[论文解读] Making Images Undiscoverable from Co-Saliency Detection.

Ruijun Gao, Qing Guo+5 more|arXiv (Cornell University)|Sep 19, 2020

Adversarial Robustness in Machine Learning被引用 18

一句话总结

本文提出Jadena，这是首个针对共显著性检测的黑盒对抗攻击方法，通过联合优化图像曝光与局部噪声，并利用高层特征级别的对比敏感损失函数，使显著性对象难以被检测。该方法在无需访问目标模型的情况下，显著降低了CoSOD基准测试的性能，有效保护了敏感内容不被共显著性方法提取。

ABSTRACT

In recent years, co-saliency object detection (CoSOD) has achieved significant progress and played a key role in the retrieval-related tasks, e.g., image retrieval and video foreground detection. Nevertheless, it also inevitably posts a totally new safety and security problem, i.e., how to prevent high-profile and personal-sensitive contents from being extracted by the powerful CoSOD methods. In this paper, we address this problem from the perspective of adversarial attack and identify a novel task, i.e., adversarial co-saliency attack: given an image selected from an image group containing some common and salient objects, how to generate an adversarial version that can mislead CoSOD methods to predict incorrect co-salient regions. Note that, compared with general adversarial attacks for classification, this new task introduces two extra challenges for existing whitebox adversarial noise attacks: (1) low success rate due to the diverse appearance of images in the image group; (2) low transferability across CoSOD methods due to the considerable difference between CoSOD pipelines. To address these challenges, we propose the very first blackbox joint adversarial exposure & noise attack (Jadena) where we jointly and locally tune the exposure and additive perturbations of the image according to a newly designed high-feature-level contrast-sensitive loss function. Our method, without any information of the state-of-the-art CoSOD methods, leads to significant performance degradation on various co-saliency detection datasets and make the co-salient objects undetectable, which can be strongly practical in nowadays where large-scale personal photos are shared on the internet and should be properly and securely preserved.

研究动机与目标

• 为应对共显著性检测（CoSOD）方法可能暴露敏感或高关注度内容的新兴安全风险。
• 识别并形式化一种新攻击范式：对抗性共显著性攻击，即通过对抗性扰动误导CoSOD模型检测出错误的显著区域。
• 解决该任务中的两个关键挑战：由于图像多样性导致的成功率低，以及在不同CoSOD流水线间迁移性差。
• 开发一种无需访问目标CoSOD模型的黑盒方法，确保在真实场景中的实际可用性。

提出的方法

• 提出一种新颖的黑盒对抗攻击框架Jadena，用于共显著性检测。
• 在局部范围内联合优化图像曝光与加性扰动，以最大化对抗效果。
• 采用高层特征级别的对比敏感损失函数，增强对共显著区域语义与结构差异的敏感度。
• 损失函数的设计旨在最大化原始图像与对抗图像在共显著性检测上下文中的特征差异。
• 该方法完全在黑盒设置下运行，无需目标CoSOD模型的架构或梯度信息。
• 攻击端到端可训练，且在多种CoSOD数据集与流水线中均表现有效。

实验结果

研究问题

• RQ1 在无法访问目标模型架构或梯度信息的情况下，黑盒对抗攻击能否有效干扰共显著性检测？
• RQ2 如何联合优化曝光与噪声的对抗扰动，以最大程度导致CoSOD模型失效？
• RQ3 所提出的高层特征级别对比敏感损失相较于标准损失函数，在攻击成功率方面提升程度如何？
• RQ4 该攻击在不同架构与训练流水线的CoSOD方法间具有多大程度的可迁移性？
• RQ5 当图像组内图像外观差异显著时，该攻击是否仍能可靠地使共显著性对象不可检测？

主要发现

• Jadena在多个CoSOD基准数据集上实现了显著的性能下降，使共显著性对象完全不可检测。
• 尽管输入组内图像外观存在多样性，该攻击仍表现出极高的成功率。
• 该方法在不同CoSOD流水线间展现出强大的可迁移性，表明对架构差异具有鲁棒性。
• 高层特征级别对比敏感损失对有效攻击性能至关重要，显著优于标准损失函数。
• Jadena的黑盒特性使其能够在模型信息不可用的真实场景中实现实际部署。
• 该方法无需任何模型特定知识，即可成功规避多种先进CoSOD模型的检测。