ALA: Naturalness-aware Adversarial Lightness Attack

TL;DR

This work introduces Adversarial Lightness Attack (ALA), an unrestricted yet natural-looking adversarial method that perturbs image lightness using a differentiable, piecewise linear filter in LAB space. By relaxing monotonicity and adding naturalness-aware constraints, ALA achieves high attack success with superior image realism across ImageNet and Places-365, including in real-world-like scenarios. The approach is validated against multiple models, demonstrates competitive transferability, and can be used for adversarial training to improve robustness to lightness corruptions. Overall, ALA advances practical unrestricted attacks and informs defenses against lightness-based perturbations in vision systems.

Abstract

Most researchers have tried to enhance the robustness of DNNs by revealing and repairing the vulnerability of DNNs with specialized adversarial examples. Parts of the attack examples have imperceptible perturbations restricted by Lp norm. However, due to their high-frequency property, the adversarial examples can be defended by denoising methods and are hard to realize in the physical world. To avoid the defects, some works have proposed unrestricted attacks to gain better robustness and practicality. It is disappointing that these examples usually look unnatural and can alert the guards. In this paper, we propose Adversarial Lightness Attack (ALA), a white-box unrestricted adversarial attack that focuses on modifying the lightness of the images. The shape and color of the samples, which are crucial to human perception, are barely influenced. To obtain adversarial examples with a high attack success rate, we propose unconstrained enhancement in terms of the light and shade relationship in images. To enhance the naturalness of images, we craft the naturalness-aware regularization according to the range and distribution of light. The effectiveness of ALA is verified on two popular datasets for different tasks (i.e., ImageNet for image classification and Places-365 for scene recognition).

Figures (10)

• Figure 1: (L) Original images with their labels (successfully classified by ResNet50), (R) ALA attacked images that are incorrectly classified by the same ResNet50 network, with imperceptible lightness shift. The three line charts showcase the lightness value shift function generated by using our attack method.
• Figure 2: (a) monotonic filter $\hat{\mathcal{F}_\theta}$. (b) scene-adaptive filter $\mathcal{F}_\theta$ with the valid range from $\textbf{2/8}$ to $\textbf{6/8}$. Both filters are segmented into 4 pieces, i.e., $T=4$ in Eq. \ref{['eq:parfilter1']}.
• Figure 3: Complex light and shade relationship in the real world. The sub-images (a), (b), (c) are under various light conditions.
• Figure 4: Adversarial examples generated by ALA with different initialization ranges.
• Figure 5: Adversarial images generated by different filters.