Human can easily recognize visual objects with lost information: even losing most details with only contour reserved, e.g. cartoon. However, in terms of visual perception of Deep Neural Networks (DNNs), the ability for recognizing abstract objects (visual objects with lost information) is still a challenge. In this work, we investigate this issue from an adversarial viewpoint: will the performance of DNNs decrease even for the images only losing a little information? Towards this end, we propose a novel adversarial attack, named \textit{AdvDrop}, which crafts adversarial examples by dropping existing information of images. Previously, most adversarial attacks add extra disturbing information on clean images explicitly. Opposite to previous works, our proposed work explores the adversarial robustness of DNN models in a novel perspective by dropping imperceptible details to craft adversarial examples. We demonstrate the effectiveness of \textit{AdvDrop} by extensive experiments, and show that this new type of adversarial examples is more difficult to be defended by current defense systems.
翻译:人类可以很容易地识别丢失信息的视觉物体:即使丢失了大部分细节,只保留了直线,例如卡通。然而,从深神经网络(DNNs)的视觉观感来看,识别抽象物体(丢失信息的视觉物体)的能力仍然是一个挑战。在这项工作中,我们从一个敌对的观点来调查这一问题:即使图像只是丢失了一点信息,DNs的表现是否还会减少?为此,我们提议进行一场新颖的对抗性攻击,名为\ textit{AdvDrop},通过丢弃现有图像信息来制作对抗性攻击的例子。以前,大多数对抗性攻击都明显增加了关于清洁图像的额外令人不安的信息。与以往的作品不同,我们拟议的工作从新颖的角度探索DNN模式的对抗性强健性,通过大量实验,我们展示了\textit{AdvDrop}的有效性,并表明目前防御系统更难维护这种新型的对抗性例子。