Synthesizing Robust Adversarial Examples
Anish Athalye Logan Engstrom Andrew Ilyas Kevin Kwok
Abstract
Standard methods for generating adversarial examples for neural networks do not consistently fool neural network classifiers in the physical world due to a combination of viewpoint shifts, camera noise, and other natural transformations, limiting their relevance to real-world systems. We demonstrate the existence of robust 3D adversarial objects, and we present the first algorithm for synthesizing examples that are adversarial over a chosen distribution of transformations. We synthesize two-dimensional adversarial images that are robust to noise, distortion, and affine transformation. We apply our algorithm to complex three-dimensional objects, using 3D-printing to manufacture the first physical adversarial objects. Our results demonstrate the existence of 3D adversarial objects in the physical world.
中文速览
针对神经网络的对抗样本（adversarial examples）此前只在二维平面上有效，一旦换个角度拍摄或受到光照、噪声干扰就会失效，让人觉得现实世界中的AI系统其实相对安全。研究者提出了一种名为"变换期望"（Expectation Over Transformation，EOT）的算法，核心思路是在优化对抗扰动时，把拍摄角度变化、光照、噪声等各种真实世界变换都纳入期望值计算，从而让生成的对抗样本在整个变换分布上同时保持欺骗性。他们将这一方法推广到三维场景，把3D渲染过程也作为变换的一部分，优化物体表面纹理，最终通过3D打印制造出了全球首批物理世界中的三维对抗物体——例如一只乌龟模型，从任意角度拍照后都被ImageNet分类器稳定识别为步枪。实验表明，二维对抗图像的平均欺骗成功率高达96.4%，三维打印物体在真实拍摄条件下也表现出强劲的对抗性，这证明对抗样本并非只是理论威胁，而是对现实AI视觉系统构成切实风险。
原文 arXiv:1707.07397;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1707.07397v3