EdgeFool: An Adversarial Image Enhancement Filter

TL;DR

EdgeFool is a novel adversarial image enhancement filter that creates structure-aware perturbations by learning to enhance image details, effectively misleading classifiers while remaining less detectable.

Contribution

It introduces a structure-aware adversarial perturbation method using a neural network trained with a multi-task loss for image detail enhancement and misclassification.

Findings

Effective against multiple classifiers including ResNet and AlexNet.

Outperforms six existing adversarial methods in experiments.

Generates less perceptible and more robust adversarial images.

Abstract

Adversarial examples are intentionally perturbed images that mislead classifiers. These images can, however, be easily detected using denoising algorithms, when high-frequency spatial perturbations are used, or can be noticed by humans, when perturbations are large. In this paper, we propose EdgeFool, an adversarial image enhancement filter that learns structure-aware adversarial perturbations. EdgeFool generates adversarial images with perturbations that enhance image details via training a fully convolutional neural network end-to-end with a multi-task loss function. This loss function accounts for both image detail enhancement and class misleading objectives. We evaluate EdgeFool on three classifiers (ResNet-50, ResNet-18 and AlexNet) using two datasets (ImageNet and Private-Places365) and compare it with six adversarial methods (DeepFool, SparseFool, Carlini-Wagner, SemanticAdv, Non-targeted and Private Fast Gradient Sign Methods). Code is available at https://github.com/smartcameras/EdgeFool.git.