Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance.
🔬 Downloadable at: https://arxiv.org/abs/1911.02466. CVPR 2020.
Introduces a novel method to incorporate perceptual color distances into adversarial attacks. Adversarial examples constructed with this method have large
Two novel adversarial attacks:
Here, we take a solid color image (left) and add the same perturbations to the green channel (middle) and to the blue channel (right). Image demo below:
Although both RGB channels were perturbed identically, the perturbations are only visible in the green channel. The reason is that color as it is perceived by the human eye does not change uniformly over distance in RGB space. Relatively large changes in RGB space may remain unnoticeable if they lead to small perceived color difference.
PerC-C&W adopts the joint optimization of the well-known C&W, but replaces the original penalty on the L2 norm with a new one based on perceptual color difference.
PerC-C&W requires time consuming binary search in order to find an optimal
Examples of adversarial images generated by five different approaches with high confidence.
I-FGSM achieves higher robustness but ends up with worse image qualities. PerC-C&W and PerC-AL consistently achieve better overall results.
I-FGSM, while outperforms others, uses excessive perturbations. Our PerC approaches are best among others.
With the help of additional structural information, perturbations in the smooth regions are suppressed, while more changes, which are barely perceptible, are triggered in the area with rich visual variation.
Perceptual color distance is able to improve imperceptibility, especially in smooth, saturated regions. Nice work. I believe perturbing specific color channels and/or different color channels in different image semantic areas may be a valid adversarial attack approach.