You cannot handle the weather: Progressive amplified adverse-weather-gradient projection adversarial attack

Yifan Liu, Min Chen, Chuanbo Zhu, Han Liang, Jincai Chen

Abstract: As is well known, deep neural networks (DNNs) are susceptible to adversarial examples. However, these adversarial examples are not commonly found in the real world. In this paper, we investigate adversarial examples induced by adverse weather conditions, such as haze, rain, and snow, based on the atmospheric scattering model. The aim is to demonstrate that these natural phenomena can be utilized as potential means of adversarial attacks. With this foundation, we propose a method called progressive amplified adverse-weather-gradient projection adversarial attack (PAA2<math><msup is="true"><mrow is="true"></mrow><mrow is="true"><mn is="true">2</mn></mrow></msup></math>). This method leverages adverse weather conditions (haze, rain, and snow) as sources of interference. The PAA2<math><msup is="true"><mrow is="true"></mrow><mrow is="true"><mn is="true">2</mn></mrow></msup></math> method involves iterative processing of input data, fusing perturbation vectors and adverse-weather perturbation layers during each iteration. The adverse-weather perturbation layer generates additional interference from haze, rain, and snow based on principles of physical imaging. To enhance the attack effectiveness, PAA2<math><msup is="true"><mrow is="true"></mrow><mrow is="true"><mn is="true">2</mn></mrow></msup></math> adjusts the current gradient using the gradient variance near the previous iteration’s vector. This reduces gradient variance and compensates for unnecessary perturbations introduced by the adverse-weather perturbation layer. Compared to state-of-the-art attack methods, PAA2<math><msup is="true"><mrow is="true"></mrow><mrow is="true"><mn is="true">2</mn></mrow></msup></math> achieves the highest attack success rate, minimizes differences between generated adversarial samples and clean images, and maintains superior natural image quality. Experimental results demonstrate that PAA2<math><msup is="true"><mrow is="true"></mrow><mrow is="true"><mn is="true">2</mn></mrow></msup></math> improves the average attack success rate, peak signal-to-noise ratio (PSNR) value, and natural image quality evaluator (NIQE) value by 5.56%, 12.60%, and 24.39%, respectively. Our code is available at https://github.com/awhitewhale/PAA-2.