[Paper Review] A Review of Adversarial Attacks in Computer Vision

Yutong Zhang, Li Yao+2 more|arXiv (Cornell University)|Aug 15, 2023

Adversarial Robustness in Machine LearningComputer Science3 citations

TL;DR

This paper provides a comprehensive review of adversarial attacks in computer vision, categorizing white-box and black-box methods, optimization-based and generative techniques, and analyzing their application across image classification, object detection, and semantic segmentation. It highlights the superior transferability and robustness of methods like PGD, C&W, and UAPs, particularly in regression-based tasks such as segmentation.

ABSTRACT

Deep neural networks have been widely used in various downstream tasks, especially those safety-critical scenario such as autonomous driving, but deep networks are often threatened by adversarial samples. Such adversarial attacks can be invisible to human eyes, but can lead to DNN misclassification, and often exhibits transferability between deep learning and machine learning models and real-world achievability. Adversarial attacks can be divided into white-box attacks, for which the attacker knows the parameters and gradient of the model, and black-box attacks, for the latter, the attacker can only obtain the input and output of the model. In terms of the attacker's purpose, it can be divided into targeted attacks and non-targeted attacks, which means that the attacker wants the model to misclassify the original sample into the specified class, which is more practical, while the non-targeted attack just needs to make the model misclassify the sample. The black box setting is a scenario we will encounter in practice.

Motivation & Objective

• To systematically categorize and analyze adversarial attack methods in computer vision, including white-box and black-box settings.
• To examine the effectiveness and transferability of optimization-based and generative adversarial attack techniques.
• To investigate the vulnerability of deep learning models in regression-based tasks such as object detection and semantic segmentation.
• To evaluate the performance of state-of-the-art attacks like PGD, C&W, and UAPs across different vision tasks and model architectures.
• To identify key challenges and open problems in adversarial robustness, especially in real-world and scenario-specific applications.

Proposed method

• Classifies adversarial attacks into white-box (full model access) and black-box (input/output only) settings, with further division into query-based and transfer-based black-box attacks.
• Reviews optimization-based methods such as Box-constrained L-BFGS and C&W attacks, which use gradient information and constrained optimization to generate small, imperceptible perturbations.
• Examines gradient-based attacks like FGSM and PGD, which iteratively update perturbations using model gradients to maximize misclassification.
• Analyzes generative methods, including universal adversarial perturbations (UAPs), which apply a single fixed perturbation across multiple inputs for broader attack success.
• Evaluates specialized attacks for object detection and semantic segmentation, including patch-based attacks and loss functions designed to mislead regression outputs.
• Compares iterative and end-to-end generative models for attack generation, noting improvements in inference speed and perturbation quality.

Experimental results

Research questions

• RQ1 How do white-box and black-box adversarial attacks differ in terms of feasibility, transferability, and practical deployment?
• RQ2 Why are regression-based tasks like semantic segmentation more vulnerable to adversarial attacks than classification tasks?
• RQ3 To what extent do optimization-based attacks generalize across different inputs, and how do generative methods like UAPs improve this generalization?
• RQ4 How do loss function design and architectural choices affect the success rate and transferability of adversarial attacks in object detection and segmentation?
• RQ5 What are the key limitations of existing adversarial attack methods, and how do recent advances address them?

Key findings

• White-box attacks achieve high success rates due to full model access, with methods like C&W and PGD demonstrating strong targeted attack performance.
• Black-box transfer-based attacks outperform query-based ones in practice due to reduced query demands, especially when query limits are enforced.
• Optimization-based attacks are instance-dependent and require per-sample computation, while generative methods like UAPs can produce a single perturbation effective across many inputs.
• Semantic segmentation models are more vulnerable than classification models due to the continuous nature of regression outputs, which are more sensitive to small input changes.
• The use of surrogate models in transfer-based attacks enables effective black-box attack generation, though success depends on the similarity between surrogate and target models.
• End-to-end generative models for adversarial attacks significantly reduce generation and inference time compared to iterative optimization methods.