Related papers: Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective

Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective

URL: http://arxiv.org/abs/2102.06479v1
Date: Fri, 12 Feb 2021 12:26:39 GMT
Title: Universal Adversarial Perturbations Through the Lens of Deep Steganography: Towards A Fourier Perspective
Authors: Chaoning Zhang, Philipp Benz, Adil Karjauv, In So Kweon
Abstract summary: A human imperceptible perturbation can be generated to fool a deep neural network (DNN) for most images. A similar phenomenon has been observed in the deep steganography task, where a decoder network can retrieve a secret image back from a slightly perturbed cover image. We propose two new variants of universal perturbations: (1) Universal Secret Adversarial Perturbation (USAP) that simultaneously achieves attack and hiding; (2) high-pass UAP (HP-UAP) that is less visible to the human eye.
Score: 78.05383266222285
License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
Abstract: The booming interest in adversarial attacks stems from a misalignment between human vision and a deep neural network (DNN), i.e. a human imperceptible perturbation fools the DNN. Moreover, a single perturbation, often called universal adversarial perturbation (UAP), can be generated to fool the DNN for most images. A similar misalignment phenomenon has recently also been observed in the deep steganography task, where a decoder network can retrieve a secret image back from a slightly perturbed cover image. We attempt explaining the success of both in a unified manner from the Fourier perspective. We perform task-specific and joint analysis and reveal that (a) frequency is a key factor that influences their performance based on the proposed entropy metric for quantifying the frequency distribution; (b) their success can be attributed to a DNN being highly sensitive to high-frequency content. We also perform feature layer analysis for providing deep insight on model generalization and robustness. Additionally, we propose two new variants of universal perturbations: (1) Universal Secret Adversarial Perturbation (USAP) that simultaneously achieves attack and hiding; (2) high-pass UAP (HP-UAP) that is less visible to the human eye.