{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/spatially-transformed-adversarial-examples","title":"Spatially Transformed Adversarial Examples","arxiv_id":"1801.02612","date":"2018-01-08","proceeding":"ICLR 2018 1","authors":["Chaowei Xiao","Jun-Yan Zhu","Bo Li","Warren He","Mingyan Liu","Dawn Song"],"abstract":"Recent studies show that widely used deep neural networks (DNNs) are\nvulnerable to carefully crafted adversarial examples. Many advanced algorithms\nhave been proposed to generate adversarial examples by leveraging the\n$\\mathcal{L}_p$ distance for penalizing perturbations. Researchers have\nexplored different defense methods to defend against such adversarial attacks.\nWhile the effectiveness of $\\mathcal{L}_p$ distance as a metric of perceptual\nquality remains an active research area, in this paper we will instead focus on\na different type of perturbation, namely spatial transformation, as opposed to\nmanipulating the pixel values directly as in prior works. Perturbations\ngenerated through spatial transformation could result in large $\\mathcal{L}_p$\ndistance measures, but our extensive experiments show that such spatially\ntransformed adversarial examples are perceptually realistic and more difficult\nto defend against with existing defense systems. This potentially provides a\nnew direction in adversarial example generation and the design of corresponding\ndefenses. We visualize the spatial transformation based perturbation for\ndifferent examples and show that our technique can produce realistic\nadversarial examples with smooth image deformation. Finally, we visualize the\nattention of deep networks with different types of adversarial examples to\nbetter understand how these examples are interpreted.","url_abs":"http://arxiv.org/abs/1801.02612v2","url_pdf":"http://arxiv.org/pdf/1801.02612v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"spatially-transformed-adversarial-examples","repo_url":"https://github.com/as791/stAdv-PyTorch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"spatially-transformed-adversarial-examples","repo_url":"https://github.com/ayberkydn/stadv-torch","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"unanswered"}},{"paper_slug":"spatially-transformed-adversarial-examples","repo_url":"https://github.com/rakutentech/stAdv","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1801.02612","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}