Adaptive Image Adversarial Reprogramming Based on Noise Invisibility Factors

Abstract

Adversarial reprogramming is an attacking method against the deep neural networks.By adding a certain perturbation to the input image,the network could be made to execute the attacker’s specified task,i.e.,destroying the legitimate permission of the training network model.It is positive to deeply understand and investigate this kind of attacks for further designing the corresponding anti-reprogramming algorithms.This paper discusses the relationship between the location of perturbations and the performance of adversarial reprogramming.Specifically,the noise visibility function is used to evaluate the adversarial distortion for each local content,and obtain the masking matrix.Then,the adversarial perturbations are added adaptively to optimize the attacking task.Experimental results show that,for the state-of-the-art deep network models,the proposed algorithm can enhance the performance of adversarial reprogramming attack and improve the imperceptibility of modified image.

Keywords

• adversarial attack|adversarial reprogramming|adaptive perturbation|noise visibility function