A single input-agnostic thermal-airflow perturbation, optimized on one surrogate CLIP model, transfers to five CLIP backbones and six VLMs, degrading scene classification by up to 38.2%.
AdvHaze: Adversarial Haze Attack
3 Pith papers cite this work. Polarity classification is still indexing.
3
Pith papers citing it
abstract
In recent years, adversarial attacks have drawn more attention for their value on evaluating and improving the robustness of machine learning models, especially, neural network models. However, previous attack methods have mainly focused on applying some $l^p$ norm-bounded noise perturbations. In this paper, we instead introduce a novel adversarial attack method based on haze, which is a common phenomenon in real-world scenery. Our method can synthesize potentially adversarial haze into an image based on the atmospheric scattering model with high realisticity and mislead classifiers to predict an incorrect class. We launch experiments on two popular datasets, i.e., ImageNet and NIPS~2017. We demonstrate that the proposed method achieves a high success rate, and holds better transferability across different classification models than the baselines. We also visualize the correlation matrices, which inspire us to jointly apply different perturbations to improve the success rate of the attack. We hope this work can boost the development of non-noise-based adversarial attacks and help evaluate and improve the robustness of DNNs.
verdicts
CONDITIONAL 3representative citing papers
A black-box attack that jointly tunes exposure and noise in one image can make co-salient object detection fail to locate common objects across a group, without accessing the detector.
FakeTagger trains an encoder-decoder with channel coding to embed recoverable identifiers in face images that survive GAN-based DeepFake transformations.
citing papers explorer
-
AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models
A single input-agnostic thermal-airflow perturbation, optimized on one surrogate CLIP model, transfers to five CLIP backbones and six VLMs, degrading scene classification by up to 38.2%.
-
Can You Spot the Chameleon? Adversarially Camouflaging Images from Co-Salient Object Detection
A black-box attack that jointly tunes exposure and noise in one image can make co-salient object detection fail to locate common objects across a group, without accessing the detector.
-
FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking
FakeTagger trains an encoder-decoder with channel coding to embed recoverable identifiers in face images that survive GAN-based DeepFake transformations.