Bo Luo, Yannan Liu, Lingxiao Wei, Qiang Xu. Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks. AAAI, 2018.

Luo et al. propose a method to compute less-perceptible adversarial examples compared to standard methods constrained in $L_p$ norms. In particular, they consider the local variation of the image and argue that humans are more likely to notice larger variations in low-variance regions than vice-versa. The sensitivity of a pixel is therefore defined as one over its local variance, meaning that it is more sensitive to perturbations. They propose a simple algorithm which iteratively sorts pixels by their sensitivity and then selects a subset to perturb each step. Personally, I wonder why they do not integrate the sensitivity into simple projected gradient descent attacks, where a Lagrange multiplier is used to enforce the $L_p$ norm of the sensitivity weighted perturbation. However, qualitative results show that their approach also works well and results in (partly) less perceptible changes, see Figure 1.

Figure 1: Qualitative results including a comparison to other state-of-the-art attacks.

What is your opinion on the summarized work? Or do you know related work that is of interest? Let me know your thoughts in the comments below: