Smooth Adversarial Examples
This work addresses the issue of generating less perceptible adversarial examples for computer vision systems, though it is incremental as it builds on existing smoothing techniques with a perceptual twist.
The paper tackles the problem of improving the visual quality of adversarial examples by making perturbations locally smooth in flat image areas while allowing noise in textured regions and sharpness across edges, using Laplacian smoothing integrated into the attack pipeline. The result is an attack that achieves the same success probability as benchmarks but with lower distortion.
This paper investigates the visual quality of the adversarial examples. Recent papers propose to smooth the perturbations to get rid of high frequency artefacts. In this work, smoothing has a different meaning as it perceptually shapes the perturbation according to the visual content of the image to be attacked. The perturbation becomes locally smooth on the flat areas of the input image, but it may be noisy on its textured areas and sharp across its edges. This operation relies on Laplacian smoothing, well-known in graph signal processing, which we integrate in the attack pipeline. We benchmark several attacks with and without smoothing under a white-box scenario and evaluate their transferability. Despite the additional constraint of smoothness, our attack has the same probability of success at lower distortion.