| Human visual attention is an advanced internal mechanism to rapidly select informative and conspicuous regions from external complex visual stimuli.In the past decades,a plethora of computational visual saliency models are proposed to simulate the human visual attention.These visual saliency models are widely used as an efficient front-end process to a wide variety of complex back-end high-level vision applications,such as saliency-aware image/video compression,video summarization,image captioning,visual question answering,patient diagnosis,scene understanding,fine-grained classification,object recognition,visual description,image quality assessment,advertising,webpage design,and security-related applications,such as autonomous driving,surveillance and tracking.Therefore,it’s critical to evaluate the robustness of current saliency models before they are deployed into the practical applications,especially to the securitysensitive cases.To the best of our knowledge,most of current human attention studies and saliency models are based on stereotype stimuli,e.g.distortion-free images and upright scenes.However,most of stimuli in the real physical world are corrupted by diverse transformations.In addition,the robustness of deep neural network based saliency models against the malicious worstcase adversarial attacks has never been well studied before.To fill these voids,this thesis investigates the robustness of visual attention models from two major perspectives,i.e.1)the robustness against common transformations(e.g.noise,blur,compression artifacts,contrast change,cropping,rotation,shearing,mirroring,etcetera),2)the robustness against malicious worst-case adversarial attacks(which add some quasiimperceptible but deliberate perturbations to the benign input,to drastically change the model output).First,to evaluate the robustness over common transformations,we create a novel eye-movement dataset including fixations of 10 observers over1900 images degraded by 18 types of transformations.By analyzing eye movements,we find that observers look at different locations over transformed versus original images.Then we utilize the new data over transformed images,called data augmentation transformation(DAT),to train deep saliency models.We find that the label-preserving DATs(e.g.mirroring,inversion,slight contrast change,slight JPEG compression and noise)that have negligible impact on human gaze can boost saliency prediction performance,whereas some other DATs(e.g.rotation,cropping,motion blur and severe shearing transformations)that significantly impact human gaze will degrade the performance.These label-preserving valid augmentation transformations provide a reliable solution to enlarge existing visual saliency datasets.Finally,we introduce a novel visual saliency model based on generative adversarial networks(dubbed Gaze GAN).A modified U-Net is utilized as the generator of the Gaze GAN,which combines classic “skip connection”with a novel “center-surround connection”(CSC)module.Our proposed CSC module mitigates trivial artifacts while emphasizing visual semantic salient regions in the representation space,and increases model nonlinearity,thus demonstrating better robustness against common transformations.We also establish a new fine-grained robustness benchmark containing 22state-of-the-art saliency models over 18 types of common transformations.Second,we propose a novel query-based adversarial attack to evaluate the robustness of DNN-based saliency models.The proposed method includes two steps: 1)We design a new partially-white-box subspace attack to reduce the redundancy of the adversarial perturbation.2)We exploit the sparse perturbations as the prior cues,and use an iterative zeroth-order optimizer to compute the directional derivatives along the sparse prior directions,in order to accelerate the estimation of the actual gradient w.r.t.the black-box target model.This method achieves the best tradeoff between attack ability and perturbation redundancy against DNN-based saliency models.Finally,we provide a new robustness benchmark including 18 state-ofthe-art DNN-based saliency models against 16 malicious adversarial attacks,under both of white-box and black-box settings.Third,we propose a novel transfer-based black-box attack,dubbed Serial-Mini-Group-Ensemble-Attack(SMGEA).Concretely,SMGEA first divides a large number of pre-trained white-box source models into several“mini-groups”.For each mini-group,we design three feature-space ensemble strategies to improve the intra-group transferability.Moreover,we propose a new algorithm that recursively accumulates the “long-term” gradient memories of the previous mini-group to the subsequent mini-group.By this way,the learned adversarial information can be preserved and the inter-group transferability can be improved.More importantly,the proposed SMGEA pipeline not only boosts the adversarial transferability against deep saliency models,but also improves the attack ability against other computer vision tasks including classification,segmentation,and image translation.Therefore,our SMGEA offers a general ensemble attack paradigm that is available for diverse adversarial robustness applications.Finally,we contribute a new general code repository to promote research on adversarial attack and defense over various computer vision tasks.This thesis reveals the fragility of state-of-the-art visual saliency models from different perspectives,and verifies that current deep saliency models are not qualified to be unleashed into safety-critical real-world applications,especially when suffering from malicious worst-cast attacks.Despite we provide some solutions to improve the model robustness(i.e.a robust new model,the label-preserving data augmentation transformations,and adversarial training),the proposed query-based and transfer-based attacks are still fatal to the DNN-based saliency models.The proposed new attacks can be utilized as efficient surrogates to examine the robustness of DNN-based saliency models,and put forward higher requirement to the effective adversarial defense solutions. |
