AdvJND: Generating Adversarial Examples with Just Noticeable Difference

TL;DR

AdvJND introduces a novel method for generating adversarial examples that balances attack success and image quality by incorporating human visual perception, resulting in more concealed and realistic adversarial images.

Contribution

The paper proposes AdvJND, a new approach that integrates just noticeable difference coefficients to improve the concealment and quality of adversarial examples.

Findings

AdvJND achieves high attack success rates on multiple datasets.

Generated adversarial examples have noise distributions similar to original images.

AdvJND significantly improves the concealment of adversarial perturbations.

Abstract

Compared with traditional machine learning models, deep neural networks perform better, especially in image classification tasks. However, they are vulnerable to adversarial examples. Adding small perturbations on examples causes a good-performance model to misclassify the crafted examples, without category differences in the human eyes, and fools deep models successfully. There are two requirements for generating adversarial examples: the attack success rate and image fidelity metrics. Generally, perturbations are increased to ensure the adversarial examples' high attack success rate; however, the adversarial examples obtained have poor concealment. To alleviate the tradeoff between the attack success rate and image fidelity, we propose a method named AdvJND, adding visual model coefficients, just noticeable difference coefficients, in the constraint of a distortion function when generating adversarial examples. In fact, the visual subjective feeling of the human eyes is added as a priori information, which decides the distribution of perturbations, to improve the image quality of adversarial examples. We tested our method on the FashionMNIST, CIFAR10, and MiniImageNet datasets. Adversarial examples generated by our AdvJND algorithm yield gradient distributions that are similar to those of the original inputs. Hence, the crafted noise can be hidden in the original inputs, thus improving the attack concealment significantly.