Generating Adversarial Images in Quantized Domains - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue IEEE Transactions on Information Forensics and Security Année : 2022

Generating Adversarial Images in Quantized Domains

Résumé

Many adversarial attacks produce floating-point tensors which are no longer adversarial when converted to raster or JPEG images due to rounding. This paper proposes a method dedicated to quantize adversarial perturbations. This "smart" quantization is conveniently implemented as versatile post-processing. It can be used on top of any white-box attack targeting any model. Its principle is tantamount to a constrained optimization problem aiming to minimize the quantization error while keeping the image adversarial after quantization. A Lagrangian formulation is proposed and an appropriate search of the Lagrangian multiplier enables to increase the success rate. We also add a control mechanism of the ∞-distortion. Our method operates in both spatial and JPEG domains with little complexity. This study shows that forging adversarial images is not a hard constraint: our quantization does not introduce any extra distortion. Moreover, adversarial images quantized as JPEG also challenge defenses relying on the robustness of neural networks against JPEG compression.
Fichier principal
Vignette du fichier
paper.pdf (2.56 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03467692 , version 1 (06-12-2021)
hal-03467692 , version 2 (17-12-2021)

Identifiants

Citer

Benoit Bonnet, Teddy Furon, Patrick Bas. Generating Adversarial Images in Quantized Domains. IEEE Transactions on Information Forensics and Security, In press, ⟨10.1109/TIFS.2021.3138616⟩. ⟨hal-03467692v2⟩
134 Consultations
180 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More