LaVAN: Localized and Visible Adversarial Noise

TL;DR

This paper introduces a method for creating localized, visible adversarial noise confined to small image patches that can fool deep image classifiers without covering the main object, demonstrating high transferability and success rates.

Contribution

The authors propose a novel approach to generate localized adversarial noise that is visible but confined, which can successfully deceive state-of-the-art classifiers and transfer across images and locations.

Findings

Localized adversarial noise can cover only 2% of pixels.

Such noise can fool Inception v3 with high success rates.

The adversarial patches are transferable across images and positions.

Abstract

Most works on adversarial examples for deep-learning based image classifiers use noise that, while small, covers the entire image. We explore the case where the noise is allowed to be visible but confined to a small, localized patch of the image, without covering any of the main object(s) in the image. We show that it is possible to generate localized adversarial noises that cover only 2% of the pixels in the image, none of them over the main object, and that are transferable across images and locations, and successfully fool a state-of-the-art Inception v3 model with very high success rates.