Just Noticeable Difference for Machine Perception and Generation of Regularized Adversarial Images with Minimal Perturbation
This addresses the challenge of creating subtle adversarial examples for image classification and object detection, which is incremental as it builds on existing adversarial attack methods with improved regularization.
The paper tackles the problem of generating adversarial images that deceive machine learning models with minimal perturbation, by introducing a Just Noticeable Difference (JND)-inspired measure and a regularized algorithm. The result shows that the method produces more successful adversarial images with less perturbation compared to state-of-the-art methods like FGV, FSGM, and DeepFool on datasets such as CIFAR10, ImageNet, and MS COCO.
In this study, we introduce a measure for machine perception, inspired by the concept of Just Noticeable Difference (JND) of human perception. Based on this measure, we suggest an adversarial image generation algorithm, which iteratively distorts an image by an additive noise until the model detects the change in the image by outputting a false label. The noise added to the original image is defined as the gradient of the cost function of the model. A novel cost function is defined to explicitly minimize the amount of perturbation applied to the input image while enforcing the perceptual similarity between the adversarial and input images. For this purpose, the cost function is regularized by the well-known total variation and bounded range terms to meet the natural appearance of the adversarial image. We evaluate the adversarial images generated by our algorithm both qualitatively and quantitatively on CIFAR10, ImageNet, and MS COCO datasets. Our experiments on image classification and object detection tasks show that adversarial images generated by our JND method are both more successful in deceiving the recognition/detection models and less perturbed compared to the images generated by the state-of-the-art methods, namely, FGV, FSGM, and DeepFool methods.