An adversarial query is an image that has been modified to disrupt
content-based image retrieval (CBIR) while appearing nearly untouched to the
human eye. This paper presents an analysis of adversarial queries for CBIR
based on neural, local, and global features. We introduce an innovative neural
image perturbation approach, called Perturbations for Image Retrieval Error
(PIRE), that is capable of blocking neural-feature-based CBIR. PIRE differs
significantly from existing approaches that create images adversarial with
respect to CNN classifiers because it is unsupervised, i.e., it needs no
labelled data from the data set to which it is applied. Our experimental
analysis demonstrates the surprising effectiveness of PIRE in blocking CBIR,
and also covers aspects of PIRE that must be taken into account in practical
settings, including saving images, image quality and leaking adversarial
queries into the background collection. Our experiments also compare PIRE (a
neural approach) with existing keypoint removal and injection approaches (which
modify local features). Finally, we discuss the challenges that face multimedia
researchers in the future study of adversarial queries.

该论文分析了针对基于神经网络、局部和全局特征的基于内容图像检索的对抗查询。作者引入了一种创新的神经网络图像扰动方法，称为图像检索错误的扰动（PIRE），能够阻止基于神经特征的 CBIR 检索。作者的实验分析证明了 PIRE 的惊人有效性，并比较了 PIRE 与以前的关键点去除和注入方法。最后，作者讨论了未来多媒体研究人员在对抗查询研究中面临的挑战。

对抗性查询有谁害怕？图像修改对基于内容图像检索的影响

Who's Afraid of Adversarial Queries? The Impact of Image Modifications  on Content-based Image Retrieval

Most existing works of adversarial samples focus on attacking image
recognition models, while little attention is paid to the image retrieval task.
In this paper, we identify two inherent challenges in applying prevailing image
recognition attack methods to image retrieval. First, image retrieval demands
discriminative visual features, which is significantly different from the
one-hot class prediction in image recognition. Second, due to the disjoint and
potentially unrelated classes between the training and test set in image
retrieval, predicting the query category from predefined training classes is
not accurate and leads to a sub-optimal adversarial gradient. To address these
limitations, we propose a new white-box attack approach, Opposite-Direction
Feature Attack (ODFA), to generate adversarial queries. Opposite-Direction
Feature Attack (ODFA) effectively exploits feature-level adversarial gradients
and takes advantage of feature distance in the representation space. To our
knowledge, we are among the early attempts to design an attack method
specifically for image retrieval. When we deploy an attacked image as the
query, the true matches are prone to receive low ranks. We demonstrate through
extensive experiments that (1) only crafting adversarial queries is sufficient
to fool the state-of-the-art retrieval systems; (2) the proposed attack method,
ODFA, leads to a higher attack success rate than classification attack methods,
validating the necessity of leveraging characteristics of image retrieval; (3)
the adversarial queries generated by our method have good transferability to
other retrieval models without accessing their parameters, i.e.,the black-box
setting.

该研究提出了一种新的针对图像检索任务的白盒对抗攻击方法，名为 ODFA，该方法可以利用特征级别的对抗梯度和表征空间中的特征距离，生成具有欺骗性的查询，而非预测类别，这大大提高了攻击成功率，并且这种对抗查询具有很好的迁移性。

逆向特征查询攻击：迈向鲁棒图像检索

Query Attack via Opposite-Direction Feature:Towards Robust Image  Retrieval

We consider the problem of answering queries about a sensitive dataset
subject to differential privacy. The queries may be chosen adversarially from a
larger set Q of allowable queries in one of three ways, which we list in order
from easiest to hardest to answer:
Offline: The queries are chosen all at once and the differentially private
mechanism answers the queries in a single batch.
Online: The queries are chosen all at once, but the mechanism only receives
the queries in a streaming fashion and must answer each query before seeing the
next query.
Adaptive: The queries are chosen one at a time and the mechanism must answer
each query before the next query is chosen. In particular, each query may
depend on the answers given to previous queries.
Many differentially private mechanisms are just as efficient in the adaptive
model as they are in the offline model. Meanwhile, most lower bounds for
differential privacy hold in the offline setting. This suggests that the three
models may be equivalent.
We prove that these models are all, in fact, distinct. Specifically, we show
that there is a family of statistical queries such that exponentially more
queries from this family can be answered in the offline model than in the
online model. We also exhibit a family of search queries such that
exponentially more queries from this family can be answered in the online model
than in the adaptive model. We also investigate whether such separations might
hold for simple queries like threshold queries over the real line.

探讨在三种模式下对不对称敏感数据集的查询差分隐私问题，证明这些模式不同，并且存在家族类的统计查询，在离线模式下可以回答指数级别的查询，而在线模式下只能回答很少的查询，同时也展示了一族搜索查询，在在线模式下可以回答指数级别的查询，但在调整模式下无法回答很多查询。