Defense-Friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty

Camilo Pestana, Wei Liu, David Glance, Ajmal Mian

Research output: Chapter in Book/Conference paperConference paperpeer-review

1 Citation (Scopus)
32 Downloads (Pure)

Abstract

Dataset bias is a problem in adversarial machine learning, especially in the evaluation of defenses. An adversarial attack or defense algorithm may show better results on the reported dataset than can be replicated on other datasets. Even when two algorithms are compared, their relative performance can vary depending on the dataset. Deep learning offers state-of-the-art solutions for image recognition, but deep models are vulnerable even to small perturbations. Research in this area focuses primarily on adversarial attacks and defense algorithms. In this paper, we report for the first time, a class of robust images that are both resilient to attacks and that recover better than random images under adversarial attacks using simple defense techniques. Thus, a test dataset with a high proportion of robust images gives a misleading impression about the performance of an adversarial attack or defense. We propose three metrics to determine the proportion of robust images in a dataset and provide scoring to determine the dataset bias. We also provide an ImageNet-R dataset of 15000+ robust images to facilitate further research on this intriguing phenomenon of image strength under attack. Our dataset, combined with the proposed metrics, is valuable for unbiased benchmarking of adversarial attack and defense algorithms. © 2021 IEEE.
Original languageEnglish
Title of host publicationConference Proceedings 2021 IEEE Winter Conference on Applications of Computer Vision (WACV)
PublisherIEEE, Institute of Electrical and Electronics Engineers
Pages556-565
Number of pages10
DOIs
Publication statusPublished - 5 Jan 2021
Event2021 IEEE Winter Conference on Applications of Computer Vision - Virtual, Virtual
Duration: 5 Jan 20219 Jan 2021

Conference

Conference2021 IEEE Winter Conference on Applications of Computer Vision
Abbreviated titleWACV 2021
Country/TerritoryVirtual
Period5/01/219/01/21

Fingerprint

Dive into the research topics of 'Defense-Friendly Images in Adversarial Attacks: Dataset and Metrics for Perturbation Difficulty'. Together they form a unique fingerprint.

Cite this