Method and apparatus for generating artificial intelligence resistant verification images
An apparatus includes one or more processors that are configured to determine a pixel-by-pixel bounds for a perturbed image, generate an adversarial example using an adversarial example generation technique, and modify the adversarial example to generate the perturbed image based on the pixel-by-pixel bounds. When an initial perturbed image does not reside within the pixel-by-pixel bounds, the one or more processors adjust the initial perturbed image to generate the perturbed image by a Weber-Fechner based adversarial perturbation to reside within the pixel-by-pixel bounds. The one or more processors provide the perturbed image to a computing device in an image-based Completely Automated Public Turing Test to tell Computers and Humans Apart (CAPTCHA).
1. A method at least partially controlled by a computing device, the method comprising:
determining pixel-by-pixel bounds for a perturbed image of a source image;
generating an adversarial example;
modifying, based on the pixel-by-pixel bounds, the adversarial example to generate the perturbed image; and
providing the perturbed image to a server that is configured to provide the perturbed image as part of a verification image.
2. The method of claim 1 , wherein:
generating the adversarial example includes generating an initial perturbed image using an adversarial example generation technique.
3. The method of claim 2 , further comprising:
determining whether the initial perturbed image resides within the pixel-by-pixel bounds.
4. The method of claim 3 , further comprising:
when the initial perturbed image does not reside within the pixel-by-pixel bounds, adjusting the initial perturbed image by a Weber-Fechner based adversarial perturbation to reside within the pixel-by-pixel bounds.
5. The method of claim 4 , wherein:
the Weber-Fechner based adversarial perturbation is equivalent to a difference between a Weber-Fechner based perturbed image and the initial perturbed image.
6. The method of claim 5 , wherein:
the Weber-Fechner based perturbed image is equivalent to an average of a maximum threshold value of the pixel-by-pixel bounds and a minimum threshold value of the pixel-by-pixel bounds.
7. The method of claim 6 , wherein:
the maximum threshold value of the pixel-by-pixel bounds and the minimum threshold value of the pixel-by-pixel bounds are determined using a threshold stimuli and the source image.
8. The method of claim 1 , wherein:
the adversarial example is generated using at least one of a Fast Gradient Sign Method (FGSM), a Deep Fool Method (DFM), or a Jacobian-based Saliency Map Attack (JSMA).
9. The method of claim 1 , wherein:
the pixel-by-pixel bounds are based on limitations of human visual perception.
10. A non-transitory computer readable medium embodying a set of executable instructions to manipulate one or more processors to perform operations comprising:
determining pixel-by-pixel bounds for a perturbed image;
generating an adversarial example;
modifying, based on the pixel-by-pixel bounds, the adversarial example to generate the perturbed image; and
providing the perturbed image to an image-based classification system.
11. The non-transitory computer readable medium of claim 10 , the operations further comprising:
generating the adversarial example includes generating an initial perturbed image using an adversarial example generation technique.
12. The non-transitory computer readable medium of claim 11 , the operations further comprising:
determining whether the initial perturbed image resides within the pixel-by-pixel bounds.
13. The non-transitory computer readable medium of claim 12 , the operations further comprising:
when the initial perturbed image does not reside within the pixel-by-pixel bounds, adjusting the initial perturbed image by a Weber-Fechner based adversarial perturbation to reside within the pixel-by-pixel bounds.
14. The non-transitory computer readable medium of claim 13 , wherein:
the Weber-Fechner based adversarial perturbation is equivalent to a difference between a Weber-Fechner based perturbed image and the initial perturbed image.
15. The non-transitory computer readable medium of claim 14 , wherein:
the Weber-Fechner based perturbed image is equivalent to an average of a maximum threshold value of the pixel-by-pixel bounds and a minimum threshold value of the pixel-by-pixel bounds.
16. The non-transitory computer readable medium of claim 15 , wherein:
the maximum threshold value of the pixel-by-pixel bounds and the minimum threshold value of the pixel-by-pixel bounds are determined using a threshold stimuli and a source image.
17. The non-transitory computer readable medium of claim 16 , wherein:
the adversarial example generation technique includes using at least one of a Fast Gradient Sign Method (FGSM), a Deep Fool Method (DFM), or a Jacobian-based Saliency Map Attack (JSMA).
18. The non-transitory computer readable medium of claim 10 , wherein:
the pixel-by-pixel bounds are based on limitations of human visual perception.
19. An apparatus, comprising:
a memory storing instructions;
one or more processors that, in response to receiving the instructions, are configured to:
determine pixel-by-pixel bounds for a perturbed image of a source image;
generate an adversarial example;
modify, based on the pixel-by-pixel bounds, the adversarial example to generate the perturbed image; and
provide the perturbed image in an image-based Completely Automated Public Turing Test to tell Computers and Humans Apart (CAPTCHA).
20. The apparatus of claim 19 , wherein:
in response to receiving the instructions, the one or more processors are configured to:
in response to detecting that an initial perturbed image does not reside within the pixel-by-pixel bounds, adjust the initial perturbed image to generate the perturbed image by a Weber-Fechner based adversarial perturbation to reside within the pixel-by-pixel bounds.