Unrestricted Adversarial Perturbations via Semantic Manipulation.
This repo contains the code for our ICLR 2020 conference paper "Unrestricted Adversarial Perturbations via Semantic Manipulation". A version of this paper was also presented at CVPR 2019 Adversarial Machine Learning workshop in an oral talk "Big but Imperceptible Adversarial Perturbations via Semantic Manipulation".
tldr: We introduce unrestricted perturbations that manipulate semantically meaningful image-based visual descriptors - color and texture - in order to generate effective and photorealistic adversarial examples.
Abstract: Machine learning models, especially deep neural networks (DNNs), have been shown to be vulnerable against adversarial examples which are carefully crafted samples with a small magnitude of the perturbation. Such adversarial perturbations are usually restricted by bounding their $\mathcal{L}_p$ norm such that they are imperceptible, and thus many current defenses can exploit this property to reduce their adversarial impact. In this paper, we instead introduce "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors - color and texture - in order to generate effective and photorealistic adversarial examples. We show that these semantically aware perturbations are effective against JPEG compression, feature squeezing and adversarially trained model. We also show that the proposed methods can effectively be applied to both image classification and image captioning tasks on complex datasets such as ImageNet and MSCOCO. In addition, we conduct comprehensive user studies to show that our generated semantic adversarial examples are photorealistic to humans despite large magnitude perturbations when compared to other attacks.
Hi, thanks for your interesting work! I got a little confused about the calculation about the style loss, especially class CrossGramMatrix() (line 124) and layer_losses = [weights[a] * loss_fns[a](A,B, Crossstyle_targets[a])/CrossGramMatrix()(A,B).std() for a,(A,B) in enumerate(Cross_out)] (line 285) in the code. My questions are:
In CorssGramMatrix, why is the G calculated by torch.bmm divided by h1*w1 then? I'm not very clear about the Gram Matrix before and just get some knowledge about it from Gatys et al. 2015 and Yeh et al. 2020 from the reference of your paper. And in the paper, i didn't find the division in Eq.(4). Maybe I didn't get a clear definition about Gram Matrix? If so, please tell me and I will check more about that.
In line 285, the standard deviation of the Gram Matrix was divided, while $std(G_{ij}^{m,n}(I_v))$ was divided in Eq.(4). It seems that $G_{ij}^{m,n}(I_v))$ is not a matrix, so how to get its STD? Is it a typo? And, is this division the additional constraint on the variation in the gram matrices?
By the way, could you provide files or their links mentioned in iclr_tadv.py?
Apologize for my silly questions and thank your in advance!