[Paper Review] Spatially Transformed Adversarial Examples

Chaowei Xiao, Jun-Yan Zhu+4 more|arXiv (Cornell University)|Jan 8, 2018

Advanced Malware Detection Techniques240 citations

TL;DR

The paper proposes adversarial examples generated via spatial transformations (flow fields) rather than pixel-value changes, showing high perceptual realism and resilience against standard defenses.

ABSTRACT

Recent studies show that widely used deep neural networks (DNNs) are vulnerable to carefully crafted adversarial examples. Many advanced algorithms have been proposed to generate adversarial examples by leveraging the $\mathcal{L}_p$ distance for penalizing perturbations. Researchers have explored different defense methods to defend against such adversarial attacks. While the effectiveness of $\mathcal{L}_p$ distance as a metric of perceptual quality remains an active research area, in this paper we will instead focus on a different type of perturbation, namely spatial transformation, as opposed to manipulating the pixel values directly as in prior works. Perturbations generated through spatial transformation could result in large $\mathcal{L}_p$ distance measures, but our extensive experiments show that such spatially transformed adversarial examples are perceptually realistic and more difficult to defend against with existing defense systems. This potentially provides a new direction in adversarial example generation and the design of corresponding defenses. We visualize the spatial transformation based perturbation for different examples and show that our technique can produce realistic adversarial examples with smooth image deformation. Finally, we visualize the attention of deep networks with different types of adversarial examples to better understand how these examples are interpreted.

Motivation & Objective

• Motivate exploration of perturbations beyond Lp pixel-space distortions.
• Introduce a geometric attack that minimizes local spatial distortion while achieving misclassification.
• Demonstrate perceptual realism of spatially transformed adversarial examples across datasets (MNIST, CIFAR-10, ImageNet).
• Analyze defense robustness and attention mechanisms under stAdv perturbations.

Proposed method

• Represent adversarial perturbations as a per-pixel flow field f that maps adversarial image pixels to original image pixels via bilinear interpolation.
• Define an attack objective that combines a misclassification loss with a flow-regularization term encouraging smooth, localized deformation.
• Use the Carlini-Wagner style loss for targeted attacks to optimize g(x_adv) toward a specified target class.
• Regularize the flow with a total-variation-like loss to enforce locally smooth transformations (L_flow).
• Optimize via L-BFGS with backtracking to obtain the optimal flow field that yields the adversarial image.
• Visualize the flow fields to show locality and edge-focused distortions.

Experimental results

Research questions

• RQ1 Can spatially transformed perturbations degrade classifier accuracy while preserving perceptual realism?
• RQ2 How do stAdv adversarial examples perform against standard defenses including FGSM, C&W, and adversarial training?
• RQ3 Do stAdv perturbations produce attention shifts in networks, and how do robust models respond?

Key findings

• stAdv produces perceptually realistic adversarial examples on MNIST, CIFAR-10, and ImageNet by smoothly deforming images rather than altering pixel values.
• The optimized flow fields are locally smooth and often focus on object edges or regions critical to recognition.
• stAdv achieves high attack success rates and remains challenging for several defense strategies, including adversarial training variants.
• CAM visualizations show that stAdv can redirect network attention, and robust models remain susceptible to stAdv attacks.
• Mean blur defenses provide limited protection against stAdv compared to other attacks, and adaptive attacks can recover robustness vulnerabilities.