[Paper Review] Traits & Transferability of Adversarial Examples against Instance Segmentation & Object Detection.

Raghav Gurbaxani, Shivank Mishra|arXiv (Cornell University)|Aug 4, 2018

Adversarial Robustness in Machine Learning18 references3 citations

TL;DR

This paper investigates the transferability and robustness of adversarial examples against instance segmentation and object detection models. Using FGSM, DeepFool, and C&W L2 attacks, it demonstrates that adversarial perturbations lose effectiveness under real-world transformations like scaling, rotation, and lighting changes—especially beyond a critical threshold—limiting their cross-network and cross-task transferability, particularly in complex vision pipelines.

ABSTRACT

Despite the recent advancements in deploying neural networks for image classification, it has been found that adversarial examples are able to fool these models leading them to misclassify the images. Since these models are now being widely deployed, we provide an insight on the threat of these adversarial examples by evaluating their characteristics and transferability to more complex models that utilize Image Classification as a subtask. We demonstrate the ineffectiveness of adversarial examples when applied to Instance Segmentation & Object Detection models. We show that this ineffectiveness arises from the inability of adversarial examples to withstand transformations such as scaling or a change in lighting conditions. Moreover, we show that there exists a small threshold below which the adversarial property is retained while applying these input transformations. Additionally, these attacks demonstrate weak cross-network transferability across neural network architectures, e.g. VGG16 and ResNet50, however, the attack may fool both the networks if passed sequentially through networks during its formation. The lack of scalability and transferability challenges the question of how adversarial images would be effective in the real world.

Motivation & Objective

• To evaluate the effectiveness of adversarial examples in fooling complex vision models like instance segmentation and object detection.
• To investigate how real-world image transformations (scaling, rotation, lighting) affect adversarial robustness.
• To assess cross-network transferability of adversarial attacks across different architectures (e.g., VGG16, ResNet50).
• To explore whether adversarial examples can transfer across different tasks, such as from classification to captioning or detection.
• To determine if sequential adversarial generation across networks enhances fooling capability on multiple models.

Proposed method

• Applied targeted and untargeted FGSM, DeepFool, and C&W L2 attacks on ImageNet-pretrained models.
• Applied input transformations including cropping, scaling, rotation, and lighting adjustments to evaluate robustness.
• Used a threshold-based analysis to identify the minimum perturbation size below which adversarial properties are retained under transformations.
• Evaluated transferability across architectures using cross-network (same dataset, different models) and cross-task (different dataset, similar architecture) settings.
• Generated adversarial images sequentially through multiple networks (e.g., ResNet50 → VGG16) to test simultaneous fooling capability.
• Evaluated attack success on downstream tasks: instance segmentation, object detection, and image captioning using pre-trained models.

Experimental results

Research questions

• RQ1 How do common image transformations (scaling, rotation, lighting) affect the adversarial robustness of adversarial examples in complex vision tasks?
• RQ2 What is the threshold below which adversarial perturbations remain effective after transformations?
• RQ3 To what extent do adversarial attacks transfer across different neural network architectures (e.g., VGG16 vs. ResNet50) on ImageNet?
• RQ4 Can adversarial examples successfully fool instance segmentation and object detection models under real-world conditions?
• RQ5 Does sequential adversarial generation across multiple networks enhance transferability and fooling capability on multiple models simultaneously?

Key findings

• Adversarial examples lose their fooling capability under common real-world transformations such as scaling, rotation, and lighting changes, especially beyond a critical threshold.
• A minimum threshold exists below which adversarial properties are preserved under transformations, indicating a region of robustness.
• Transferability of adversarial examples across different architectures (e.g., VGG16 and ResNet50) is weak, with low success rates on ImageNet.
• Adversarial attacks fail to transfer effectively to instance segmentation and object detection models due to their reliance on cropping and localized classification.
• Sequential adversarial generation (e.g., generating an adversarial image for ResNet50 and then using it to generate another for VGG16) can result in a single image fooling both networks simultaneously.
• Adversarial examples are not transferable to image captioning models unless the training setup is specifically aligned with prior work, indicating task-specific sensitivity.