OTI: A Model-free and Visually Interpretable Measure of Image Attackability

TL;DR

This paper introduces OTI, a novel, model-free, visually interpretable measure of image attackability based on texture intensity, addressing limitations of prior methods that rely on models and lack interpretability.

Contribution

The paper proposes OTI, a new texture-based attackability measure that is model-free and visually interpretable, with theoretical foundations and demonstrated effectiveness.

Findings

OTI effectively measures image attackability across various scenarios.

OTI is computationally efficient and provides visual insights into attackability.

Experiments show OTI correlates well with adversarial robustness.

Abstract

Despite the tremendous success of neural networks, benign images can be corrupted by adversarial perturbations to deceive these models. Intriguingly, images differ in their attackability. Specifically, given an attack configuration, some images are easily corrupted, whereas others are more resistant. Evaluating image attackability has important applications in active learning, adversarial training, and attack enhancement. This prompts a growing interest in developing attackability measures. However, existing methods are scarce and suffer from two major limitations: (1) They rely on a model proxy to provide prior knowledge (e.g., gradients or minimal perturbation) to extract model-dependent image features. Unfortunately, in practice, many task-specific models are not readily accessible. (2) Extracted features characterizing image attackability lack visual interpretability, obscuring their direct relationship with the images. To address these, we propose a novel Object Texture Intensity (OTI), a model-free and visually interpretable measure of image attackability, which measures image attackability as the texture intensity of the image's semantic object. Theoretically, we describe the principles of OTI from the perspectives of decision boundaries as well as the mid- and high-frequency characteristics of adversarial perturbations. Comprehensive experiments demonstrate that OTI is effective and computationally efficient. In addition, our OTI provides the adversarial machine learning community with a visual understanding of attackability.