Introduction
Related work
Adversarial attack
Just notification difference
JND based privacy-preserving adversarial image generation
Problem formulation
JND based perceptual loss
Optimization
Experiments
Experimental settings
-
\(\mathcal {L}_{1}\) evaluation: Only deviation loss \(\mathcal {L}_{1}(\cdot ,\cdot ,\cdot )\) in formula (1) is optimized. That is, \(\beta _{1}\not =0\), \(\beta _{2}=\beta _{3}=0\).
-
\(L1_{ori}\) evaluation: Only original L1 loss \(L1_{ori}(\cdot ,\cdot )\) in formula (1) is optimized. That is, \(\beta _{1}\not =0\), \(\beta _{2}=\beta _{3}=0\).
-
\(\mathcal {L}_{2}\) evaluation: Only fidelity loss \(\mathcal {L}_{2}(\cdot ,\cdot ,\cdot )\) in formula (1) is optimized. We have \(\beta _{2}\not =0\), \(\beta _{1}=\beta _{3}=0\).
-
\(L2_{ori}\) evaluation: Only original L2 loss \(L2_{ori}(\cdot ,\cdot )\) in formula (1) is optimized. We have \(\beta _{2}\not =0\), \(\beta _{1}=\beta _{3}=0\).
-
\(\mathcal {L}_{1} + \mathcal {L}_{2}\) evaluation: Deviation loss \(\mathcal {L}_{1}(\cdot ,\cdot ,\cdot )\) and fidelity loss \(\mathcal {L}_{2}(\cdot ,\cdot ,\cdot )\) are optimized for generating Z. That is, \(\beta _{1}, \beta _{2}\not =0\),\(\beta _{3}=0\).
-
\(\mathcal {L}_{1} + \mathcal {L}_{2} + \mathcal {G}\) evaluation: All the three items in formula (1) are used for constrain Z. \(\beta _{1}, \beta _{2}, \beta _{3}\not =0\)
Comparison and objective evaluation
Image Index | Non-Targeted Attack | Non-Targeted Attack | ||
---|---|---|---|---|
PSNR | SSIM | PSNR | SSIM | |
MIFGSM [26] | 31.78±0.10 | 0.8421±0.0169 | 31.96±0.12 | 0.8451±0.0165 |
PGD [25] | 32.63±0.26 | 0.8613±0.0132 | 32.94±0.22 | 0.8671±0.0133 |
DI\(^2\)FGSM [20] | 32.58±0.01 | 0.8709±0.0126 | 32.94±0.21 | 0.8764±0.0127 |
BIM [21] | 33.38±0.48 | 0.8872±0.0094 | 34.31±0.48 | 0.9054±0.0080 |
JNDMGA [28] | 34.91±1.99 | 0.9124±0.0218 | 35.69±2.39 | 0.9422±0.0163 |
MND [29] | 36.84±1.48 | 0.9176±0.0330 | 38.39±1.58 | 0.9651±0.0047 |
\(L2_{ori}\) | 34.34±1.43 | 0.9025±0.0113 | 32.27±1.56 | 0.8521±0.0262 |
\(\mathcal {L}_2\) | 33.98±1.95 | 0.9294±0.0175 | 31.57±2.66 | 0.8743±0.0364 |
\(L1_{ori}\) | 36.72±0.32 | 0.9324±0.0233 | 35.03±1.23 | 0.9323±0.0212 |
\(\mathcal {L}_1\) | 36.32±1.59 | 0.9496±0.0127 | 34.33±1.74 | 0.9545±0.0164 |
\(\mathcal {L}_1+\mathcal {L}_2\) | 36.08±1.53 | 0.9524±0.0128 | 35.38±1.87 | 0.9589±0.0160 |
\(\varvec{\mathcal {L}}_{\varvec{1}}\varvec{+}\varvec{\mathcal {L}}_{\varvec{2}}\varvec{+}\varvec{\mathcal {G}}\) | 38.02±1.60 | 0.9628±0.0095 | 38.12±2.10 | 0.9782±0.0092 |
Subjective viewing test
Image Index | Non-Targeted Attack | |||||
---|---|---|---|---|---|---|
BIM [21] | PGD [25] | MIFGSM [26] | DI\(^{2}\)FGSM [20] | JNDMGA [28] | MND [29] | |
P9 | 1.84 | 1.76 | 2.02 | 2.23 | 2.05 | 1.60 |
P10 | 1.94 | 1.96 | 1.74 | 1.58 | 1.97 | 1.55 |
P11 | 1.12 | 1.47 | 1.64 | 1.38 | 0.69 | 1.17 |
P12 | 0.92 | 0.88 | 1.42 | 1.58 | 1.51 | 1.11 |
P13 | 1.08 | 1.10 | 1.42 | 1.30 | 1.44 | 1.25 |
P14 | 1.59 | 1.78 | 1.68 | 1.40 | 1.15 | 1.36 |
P15 | 1.22 | 1.10 | 1.32 | 1.38 | 0.51 | 0.96 |
P16 | 0.92 | 0.84 | 1.51 | 1.13 | 1.36 | 0.87 |
Average | 1.33 | 1.36 | 1.59 | 1.50 | 1.34 | 1.23 |
Image Index | Targeted Attack | |||||
---|---|---|---|---|---|---|
BIM [21] | PGD [25] | MIFGSM [26] | DI\(^2\)FGSM [20] | JNDMGA [28] | MND [29] | |
P9 | 1.98 | 2.27 | 2.14 | 2.03 | 2.13 | 2.10 |
P10 | 1.18 | 1.93 | 1.86 | 1.95 | 0.44 | 1.53 |
P11 | 1.93 | 1.82 | 1.41 | 1.55 | 0.51 | 1.27 |
P12 | 1.43 | 1.45 | 1.37 | 1.28 | 1.00 | 1.06 |
P13 | 1.42 | 1.38 | 1.14 | 1.18 | 0.56 | 1.18 |
P14 | 1.67 | 1.62 | 1.71 | 1.83 | -0.23 | 1.31 |
P15 | 1.10 | 1.28 | 1.12 | 1.05 | 0.41 | 0.76 |
P16 | 0.98 | 1.30 | 1.25 | 1.23 | 0.41 | 0.67 |
Average
|
1.46
|
1.63
|
1.50
|
1.51
|
0.65
|
1.24
|
Image Index | Non-Targeted Attack | |||||
---|---|---|---|---|---|---|
BIM [21] | PGD [25] | MIFGSM [26] | DI\(^2\)FGSM [20] | JNDMGA [28] | MND [29] | |
P12 | 1.87 | 2.20 | 1.90 | 1.97 | 1.35 | 1.54 |
P13 | 2.14 | 1.43 | 1.73 | 1.94 | 2.23 | 1.31 |
P14 | 1.31 | 1.21 | 1.51 | 1.09 | 1.13 | 0.87 |
P15 | 1.53 | 1.66 | 1.62 | 1.09 | 1.42 | 0.94 |
P16 | 1.88 | 0.98 | 1.33 | 1.06 | 0.87 | 0.76 |
P17 | 0.76 | 1.14 | 1.10 | 1.69 | 0.98 | 0.65 |
P18 | 1.13 | 1.21 | 0.74 | 1.34 | 0.99 | 1.02 |
P19 | 1.42 | 0.87 | 1.25 | 0.83 | 1.08 | 1.43 |
Average
|
1.51
|
1.34
|
1.40
|
1.38
|
1.26
|
1.01
|
Image Index | Targeted Attack | |||||
---|---|---|---|---|---|---|
BIM [21] | PGD [25] | MIFGSM [26] | DI\(^2\)FGSM [20] | JNDMGA [28] | MND [29] | |
P12 | 2.04 | 1.82 | 1.88 | 1.76 | 2.27 | 1.54 |
P13 | 1.92 | 1.86 | 1.83 | 1.96 | 1.42 | 1.31 |
P14 | 1.88 | 1.05 | 1.21 | 1.47 | 1.15 | 0.87 |
P15 | 1.27 | 0.91 | 1.54 | 0.88 | 1.38 | 0.94 |
P16 | 1.58 | 1.05 | 1.33 | 1.10 | 1.35 | 0.76 |
P17 | 1.73 | 1.64 | 1.13 | 1.78 | 1.46 | 0.65 |
P18 | 1.15 | 1.23 | 0.83 | 1.10 | 1.35 | 1.02 |
P19 | 1.42 | 0.86 | 1.33 | 0.84 | 1.08 | 1.43 |
Average
|
1.62
|
1.30
|
1.39
|
1.36
|
1.43
|
1.07
|