%PDF-1.3 1 0 obj << /Kids [ 3 0 R 4 0 R 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R ] /Type /Pages /Count 8 >> endobj 2 0 obj << /Title (On Visible Adversarial Perturbations \046 Digital Watermarking) /Producer (PyPDF2) /Author (Jamie Hayes) /Subject (2018 IEEE Conference on Computer Vision and Pattern Recognition Workshops) >> endobj 3 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 12 0 R /Resources << /XObject << /x8 13 0 R /x6 16 0 R /x12 19 0 R /x10 22 0 R >> /ExtGState << /s9 25 0 R /s11 28 0 R /a0 << /CA 1 /ca 1 >> /s5 31 0 R /R24 34 0 R /s7 35 0 R >> /Font << /F2 38 0 R /R41 39 0 R /R29 43 0 R /F1 46 0 R /R39 47 0 R /R37 50 0 R /R35 55 0 R /R25 60 0 R /R33 63 0 R /R27 68 0 R /R31 72 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R ] >> endobj 4 0 obj << /Parent 1 0 R /Rotate 0 /Contents 91 0 R /Resources << /XObject << /R54 92 0 R /R53 93 0 R >> /ExtGState << /R24 34 0 R >> /Font << /R59 94 0 R /R55 97 0 R /R57 102 0 R /F2 106 0 R /F1 107 0 R /R61 108 0 R /R37 50 0 R /R35 55 0 R /R25 60 0 R /R33 63 0 R /R27 68 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 112 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 113 0 R 114 0 R 115 0 R ] /Type /Page >> endobj 5 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 116 0 R /Resources << /ExtGState << /R24 34 0 R >> /Font << /F2 117 0 R /R102 118 0 R /R59 94 0 R /R55 97 0 R /R57 102 0 R /R98 123 0 R /F1 128 0 R /R61 108 0 R /R27 68 0 R /R100 129 0 R /R37 50 0 R /R35 55 0 R /R25 60 0 R /R33 63 0 R /R96 133 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R ] >> endobj 6 0 obj << /Parent 1 0 R /Rotate 0 /Contents 165 0 R /Resources << /XObject << /R116 166 0 R /R115 167 0 R >> /ExtGState << /R24 34 0 R >> /Font << /R59 94 0 R /R55 97 0 R /R57 102 0 R /R127 168 0 R /R125 172 0 R /F1 176 0 R /R123 177 0 R /R121 181 0 R /R129 184 0 R /F2 187 0 R /R119 188 0 R /R100 129 0 R /R117 192 0 R /R61 108 0 R /R37 50 0 R /R35 55 0 R /R25 60 0 R /R33 63 0 R /R27 68 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /Group 112 0 R /MediaBox [ 0 0 612 792 ] /Annots [ 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R ] /Type /Page >> endobj 7 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 203 0 R /Resources << /ExtGState << /R24 34 0 R >> /Font << /F2 204 0 R /F1 205 0 R /R139 206 0 R /R25 60 0 R /R33 63 0 R /R27 68 0 R /R31 72 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 209 0 R 210 0 R ] >> endobj 8 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 211 0 R /Resources << /ExtGState << /R24 34 0 R >> /Font << /R59 94 0 R /R55 97 0 R /R57 102 0 R /F2 212 0 R /F1 213 0 R /R37 50 0 R /R35 55 0 R /R25 60 0 R /R33 63 0 R /R27 68 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R ] >> endobj 9 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 222 0 R /Resources << /XObject << /R189 223 0 R /R188 224 0 R /R190 225 0 R /R187 226 0 R /R186 227 0 R >> /ExtGState << /R24 34 0 R >> /Font << /F2 228 0 R /F1 229 0 R /R25 60 0 R /R27 68 0 R /R31 72 0 R >> /ProcSet [ /Text /ImageC /ImageB /PDF /ImageI ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R ] >> endobj 10 0 obj << /Parent 1 0 R /Rotate 0 /Type /Page /Contents 258 0 R /Resources << /ExtGState << /R24 34 0 R >> /Font << /F2 259 0 R /F1 260 0 R /R27 68 0 R /R31 72 0 R >> /ProcSet [ /ImageC /Text /PDF /ImageI /ImageB ] >> /MediaBox [ 0 0 612 792 ] /Annots [ 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R ] >> endobj 11 0 obj << /Type /Catalog /Pages 1 0 R >> endobj 12 0 obj << /Length 20270 >> stream q q q 0.1 0 0 0.1 0 0 cm /R24 gs 0 g q 10 0 0 10 0 0 cm BT /R25 14.3462 Tf 1 0 0 1 175.95 675.067 Tm [ (On) -249.989 (V) 37.0137 (isible) -249.998 (Adv) 10.0014 (ersarial) -250.012 (P) 20.0061 (erturbations) -250.005 (\046) ] TJ 53.791 -17.9332 Td [ (Digital) -250.007 (W) 65.0011 (atermarking) ] TJ /R27 11.9552 Tf 37.493 -37.8578 Td [ (Jamie) -250.016 (Hayes) ] TJ -34.7121 -13.9473 Td [ (Uni) 24.9957 (v) 14.9851 (ersity) -249.989 (Colle) 14.9872 (ge) -250.008 (London) ] TJ /R29 11.9552 Tf -6.64102 -13.948 Td (j\056hayes\100cs\056ucl\056ac\056uk) Tj /R25 11.9552 Tf -79.8859 -41.0457 Td (Abstract) Tj /R31 9.9626 Tf 1.019 0 0 1 62.0672 525.273 Tm [ (Given) -246.015 (a) -247.013 (mac) 14.9836 (hine) -245.999 (learning) -246.985 (model\054) -245.993 (adver) 9.98746 (sarial) -246.993 (perturba\055) ] TJ 1.002 0 0 1 50.1121 513.317 Tm [ (tions) -250.986 (tr) 15.0012 (ansform) -250.001 (ima) 10.0138 (g) 10.0028 (es) -251.004 (suc) 14.9932 (h) -249.983 (that) -250.985 (the) -249.986 (model\047) 39.9893 (s) -250.985 (output) -249.997 (is) -251.01 (clas\055) ] TJ 0.98 0 0 1 50.1121 501.362 Tm [ <7369026564> -243.989 (as) -244.985 (an) -244.01 (attac) 20.0184 (k) 10.0186 (er) -244.011 (c) 15.0198 (hosen) -245 (class) 1.01399 (\056) -313.012 (Most) -245.003 (r) 37.9989 (esear) 37.9839 (c) 15.021 (h) -244.014 (in) -245 (this) -243.994 (ar) 37.0011 (ea) ] TJ 0.99 0 0 1 50.1121 489.407 Tm [ (has) -252.002 (focused) -251.994 (on) -252 (adver) 10.9892 (sarial) -251.982 (perturbations) -252.01 (that) -252.018 (ar) 38.0037 (e) -251.983 (imper) 37.0086 (cep\055) ] TJ 0.98 0 0 1 50.1121 477.452 Tm [ (tible) -238.99 (to) -239.997 (the) -238.981 (human) -240.011 (e) 30.9835 (ye) 14.996 (\056) -311.011 (Howe) 15.0198 (ver) 114.009 (\054) -242.995 (r) 37.9976 (ecent) -239.988 (work) -239.003 (has) -239.021 (consider) 37.0061 (ed) ] TJ 11.9551 TL T* [ (attac) 20.0184 (ks) -244.011 (that) -245.02 (ar) 37.0011 (e) -244 (per) 37.0174 (ceptible) -243.996 (b) 20.0084 (ut) -244.998 (localized) -245.02 (to) -245 (a) -244.014 (small) -245.002 (r) 36.9986 (e) 40.9871 (gion) -244.992 (of) ] TJ T* [ (the) -224.017 (ima) 10.0123 (g) 10.0055 (e) 15.0198 (\056) -306.009 (Under) -224.008 (this) -223.99 (thr) 38.0164 (eat) -225.017 (model\054) -230.002 (we) -223.991 (discuss) -224.005 (both) -224.987 (defenses) ] TJ 11.9563 TL T* [ (that) -251.982 (r) 37.9982 (emo) 10.0136 (ve) -251.986 (suc) 15.0122 (h) -252.015 (adver) 9.99108 (sar) 0.98273 (ial) -251.985 (perturbations\054) -252.986 (and) -252.009 (attac) 20.0172 (ks) -252.014 (that) ] TJ 1 0 0 1 50.1121 429.631 Tm [ (can) -249.992 (bypass) -250.014 (these) -249.988 (defenses\056) ] TJ /R25 11.9552 Tf 39.3219 TL T* [ (1\056) -249.99 (Intr) 18.0146 (oduction) ] TJ /R27 9.9626 Tf 0.999 0 0 1 62.0672 370.228 Tm [ (Neural) -249.985 (netw) 9.99607 (orks) -249.996 (are) -251.011 (kno) 25.0061 (wn) -250.011 (to) -249.994 (be) -250.015 (vulnerable) -249.98 (to) -249.995 (adv) 15.0052 (ersar) 19.9848 (\055) ] TJ 1.02 0 0 1 50.1121 358.273 Tm [ (ial) -257.998 (e) 15.0055 (xamples\072) -330.019 (perturbations) -257.985 (that) -257.992 (when) -258.009 (combined) -257.99 (with) -257.992 (data) ] TJ 11.9551 TL T* [ (inputs\054) -257.987 (cause) -256.019 (intentional) -256 <6d6973636c6173736902636174696f6e732e> -336.017 (Most) -255.993 (research) ] TJ 1.011 0 0 1 50.1121 334.363 Tm [ (has) -247 (focused) -247.016 (on) -247.983 (studying) -246.98 (small) ] TJ /R33 9.9626 Tf 1 0 0 1 173.908 334.363 Tm [ (\140) -0.69964 ] TJ /R35 6.9738 Tf 4.15078 -1.49492 Td [ (p) -0.89971 ] TJ /R27 9.9626 Tf 1.011 0 0 1 185.154 334.363 Tm [ (perturbations) -246.989 (that) -246.999 (remain) ] TJ 0.98 0 0 1 49.8629 322.408 Tm [ (visually) -225.991 (imperceptible) -226.015 (when) -224.997 (applied) -226.019 (to) -225.994 (an) -225.993 (input\056) -306.009 (FGSM) -226.008 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 271.953 322.408 Tm (13) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 0.98 0 0 1 281.915 322.408 Tm (\135\054) Tj 1 0 0 1 50.1121 310.452 Tm [ (L\055BFGS) -249.991 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 90.2414 310.452 Tm (35) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 100.204 310.452 Tm [ (\135\054) -249.999 (DeepF) 14.9914 (ool) -250.02 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 153.454 310.452 Tm (25) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 163.417 310.452 Tm [ (\135\054) -249.999 (Carlini) ] TJ /R37 6.9738 Tf 35.9773 -1.79805 Td [ (f) -0.29932 ] TJ /R35 6.9738 Tf 4.08203 0 Td [ (\140) -0.19955 ] TJ /R39 4.9813 Tf 3.33477 -0.99687 Td [ (2) -0.60284 ] TJ /R35 6.9738 Tf 3.88789 0.99687 Td [ (\073) -0.30107 (\140) -0.19955 ] TJ /R41 4.9813 Tf 5.70117 -0.99687 Td [ (1) -0.10292 ] TJ /R37 6.9738 Tf 7.27813 0.99687 Td [ (g) -0.30107 ] TJ /R27 9.9626 Tf 7.0707 1.79805 Td (\133) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 234.066 310.452 Tm (8) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 239.048 310.452 Tm [ (\135\054) -249.997 (PGD) -250.017 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 273.08 310.452 Tm (24) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 283.043 310.452 Tm (\135) Tj 1.02 0 0 1 50.1121 298.497 Tm [ (and) -278.012 (EAD) -277.983 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 94.7012 298.497 Tm (9) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.02 0 0 1 99.682 298.497 Tm [ (\135) -278.009 (are) -277.981 (all) -277.987 (e) 15.0061 (xamples) -278.009 (of) -278.003 (attacks) -278.008 (that) -277.981 (modify) -277.984 (each) ] TJ 1.014 0 0 1 50.1121 286.542 Tm [ (pix) 14.994 (el) -246.009 (in) -247.006 (an) -246.001 (image) -246.002 (by) -246.998 (a) -245.988 (small) -245.986 (amount\054) -245.994 (while) -247.015 (attacks) -246.009 (such) -246.012 (as) ] TJ 0.98 0 0 1 49.923 274.587 Tm [ (JSMA) -233.011 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 80.3988 274.587 Tm (26) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 0.98 0 0 1 90.3621 274.587 Tm [ (\135) -233.012 (and) -231.99 (Carlini) ] TJ /R35 6.9738 Tf 1 0 0 1 139.375 273.093 Tm [ (\140) -0.2013 ] TJ /R39 4.9813 Tf 3.33398 -0.99687 Td [ (0) -0.60039 ] TJ /R27 9.9626 Tf 0.98 0 0 1 149.366 274.587 Tm (\133) Tj ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 152.617 274.587 Tm (8) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 0.98 0 0 1 157.599 274.587 Tm [ (\135\054) -236.992 (perturb) -233.008 (a) -231.998 (small) -233 (subset) -231.997 (of) -233.009 (pix) 15.9862 (els) ] TJ 1 0 0 1 50.1121 262.632 Tm [ (in) -249.985 (an) -249.997 (image\056) ] TJ 1.017 0 0 1 62.0672 249.524 Tm [ (Recent) -245.998 (w) 9.98963 (ork) -245.004 (by) -246.019 (Bro) 25.0117 (wn) -246.01 (et) -246.007 (al\056) -244.987 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 183.856 249.524 Tm (5) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.017 0 0 1 188.838 249.524 Tm [ (\135) -246 (and) -245 (Karmon) -246.002 (et) -245.004 (al\056) -245.99 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 273.025 249.524 Tm (20) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.017 0 0 1 282.988 249.524 Tm (\135) Tj 0.986 0 0 1 50.1121 237.569 Tm [ (ha) 20 (v) 15.0153 (e) -254.01 (studied) -255.009 (adv) 16.0082 (ersarial) -255.011 (e) 15.0054 (xamples) -254 (under) -255.011 (a) -255.004 (ne) 26.0044 (w) -255.009 (threat) -254.017 (model) ] TJ 0.98 0 0 1 48.4578 225.614 Tm [ (\055) -244.014 (an) -243.997 (at) 0.99211 (tack) 10.0136 (er) -243.998 (that) -244.007 (crafts) -243.014 (perturbations) -244.007 (that) ] TJ /R31 9.9626 Tf 165.737 0 Td [ (ar) 38.0014 (e) -244 (not) ] TJ /R27 9.9626 Tf 30.6756 0 Td [ (bounded) -244.019 (by) ] TJ -194.725 -11.9551 Td (an) Tj /R33 9.9626 Tf 1 0 0 1 61.3699 213.659 Tm [ <0f> -0.89997 ] TJ /R27 9.9626 Tf 0.98 0 0 1 67.4559 213.659 Tm [ (v) 26.0092 (alue) -209.998 (b) 21.008 (ut) ] TJ /R31 9.9626 Tf 38.0206 0 Td [ (ar) 38.0014 (e) ] TJ /R27 9.9626 Tf 14.9868 0 Td [ (bounded) -209.011 (to) -208.99 (a) -208.992 (small) -208.994 (re) 14.9822 (gion) -208.984 (or) -209.004 (location) -209.001 (in) -209.991 (the) ] TJ -70.7051 -11.9551 Td [ (image\056) -308.02 (Clearly) 67.0094 (\054) -234.994 (this) -228.991 (remo) 15.0047 (v) 15.0072 (es) -229.007 (the) -229.018 (visually) -229.991 (imperceptible) -229.016 (prop\055) ] TJ 1.02 0 0 1 50.1121 189.749 Tm [ (erty) -251.004 (that) -250.996 (most) -252.018 (other) -250.997 (attacks) -250.984 (possess\056) -322.991 (Ho) 25.0054 (we) 24.0156 (v) 14.9989 (er) 38.9833 (\054) -251.993 (as) -252.017 (noted) -250.982 (by) ] TJ 1.003 0 0 1 50.1121 177.793 Tm [ (both) -250.008 (Bro) 24.9858 (wn) -250.004 (et) -250.019 (al\056) -250.012 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 125.076 177.793 Tm (5) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.003 0 0 1 130.057 177.793 Tm [ (\135) -250.016 (and) -250.007 (Karmon) -249.985 (et) -250.019 (al\056) -250.012 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 213.304 177.793 Tm (20) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.003 0 0 1 223.267 177.793 Tm [ (\135\054) -250.01 (attack) 10.0026 (ers) -249.985 (may) ] TJ 1.02 0 0 1 50.1121 165.838 Tm [ (not) -261.997 (be) -260.989 (concerned) -262.012 (with) -261.99 (this) -261.982 (property\073) -269.983 (ML) -260.991 (models) -261.993 (are) -261.99 (often) ] TJ 0.98 0 0 1 50.1121 153.883 Tm [ (not) -246.996 (v) 26.0092 (alidated) -246.996 (by) -247.011 (humans\054) -249.002 (and) -246.994 (thus) -247.006 (visual) -246.015 (indistinguishability) ] TJ 1.02 0 0 1 50.1121 141.928 Tm [ (between) -283.006 (adv) 15.0188 (ersarial) -282.991 (and) -283.009 (clean) -281.989 (e) 14.0067 (xamples) -283.005 (may) -282.01 (not) -282.986 (a) -282.983 (highly) ] TJ 11.9551 TL T* [ (sought) -303.016 (after) -303.015 (property) -303.002 (of) -301.99 (the) -303.005 (attack\056) -477.012 (Furthermore\054) -318.007 (humans) ] TJ 1.018 0 0 1 50.1121 118.018 Tm [ (may) -245.005 (not) -245.995 (recognize) -244.981 (the) -245.994 (adv) 14.9851 (ersarial) -245.997 (e) 15.0104 (xamples) -245.007 (as) -245.984 (adv) 14.9851 (ersarial\054) ] TJ 0.998 0 0 1 49.8629 106.062 Tm [ (vie) 24.9821 (wing) -250.99 (the) -251.014 (small) -251.002 (visual) -251.999 (perturbations) -251.018 (as) -250.987 (natural) -250.982 (corruption) ] TJ 1 0 0 1 50.1121 94.107 Tm [ (or) -249.996 (noise) -250.018 (within) -250.002 (the) -249.99 (image\056) ] TJ 1.006 0 0 1 62.0672 81 Tm [ (Bro) 25.0191 (wn) -247.992 (et) -248.017 (al\056) -248.005 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 116.868 81 Tm (5) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.006 0 0 1 121.849 81 Tm [ (\135) -248.005 (introduced) -247.992 (an) -247.982 (attack\054) -248.002 (Adv) 14.9982 (ersarial) -247.985 (P) 14.9836 (atch\054) ] TJ 1.01 0 0 1 308.862 550.335 Tm [ (that) -247.991 <026e6473> -247.995 (a) -247.983 (\223uni) 24.9813 (v) 15.0091 (ersal\224) -248 (adv) 15 (ersarial) -248.003 (perturbation) -248.008 (that) -247.988 (can) -247.993 (be) ] TJ 1.02 0 0 1 308.862 538.38 Tm [ (applied) -314.012 (to) -313.012 (an) 15.0134 (y) -314.012 (image) -314.017 (and) -312.991 (cause) -313.985 (a) -314.005 (miscl) 1.00425 <6173736902636174696f6e> -314 (of) -313.981 (the) ] TJ 11.9551 TL T* [ (adv) 15.0182 (ersaries) -277.008 (choice\056) -399.011 (The) 15.0037 (y) -276.996 (sho) 24.9814 (w) -276.987 (that) -276.982 (it) -277.001 (is) -276.016 (possible) -277.001 (to) -276.996 (create) ] TJ 11.9559 TL T* [ (a) -247.003 (small) -246.016 (adv) 13.9803 (ersarial) -246.011 (\223patch\224) -246.989 (that) -246.998 (is) -245.994 (in) 38.9833 (v) 23.9916 (ariant) -245.994 (to) -247.013 (location) -247.008 (\050on) ] TJ 1.01 0 0 1 308.862 502.514 Tm [ (the) -247.993 (image\051) -249.014 (and) -248.01 (rotation\056) -309.015 (Furthermore\054) -248.008 (the) 14.0095 (y) -248.003 (sho) 24.9861 (w) -248.017 (the) -249.002 (attack) ] TJ 1.007 0 0 1 308.862 490.559 Tm [ (transfers) -247.994 (to) -248.992 (the) -248.011 (ph) 5.01552 (ysical) -249.002 (w) 10.0067 (orld) -247.987 (\055) -248.985 (it) -248.002 (is) -248.985 (possible) -247.982 (to) -248.016 (construct) -248.995 (a) ] TJ 1 0 0 1 308.862 478.604 Tm [ (patch\054) -249.988 (print) -250.015 (it) -249.983 (out) -250.02 (and) -249.993 (retain) -249.988 (its) -250.017 (adv) 14.9828 (ersarial) -249.997 (properties\056) ] TJ 1.02 0 0 1 320.817 465.621 Tm [ (In) -254.016 (parallel\054) -255.991 (Karmon) -254.014 (et) -253 (al\056) -254.014 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 429.114 465.621 Tm (20) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1.02 0 0 1 439.077 465.621 Tm [ (\135) -253.985 (introduced) -254 (an) -252.995 (attack\054) -256.017 (La\055) ] TJ 0.993 0 0 1 308.503 453.666 Tm [ (V) 135.996 (AN\054) -252.994 (that) -253.001 (creates) -253.016 (localized) -252.989 (and) -253.009 (visible) -252.994 (adv) 16.0065 (ersarial) -252.999 (perturba\055) ] TJ 0.98 0 0 1 308.862 441.711 Tm [ (tions\056) -299.982 (Broadly) 65.9829 (\054) -216.988 (both) -207.983 (attacks) -208.019 (are) -207.013 (equi) 25.0058 (v) 26.0111 (alent\073) -224.012 (Adv) 16.0037 (ersarial) -208.014 (P) 14.9935 (atch) ] TJ 1 0 0 1 308.862 429.755 Tm [ (is) -249.985 (trained) -249.005 (under) -249.99 (a) -248.983 (pre\055processing) -250.017 (stage) -249.007 (that) -249.983 (is) -249.983 (applied) -248.998 (to) -249.988 (the) ] TJ 11.9551 TL T* [ (patch\054) -249.007 (which) -249.983 (outputs) -249.015 (a) -248.983 (ne) 25.0154 (w) -249.012 (rotated) -249.983 (and) -249.012 (scaled) -249.012 (patch\054) -249.988 (which) ] TJ 1.017 0 0 1 308.862 405.845 Tm [ (is) -245.992 (then) -247.016 (applied) -246.014 (to) -246.99 (the) -246.011 (image) -247.014 (at) -246.007 (a) -245.997 (randomly) -246.985 (chosen) -245.997 (location\056) ] TJ 0.98 0 0 1 308.862 393.89 Tm [ (LaV) 138.017 (AN) -240.994 (is) -240.011 (similar) 41.0021 (\054) -242.994 (ho) 25.0133 (we) 26.0136 (v) 15.006 (er) -239.996 (the) -240.981 (locati) 1 (on\054) -243.987 (rotation) -239.981 (and) -239.991 (scale) -241.001 (is) ] TJ 1.011 0 0 1 308.862 381.935 Tm [ (randomly) -247.001 (chosen) -248 (once) -247.018 (at) -247.99 (the) -247.006 (be) 15.004 (ginning) -248 (of) -247.016 (the) -248.014 (attack) -247.001 (and) -248.005 (is) ] TJ 0.986 0 0 1 308.862 369.98 Tm [ (then) -254.004 (left) -254.017 (unchanged\056) -316.002 (The) -253.99 (authors) -254.009 (also) -254.019 (discuss) -254.014 (transferability) ] TJ 0.991 0 0 1 308.862 358.024 Tm [ (properties) -252.997 (of) -252.988 (their) -253.987 (method\054) -252.985 (and) -252.99 (sho) 24.9904 (w) -253.005 (that) -254.004 (applying) -253 (a) -252.98 (similar) ] TJ 0.98 0 0 1 308.862 346.069 Tm [ (pre\055processing) -238.988 (stage) -239.016 (at) -238.983 (each) -239 (iteration) -238.991 (of) -239.011 (the) -238.981 (attack) -239.011 (can) -239.021 (create) ] TJ 1 0 0 1 308.862 334.114 Tm [ (perturbations) -250 (that) -249.983 (are) -250.01 (in) 40.0056 (v) 24.9811 (ariant) -249.988 (to) -249.988 (location) -250.007 (or) -249.997 (rotation\056) ] TJ 1.02 0 0 1 320.817 321.131 Tm [ (In) -394.016 (this) -394.984 (w) 10.0089 (ork\054) -432.005 (we) -393.985 (discuss) -394 (the) -394.994 (dif) 24.9814 <0263756c74696573> -394 (in) -394.009 (defending) ] TJ 0.98 0 0 1 308.862 309.176 Tm [ (ag) 4.98116 (ainst) -225.012 (such) -225 (attacks\056) -306.016 (Because) -224.987 (both) -224.987 (Adv) 15.0035 (ersarial) -224.017 (P) 14.9935 (atch) -225.002 (and) -224.987 (La\055) ] TJ 0.992 0 0 1 308.503 297.221 Tm [ (V) 135.997 (AN) -251.994 (radically) -251.994 (change) -251.016 (small) -251.989 (re) 14.99 (gions) -251.989 (of) -252.009 (an) -251.011 (image\054) -251.984 (defending) ] TJ 0.98 0 0 1 308.862 285.266 Tm [ (ag) 4.98116 (ainst) -239.016 (such) -239.003 (a) 1.01774 (ttacks) -239 (is) -239.011 (v) 15.006 (ery) -238.996 (closely) -237.995 (aligned) -238.981 (to) -238.996 (the) -238.981 (problem) -238.991 (of) ] TJ 0.981 0 0 1 308.862 273.31 Tm [ (inpainting) -255.007 (and) -255.981 (w) 10 (atermark) -255.002 (remo) 15.0032 (v) 26.0145 (al\056) -317.985 (W) 82 (e) -256.009 (may) -255.004 (think) -255.979 (of) -254.984 (the) -255.999 (per) 20.9885 (\055) ] TJ 0.982 0 0 1 308.862 261.355 Tm [ (turbation) -255.014 (as) -254.994 (a) -254.018 (w) 10.0069 (atermark) -254.997 (placed) -254.984 (in) -255.014 (the) -254.011 (image) -255.004 (by) -255.014 (the) -255.009 (attack) 10.0169 (er) 55.9838 (\056) ] TJ 1.02 0 0 1 308.553 249.4 Tm [ (The) -295.018 (goal) -295.003 (of) -295.993 (a) -295.015 (rob) 19.9938 (ust) -295 (defense) -296 (is) -295.006 (then) -295 (to) -294.986 (remo) 14.0115 (v) 14.9965 (e) -295.015 (this) -295 (w) 10.0089 (ater) 19.0087 (\055) ] TJ 0.98 0 0 1 308.862 237.445 Tm [ (mark\054) -233.992 (or) -229.008 (at) -228.981 (least) -229 (render) -229.008 (it) -228.983 (as) -229.008 (safe) -228.988 (to) -228.993 (the) -229.018 (tar) 18 (get) -229.018 (model\056) -307.992 (Quiring) ] TJ T* [ (et) -244.985 (al\056) -246.005 (\133) ] TJ ET Q 0 1 0 rg q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 1 0 0 1 333.443 225.49 Tm (28) Tj ET Q 0 g q 10 0 0 10 0 0 cm BT /R27 9.9626 Tf 0.98 0 0 1 343.406 225.49 Tm [ (\135) -245.015 (ha) 19.9847 (v) 15.006 (e) -245 (also) -244.992 (dra) 14.986 (wn) -244.982 (connections) -246.012 (between) -244.992 (the) -245.982 (researc) 0.98023 (h) ] TJ 1.012 0 0 1 308.862 213.535 Tm [ <02656c6473> -246.997 (of) -245.987 (adv) 14.9964 (ersarial) -247.004 (e) 14.9843 (xamples) -247.004 (and) -245.982 (digital) -246.99 (w) 9.99601 (atermarking\054) -245.987 (in) ] TJ 1 0 0 1 308.862 201.579 Tm [ (the) -249.99 (conte) 14.9852 (xt) -249.985 (of) -249.995 (traditional) ] TJ /R33 9.9626 Tf 100.572 0 Td [ <0f> -0.89691 ] TJ /R27 9.9626 Tf 4.04414 0 Td [ (\055ball) -249.988 (attacks\056) ] TJ 1.013 0 0 1 320.817 188.597 Tm [ (W) 78.9989 (e) -247.984 (sho) 25.0016 (w) -248.011 (that) -248.001 (localized) -248.018 (and) -247.994 (visible) -247.984 (adv) 15.0131 (ersarial) -247.999 (perturba\055) ] TJ 1.01 0 0 1 308.862 176.641 Tm [ (tions) -247.995 (can) -249 (be) -247.998 (defended) -247.995 (ag) 3.98885 (a) 1.0142 (inst) -248.993 (using) -248.012 (simple) -248.997 (principles) -248.003 (from) ] TJ 0.983 0 0 1 308.862 164.686 Tm [ (inpainting) -255.012 (res) 1.01463 (earch\056) -316.996 (Our) -254.004 (intuition) -255.014 (is) -253.997 (that) -255 (the) -253.987 <696e0375656e6365> -254.994 (signal) ] TJ 1.02 0 0 1 308.862 152.731 Tm [ (of) -269.008 (pix) 14.0043 (els) -269.008 (within) -269.02 (an) -269.983 (im) 1.00425 (age) -270.01 (containing) -268.986 (localized) -269.015 (and) -270.015 (visible) ] TJ 0.98 0 0 1 308.862 140.776 Tm [ (adv) 14.986 (ersarial) -246.983 (perturbations) -247.008 (are) -247.983 (dominated) -247.003 (by) -248.013 (the) -246.983 (perturbations\054) ] TJ 1.02 0 0 1 308.862 128.821 Tm [ (and) -331.983 (thus) -332.014 (we) -330.981 (can) -332.014 (use) -332.004 (this) -331.98 (domi) 1.01867 (nating) -332.014 (f) 9.98488 (actor) -331.985 (to) -332.004 (detect) -332 (and) ] TJ 0.98 0 0 1 308.862 116.866 Tm [ (defend\056) -314.006 (W) 82 (e) -248 (sho) 26.0011 (w) -246.985 (an) -247.998 (attack) 10.0073 (er) -246.998 (is) -248.013 (unabl) 1 (e) -248.003 (to) -246.998 (modify) -248.013 (their) -247.003 (attack) ] TJ 1.02 0 0 1 308.862 104.91 Tm [ (to) -314.012 (successfully) -313.015 (bypass) -314.017 (the) -314 (defense) -313.99 (i) 1 (f) -313.99 (the) 14.0115 (y) -313.015 (are) -314 <636f6e026e6564> -314.005 (to) ] TJ 11.9551 TL T* [ (perturb) -265.99 (only) -265.988 (a) -265.993 (small) -266.005 (subset) -266.012 (of) -267.007 (pix) 15.0061 (els\056) -367.009 (W) 79.0141 (e) -265.993 (then) -267.016 (introduce) -266.002 (a) ] TJ T* [ (tri) 25.015 (vial) -314 (attack) -314.009 (that) -313 (can) -313.985 (break) -313.985 (this) -312.991 (defense\054) -330.995 (highlighting) -314.014 (the) ] TJ 1 0 0 1 295.121 51.1121 Tm (1) Tj ET Q Q Q q q 1 1 1 rg /a0 gs 48.406 786.422 515.188 -52.699 re f q /s5 gs /x6 Do Q q /s7 gs /x8 Do Q q /s9 gs /x10 Do Q q /s11 gs /x12 Do Q Q Q Q q 1 0 0 1 0 0 cm BT /F1 12 Tf 14.4 TL ET 1 1 1 rg n 270 47 72 14 re f* 0.5 0.5 0.5 rg BT /F2 9 Tf 10.8 TL ET BT 1 0 0 1 297 50 Tm (1710) Tj T* ET Q endstream endobj 13 0 obj << /Filter /FlateDecode /Resources << /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x18 14 0 R >> >> /Length 28 /Group << /Type /Group /S /Transparency /CS /DeviceRGB /I true >> /BBox [ 78 746 96 765 ] /Type /XObject /Subtype /Form >> stream x+O4PH/VЯ0Pp 0 endstream endobj 14 0 obj << /Filter /FlateDecode /Resources 15 0 R /Length 107 /Type /XObject /BBox [ 78 746 96 765 ] /Subtype /Form >> stream xe AC̬wʠ =p,?]%+H-
Jc "82w8VSnGW;"
endstream
endobj
15 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
16 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x15 17 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 67 752 84 775 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ04Up
0
endstream
endobj
17 0 obj
<<
/Filter /FlateDecode
/Resources 18 0 R
/Length 228
/Type /XObject
/BBox [ 67 752 84 775 ]
/Subtype /Form
>>
stream
xeQKn!s ?FPav6R٪TS.
b];15YyR
{7QL.\:Rv/x9l+L7h%1!}i/AI(kz"U&,YO![R hg{3}4/GyYF:!w}Gn+'xJcO9i뽼_-:`
endstream
endobj
18 0 obj
<<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
>>
endobj
19 0 obj
<<
/Filter /FlateDecode
/Resources <<
/ExtGState <<
/a0 <<
/CA 1
/ca 1
>>
>>
/XObject <<
/x24 20 0 R
>>
>>
/Length 28
/Group <<
/Type /Group
/S /Transparency
/CS /DeviceRGB
/I true
>>
/BBox [ 112 751 500 772 ]
/Type /XObject
/Subtype /Form
>>
stream
x+O4PH/VЯ02Qp
0
endstream
endobj
20 0 obj
<<
/Filter /FlateDecode
/Resources 21 0 R
/Length 56490
/Type /XObject
/BBox [ 112 751 500 772 ]
/Subtype /Form
>>
stream
xtIJ5*|^~x?P9)<<ҥ+kh4}/?>]漿վ]Z Ǭ57W'b~?Kwk6:>rAニxeG1k-/LfߗA̺(egk5>
=KO1{Vux}Ol|_s؟|*>5=k|*a5x}On :97~1s7rX {|>IQQo6|'\#x_ڽC}M7(췀(N
سW#^Ň}|zblnB'\o=r;$s:z-
V3+έ昵 WD/nl ;q"3Pg휅\3C`k7760c9-Cȸ