Prevention from Automated Analysis Services with Object-Level Adversarial Examples

我们提出了两个保护系统的基础上对抗的例子。在第一个系统中，我们通过自动识别可保护区域来保护人们免受人类实例分割网络的影响，以最大限度地减少对图像质量的影响，并合成不显眼和自然的对抗性纹理。该系统已在CVPR研讨会2021上发布。在第二个系统中，我们保护位置隐私对地标识别系统。特别是，我们引入了掩码引导的多模态投影梯度下降（MM-PGD）来提高对各种深度模型的保护。我们还研究了不同的保护区域识别策略，以抵御黑盒地标识别系统，而不需要太多的图像处理。该工作已被WIFS 2022接受。我们还分析了对抗性示例的类感知可迁移性，以显示对抗性示例的非目标可迁移性与相同错误之间的强联系。我们证明了非鲁棒特征可以通过扩展Ilyas等人的框架来全面解释不同错误和相同错误之间的差异。特别是，我们证明了当对抗性示例中的操纵非鲁棒特征被多个模型不同地使用时，这些模型可能会对对抗性示例进行不同的分类。这项工作被WACV 2023接受。

We proposed two protection systems based on adversarial examples. In the first system, we protect people from human instance segmentation networks by automatically identifying protectable regions to minimize the effect on image quality and synthesizing inconspicuous and natural adversarial textures. This system was published at CVPR Workshops 2021. In the second system, we protect location privacy against landmark recognition systems. In particular, we introduce mask-guided multimodal projected gradient descent (MM-PGD) to improve the protection against various deep models. We also investigated different protectable region identification strategies to defend against black-box landmark recognition systems without the need for much image manipulation. This work was accepted to WIFS 2022.We also analyzed class-aware transferability of adversarial examples to show the strong connection between non-targeted transferability of adversarial examples and same mistakes. We demonstrated that non-robust features can comprehensively explain the difference between a different mistake and a same mistake by extending the framework of Ilyas et al. In particular, we showed that when the manipulated nonrobust features in an adversarial examples are differently used by multiple models, those models may classify the adversarial examples differently. This work was accepted to WACV 2023.