Systems and methods for joint adversarial training by incorporating both spatial and pixel attacks

A computer-implemented method for adversarial image generation to train an image model using one or more processors to cause steps to be performed comprising:

• receiving an input image, a ground-truth label for the input image, a spatial attack budget, and a pixel perturbation budget;
• selecting random points for both flow field and pixel perturbation in their respective budget induced spaces;
• obtaining a first adversarial image for the input image using the current pixel perturbation and flow field, the current flow field and pixel perturbation are updatable and start from the selected random points;
• computing an adversarial-generation label by randomly sampling a non-ground-truth label;
• computing a gradient with respect to pixel perturbation for a loss function comprising the first adversarial image, the adversarial-generation label and image model parameters;
• obtaining a modified pixel perturbation based on at least the computed gradient with respect to pixel perturbation;
• projecting the modified pixel perturbation to a pixel perturbation feasible region specified by the pixel perturbation budget to update the pixel perturbation;
• obtaining a second adversarial image for the input image using a current flow field and the update pixel perturbation;
• computing a gradient with respect to the flow field for a loss function comprising the second adversarial image, the adversarial-generation label and image model parameters;
• obtaining a modified flow field based on at least the computed gradient with respect to the flow field;
• projecting the modified flow field to a flow feasible region specified by the spatial attack budget to update the flow field;
• and
• generating an adversarial image based on the updated flow field and the updated pixel perturbation.

A computer-implemented method of joint adversarial training for an image model using one or more processors to cause steps to be performed comprising:

• receiving a dataset comprising a plurality of input images, spatial attack budget and pixel perturbation budget, each image has a corresponding ground-truth label;
• randomly sampling a batch comprising multiple input images and corresponding ground-truth labels from the dataset;
• applying a joint adversarial attack incorporating both spatial and pixel attacks to each input image in the batch to generate an adversarial image batch comprising multiple adversarial images;
• generating a smoothed ground-truth label for each input image of the batch;
• for each adversarial image, obtaining a gradient of a loss function with respect to image model parameters based on at least the batch of perturbed images and smoothed ground-truth labels;
• and
• using a descent step based on the gradient for each adversarial image to update the image model parameters.