Houdini: Fooling Deep Structured Prediction Models

TL;DR

This work introduces Houdini, a universal surrogate for generating adversarial examples that directly target non-differentiable task losses in structured prediction. By formulating a differentiable surrogate tightly linked to the task loss and deriving an analytic gradient, Houdini enables efficient input perturbations and FGSM-style attacks across diverse domains. Empirically, Houdini yields higher success rates and often smaller perceptual perturbations than traditional surrogates in speech recognition, pose estimation, and semantic segmentation, including successful black-box transfer. The approach broadens adversarial evaluation beyond classification and provides a practical framework for robustness assessment of complex prediction systems.

Abstract

Generating adversarial examples is a critical step for evaluating and improving the robustness of learning machines. So far, most existing methods only work for classification and are not designed to alter the true performance measure of the problem at hand. We introduce a novel flexible approach named Houdini for generating adversarial examples specifically tailored for the final performance measure of the task considered, be it combinatorial and non-decomposable. We successfully apply Houdini to a range of applications such as speech recognition, pose estimation and semantic segmentation. In all cases, the attacks based on Houdini achieve higher success rate than those based on the traditional surrogates used to train the models while using a less perceptible adversarial perturbation.

Figures (9)

• Figure 1: We cause the network to generate a minion as segmentation for the adversarially perturbed version of the original image. Note that the original and the perturbed image are indistinguishable.
• Figure 2: Convergence dynamics for pose estimation attacks: (a) perturbation perceptibility vs nb. iterations, (b) $\text{PCKh}^{0.5}$ vs nb. iterations, (c) proportion of re-positioned joints vs perceptibility.
• Figure 3: Example of disrupted pose estimation due to an adversarial attack exploiting Houdini loss: after 55 iterations, $\text{PCKh}^{0.5}$ dropped from $81.25$ to $0.00$ (final perturbation perceptibility is $0.0063$).
• Figure 4: Examples of successful targetted attacks on a pose estimation system. Despite the important difference between the images selected, it is possible to make the network predict the wrong pose by adding an imperceptible perturbation.
• Figure 5: Targetted attack on a semantic segmentation system: switching target segmentation between two images from Cityscapes dataset Cityscapes. The last two columns are respectively zoomed-in parts of the perturbed image and the adversarial perturbation added to the original one.