This is an official release of the paper

Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity, CVPR 2022

[Paper]

Abstract: Current adversarial attack research reveals the vulnerability of learning-based classifiers against carefully crafted perturbations. However, most existing attack methods have inherent limitations in cross-dataset generalization as they rely on a classification layer with a closed set of categories. Furthermore, the perturbations generated by these methods may appear in regions easily perceptible to the human visual system (HVS). To circumvent the former problem, we propose a novel algorithm that attacks semantic similarity on feature representations. In this way, we are able to fool classifiers without limiting attacks to a specific dataset. For imperceptibility, we introduce the low-frequency constraint to limit perturbations within high-frequency components, ensuring perceptual similarity between adversarial examples and originals. Extensive experiments on three datasets (CIFAR-10, CIFAR-100, and ImageNet-1K) and three public online platforms indicate that our attack can yield misleading and transferable adversarial examples across architectures and datasets. Additionally, visualization results and quantitative performance (in terms of four different metrics) show that the proposed algorithm generates more imperceptible perturbations than the state-of-the-art methods. Our code will be publicly available.

• python ==3.6
• torch == 1.7.0
• torchvision >= 0.7
• numpy == 1.19.2
• Pillow == 8.0.1
• pywavelets

1. The data structure of Cifar10, Cifar100, ImageNet or any other datasets look like below. Please modify the dataloader at SSAH-Adversarial-master/main.py/ accordingly for your dataset structure.

/dataset/
├── cifar10
│   │   ├── cifar-10-python.tar.gz
├── cifar-100-python
│   │   ├── cifar-100-python.tar.gz
├── ILSVRC2012
│   ├── val
│   │   ├── n02328150

We provide six perceptural metrics to measure imperceptibility, including l_2, l_inf, FID, SSIM, CIEDE2000, and LF.

Your can add more metrics in

/utils/
├── eval_metric_utils.py

We trained a resnet20 model with 92.6% accuracy with CIFAR1010 and a resnet20 model with 69.63% accuracy with CIFAR100. If you want to have a test, you can download our pre-trained models with the Google Drivers. If you want to use our algorithm to attack your own trained model, you can always replace our models in the file checkpoints. If your want to calculate FID, you need to download pt_inception-2015-12-05-6726825d.pth in this Google Drive and put it in the file checkpoints.

CUDA_VISIBLE_DEVICES=0,1 bash scripts/cifar/cifar10-r20.sh

CUDA_VISIBLE_DEVICES=0,1 bash scripts/cifar/cifar100-r20.sh

CUDA_VISIBLE_DEVICES=0,1 bash scripts/cifar/Imagenet_val-r50.sh

Here we offer some experiment results. You can get more results in our paper.

if the code or method help you in the research, please cite the following paper:

@inproceedings{luo2022frequency,
  title={Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity},
  author={Luo, Cheng and Lin, Qinliang and Xie, Weicheng and Wu, Bizhu and Xie, Jinheng and Shen, Linlin},
  booktitle={Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition},
  pages={15315--15324},
  year={2022}
}