Adversarial Attacks Beyond the Image Space

The Hong Kong University of Science and Technology
Department of Computer Science and Engineering

Final Year Thesis Oral Defense

Title: "Adversarial Attacks Beyond the Image Space"

by

ZENG Xiaohui

Abstract:

Generating adversarial examples is an intriguing problem and an important 
way of understanding the working mechanism of deep neural networks. Most 
existing approaches generated perturbations in the image space, i.e., each 
pixel can be modified independently. However, in this project we pay 
special attention to the subset of adversarial examples that are 
physically authentic -- those corresponding to actual changes in 3D 
physical properties such as surface normals, lighting, rotation, location, 
color. These adversaries arguably pose a more serious concern, as they 
demonstrate the possibility of causing neural network failure by small 
perturbations of real-world 3D objects and scenes.

In the contexts of object classification and visual question answering, we 
investigate two different physical attacks: white-box attack and black-box 
attack. In the white-box attack, we augment state-of-the-art deep neural 
networks that receive 2D input images with a differentiable rendering 
layer in front, so that a 3D scene (in the physical space) is rendered 
into a 2D image (in the image space), and then mapped to a prediction (in 
the output space).

The adversarial perturbations can now go beyond the image space, and have 
clear meanings in the 3D physical world. Through extensive experiments, we 
found that a vast majority of image-space adversaries cannot be explained 
by adjusting parameters in the physical space, i.e., they are usually 
physically inauthentic. But, it is still possible to successfully attack 
beyond the image space on the physical space (such that authenticity is 
enforced), though this is more difficult than image-space attacks, 
reflected in lower success rates and heavier perturbations required.


Date            : 24 April 2018 (Tuesday)

Time            : 14:30-15:10

Venue           : Room 1505 (near lifts 25/26), HKUST

Advisor         : Prof. TANG Chi-Keung

2nd Reader      : Prof. YEUNG Dit-Yan