Procedural Noise Adversarial Examples for Black-Box Attacks on Deep Convolutional Networks

Deep Convolutional Networks (DCNs) have been shown to be vulnerable to adversarial examples---perturbed inputs specifically designed to produce intentional errors in the learning algorithms at test time. Existing input-agnostic adversarial perturbations exhibit interesting visual patterns that are currently unexplained. In this paper, we introduce a structured approach for generating Universal Adversarial Perturbations (UAPs) with procedural noise functions. Our approach unveils the systemic vulnerability of popular DCN models like Inception v3 and YOLO v3, with single noise patterns able to fool a model on up to 90% of the dataset. Procedural noise allows us to generate a distribution of UAPs with high universal evasion rates using only a few parameters. Additionally, we propose Bayesian optimization to efficiently learn procedural noise parameters to construct inexpensive untargeted black-box attacks. We demonstrate that it can achieve an average of less than 10 queries per successful attack, a 100-fold improvement on existing methods. We further motivate the use of input-agnostic defences to increase the stability of models to adversarial perturbations. The universality of our attacks suggests that DCN models may be sensitive to aggregations of low-level class-agnostic features. These findings give insight on the nature of some universal adversarial perturbations and how they could be generated in other applications.Comment: 16 pages, 10 figures. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS '19

Feature discrimination learning transfers to noisy displays in complex stimuli

Introduction: Perception under noisy conditions requires not only feature identification but also a process whereby target features are selected and noise is filtered out (e.g., when identifying an animal hiding in the savannah). Interestingly, previous perceptual learning studies demonstrated the utility of training feature representation (without noise) for improving discrimination under noisy conditions. Furthermore, learning to filter out noise also appears to transfer to other perceptual task under similar noisy conditions. However, such learning transfer effects were thus far demonstrated predominantly in simple stimuli. Here we sought to explore whether similar learning transfer can be observed with complex real-world stimuli.Methods: We assessed the feature-to-noise transfer effect by using complex stimuli of human faces. We first examined participants' performance on a face-noise task following either training in the same task, or in a different face-feature task. Second, we assessed the transfer effect across different noise tasks defined by stimulus complexity, simple stimuli (Gabor) and complex stimuli (faces).Results: We found a clear learning transfer effect in the face-noise task following learning of face features. In contrast, we did not find transfer effect across the different noise tasks (from Gabor-noise to face-noise).Conclusion: These results extend previous findings regarding transfer of feature learning to noisy conditions using real-life stimuli

Improving visual functions in adult amblyopia with combined perceptual training and transcranial random noise stimulation (tRNS): a pilot study

Amblyopia is a visual disorder due to an abnormal pattern of functional connectivity of the visual cortex and characterized by several visual deficits of spatial vision including impairments of visual acuity (VA) and of the contrast sensitivity function (CSF). Despite being a developmental disorder caused by reduced visual stimulation during early life (critical period), several studies have shown that extensive visual perceptual training can improve VA and CSF in people with amblyopia even in adulthood. With the present study we assessed whether a much shorter perceptual training regime, in association with high-frequency transcranial electrical stimulation (hf-tRNS), was able to improve visual functions in a group of adult participants with amblyopia. Results show that, in comparison with previous studies where a large number sessions with a similar training regime were used (Polat et al., 2004), here just eight sessions of training in contrast detection under lateral masking conditions combined with hf-tRNS, were able to substantially improve VA and CSF in adults with amblyopia

From white elephant to Nobel Prize: Dennis Gabor’s wavefront reconstruction

Dennis Gabor devised a new concept for optical imaging in 1947 that went by a variety of names over the following decade: holoscopy, wavefront reconstruction, interference microscopy, diffraction microscopy and Gaboroscopy. A well-connected and creative research engineer, Gabor worked actively to publicize and exploit his concept, but the scheme failed to capture the interest of many researchers. Gabor’s theory was repeatedly deemed unintuitive and baffling; the technique was appraised by his contemporaries to be of dubious practicality and, at best, constrained to a narrow branch of science. By the late 1950s, Gabor’s subject had been assessed by its handful of practitioners to be a white elephant. Nevertheless, the concept was later rehabilitated by the research of Emmett Leith and Juris Upatnieks at the University of Michigan, and Yury Denisyuk at the Vavilov Institute in Leningrad. What had been judged a failure was recast as a success: evaluations of Gabor’s work were transformed during the 1960s, when it was represented as the foundation on which to construct the new and distinctly different subject of holography, a re-evaluation that gained the Nobel Prize for Physics for Gabor alone in 1971. This paper focuses on the difficulties experienced in constructing a meaningful subject, a practical application and a viable technical community from Gabor’s ideas during the decade 1947-1957