Research map / Adversarial robustness and security / Attacks on text and graphs
Defending Against Physically Realizable Attacks on Image Classification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with rectangular occlusion attacks instead of whole-image Lp perturbations | Image classifiers on face recognition and traffic sign tasks · Physically realizable attacks | accuracy: over 90% | Helped |
| Use gradient-based rather than exhaustive location search (ablation) | DOA · LISA stop-sign attack (10^3 iterations) | accuracy: 90.5% -> 84% | Hurt |
| Use gradient-based rather than exhaustive location search (ablation) | DOA · Face eyeglass-frame attack | accuracy | Hurt |
| Change rectangle dimensions while keeping area roughly constant (ablation) | DOA · Face eyeglass-frame attack | accuracy | No clear effect |
| Use a square 7 × 7 rectangle rather than a 10 × 5 rectangle (ablation) | DOA · LISA stop-sign attack | accuracy | Helped |
| Increase the number of PGD iterations inside the rectangle from 7 to 20 (ablation) | DOA with exhaustive search and 10 × 5 rectangle · LISA stop-sign attack (10^2 iterations) | accuracy: 70.5% -> 85% | Helped |
| Increase PGD iterations inside the rectangle from 20 to 50 (ablation) | DOA with exhaustive search and 10 × 5 rectangle · LISA stop-sign attack (10^2 iterations) | accuracy: 85% -> 76.5% | Hurt |
| Use conventional adversarial training or randomized smoothing rather than ROA adversarial training | Image classifiers · Physical eyeglass-frame and sticker attacks | accuracy | Hurt |
| Increase the physical adversarial-patch region | Face recognition classifiers · Adversarial patch attack | accuracy: 20% | Mixed |
| Train with curriculum adversarial training at ε = 32 (ablation) | Traffic sign classifier · Clean traffic-sign data | accuracy: 65.63% | Hurt |
| Train with curriculum adversarial training at ε = 32 (ablation) | Face recognition classifier · Clean face data | accuracy: 80.85% | Hurt |
| Use more PGD iterations for conventional adversarial training (ablation) | Face and traffic-sign classifiers · Physical attacks | accuracy | No clear effect |
Closest papers by meaning
- Adversarial camera stickers: A physical camera-based attack on deep learning systems (ICML 2019 · similarity 0.89)
- Connecting the Digital and Physical World: Improving the Robustness of Adversarial Attacks (AAAI 2019 · similarity 0.89)
- Robust Physical-World Attacks on Deep Learning Visual Classification (CVPR 2018 · similarity 0.89)
- Countering Adversarial Images using Input Transformations (ICLR 2018 · similarity 0.87)
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples (ICLR 2018 · similarity 0.87)
- Are adversarial examples inevitable? (ICLR 2019 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.