Prevention from Automated Analysis Services with Object-Level Adversarial Examples

我们提出了两个基于对抗性例子的保护系统。在第一个系统中，我们通过自动识别可保护区域以最小化对图像质量的影响以及合成不明显和自然的对抗性纹理来保护人们免受人类实例分割网络的影响。该系统已在2021年CVPR研讨会上发布。在第二个系统中，我们保护位置隐私不受地标识别系统的影响。特别是，我们引入了掩模引导的多峰投影梯度下降(MM-PGD)算法，以提高对各种深度模型的保护。我们还研究了不同的可保护区域识别策略来防御黑盒地标识别系统，而不需要太多的图像处理。这项工作被WIFS2022接受，我们还分析了对抗性范例的类别意识转移，以表明对抗性范例的非目标转移与相同错误之间的密切联系。通过扩展Ilyas等人的框架，我们证明了非稳健特征可以全面地解释不同错误和相同错误之间的差异。特别地，我们证明了当对抗性例子中被操纵的非稳健特征被多个模型不同地使用时，这些模型可能会对对抗性例子进行不同的分类。这项工作被WACV 2023接受。

We proposed two protection systems based on adversarial examples. In the first system, we protect people from human instance segmentation networks by automatically identifying protectable regions to minimize the effect on image quality and synthesizing inconspicuous and natural adversarial textures. This system was published at CVPR Workshops 2021. In the second system, we protect location privacy against landmark recognition systems. In particular, we introduce mask-guided multimodal projected gradient descent (MM-PGD) to improve the protection against various deep models. We also investigated different protectable region identification strategies to defend against black-box landmark recognition systems without the need for much image manipulation. This work was accepted to WIFS 2022.We also analyzed class-aware transferability of adversarial examples to show the strong connection between non-targeted transferability of adversarial examples and same mistakes. We demonstrated that non-robust features can comprehensively explain the difference between a different mistake and a same mistake by extending the framework of Ilyas et al. In particular, we showed that when the manipulated nonrobust features in an adversarial examples are differently used by multiple models, those models may classify the adversarial examples differently. This work was accepted to WACV 2023.