It has been well demonstrated that adversarial examples, i.e., natural images
with visually imperceptible perturbations added, generally exist for deep
networks to fail on image classification. In this paper, we extend adversarial
examples to semantic segmentation and object detection which are much more
difficult. Our observation is that both segmentation and detection are based on
classifying multiple targets on an image (e.g., the basic target is a pixel or
a receptive field in segmentation, and an object proposal in detection), which
inspires us to optimize a loss function over a set of pixels/proposals for
generating adversarial perturbations. Based on this idea, we propose a novel
algorithm named Dense Adversary Generation (DAG), which generates a large
family of adversarial examples, and applies to a wide range of state-of-the-art
deep networks for segmentation and detection. We also find that the adversarial
perturbations can be transferred across networks with different training data,
based on different architectures, and even for different recognition tasks. In
particular, the transferability across networks with the same architecture is
more significant than in other cases. Besides, summing up heterogeneous
perturbations often leads to better transfer performance, which provides an
effective method of black-box adversarial attack.

本文研究了在语义分割和物体检测领域中存在的对抗样本，并通过一种名为 DAG（Dense Adversary Generation）的算法来产生大量对抗样本，可以应用于各种先进的深度网络架构，除此之外还发现了对抗扰动可以在不同的训练数据、不同的架构以及不同的任务之间进行传递，尤其是在具有相同架构的网络之间的可传递性更加显著；此外，对多个异构扰动进行求和通常会导致更好的传递性能，这提供了一种有效的黑盒对抗攻击方法。