We have investigated a new application of adversarial examples, namely location privacy protection against landmark recognition systems. We introduce mask-guided multimodal projected gradient descent (MM-PGD), in which adversarial examples are trained on different deep models. Image contents are protected by analyzing the properties of regions to identify the ones most suitable for blending in adversarial examples. We investigated two region identification strategies: class activation map-based MM-PGD, in which the internal behaviors of trained deep models are targeted; and human-vision-based MM-PGD, in which regions that attract less human attention are targeted. Experiments on the Places365 dataset demonstrated that these strategies are potentially effective in defending against black-box landmark recognition systems without the need for much image manipulation.

翻译：我们调查了一种新的对抗性例子的应用,即针对里程碑式识别系统的定位隐私保护;我们引入了蒙面制导多式联运预测梯度下降(MM-PGD),其中对敌对性实例进行了不同深度模型的培训;通过分析区域特性,确定最适合纳入对抗性实例的区域特征,保护图像内容;我们调查了两种区域识别战略:以基于等级的启动地图为基础的MMM-PGD,其中针对的是受过训练的深层模型的内部行为;以及以人为视野的MMM-PGD,其中针对的是吸引较少人类注意力的区域。 对Places365数据集的实验表明,这些战略在抵御黑箱里程碑式识别系统方面可能有效,无需大量图像操纵。