Physically Robust and Imperceptible Adversarial Examples Generation Based on Frequency

Abstract

Adversarial examples generated in digital space may fail to work in the physical world because the recapture process will ruin the adversarial property of the examples. Several approaches have been proposed to generate adversarial examples that can survive in the physical world, they however either introduce markedly perceptible patterns (e.g., adversarial patches) or suffer from a low attack success rate due to improper perturbation propagation. In this work, we propose PRIA, a frequency-based approach to generating Physically Robust and Imperceptible Adversarial examples. PRIA reforms the pipeline of perturbation generation such that adversarial property of the generated examples retains after the recapture process. The experimental results reveal that PRIA outperforms state-of-the-art solutions, improves the attack success rate in the physical world by up to 19%, and meanwhile achieves the highest perceptual quality.