When Measures are Unreliable: Imperceptible Adversarial Perturbations toward Top-$k$ Multi-Label Learning

TL;DR

This paper introduces a new adversarial attack method for multi-label learning that remains imperceptible both visually and in measure-based metrics like Precision@$k$, effectively deceiving top-$k$ classifiers.

Contribution

It proposes the concept of measure imperceptibility and develops a novel loss function and algorithm to generate adversarial perturbations that evade both visual and measure-based detection.

Findings

Outperforms existing methods on benchmark datasets

Successfully deceives top-$k$ multi-label classifiers

Maintains imperceptibility in both visual and measure metrics

Abstract

With the great success of deep neural networks, adversarial learning has received widespread attention in various studies, ranging from multi-class learning to multi-label learning. However, existing adversarial attacks toward multi-label learning only pursue the traditional visual imperceptibility but ignore the new perceptible problem coming from measures such as Precision@$k$ and mAP@$k$. Specifically, when a well-trained multi-label classifier performs far below the expectation on some samples, the victim can easily realize that this performance degeneration stems from attack, rather than the model itself. Therefore, an ideal multi-labeling adversarial attack should manage to not only deceive visual perception but also evade monitoring of measures. To this end, this paper first proposes the concept of measure imperceptibility. Then, a novel loss function is devised to generate such adversarial perturbations that could achieve both visual and measure imperceptibility. Furthermore, an efficient algorithm, which enjoys a convex objective, is established to optimize this objective. Finally, extensive experiments on large-scale benchmark datasets, such as PASCAL VOC 2012, MS COCO, and NUS WIDE, demonstrate the superiority of our proposed method in attacking the top-$k$ multi-label systems.