[Paper Review] Generating Natural Adversarial Hyperspectral examples with a modified Wasserstein GAN

Jean-Christophe Burnel, Kilian Fatras+1 more|arXiv (Cornell University)|Jan 27, 2020

Digital Imaging for Blood Diseases1 references4 citations

TL;DR

This paper proposes a modified Wasserstein GAN that generates natural adversarial hyperspectral examples without requiring gradients of the target classifier, instead using only its predictions. By reweighting the true data distribution based on classifier confidence, the generator learns to produce realistic, misclassified spectra, achieving high success rates (up to 99%) even on highly accurate classifiers.

ABSTRACT

Adversarial examples are a hot topic due to their abilities to fool a classifier's prediction. There are two strategies to create such examples, one uses the attacked classifier's gradients, while the other only requires access to the clas-sifier's prediction. This is particularly appealing when the classifier is not full known (black box model). In this paper, we present a new method which is able to generate natural adversarial examples from the true data following the second paradigm. Based on Generative Adversarial Networks (GANs) [5], it reweights the true data empirical distribution to encourage the classifier to generate ad-versarial examples. We provide a proof of concept of our method by generating adversarial hyperspectral signatures on a remote sensing dataset.

Motivation & Objective

• To generate natural adversarial examples for hyperspectral data without requiring access to the target classifier's gradients.
• To develop a black-box adversarial example generation method that relies solely on classifier predictions.
• To improve the realism and robustness of adversarial examples in remote sensing applications.
• To evaluate the method on real hyperspectral data from the Data Fusion Contest 2018.
• To compare the proposed method with state-of-the-art GAN-based approaches in terms of adversarial success and data fidelity.

Proposed method

• The method uses a modified WGAN with a gradient penalty to enforce the 1-Lipschitz constraint on the critic, ensuring stable training.
• A reweighted data distribution is constructed by assigning higher weights to samples with low classifier confidence, guiding the generator toward adversarial examples.
• The generator is trained to map latent vectors to hyperspectral signatures that are both realistic and misclassified by the target model.
• The critic is trained to distinguish between real data and generated adversarial examples, with the loss function modified to emphasize misclassified samples.
• The generator is optimized to minimize the distance between generated spectra and the reweighted real data distribution, promoting naturalness.
• The method operates in a black-box setting, requiring only model predictions, not gradients or architectural details.

Experimental results

Research questions

• RQ1 Can natural adversarial hyperspectral examples be generated without access to the target classifier’s gradients?
• RQ2 How effective is a reweighted data distribution based on classifier confidence in guiding the generator toward adversarial examples?
• RQ3 Can the proposed WGAN-based method generate realistic adversarial spectra that fool highly accurate classifiers?
• RQ4 How does the method compare to existing GAN-based adversarial example generation techniques in terms of success rate and spectral fidelity?
• RQ5 Does the method generalize across different classes with varying classifier accuracy?

Key findings

• The method achieved a 99% success rate in generating adversarial examples for the Crosswalks class, where the original classifier had only 5% accuracy.
• For the Car class, with a 39% classifier accuracy, the method achieved an 81% success rate across 10 runs.
• The Healthy Grass class, with 82% classifier accuracy, saw a 66% success rate, demonstrating effectiveness even on relatively accurate models.
• The generated adversarial spectra closely matched the target class in spectral mean and standard deviation, indicating high realism and fidelity.
• Compared to a state-of-the-art method from [9], the proposed approach produced cleaner, more realistic adversarial spectra, especially for low-accuracy classes like Crosswalks.
• The method successfully generated adversarial examples for all tested classes, including those where the baseline method failed entirely (e.g., Car class with 100 runs of 10,000 iterations).