I will be presenting our work on adversarial robustness at ICML'19 and CVPR'19 in Long Beach beginning next week!


Bo Luo, Yannan Liu, Lingxiao Wei, Qiang Xu. Towards Imperceptible and Robust Adversarial Example Attacks Against Neural Networks. AAAI, 2018.

Luo et al. propose a method to compute less-perceptible adversarial examples compared to standard methods constrained in $L_p$ norms. In particular, they consider the local variation of the image and argue that humans are more likely to notice larger variations in low-variance regions than vice-versa. The sensitivity of a pixel is therefore defined as one over its local variance, meaning that it is more sensitive to perturbations. They propose a simple algorithm which iteratively sorts pixels by their sensitivity and then selects a subset to perturb each step. Personally, I wonder why they do not integrate the sensitivity into simple projected gradient descent attacks, where a Lagrange multiplier is used to enforce the $L_p$ norm of the sensitivity weighted perturbation. However, qualitative results show that their approach also works well and results in (partly) less perceptible changes, see Figure 1.

Figure 1: Qualitative results including a comparison to other state-of-the-art attacks.

What is your opinion on the summarized work? Or do you know related work that is of interest? Let me know your thoughts in the comments below: