020-12-20T11:35:29Z)
• Boosting Gradient for White-Box Adversarial Attacks [60.422511092730026]
  We propose a universal adversarial example generation method, called ADV-ReLU, to enhance the performance of gradient based white-box attack algorithms. Our approach calculates the gradient of the loss function versus network input, maps the values to scores, and selects a part of them to update the misleading gradients.
  arXiv  Detail & Related papers  (2020-10-21T02:13:26Z)
• Increasing the Robustness of Semantic Segmentation Models with Painting-by-Numbers [39.95214171175713]
  We build upon an insight from image classification that output can be improved by increasing the network-bias towards object shapes. Our basic idea is to alpha-blend a portion of the RGB training images with faked images, where each class-label is given a fixed, randomly chosen color. We demonstrate the effectiveness of our training schema for DeepLabv3+ with various network backbones, MobileNet-V2, ResNets, and Xception, and evaluate it on the Cityscapes dataset.
  arXiv  Detail & Related papers  (2020-10-12T07:42:39Z)
• Patch-wise Attack for Fooling Deep Neural Network [153.59832333877543]
  We propose a patch-wise iterative algorithm -- a black-box attack towards mainstream normally trained and defense models. We significantly improve the success rate by 9.2% for defense models and 3.7% for normally trained models on average.
  arXiv  Detail & Related papers  (2020-07-14T01:50:22Z)
• A Black-box Adversarial Attack Strategy with Adjustable Sparsity and Generalizability for Deep Image Classifiers [16.951363298896638]
  Black-box adversarial perturbations are more practical for real-world applications. We propose the DEceit algorithm for constructing effective universal pixel-restricted perturbations. We find that perturbing only about 10% of the pixels in an image using DEceit achieves a commendable and highly transferable Fooling Rate.
  arXiv  Detail & Related papers  (2020-04-24T19:42:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.