AVA: Adversarial Vignetting Attack against Visual Recognition

1 Introduction

In photography, image vignetting is a common effect as a result of camera settings or lens limitations. It shows up as a gradually darkened transparent ring-shape mask towards the

∗Qing Guo and Xiaohong Li are the corresponding authors ( tsingqguo@ieee.org and xiaohongli@tju.edu.cn).

(a) Real-world Vignetting Examples

ResNet50:

Bison ResNet50:

Hippo

(b) Adversarial Vignetting Examples

Figure 1: (a) shows three real vignetting images captured by cameras. (b) shows the adversarial examples produced by our adversarial vignetting attack (AVA), fooling the SOTA CNN ResNet50 with imperceptible property due to the realistic vignetting effects.

image border with continuous reduction of the image brightness or saturation [Gonzalez et al., 2004]. Vignetting often naturally occurs during the photo taking process. As categorized by [Ray, 2002], there are the following three main causes of vignetting for digital imaging: (1) mechanical vignetting, (2) optical vignetting, and (3) natural vignetting. Both mechanical vignetting and optical vignetting are somehow caused by the blockage of light. For example, the mechanical vignetting is caused by light emanated from off-axis scene being partially blocked by external objects such as lens hoods, and the optical vignetting is usually caused by the multiple element lens setting where the effective lens opening for off-axis incident light can be reduced. On the other hand, naturally vignetting is not due to light blockage, but rather by the law of illumination falloff where the light falloff is proportional to the 4-th power of the cosine of the angle at which the light particles hit the digital sensor. Sometimes, vignetting can also be applied on the digital image as an artistic post-processing step to draw people's attention to the center portion of the photograph as depicted in Fig. 1(a).

Therefore, image vignetting can be capitalized to ideally hide adversarial attack information in a stealthy way for its ubiquity and naturalness in digital imaging. In this work, we propose a novel and stealthy attack method called the adversarial vignetting attack (AVA) that aims at embedding intentionally misleading information into the vignetting and producing a natural adversarial example without noise patterns, as depicted in Fig. 1(b). By first mathematically and physically model the image vignetting effect, we have proposed the radial-isotropic adversarial vignetting attack (RIAVA) and the physical parameters such as the illumination factors and the focal length are tuned through the guidance of the target CNN models under attack. Next, by further allowing the effective regions of vignetting to be radial-anisotropic and shape-free, our proposed radial-anisotropic adversarial vignetting attack (RA-AVA) can achieve much higher transferability across different CNN models. Moreover, we have proposed the level-set-based optimization method, that is geometry-aware, to solve the adversarial vignetting regions and physical parameters jointly.

Through extensive experiments, we have validated the effectiveness of the proposed methods on three popular datasets, i.e., DEV [Google, 2017], CIFAR10 [Krizhevsky and Hinton, 2009], and Tiny ImageNet [Stanford, 2017], by attacking four CNNs, e.g., ResNet50 [He et al., 2016], EfficientNet-B0 [Tan and Le, 2019], DenseNet121 [Huang et al., 2017], and MobileNet-V2 [Sandler et al., 2018]. We have successfully demonstrated the advantages of our methods over strong baseline methods especially on transerferbility and image quality. To the best of our knowledge, this is the very first attempt to formulate stealthy adversarial attack by means of image vignetting and showcase both the feasibility and the effectiveness through extensive experiments.

2 RelatedWork

Adversarial noise attacks. Adversarial noise attacks aim to fool DNNs by adding imperceptible perturbations to the images. One of the most popular attack methods, i.e., fast gradient sign method (FGSM) [Goodfellow et al., 2014], involves only one back propagation step in the process of calculating the gradient of cost function, enabling simple and fast adversarial example generation. [Kurakin et al., 2016] proposes an improved version of FGSM, known as basic iteration method (BIM), which heuristically search for examples that are most likely to fool the classifier. [Dong et al., 2018] proposes a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, it can stabilize update directions and escape from poor local maxima during the iterations. [Dong et al., 2019] further proposes a translationinvariant attack method to generate more transferable examples against the defense models. Adversarial noise attack will generate patterns that do not exist in reality, and our method is an early method of applying patterns that may be generated in natural optical systems to attacks.

Other adversarial attacks. In addition to traditional adversarial noise attacks, there are some methods that focus on sparse or real-life patterns. [Croce and Hein, 2019] proposes a new attack method to generate adversarial examples aiming at minimizing the l0-distance to the original image. It allows pixels to change only in region of high variation and avoiding changes along axis-aligned edges, resulting in almost nonperceivable adversarial examples. [Wong et al., 2019] proposes a new threat model for adversarial attacks based on the Wasserstein distance. It can successfully attack image classification models, bringing traditional CIFAR10 models down to 3% accuracy within a Wasserstein ball with radius 0.1. [Bhattad et al., 2019] introduces "unrestricted" perturbations that manipulate semantically meaningful image-based visual descriptors (e.g., color and texture) to generate effective and photorealistic adversarial examples. [Guo et al., 2020b] proposes an adversarial attack method that can generate visually natural motion-blurred adversarial examples. Along similar lines, non-additive noise based adversarial attacks that focus on producing realistic degradation-like adversarial patterns have emerged in several recent studies, such as adversarial rain [Zhai et al., 2020] and haze [Gao et al., 2021], adversarial exposure for medical analysis [Cheng et al., 2020b] and co-saliency detection problems [Gao et al., 2020], adversarial bias field in medial imaging [Tian et al., 2020], as well as adversarial denoising [Cheng et al., 2020a] and face morphing [Wang et al., 2020]. These methods apply patterns that may be produced in reality such as color and texture to attack, but ignore the patterns that are generated naturally in the optical systems, which are also vitally important.

Vignetting correction methods. Research into vignetting correction has a long history. The Kang-Weiss model [Kang and Weiss, 2000] is established to simulate the vignetting effect. It proves that it is possible to calibrate a camera using just a flat, textureless Lambertian surface and constant illumination. [Zheng et al., 2008] proposes a method for robustly determining the vignetting function in order to remove the vignetting given only a single image. [Goldman, 2010] further proposes a method to remove the vignetting from the images without resolving ambiguities or the previously known scale and gamma ambiguities. These works on correcting the vignetting effect provides a basis for us to model the vignetting effect. Inspired by these work, we will capitalize the vignetting effect as a means of an adversarial attack.

3 Adversarial Vignetting Attack (AVA)

Vignetting effect is related to numerous factors, e.g., anglevariant light across camera sensor, intrinsic lens characteristics, and physical occlusions. There are several works studying how to model the vignetting including empiricalbased [Goldman, 2010; Yu, 2004] and physical-based methods [Asada et al., 1996; Kang and Weiss, 2000]. In particular, Kang and Weiss [Kang and Weiss, 2000] proposes a physical-based method that models vignetting via physically meaningful parameters (e.g., off-axis illumination, light path obstruction, tilt effects), allowing better understanding of the influence from real-world environments (e.g., camera setups or physical occlusion) to the final results. In this section, we

G

start from the physical model of vignetting effects [Kang and Weiss, 2000] and propose two adversarial vignetting attacks based on this model with an level-set-based optimization.

3.1 Physical Model of Vignetting

Given a clean image I, we aim to simulate the vignetting image 1 via ˆI = I ⊙ V where V is a matrix having the same size with I and represents the vignetting effects, and ⊙ denotes the pixel-wise multiplication. We model the vignetting from three aspects, i.e., off-axis illumination factor A, geometric factor G, and a tilt factor T [Kang and Weiss, 2000]. All three factors are pixel-wise and have the same size with the original image. Then, the vignetting effects can be also represented as

Intuitively, A describes the phenomenon of the illumination in the image that is darkened with distance away from the image center [Kang and Weiss, 2000], defined as

where f is the effective focal length of the camera, and R is a fixed matrix and denotes the distance of each pixel to the principal point, i.e., the image center with the coordinate as (u, v) = (0, 0) if the lens distortion does not exist.

The matrix G represents the vignetting caused by the offaxis angle projection from the scene to the image plane [Tsai, 1987], and is approximated by

where α is a scalar deciding the geometry vignetting degree.

The matrix T defines the effects of camera tilting to image plane and the i-th element is formulated as

where χ and τ are tilt-related parameters determining the camera pose w.r.t. a scene/object. Please find more details in [Kang and Weiss, 2000].

With this physical model, we aim to study the effects of vignetting from the viewpoint of adversarial attack, e.g., how to actively tune the vignetting-related parameters, i.e., f, α, τ, and χ, to let the simulated vignetting images to fool the state-of-the-art CNNs easily? To this end, we represent the vignetting process as a simple function, i.e.,

1 Throughout the paper, the term 'vignetting image' refers to a photographic image that exhibits the vignetting effect to some degree.

where P = {f -1 , α, τ, χ}. Then, we propose the radialisotropic adversarial vignetting attack (RI-AVA).

3.2 Radial-Isotropic AVA

Given a clean image I and a pre-trained CNN φ, we aim to tune the P = [f -1 , α, τ, χ] under a norm ball constraint for each parameter.

where the first term J(·) is the image classification loss under the supervision of the annotation label y, the second and third terms encourage the focal length to be larger and geometry coefficient α to be smaller. As a result, the clean image I would not be changed significantly. Besides, ϵρ denotes the ball bound under Lp for the parameter ρ. Here, we use the infinite norm. We can optimize the objective function by gradient descent-based methods, that is, we calculate the gradient of the loss function with respect to all parameters in P and update them to realize the gradient-based attacks like existing adversarial noise attacks [Kurakin et al., 2017; Guo et al., 2020b].

Since this method equally tunes the pixels on the same radius to the image center, we name it as radial-isotropic adversarial vignetting attack (RI-AVA). Nevertheless, by tuning only four scalar physical-related parameters to realize attack, this method can study the robustness of CNN to realistic vignetting effects but it is hard to realize intentional attacks with high attack success rate and high transferability across different CNNs. To fill this gap, we further propose the radial-anisotropic adversarial vignetting attack (RA-AVA) by extending the geometry vignetting G, allowing the each element of G to be independently tuned.

3.3 Radial-Anisotropic AVA

To enable more flexible vignetting effects, we allow G to be tuned independently in an element-wise way and redefine the objective function in Eq. (6) to jointly optimize G and P. Specifically, for the matrix G, we split it into two parts with a closed curve C centered at the principal point. On the one hand, we desire the region of G inside C (i.e., Ωin) to be similar with the physical function defined by Eq. (3), making the simulated image look naturally. In contrast, we also want all elements of G to be flexibly tuned according to the adversarial classification loss, leading to high attack success rate. In particular, the vignetting effects let pixels in the outside region darker than the ones in the Ωin. Hence, embedding adversarial information into this region is less risky to be perceived. Overall, we define a new objective function to tune G, C, and P jointly

success rate

success rate

where G0 = 1 - αR, and the region Ωin is determined by the curve C. Note that, we tune C along its inward normal direction to let shape and area of Ωout be changed according to the adversarial classification loss (i.e., J(·)). For example, when the Ωout becomes larger and then less pixels (i.e., Ωin) are constrained by the second term of Eq. (7), we have more flexibility to tune the pixels in the image to reach high attack success rate. We can solve Eq. (7) by regarding it as a curve evolution problem [Kass et al., 1988] since the curve C is an optimization variable. Nevertheless, this method can hardly handle topological changes of the moving front, such as splitting and merging of C [Kimia et al., 1992]. Inspired by the works [Guo et al., 2018] for curve optimization, we propose to regard the G as the level-set function of the curve and solve Eq. (7) via our geometry-aware level-set optimization.

3.4 Geometry-aware Level-Set Optimization

To optimize Eq. (7), we first initialize the geometry vignetting, i.e., G = G0 = 1 - αR, which is a distancerelated matrix and we reformulate it as a level-set function g(ui, vi) = G[i] = 1 - α√u2i + v2 i . Intuitively, the function g(·) takes the coordinates of a position on the image plane as inputs and outputs a value that decreases as the coordinates become larger, leading to a 3D surface. With such a function, we can define the curve C as the z-level-set of g(·), i.e., C = {(ui, vi)|z = g(ui, vi)}, that is, C is the cross section of the 3D surface at level z. Then, we can define the region inside the curve as Ωin = {(ui, vi)|z < g(ui, vi)}, which can be reformulated it as the function of g by the Heaviside function (i.e., H(·)) [Chan and Vese, 2001], that is, we have Ωin = {(ui, vi)|H(g(ui, vi)) > z} or H(G). Finally, we can reformulate Eq. (7) as

Since the Heaviside function is differentiable we can optimize the objective function via gradient descent. Compared

( a )

40

( b )

Original f=1.0

f=0.9

f=0.7

f=0.5

with Eq. (7), the proposed new formulation only contains two terms that should be optimized, i.e., G and P, making the optimization more easier. In practice, we can calculate the gradient of G and P w.r.t. to the objective function and use the signed gradient descent to optimize G and P as is done in [Kurakin et al., 2017].

3.5 Implementation Details

We show the whole process in Fig. 2(a). Specifically, given a clean image I and a DNN φ(·), we summarize the workflow of our attacking algorithm in the following steps: ¶ Initialize the parameters P = {f -1 , α, τ, χ} = {1, 0, 0, 0}, the geometry vignetting matrix G as 1-αR, and the distance matrix R via R[i] = √u2i + v2 i . · Calculate the illumination-related matrix A via Eq. (2), and the camera tilting-related matrix T via Eq (4). , At the t-th iteration, calculate the gradient of Gt, Pt with respect to the objective function Eq. (8) and obtain ∇Gt and {∇ρt |ρt ∈ Pt}. " Update ∇Gt and Pt with their own step sizes. " Update t = t + 1 and go to the step three for further optimization until it reaches the maximum iteration or vig(I, P) fools the DNN. In the experimental parts, we set our hyper-parameters as follows: we set the stepsize of f, α, τ, χ and ∇Gt as 0.0125, 0.0125, 0.01, 0.01 and 0.0125, respectively. We set the number of iterations to be 40 and z of the level-set method to be 1.0. We set p to be ∞, and set the ϵ of f -1 , α, τ, and χ as 0.5, 0.5, π/6, and π/6. In addition, we set λf , λg and λα all to be 1. In Section 4, we will carry out experiments to evaluate the effect of different hyperparameters. And we do not choose the hyper-parameters for the highest success rate when compared with baseline attacks, but rather set the parameters that can balance the high success rate and good image quality.

4 Experimental Results

Here, we conduct comprehensive experiments on three popular datasets to evaluate the effectiveness of our method. We compare our method with some popular baselines including

675

Table 1: Comparison results on 3 datasets with 5 attack baselines and our methods. It contains the success rates (%) of whitebox adversarial attack on four normally trained models: ResNet50, EfficientNet-b0, DenseNet121 and MobileNet-v2. The 1st column displays the whitebox attack results. The last two columns show the BRISQUE and NIQE score. Original 734 RI-AVA (Ours) RA-AVA (Ours) C&W 734 MIFGSM 675 TIMIFGSM 734 Wasserstein 675 cAdv 407

675

675

675

adversarial noise attack methods and other methods. Finally, we conduct experiments to showcase that our method can effectively defend against vignetting corrections.

Datasets. We carry out our experiments on three popular datasets, i.e., DEV [Google, 2017], CIFAR10 [Krizhevsky and Hinton, 2009], and Tiny ImageNet [Stanford, 2017].

Models. In order to show the effect of our attack method on different neural network models, we choose four popular models to attack, i.e., ResNet50 [He et al., 2016], EfficientNet-B0 [Tan and Le, 2019], DenseNet121 [Huang et al., 2017], and MobileNet-V2 [Sandler et al., 2018]. We train these models on the CIFAR10 and Tiny ImageNet dataset. For DEV dataset, we use the pretrained models.

Metrics. We choose attack success rate and image quality to evaluate the effectiveness of our method. The image quality measurement metrics are BRISQUE [Mittal et al., 2012a]

and NIQE [Mittal et al., 2012b]. BRISQUE and NIQE are two non-reference image quality assessment methods. A high score for BRISQUE or NIQE indicates poor image quality.

Baseline methods. We compare our method with five SOTA attack baselines, i.e., momentum iterative fast gradient sign method (MIFGSM) [Dong et al., 2018], Carlini & Wagner L2 method (C&WL2) [Carlini and Wagner, 2017], translation-invariant momentum iterative fast gradient sign method (TIMIFGSM) [Dong et al., 2019], Wasserstein attack via projected sinkhorn iterates (Wasserstein) [Wong et al., 2019] and colorization attack (cAdv) [Bhattad et al., 2019].

Analysis of physical parameters. Focal length and geometric factor are the two important parameters for the vignetting effect. We evaluate the influence of the two physical parameters by setting different norm ball constraint for f -1 , α via Eq (6). According to the result in Fig. 3(a) and (b), we observe that: ¶ Given different ball bound to f and α, the success rate of attack will be different. ·With the ball bound of f growing, the success rate decreases. But as ball bound of α increases, the success rate increases. , From the visualization results in Fig. 4, with the value of f decreasing and the value of α increasing, the vignetting effect becomes more obvious. Therefore, we can conclude that a stronger vignetting effect can increase the attack success rate.

Analysis of different objective functions. We evaluate the effect of different energy terms by setting different coefficient values of energy terms, i.e., λg, λf and λα. From the result in Fig. 3(c)(d), we can see that: ¶ With the increasing of λg and λf , the success rate of attack decreases accordingly. · The restriction on the energy item will reduce the success rate, indicating that the energy item has certain constraints on the attack. In addition, we find that the change of λα almost does not affect the attack success rate, which shows that this energy item has minimal constraints on the attack.

Comparison with baseline attacks. We evaluate the effectiveness of our attack with the baseline. Table 1 shows the quantitative results about the attack success rates and the image quality. We observe that for every dataset, RA-AVA reaches higher success rate than RI-AVA, indicating that tunable vignetting regions can greatly improve the success rate of attack. Compared with the noise-based adversarial attack, we found that our attack achieved lower success rate than MIFGSM, CW and TIMIFGSM attack. This is in line with our expectation since the image vignetting has more constraints on image perturbation than adding arbitrary noises. This is also why our method (RA-AVA) could have better image quality than the noise-based attack. We also noticed that on some models and datasets (e.g., DEV), RA-AVA could still achieve competitive results in terms of attack success rate while the image quality is better. Compared with the nonnoise based attack, our method is better than cAdv significantly. Furthermore, we also find that our method can achieve much better transferability, which will be introduced later.

In Fig. 5, we have showcased some examples generated by baselines and our attack methods. The first column shows the original images while the following columns list the corresponding adversarial examples. It is clear that our method could generate high-quality adversarial examples that are smooth and realistic. However, we could find obvious noises in the examples generated by the adversarial noise attack methods, which are difficult to appear in the real world. For other non-noise attack methods, e.g., cAdv, they allow patterns that may appear in the real world but the change between the original and the generated image is very perceptible. Our method does not change the image too much while maintaining the realism in optical system for the vignetting effects.

Comparison on transferability. We then evaluate the transferability of different attacks. Table 2 shows the quantitative transfer attack results of our methods and the baseline methods. In transfer attack, one attacks the target DNN with the adversarial examples generated from other models. As we can see, in most cases, our method achieves much higher transfer success rate than others while the image quality is also higher. For example, the attack examples crafted from ResNet50 on CIFAR10 dataset achieves 18.21%, 19.18%, and 15.33% transfer success rate on EfficientNet, DenseNet, and MobileNet, with the lowest values of BRISQUE and NIQE, i.e., 33.56 and 38.05.

AVAs against vignetting corrections. Since our method is to use the vignetting effect as the attack method, we need to consider whether the method of light intensity and vignetting correction can neutralize our attack. For this reason, we use the Zero-DCE method [Guo et al., 2020a] to adjust the light intensity. The visualization result is shown in Fig. 6. It can be seen that the Zero-DCE method has performed a certain brightness correction on the attacked images. The quantitative results of the accuracy change are shown in Table 3. After Zero-DCE correction, the accuracy has a certain improvement, but it is still lower than the original. It shows that the Zero-DCE method could mitigate the attack on some images but it is still not effective (e.g., only about 10% improvement), indicating that our attack method is robust against intensity and vignetting correction methods.

5 Conclusion

We have successfully embedded stealthy adversarial attack into the image vignetting effect through a novel adversarial attack method termed adversarial vignetting attack (AVA). By first mathematically and physically model the image vignetting effect, we have proposed the radial-isotropic adversarial vignetting attack (RI-AVA) and tuned the physical parameters such as the illumination factors and the focal length through the guidance of the target CNN models under attack. Next, by further allowing the effective regions of vignetting to be radial-anisotropic and shape-free, our proposed radial-anisotropic adversarial vignetting attack (RAAVA) can reach much higher transferability across various CNN models. Moreover, level-set-based optimization is proposed to jointly solve the adversarial vignetting regions and physical parameters.

The proposed AVA-enabled adversarial examples can fool the SOTA CNNs with high success rate while remaining imperceptible to human. Through extensive experiments on three popular datasets and via attacking four SOTA CNNs, we have demonstrated the effectiveness of the proposed method over strong baselines. We hope that our study can mark one small step towards a fuller understanding of adversarial robustness of DNNs. In a long run, it can be important to explore the interplay between the proposed adversarial vignetting attack and other downstream perception tasks that are usually mission critical such as robust tracking [Guo et al., 2020c; Cheng et al., 2021], robust autonomous driving [Li et al., 2021], and robust DeepFake detection [Qi et al., 2020; Juefei-Xu et al., 2021], etc.

Acknowledgements

This work has partially been sponsored by the National Science Foundation of China (No. 61872262). It was also supported by the National Research Foundation, Singapore under its the AI Singapore Programme (AISG2-RP-2020019), the National Research Foundation, Prime Ministers Office, Singapore under its National Cybersecurity R&D Program (No. NRF2018NCR-NCR005-0001), NRF Investigatorship NRFI06-2020-0001, the National Research Foundation through its National Satellite of Excellence in Trustworthy Software Systems (NSOE-TSS) project under the National Cybersecurity R&D (NCR) Grant (No. NRF2018NCRNSOE003-0001). We gratefully acknowledge the support of NVIDIA AI Tech Center (NVAITC) to our research.