PFFAA: Prototype-based Feature and Frequency Alteration Attack for Semantic Segmentation

Zhidong Yu, Zhenbo Shi, Xiaoman Liu, Wei Yang

Abstract: Recent research has confirmed the possibility of adversarial attacks on deep models. However, these methods typically assume that the surrogate model has access to the target domain, which is difficult to achieve in practical scenarios. To address this limitation, this paper introduces a novel cross-domain attack method tailored for semantic segmentation, named Prototype-based Feature and Frequency Alteration Attack (PFFAA). This approach empowers a surrogate model to efficiently deceive the black-box victim model without requiring access to the target data. Specifically, through limited queries on the victim model, bidirectional relationships are established between the target classes of the victim model and the source classes of the surrogate model, enabling the extraction of prototypes for these classes. During the attack process, the features of each source class are perturbed to move these features away from their respective prototypes, thereby manipulating the feature space. Moreover, we propose substituting frequency information from images used to train the surrogate model into the frequency domain of the test images to modify texture and structure, thus further enhancing the attack efficacy. Experimental results across multiple datasets and victim models validate that PFFAA achieves state-of-the-art attack performances.

Primary Subject Area: [Content] Multimodal Fusion

Relevance To Conference: We improve the robustness of computer vision models by utilizing a black-box attack based on prototype and frequency domain variations. The attack is also applicable to image attacks in multimodality. All these are closely related to multimedia and multimodal processing.

Submission Number: 3357