AEGM-C&V: enhanced adversarial example generation method combining complexity perception model and variance map
摘要
Deep Learning (DL) technology has shown outstanding performance in computer vision such as the identification and classification of objects in images or videos. However, it is well-known that a DL model is vulnerable to adversarial example attacks that intentionally add perturbations to an input image to cause the DL model to misclassify the input according to the attacker’s intention. Meanwhile, even a small perturbation added to an original image may generate an adversarial example image with poor perceptual quality. Thus, since such an adversarial example image looks suspicious especially when compared with an original image, it can be easily detected and removed by security examiners or systems. To improve the perceptual quality of an adversarial example image, a Complexity Perception Model (CPM)-based method has been proposed, where perturbations are craftily inserted within a constrained area (i.e., imperceptible regions). However, this notable method showed relatively low performance in generating successful adversarial example images, as it ironically only uses limited regions and thus greatly reduces the chance of generating adversarial example images. Motivated by these considerations, an enhanced adversarial example generation method, termed AEGM-C&V, is proposed, which operates in two steps: (1) Identifying and extending the imperceptible regions of a given input image by combining the CPM and Variance Map (VM) and (2) Inserting perturbations into the extended imperceptible regions in optimized ways by using Fast Gradient Signed Method (FGSM) and Projected Gradient Descent (PGD), which are representative