With the great success of deep neural networks, adversarial learning has received widespread attention in various studies, ranging from multi-class learning to multi-label learning. However, existing adversarial attacks toward multi-label learning only pursue the traditional visual imperceptibility but ignore the new perceptible problem coming from measures such as Precision@$k$ and mAP@$k$. Specifically, when a well-trained multi-label classifier performs far below the expectation on some samples, the victim can easily realize that this performance degeneration stems from attack, rather than the model itself. Therefore, an ideal multi-labeling adversarial attack should manage to not only deceive visual perception but also evade monitoring of measures. To this end, this paper first proposes the concept of measure imperceptibility. Then, a novel loss function is devised to generate such adversarial perturbations that could achieve both visual and measure imperceptibility. Furthermore, an efficient algorithm, which enjoys a convex objective, is established to optimize this objective. Finally, extensive experiments on large-scale benchmark datasets, such as PASCAL VOC 2012, MS COCO, and NUS WIDE, demonstrate the superiority of our proposed method in attacking the top-$k$ multi-label systems.

翻译：随着深度神经网络取得巨大成功，对抗学习在多分类和多标签学习等众多研究中受到广泛关注。然而，现有针对多标签学习的对抗攻击仅追求传统的视觉不可察觉性，却忽视了由Precision@$k$和mAP@$k$等度量带来的新型可察觉问题。具体而言，当训练良好的多标签分类器在某些样本上表现远低于预期时，受害者很容易察觉到这种性能退化源于攻击而非模型自身。因此，理想的多标签对抗攻击应不仅能欺骗视觉感知，还应能规避对度量的监控。为此，本文首次提出度量不可察觉性的概念，进而设计了一种新型损失函数，以生成能同时实现视觉与度量不可察觉性的对抗扰动。此外，我们建立了一种具有凸目标函数的高效算法来优化该目标。最后，在PASCAL VOC 2012、MS COCO和NUS WIDE等大规模基准数据集上的大量实验表明，我们提出的方法在攻击Top-$k$多标签系统方面具有优越性。