| Reference : A strategy creating high-resolution adversarial images against convolutional neural n... |
| Scientific journals : Article | |||
| Engineering, computing & technology : Computer science | |||
| Computational Sciences | |||
| http://hdl.handle.net/10993/55235 | |||
| A strategy creating high-resolution adversarial images against convolutional neural networks and a feasibility study on 10 CNNs | |
| English | |
Leprevost, Franck  [University of Luxembourg > Faculty of Science, Technology and Medicine (FSTM) > Department of Computer Science (DCS) >] | |
| Topal, Ali Osman [University of Luxembourg > Faculty of Science, Technology and Medicine (FSTM) > Department of Computer Science (DCS) >] | |
| Avdusinovic, Elmir [] | |
| Chitic, Ioana Raluca [University of Luxembourg > Faculty of Science, Technology and Medicine (FSTM) > Department of Computer Science (DCS) >] | |
| 22-Oct-2022 | |
| Journal of Information and Telecommunication | |
| Taylor & Francis Group | |
| 7 | |
| 1 | |
| 89-119 | |
| Yes | |
| International | |
| 2475-1839 | |
| 2475-1847 | |
| United Kingdom | |
| [en] Black-box attack ; Convolutional Neural Network ; Evolutionary Algorithm ; high-resolution adversarial image | |
| [en] To perform image recognition, Convolutional Neural Networks (CNNs) assess any image by first resizing it to its input size. In particular, high-resolution images are scaled down, say to 224×244
for CNNs trained on ImageNet. So far, existing attacks, aiming at creating an adversarial image that a CNN would misclassify while a human would not notice any difference between the modified and unmodified images, proceed by creating adversarial noise in the 224×244 resized domain and not in the high-resolution domain. The complexity of directly attacking high-resolution images leads to challenges in terms of speed, adversity and visual quality, making these attacks infeasible in practice. We design an indirect attack strategy that lifts to the high-resolution domain any existing attack that works efficiently in the CNN's input size domain. Adversarial noise created via this method is of the same size as the original image. We apply this approach to 10 state-of-the-art CNNs trained on ImageNet, with an evolutionary algorithm-based attack. Our method succeeded in 900 out of 1000 trials to create such adversarial images, that CNNs classify with probability ≥0.55 in the adversarial category. Our indirect attack is the first effective method at creating adversarial images in the high-resolution domain. | |
| University of Luxembourg: High Performance Computing - ULHPC | |
| Researchers ; Professionals ; Students | |
| http://hdl.handle.net/10993/55235 | |
| 10.1080/24751839.2022.2132586 | |
| https://www.tandfonline.com/doi/full/10.1080/24751839.2022.2132586 |
| File(s) associated to this reference | ||||||||||||||
|
Fulltext file(s):
| ||||||||||||||
All documents in ORBilu are protected by a user license.
