%PDF-1.4
%
1 0 obj
<< /Metadata 3 0 R /Pages 4 0 R /Type /Catalog >>
endobj
2 0 obj
<< /Author (Chin-Yuan Yeh; Hsi-Wen Chen; Hong-Han Shuai; De-Nian Yang; Ming-Syan Chen) /Producer (pikepdf 3.1.0) /Subject (IEEE International Conference on Computer Vision) /Title (Attack As the Best Defense: Nullifying Image-to-Image Translation GANs via Limit-Aware Adversarial Attack) >>
endobj
3 0 obj
<< /Subtype /XML /Type /Metadata /Length 1242 >>
stream
Attack As the Best Defense: Nullifying Image-to-Image Translation GANs via Limit-Aware Adversarial AttackChin-Yuan Yeh Hsi-Wen Chen Hong-Han Shuai De-Nian Yang Ming-Syan ChenIEEE International Conference on Computer Vision
endstream
endobj
4 0 obj
<< /Count 10 /Kids [ 5 0 R 6 0 R 7 0 R 8 0 R 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R ] /Type /Pages >>
endobj
5 0 obj
<< /Annots [ 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R ] /Contents [ 24 0 R 25 0 R 26 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 27 0 R /Type /Page >>
endobj
6 0 obj
<< /Annots [ 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R ] /Contents [ 54 0 R 55 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 56 0 R /Type /Page >>
endobj
7 0 obj
<< /Annots [ 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R ] /Contents [ 72 0 R 73 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 74 0 R /Type /Page >>
endobj
8 0 obj
<< /Annots [ 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R ] /Contents [ 90 0 R 91 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 92 0 R /Type /Page >>
endobj
9 0 obj
<< /Annots [ 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R ] /Contents [ 119 0 R 120 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 121 0 R /Type /Page >>
endobj
10 0 obj
<< /Annots [ 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R ] /Contents [ 138 0 R 139 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 140 0 R /Type /Page >>
endobj
11 0 obj
<< /Annots [ 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R ] /Contents [ 147 0 R 148 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 149 0 R /Type /Page >>
endobj
12 0 obj
<< /Annots [ 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R ] /Contents [ 155 0 R 156 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 157 0 R /Type /Page >>
endobj
13 0 obj
<< /Annots [ 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R ] /Contents [ 202 0 R 203 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 204 0 R /Type /Page >>
endobj
14 0 obj
<< /Annots [ 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R ] /Contents [ 225 0 R 226 0 R ] /MediaBox [ 0 0 612 792 ] /Parent 4 0 R /Resources 227 0 R /Type /Page >>
endobj
15 0 obj
<< /A << /D (cite.goodfellow2014generative) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 272.086 193.022 284.041 201.948 ] /Subtype /Link /Type /Annot >>
endobj
16 0 obj
<< /A << /D (cite.pathak2016context) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 69.158 157.157 81.114 166.083 ] /Subtype /Link /Type /Annot >>
endobj
17 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 165.359 157.157 177.314 166.083 ] /Subtype /Link /Type /Annot >>
endobj
18 0 obj
<< /A << /D (cite.wang2020cnn) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 229.789 79.892 239.751 87.432 ] /Subtype /Link /Type /Annot >>
endobj
19 0 obj
<< /A << /D (Hfootnote.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 403.526 342.221 409.504 354.742 ] /Subtype /Link /Type /Annot >>
endobj
20 0 obj
<< /A << /D (cite.jafar2020forensics) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 479.854 247.237 491.809 256.163 ] /Subtype /Link /Type /Annot >>
endobj
21 0 obj
<< /A << /D (cite.lwlodo2019official) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 336.28 235.421 348.235 244.208 ] /Subtype /Link /Type /Annot >>
endobj
22 0 obj
<< /A << /D (cite.rossler2019faceforensics++) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 427.943 199.416 439.899 208.342 ] /Subtype /Link /Type /Annot >>
endobj
23 0 obj
<< /A << /D (cite.wang2020cnn) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 443.365 199.416 455.321 208.342 ] /Subtype /Link /Type /Annot >>
endobj
24 0 obj
<< /Length 10577 >>
stream
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
BT
/F74 14.3462 Tf 73.778 675.067 Td [(Attack)-250(as)-250(the)-250(Best)-250(Defense:)-310(Nullifying)-250(Image-to-image)-250(T)74(ranslation)-250(GANs)]TJ 114.266 -17.933 Td [(via)-250(Limit-awar)18(e)-250(Adv)10(ersarial)-250(Attack)]TJ/F75 11.9552 Tf -104.333 -37.858 Td [(Chin-Y)111(uan)-250(Y)100(eh)]TJ/F75 7.9701 Tf 73.512 4.339 Td [(1,3)]TJ/F75 11.9552 Tf 10.461 -4.339 Td [(,)-250(Hsi-W)80(en)-250(Chen)]TJ/F75 7.9701 Tf 76.405 4.339 Td [(1)]TJ/F75 11.9552 Tf 4.483 -4.339 Td [(,)-250(Hong-Han)-250(Shuai)]TJ/F75 7.9701 Tf 86.663 4.339 Td [(2)]TJ/F75 11.9552 Tf 4.483 -4.339 Td [(,)-250(De-Nian)-250(Y)100(ang)]TJ/F75 7.9701 Tf 74.827 4.339 Td [(3)]TJ/F75 11.9552 Tf 4.483 -4.339 Td [(,)-250(Ming-Syan)-250(Chen)]TJ/F75 7.9701 Tf 88.001 4.339 Td [(1)]TJ -420.728 -13.958 Td [(1)]TJ/F75 11.9552 Tf 4.483 -4.339 Td [(National)-250(T)80(aiw)10(an)-250(Uni)25(v)15(ersity)]TJ/F75 7.9701 Tf 134.913 4.339 Td [(2)]TJ/F75 11.9552 Tf 4.483 -4.339 Td [(National)-250(Y)100(angming)-250(Jiaotong)-250(Uni)25(v)15(ersity)]TJ/F75 7.9701 Tf 192.918 4.339 Td [(3)]TJ/F75 11.9552 Tf 4.484 -4.339 Td [(Academia)-250(Sinica)]TJ/F57 8.9664 Tf -371.29 -13.948 Td [(f)]TJ/F77 8.9664 Tf 4.608 0 Td [(d09942009,)-600(d09921004,)-600(mschen)]TJ/F57 8.9664 Tf 150.635 0 Td [(g)]TJ/F77 8.9664 Tf 9.987 0 Td [(@ntu.edu.tw)-600(hhshuai@g2.nctu.edu.tw)-600(dnyang@iis.sinica.edu.tw)]TJ
0 g 0 G
/F74 11.9552 Tf -75.527 -41.046 Td [(Abstract)]TJ/F79 9.9626 Tf -83.928 -24.409 Td [(Due)-347(to)-347(the)-347(gr)37(eat)-347(success)-347(of)-347(ima)10(g)10(e-to-ima)10(g)10(e)-347(\(Img2Img\))]TJ -11.955 -11.955 Td [(tr)15(anslation)-513(GANs,)-579(many)-513(applications)-513(with)-513(ethics)-513(issues)]TJ 0 -11.955 Td [(arise)10(,)]TJ/F75 9.9626 Tf 26.927 0 Td [(e.g)]TJ/F79 9.9626 Tf 11.896 0 Td [(.,)-463(DeepF)75(ak)10(e)-420(and)-420(DeepNude)10(,)-463(pr)37(esenting)-421(a)-420(c)15(hal-)]TJ -38.823 -11.955 Td [(lenging)-301(pr)45(oblem)-302(to)-301(pr)37(e)15(vent)-302(the)-301(misuse)-302(of)-301(these)-302(tec)15(hniques.)]TJ 0 -11.955 Td [(In)-353(this)-353(work,)-379(we)-353(tac)20(kle)-353(the)-353(pr)45(oblem)-353(by)-353(a)-353(ne)15(w)-353(adver)10(sarial)]TJ 0 -11.956 Td [(attac)20(k)-381(sc)15(heme)10(,)-413(namely)-381(the)]TJ/F81 9.9626 Tf 112.156 0 Td [(Nullifying)-381(Attac)10(k)]TJ/F79 9.9626 Tf 72.336 0 Td [(,)-413(whic)15(h)-381(can-)]TJ -184.492 -11.955 Td [(cels)-387(the)-388(ima)10(g)10(e)-387(tr)15(anslation)-388(pr)45(ocess)-387(and)-388(pr)45(oposes)-387(a)-388(corr)37(e-)]TJ 0 -11.955 Td [(sponding)-365(fr)15(ame)15(work,)-394(the)]TJ/F81 9.9626 Tf 105.269 0 Td [(Limit-A)74(w)10(are)-365(Self-Guiding)-365(Gra-)]TJ -105.269 -11.955 Td [(dient)-255(Sliding)-255(Attac)10(k)-255(\(LaS-GSA\))]TJ/F79 9.9626 Tf 132.407 0 Td [(under)-255(a)-255(blac)20(k-box)-255(setting)15(.)]TJ -132.407 -11.955 Td [(In)-289(other)-289(wor)37(ds,)-299(by)-289(pr)45(ocessing)-289(the)-289(ima)10(g)10(e)-289(with)-290(the)-289(pr)45(oposed)]TJ 0 -11.955 Td [(LaS-GSA)-444(befor)37(e)-444(publishing)10(,)-493(any)-444(ima)10(g)10(e)-444(tr)15(anslation)-444(func-)]TJ 0 -11.956 Td [(tions)-300(can)-299(be)-300(nulli\002ed,)-312(whic)15(h)-299(pr)37(e)15(vents)-300(the)-300(ima)10(g)10(es)-299(fr)45(om)-300(ma-)]TJ 0 -11.955 Td [(licious)-315(manipulations.)-507(F)45(ir)10(st,)-331(we)-316(intr)45(oduce)-315(the)]TJ/F81 9.9626 Tf 189.297 0 Td [(limit-aw)10(are)]TJ -189.297 -11.955 Td [(RGF)]TJ/F79 9.9626 Tf 23.802 0 Td [(and)-333(the)]TJ/F81 9.9626 Tf 33.758 0 Td [(gradient)-333(sliding)-333(mec)10(hanism)]TJ/F79 9.9626 Tf 118.92 0 Td [(to)-333(estimate)-333(the)]TJ -176.48 -11.955 Td [(gr)15(adient)-259(that)-258(adher)37(es)-259(to)-258(the)-259(adver)10(sarial)-259(limit,)]TJ/F75 9.9626 Tf 184.869 0 Td [(i.e)]TJ/F79 9.9626 Tf 9.684 0 Td [(.,)-261(the)-258(pixel)]TJ -194.553 -11.955 Td [(value)-330(limitations)-330(of)-330(the)-329(adver)10(sarial)-330(e)20(xample)15(.)-550(W)92(e)-330(theor)37(eti-)]TJ 0 -11.955 Td [(cally)-246(pr)45(o)10(ve)-246(that)-246(our)-246(model)-245(is)-246(able)-246(to)-246(avoid)-246(the)-246(err)45(or)-246(caused)]TJ 0 -11.956 Td [(by)-234(the)-233(pr)45(ojection)-234(in)-234(both)-233(the)-234(dir)37(ection)-234(and)-233(the)-234(length.)-305(Then,)]TJ 0 -11.955 Td [(an)-331(ef)18(fective)]TJ/F81 9.9626 Tf 49.571 0 Td [(self-guiding)-331(prior)]TJ/F79 9.9626 Tf 76.34 0 Td [(is)-331(e)20(xtr)15(acted)-331(solely)-330(fr)45(om)-331(the)]TJ -125.911 -11.955 Td [(thr)37(eat)-241(model)-240(and)-241(the)-241(tar)37(g)10(et)-241(ima)10(g)10(e)-240(to)-241(ef)18(\002ciently)-241(le)15(ver)15(a)10(g)10(e)-241(the)]TJ 0 -11.955 Td [(prior)-396(information)-396(and)-396(guide)-396(the)-397(gr)15(adient)-396(estimation)-396(pr)45(o-)]TJ 0 -11.955 Td [(cess.)-407(Extensive)-282(e)20(xperiments)-282(demonstr)15(ate)-282(that)-283(LaS-GSA)-282(r)37(e-)]TJ 0 -11.955 Td [(quir)37(es)-217(fe)15(wer)-217(queries)-217(to)-216(nullify)-217(the)-217(ima)10(g)10(e)-217(tr)15(anslation)-217(pr)45(ocess)]TJ 0 -11.956 Td [(with)-250(higher)-250(success)-250(r)15(ates)-250(than)]TJ/F8 9.9626 Tf 122.997 0 Td [(4)]TJ/F79 9.9626 Tf 7.472 0 Td [(state-of-the-art)-250(methods.)]TJ/F74 11.9552 Tf -130.469 -37.361 Td [(1.)-250(Intr)18(oduction)]TJ/F75 9.9626 Tf 11.955 -19.428 Td [(Recently)65(,)-210(Generati)25(v)15(e)-201(Adv)15(ersarial)-200(Netw)10(orks)-200(\(GANs\))-201([)]TJ
0 1 0 rg 0 1 0 RG
[(13)]TJ
0 g 0 G
[(])]TJ -11.955 -11.955 Td [(ha)20(v)15(e)-273(achie)25(v)15(ed)-273(impressi)25(v)15(e)-272(breakthroughs)-273(on)-273(v)25(arious)-273(image-)]TJ 0 -11.955 Td [(to-image)-471(translation)-471(\(Img2Img\))-471(tasks,)-526(including)-471(inpaint-)]TJ 0 -11.955 Td [(ing)-401([)]TJ
0 1 0 rg 0 1 0 RG
[(25)]TJ
0 g 0 G
[(])-401(and)-400(style)-401(transfer)-401([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(].)-762(These)-401(models)-401(learn)-401(the)]TJ 0 -11.955 Td [(cross-domain)-333(mapping)-332(by)-333(ensuring)-332(that)-333(the)-333(style)-332(of)-333(trans-)]TJ 0 -11.955 Td [(lated)-233(images)-234(is)-233(close)-234(to)-233(the)-234(image)-233(style)-233(of)-234(the)-233(tar)18(get)-234(domain)]TJ 0 -11.956 Td [(while)-325(the)-325(semantics)-326(of)-325(the)-325(input)-325(image)-325(are)-326(still)-325(preserv)15(ed,)]TJ/F79 9.9626 Tf 0 -11.955 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-250(the)-250(identity)-250(or)-250(the)-250(layout.)]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 100.143 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 64.558 93.277 Td [(1)]TJ/F75 7.9701 Tf 3.487 -2.812 Td [(Due)-620(to)-620(ethical)-621(reasons,)-712(the)-621(i)1(llustrati)25(v)15(e)-621(e)15(xamples)-620(utilizes)-620(hair)20(-)]TJ -17.933 -9.465 Td [(changing)-250(model)]TJ/F75 6.3761 Tf 53.328 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 7.9701 Tf 23.32 0 Td [(2)]TJ/F75 6.3761 Tf 4.383 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 7.9701 Tf 23.727 0 Td [(,)-250(instead)-250(of)-250(DeepNude)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(31)]TJ
0 g 0 G
[(].)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
ET
1 0 0 1 310.043 399.571 cm
q
.44893 0 0 .44893 0 0 cm
q
521 0 0 358 0 0 cm
/Im1 Do
Q
Q
0 g 0 G
1 0 0 1 -310.043 -399.571 cm
BT
/F75 9.9626 Tf 308.862 381.24 Td [(Figure)-621(1:)-1051(An)-620(illustration)-621(of)-621(nullifying)-620(attack)-621(ag)5(ainst)]TJ 0 -11.956 Td [(Img2Img)-479(GAN.)-479(The)-479(original)-479(portrait)-480(is)-479(initially)-479(manip-)]TJ 0 -11.955 Td [(ulated)-470(by)-471(model)]TJ/F75 7.9701 Tf 73.522 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 34.344 0 Td [(to)-470(impaint)-470(the)-471(portrait)]TJ -142.495 -11.955 Td [(image)-451(with)-450(blond)-451(hair)55(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 95.66 3.615 Td [(1)]TJ
0 g 0 G
/F75 9.9626 Tf 3.985 -3.615 Td [(After)-451(the)-450(nullifying)-451(attack,)-501(LaS-)]TJ -99.645 -11.955 Td [(GSA)-364(adds)-364(human)-365(imperceptible)-364(perturbation)-364(to)-364(the)-365(origi-)]TJ 0 -11.955 Td [(nal)-281(image)-281(and)-281(generate)-281(an)-280(attack)10(ed)-281(image,)-289(which)-281(leads)-281(the)]TJ 0 -11.955 Td [(Img2Img)-240(GAN)-240(to)-240(return)-240(the)-240(nulli\002ed)-240(image)-241(with)-240(black)-240(hair)]TJ 0 -11.956 Td [(identical)-250(to)-250(the)-250(original)-250(image.)]TJ
0 g 0 G
0 g 0 G
11.955 -37.226 Td [(Ho)25(we)25(v)15(er)40(,)-469(Img2Img)-425(GANs)-425(ha)20(v)15(e)-425(also)-425(been)-425(misused)-425(to)]TJ -11.955 -11.955 Td [(generate)-615(f)10(ak)10(e)-615(images,)]TJ/F79 9.9626 Tf 100.699 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-706(DeepF)15(ak)10(e)-616([)]TJ
0 1 0 rg 0 1 0 RG
[(16)]TJ
0 g 0 G
[(])-615(and)-615(Deep-)]TJ -110.383 -11.955 Td [(Nude)-353([)]TJ
0 1 0 rg 0 1 0 RG
[(12)]TJ
0 g 0 G
[(].)-619(F)15(or)-354(e)15(xample,)-378(DeepNude)-354(e)15(xcels)-353(in)-353(undressing)]TJ 0 -11.955 Td [(full-body)-325(shots)-324(and)-325(producing)-325(realist)1(ic)-325(nude)-325(images.)-534(F)15(ac-)]TJ 0 -11.955 Td [(ing)-269(the)-270(threat)-269(of)-269(these)-269(immoral)-270(algorithms,)-274(a)-269(simple)-269(w)10(ay)-270(is)]TJ 0 -11.955 Td [(to)-298(detect)-298(DeepF)15(ak)10(e)-298(contents)-298([)]TJ
0 1 0 rg 0 1 0 RG
[(26)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-298(31)]TJ
0 g 0 G
[(])-298(after)-298(the)-298(f)10(ak)10(e)-298(images)]TJ 0 -11.956 Td [(are)-395(released.)-744(Ho)25(we)25(v)15(er)40(,)-431(e)25(v)15(en)-394(though)-395(those)-395(post-detection)]TJ 0 -11.955 Td [(methods)-256(can)-256(catch)-256(the)-256(footprints)-255(of)-256(DeepF)15(ak)10(e,)-258(the)-256(manipu-)]TJ 0 -11.955 Td [(lated)-254(images)-254(ha)20(v)15(e)-255(already)-254(harmed)-254(each)-254(indi)25(vidual')55(s)-255(reputa-)]TJ 0 -11.955 Td [(tion.)-301(Our)-223(idea)-223(is)-224(to)-223(defend)-223(personal)-223(pri)25(v)25(ac)15(y)-223(in)-223(the)-224<02727374>-223(place)]TJ 0 -11.955 Td [(by)-356(nullifying)-356(the)-356(translation)-356(process)-356(of)-357(misused)-356(Img2Img)]TJ 0 -11.955 Td [(GANs.)-743(W)80(e)-395(aim)-394(to)-395(attach)-394(human-imperceptible)-395(perturba-)]TJ 0 -11.956 Td [(tions)-318(to)-318(input)-318(images,)-336(such)-318(that)-318(the)-318(attack)10(ed)-318(image)-319(can)-318(be)]TJ 0 -11.955 Td [(refrained)-416(from)-416(being)-416(immorally)-416(manipulated)-416(\(to)-416(produce)]TJ 0 -11.955 Td [(obscene)-288(images)-289(with)-288(DeepF)15(ak)10(e\).)-426(Thus,)-298(our)-288(goal)-289(is)-288(to)-289(con-)]TJ 0 -11.955 Td [(duct)-250(adv)15(ersarial)-250(attacks)-250(ag)5(ainst)-250(misused)-250(Img2Img)-250(GANs.)]TJ
0 g 0 G
0 g 0 G
ET
endstream
endobj
25 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/tLuQeDWvIDqB4U5-z2yHQg Do
Q
endstream
endobj
26 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/rSvu18RzFGFU66GrAUV4kQ Do
Q
endstream
endobj
27 0 obj
<< /Font << /F57 228 0 R /F74 229 0 R /F75 230 0 R /F77 231 0 R /F79 232 0 R /F8 233 0 R /F81 234 0 R >> /ProcSet [ /PDF /Text /ImageC ] /XObject << /Im1 235 0 R /rSvu18RzFGFU66GrAUV4kQ 236 0 R /tLuQeDWvIDqB4U5-z2yHQg 237 0 R >> >>
endobj
28 0 obj
<< /A << /D (cite.ruiz2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 112.91 685.056 124.866 693.918 ] /Subtype /Link /Type /Annot >>
endobj
29 0 obj
<< /A << /D (cite.demontis2019adversarial) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 129.326 684.991 141.281 693.918 ] /Subtype /Link /Type /Annot >>
endobj
30 0 obj
<< /A << /D (cite.yeh2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 105.882 613.26 117.838 622.187 ] /Subtype /Link /Type /Annot >>
endobj
31 0 obj
<< /A << /D (Hfootnote.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 78.176 587.333 84.154 599.853 ] /Subtype /Link /Type /Annot >>
endobj
32 0 obj
<< /A << /D (figure.caption.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 189.423 551.467 196.397 562.411 ] /Subtype /Link /Type /Annot >>
endobj
33 0 obj
<< /A << /D (Hfootnote.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 109.976 521.374 115.456 528.122 ] /Subtype /Link /Type /Annot >>
endobj
34 0 obj
<< /A << /D (cite.liu2016delving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 75.824 481.097 87.779 490.103 ] /Subtype /Link /Type /Annot >>
endobj
35 0 obj
<< /A << /D (cite.papernot2017practical) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 91.743 481.316 103.698 490.103 ] /Subtype /Link /Type /Annot >>
endobj
36 0 obj
<< /A << /D (cite.dong2019evading) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 107.662 481.316 119.617 490.103 ] /Subtype /Link /Type /Annot >>
endobj
37 0 obj
<< /A << /D (Hfootnote.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 219.401 431.339 225.378 443.86 ] /Subtype /Link /Type /Annot >>
endobj
38 0 obj
<< /A << /D (cite.chen2017zoo) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 225.654 384.959 232.628 393.885 ] /Subtype /Link /Type /Annot >>
endobj
39 0 obj
<< /A << /D (cite.tu2019autozoom) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 78.177 301.273 90.132 310.199 ] /Subtype /Link /Type /Annot >>
endobj
40 0 obj
<< /A << /D (cite.andriushchenko2020square) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 92.574 301.412 99.548 310.199 ] /Subtype /Link /Type /Annot >>
endobj
41 0 obj
<< /A << /D (cite.ruiz2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 262.483 265.472 274.438 274.334 ] /Subtype /Link /Type /Annot >>
endobj
42 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 67.986 205.12 74.96 213.842 ] /Subtype /Link /Type /Annot >>
endobj
43 0 obj
<< /A << /D (cite.tu2019autozoom) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 78.837 205.055 90.792 213.981 ] /Subtype /Link /Type /Annot >>
endobj
44 0 obj
<< /A << /D (cite.papernot2017practical) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 142.158 108.662 152.121 116.09 ] /Subtype /Link /Type /Annot >>
endobj
45 0 obj
<< /A << /D (cite.dai2018adversarial) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 154.113 108.486 160.091 116.09 ] /Subtype /Link /Type /Annot >>
endobj
46 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 144.52 79.892 154.482 87.432 ] /Subtype /Link /Type /Annot >>
endobj
47 0 obj
<< /A << /D (cite.bashkirova2019adversarial) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 486.426 322.314 493.399 331.1 ] /Subtype /Link /Type /Annot >>
endobj
48 0 obj
<< /A << /D (cite.goodfellow2014generative) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 486.224 286.309 498.179 295.235 ] /Subtype /Link /Type /Annot >>
endobj
49 0 obj
<< /A << /D (cite.isola2017image) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 404.778 262.398 416.733 271.325 ] /Subtype /Link /Type /Annot >>
endobj
50 0 obj
<< /A << /D (cite.liu2017unsupervised) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 420.766 262.398 432.721 271.325 ] /Subtype /Link /Type /Annot >>
endobj
51 0 obj
<< /A << /D (cite.isola2017image) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 435.859 151.595 447.814 160.522 ] /Subtype /Link /Type /Annot >>
endobj
52 0 obj
<< /A << /D (cite.liu2017unsupervised) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 340.333 139.64 352.288 148.567 ] /Subtype /Link /Type /Annot >>
endobj
53 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 392.833 127.685 404.789 136.611 ] /Subtype /Link /Type /Annot >>
endobj
54 0 obj
<< /Length 17498 >>
stream
0 g 0 G
0 g 0 G
BT
/F75 9.9626 Tf 62.067 710.037 Td [(T)80(o)-758(de)25(v)15(elop)-758(an)-757(adv)15(ersarial)-758(attack)-758(ag)5(ainst)-758(misused)]TJ -11.955 -11.955 Td [(Img2Img)-408(GANs,)-446(a)-408(simple)-408(approach)-407(is)-408(adopting)-407(the)]TJ/F79 9.9626 Tf 219.095 0 Td [(Dis-)]TJ -219.095 -11.955 Td [(torting)-398(Attac)20(k)]TJ/F75 9.9626 Tf 60.477 0 Td [([)]TJ
0 1 0 rg 0 1 0 RG
[(27)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-398(10)]TJ
0 g 0 G
[(],)-434(which)-398(distorts)-398(the)-398(image)-397(transla-)]TJ -60.477 -11.955 Td [(tion)-345(process)-346(of)-345(the)-345(Img2Img)-345(GANs)-346(to)-345(generate)-345(a)-346(deterio-)]TJ 0 -11.955 Td [(rated)-319(image.)-518(Ho)25(we)25(v)15(er)40(,)-336(it)-319(can)-319(lead)-319(to)-320(unpredictable)-319(results)]TJ 0 -11.956 Td [(in)-410(this)-411(case.)-791(F)15(or)-410(e)15(xample,)-450(if)-411(the)-410(distorting)-410(attack)-410(is)-411(ap-)]TJ 0 -11.955 Td [(plied)-331(to)]TJ/F79 9.9626 Tf 34.281 0 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-352(DeepNude,)-352(the)-331(distorted)-332(re)15(gions)-331(may)-332(appear)]TJ -46.027 -11.955 Td [(in)-371(the)-371(background,)-401(and)-371(nak)10(ed)-371(images)-371(are)-371(still)-371(created)-371(af-)]TJ 0 -11.955 Td [(ter)-377(cropping)-378([)]TJ
0 1 0 rg 0 1 0 RG
[(32)]TJ
0 g 0 G
[(].)-692(Therefore,)-410(in)-377(this)-378(paper)40(,)-409(we)-378(introduce)]TJ 0 -11.955 Td [(a)-310(ne)25(w)-310(attack,)-324(namely)-310(the)]TJ/F79 9.9626 Tf 104.136 0 Td [(Nullifying)-310(Attac)20(k)]TJ/F75 9.9626 Tf 68.201 0 Td [(,)-325(in)-310(a)-309(black-box)]TJ -172.337 -11.955 Td [(setting.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 29.06 3.615 Td [(2)]TJ
0 g 0 G
/F75 9.9626 Tf 6.956 -3.615 Td [(Compared)-214(with)-215(the)-214(distorting)-215(attack,)-221(the)-215(nullifying)]TJ -36.016 -11.956 Td [(attack)-302(is)-302(designed)-302(to)-302(cancel)-302(the)-302(translation)-302(process)-302(of)-302(mis-)]TJ 0 -11.955 Td [(used)-291(Img2Img)-291(GANs)-292(and)-291(generate)-291(an)-291(output)-291(image)-292(nearly)]TJ 0 -11.955 Td [(identical)-340(to)-340(the)-339(input)-340(one.)-580(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-339(1)]TJ
0 g 0 G
[-340(illustrates)-340(the)-340(nullify-)]TJ 0 -11.955 Td [(ing)-376(attack,)-408(where)-376(the)-376(tar)18(geted)-376(Img2Img)-377(GAN)-376(is)-376(nulli\002ed)]TJ 0 -11.955 Td [(by)-276(the)-275(adv)15(ersarial)-276(e)15(xample)-275(created)-276(by)-276(our)-275(attack)10(ed)-276(method)]TJ 0 -11.955 Td [(\(detailed)-250(later\).)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 60.861 3.615 Td [(1)]TJ
0 g 0 G
/F75 9.9626 Tf -48.906 -16.147 Td [(T)80(o)-260(f)10(acilitate)-259(nullifying)-260(attack)-259(in)-260(a)-259(black-box)-260(setting,)-262(one)]TJ -11.955 -11.955 Td [(approach)-231(is)-231(to)-231(e)15(xploit)-231(surrog)5(ate)-231(models)-232(to)-231(approximate)-231(gra-)]TJ 0 -11.955 Td [(dient)-348([)]TJ
0 1 0 rg 0 1 0 RG
[(19)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-348(24)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-348(11)]TJ
0 g 0 G
[(],)]TJ/F79 9.9626 Tf 78.027 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-372(the)-348(optimal)-348(modi\002cation)-348(to)-348(gener)20(-)]TJ -87.71 -11.956 Td [(ate)-347(a)-346(successful)-347(adv)15(ersarial)-346(e)15(xample.)-600(Ho)25(we)25(v)15(er)40(,)-371(preparing)]TJ 0 -11.955 Td [(surrog)5(ate)-270(models)-270(for)-270(an)-270(Img2Img)-270(GAN)-270(requires)-270(additional)]TJ 0 -11.955 Td [(computational)-361(resources,)-388(and)-361(the)-361(datasets)-360(need)-361(to)-361(be)-361(pre-)]TJ 0 -11.955 Td [(processed)-236(and)-236(prepared)-236(for)-236(model)-236(training.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 170.285 3.615 Td [(3)]TJ
0 g 0 G
/F75 9.9626 Tf 7.027 -3.615 Td [(Moreo)15(v)15(er)40(,)-239(cre-)]TJ -177.312 -11.955 Td [(ating)-278(another)-277(surrog)5(ate)-278(model)-277(with)-278(functions)-278(simil)1(ar)-278(to)-278(the)]TJ 0 -11.955 Td [(threat)-291(model)-291(is)-291(morally)-291(questionable)-291(when)-291(the)-291(threat)-291(mod-)]TJ 0 -11.956 Td [(els)-250(are)-250(unethical)-250(Img2Img)-250(GANs.)]TJ 11.955 -12.531 Td [(On)-303(the)-303(other)-302(hand,)-317(query-bas)1(ed)-303(attacks)-303([)]TJ
0 1 0 rg 0 1 0 RG
[(6)]TJ
0 g 0 G
[(])-303(estimate)-303(the)]TJ -11.955 -11.955 Td [(gradient)-425(for)-425(modifying)-426(the)-425(image)-425(by)-425(querying)-425(the)-426(tar)18(get)]TJ 0 -11.956 Td [(model)-240(and)-240(condu)-1(c)1(ting)-241(zeroth-order)-240(optimization.)-307(Ho)25(we)25(v)15(er)40(,)]TJ 0 -11.955 Td [(such)-466(attacks)-465(are)-466(inef)25(\002cient)-466(because)-465(the)15(y)-466(usually)-466(require)]TJ 0 -11.955 Td [(more)-338(than)]TJ/F8 9.9626 Tf 44.373 0 Td [(10)]TJ/F7 6.9738 Tf 9.962 3.615 Td [(6)]TJ/F75 9.9626 Tf 7.842 -3.615 Td [(queries)-338(to)-339(optimize)-338(the)-339(adjustment)-338(of)-339(each)]TJ -62.177 -11.955 Td [(pix)15(el)-279(for)-280(an)-279(RGB)-279(image.)-398(While)-279(acceleration)-279(schemes)-280(ha)20(v)15(e)]TJ 0 -11.955 Td [(been)-231(proposed)-232(for)-231(the)-232(adv)15(ersarial)-231(attack)-232(ag)5(ainst)-231(image)-232(clas-)]TJ 0 -11.956 Td [(si\002ers)-195([)]TJ
0 1 0 rg 0 1 0 RG
[(30)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-195(1)]TJ
0 g 0 G
[(],)-206(the)-195(adv)15(ersarial)-195(attack)-196(ag)5(ainst)-195(Img2Img)-195(GANs)]TJ 0 -11.955 Td [(is)-255(more)-255(challenging)-256(becaus)1(e)-256(it)-255(is)-255(required)-255(to)-255(alter)-256(the)-255(entire)]TJ 0 -11.955 Td [(output)-212(image)-212(to)-212(a)-212(visually)-211(distinguishable)-212(de)15(gree,)-220(instead)-212(of)]TJ 0 -11.955 Td [(simply)-250(changing)-250(a)-250(fe)25(w)-250(labels)-250(in)-250(image)-250(classi\002cation)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(27)]TJ
0 g 0 G
[(].)]TJ 11.955 -12.532 Td [(T)80(o)-482(address)-482(the)-483(abo)15(v)15(e)-482(challenge,)-540(we)-483(int)1(roduce)]TJ/F79 9.9626 Tf 199.937 0 Td [(Limit-)]TJ -211.892 -11.955 Td [(A)55(war)37(e)-325(Self-Guiding)-326(Gr)15(adient)-325(Sliding)-326(Attac)20(k)-325(\(LaS-GSA\))]TJ/F75 9.9626 Tf 228.499 0 Td [(to)]TJ -228.499 -11.955 Td [(attack)-450(Img2Img)-449(GANs)-450(ef)25(fecti)25(v)15(ely)65(.)-908(First,)-500(we)-449(pro)15(v)15(e)-450(that)]TJ 0 -11.955 Td [(nai)25(v)15(ely)-503(projecting)-503(the)-502(gradient,)]TJ/F79 9.9626 Tf 137.307 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-566(clipping)-503(the)-503(gradi-)]TJ -146.99 -11.955 Td [(ent)-339([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-339(30)]TJ
0 g 0 G
[(])-339(to)-340(achie)25(v)15(e)-339(human-imperceptible)-339(modi\002cations,)]TJ 0 -11.956 Td [(has)-336(a)-336(detri)1(mental)-336(ef)25(fect)-336(on)-336(the)-335(correctness)-336(of)-336(the)-336(nulli\002ed)]TJ 0 -11.955 Td [(process.)-877(Therefore,)-486(a)]TJ/F79 9.9626 Tf 96.502 0 Td [(limit-awar)37(e)-439(str)15(ate)40(gy)]TJ/F75 9.9626 Tf 86.422 0 Td [(is)-439(de)25(vised)-439(to)]TJ -182.924 -11.955 Td [(a)20(v)20(oid)-232(querying)-232(the)-233(gradient)-232(in)-232(the)-232(directions)-232(that)-233(violate)-232(the)]TJ/F79 9.9626 Tf 0 -11.955 Td [(adver)10(sarial)-316(limit)]TJ/F75 9.9626 Tf 67.256 0 Td [(,)]TJ/F79 9.9626 Tf 5.801 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-332(the)-316(pix)15(el)-316(v)25(alue)-316(limitations)-316(of)-316(an)-316(ad-)]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 147.73 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 64.558 140.864 Td [(2)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(Since)-331(the)-331(white-box)-331(attack)-331(requires)-330(the)-331(complete)-331(kno)25(wledge)-331(of)-331(the)]TJ -17.933 -9.464 Td [(threat)-420(model,)-463(including)-421(the)-420(model)-421(architectures)-420(and)-421(weights,)-463(we)-420(focus)]TJ 0 -9.465 Td [(on)-266(the)-266(black-box)-265(attack)-266(which)-266(is)-266(more)-266(practical)-265(in)-266(real-w)10(orld)-266(applications)]TJ 0 -9.464 Td [(\()]TJ/F79 7.9701 Tf 2.654 0 Td [(e)15(.g)]TJ/F75 7.9701 Tf 9.397 0 Td [(.,)-250(Google)-250(Cloud)-250(V)60(ision\))-250([)]TJ
0 1 0 rg 0 1 0 RG
[(24)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-250(9)]TJ
0 g 0 G
[(].)]TJ/F75 5.9776 Tf 2.395 -6.916 Td [(3)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(F)15(or)-319(instance,)-336(training)-319(a)-319(CycleGAN)-318(model)-319(in)40(v)20(olv)15(es)-319(collecting)-319(thou-)]TJ -17.933 -9.464 Td [(sands)-344(of)-345(rele)25(v)25(ant)-344(images)-344(and)-345(hundreds)-344(of)-344(epoch)-344(of)-345(training)-344(on)-344(a)-345(pair)-344(of)]TJ 0 -9.465 Td [(models)-250(with)]TJ/F37 7.9701 Tf 41.181 0 Td [(10)]TJ/F38 5.9776 Tf 8.468 2.813 Td [(7)]TJ/F75 7.9701 Tf 6.144 -2.813 Td [(parameters)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(].)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
/F75 9.9626 Tf 202.957 629.037 Td [(v)15(ersarial)-291(e)15(xample)-291(to)-291(follo)25(w)-291(the)-291(imperceptible)-291(requirement.)]TJ 0 -11.955 Td [(Then,)-242(a)]TJ/F79 9.9626 Tf 32.178 0 Td [(gr)15(adient-sliding)-239(mec)15(hanism)]TJ/F75 9.9626 Tf 113.501 0 Td [(is)-239(introduced)-240(to)-239(e)15(xtend)]TJ -145.679 -11.955 Td [(the)-237(modi\002cation)-237(along)-238(the)-237(boundary)-237(of)-237(the)-238(adv)15(ersarial)-237(limit)]TJ 0 -11.955 Td [(and)-246(a)20(v)20(oid)-246(being)-246(trapped)-246(in)-245(the)-246(limit)-246(boundary)65(,)-247(such)-246(that)-246(the)]TJ 0 -11.955 Td [(nullifying)-236(attack)-236(can)-235(be)-236(achie)25(v)15(ed)-236(ef)25(\002ciently)65(.)-305(Last,)-239(by)-236(in)40(v)15(es-)]TJ 0 -11.956 Td [(tig)5(ating)-382(the)-382(semantic)-383(consistenc)15(y)-382(of)-382(Img2Img)-382(GANs,)-416(we)]TJ 0 -11.955 Td [(present)-233(the)]TJ/F79 9.9626 Tf 45.593 0 Td [(self-guiding)-233(prior)]TJ/F75 9.9626 Tf 72.959 0 Td [(that)-233(can)-233(be)-234(e)15(xtracted)-233(from)-233(the)]TJ -118.552 -11.955 Td [(tar)18(geted)-381(model)-380(directly)-381(and)-380(remo)15(v)15(e)-381(the)-381(cost)-380(of)-381(preparing)]TJ 0 -11.955 Td [(surrog)5(ate)-321(models.)-524(At)-321(the)-321(same)-322(tim)1(e,)-340(v)25(aluable)-321(information)]TJ 0 -11.955 Td [(is)-211(still)-212(obtained)-211(by)-211(the)-212(prior)-211(to)-212(f)10(acilitate)-211(the)-211(nullifying)-212(attack)]TJ 0 -11.955 Td [(in)-250(a)-250(black-box)-250(setting.)]TJ 11.955 -11.956 Td [(The)-250(contrib)20(utions)-250(of)-250(this)-250(paper)-250(are)-250(as)-250(follo)25(ws:)]TJ
0 g 0 G
-11.919 -18.323 Td [<95>]TJ
0 g 0 G
[-500(W)80(e)-601(introduce)-601(a)-601(ne)25(w)-602(adv)15(ersarial)-601(attack)-601(on)-601(Img2Img)]TJ 8.468 -11.956 Td [(GANs,)-504(namely)-452(the)]TJ/F79 9.9626 Tf 83.488 0 Td [(Nullifying)-453(Attac)20(k)]TJ/F75 9.9626 Tf 69.626 0 Td [(,)-504(and)-452(propose)-453(the)]TJ -153.114 -11.955 Td [(LaS-GSA)-240(to)-240(cancel)-240(the)-240(translation)-240(process)-240(in)-240(a)-240(black-box)]TJ 0 -11.955 Td [(setting.)]TJ
0 g 0 G
-8.468 -19.125 Td [<95>]TJ
0 g 0 G
[-500(W)80(e)-393(in)40(v)15(estig)5(ate)-393(the)-393(detrimental)-394(ef)25(fects)-393(of)-393(the)-393(projection)]TJ 8.468 -11.955 Td [(for)-226(the)-225(adv)15(ersarial)-226(limit)-225(and)-226(propose)-225(the)]TJ/F79 9.9626 Tf 160.006 0 Td [(limit-awar)37(e)-225(RGF)]TJ/F75 9.9626 Tf -160.006 -11.955 Td [(and)-193(the)]TJ/F79 9.9626 Tf 30.406 0 Td [(gr)15(adient)-193(sliding)-193(mec)15(hanism)]TJ/F75 9.9626 Tf 111.184 0 Td [(to)-193(ef)25(fecti)25(v)15(ely)-193(mitig)5(ate)]TJ -141.59 -11.955 Td [(the)-250(harm)-250(in)-250(the)-250(gradient)-250(estimation)-250(process.)]TJ
0 g 0 G
-8.468 -19.125 Td [<95>]TJ
0 g 0 G
[-500(W)40(ith)-587(the)]TJ/F79 9.9626 Tf 51.862 0 Td [(self-guiding)-587(prior)]TJ/F75 9.9626 Tf 73.93 0 Td [(,)-671(we)-587(pro)15(vide)-587(an)-587(ef)25(\002cient)]TJ -117.324 -11.955 Td [(scheme)-674(to)-674(e)15(xtract)-675(prior)-674(information)-674(from)-674(Img2Img)]TJ 0 -11.955 Td [(GANs,)-250(remo)15(ving)-250(the)-250(need)-250(for)-250(surrog)5(ate)-250(models.)]TJ
0 g 0 G
-8.468 -19.125 Td [<95>]TJ
0 g 0 G
[-500(Experimental)-430(results)-431(demonstrate)-430(the)-431(ef)25(fecti)25(v)15(eness)-430(and)]TJ 8.468 -11.955 Td [(ef)25(\002cienc)15(y)-336(of)-336(LaS-GSA)-337(compared)-336(with)]TJ/F8 9.9626 Tf 160.218 0 Td [(4)]TJ/F75 9.9626 Tf 8.331 0 Td [(state-of-the-art)]TJ -168.549 -11.955 Td [(methods)-250(on)]TJ/F8 9.9626 Tf 48.707 0 Td [(3)]TJ/F75 9.9626 Tf 7.472 0 Td [(Img2Img)-250(GANs.)]TJ/F74 11.9552 Tf -64.683 -23.11 Td [(2.)-250(Pr)18(eliminary)]TJ/F74 10.9589 Tf 0 -18.929 Td [(2.1.)-250(Imagetoimage)-250(translation)-250(GANs)]TJ/F75 9.9626 Tf 11.955 -17.932 Td [(The)-267(goal)-268(of)-267(image-to-image)-268(translations)-267([)]TJ
0 1 0 rg 0 1 0 RG
[(2)]TJ
0 g 0 G
[(])-267(is)-268(to)-267(learn)-268(a)]TJ -11.955 -11.956 Td [(mapping)]TJ/F66 9.9626 Tf 37.227 0 Td [(T)]TJ/F75 9.9626 Tf 8.999 0 Td [(that)-237(translates)-236(an)-237(image)]TJ/F11 9.9626 Tf 95.756 0 Td [(x)]TJ/F75 9.9626 Tf 8.052 0 Td [(from)-237(an)-236(input)-237(domain)]TJ/F11 9.9626 Tf -150.034 -11.955 Td [(X)]TJ/F75 9.9626 Tf 11.936 0 Td [(to)-291(a)-291(tar)18(get)-292(domain)]TJ/F11 9.9626 Tf 76.171 0 Td [(Y)]TJ/F75 9.9626 Tf 7.998 0 Td [(,)]TJ/F79 9.9626 Tf 5.494 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)]TJ/F66 9.9626 Tf 7.985 0 Td [(T)]TJ/F8 9.9626 Tf 6.641 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F8 9.9626 Tf 5.694 0 Td [(\))-354(=)]TJ/F11 9.9626 Tf 18.677 0 Td [(y)]TJ/F14 9.9626 Tf 8.769 0 Td [(2)]TJ/F11 9.9626 Tf 10.169 0 Td [(Y)]TJ/F14 9.9626 Tf 11.319 0 Td [(8)]TJ/F11 9.9626 Tf 5.534 0 Td [(x)]TJ/F14 9.9626 Tf 9.221 0 Td [(2)]TJ/F11 9.9626 Tf 10.169 0 Td [(X)]TJ/F75 9.9626 Tf 9.036 0 Td [(.)-434(As)]TJ -218.372 -11.955 Td [(Generati)25(v)15(e)-368(Adv)15(ersarial)-369(Netw)10(orks)-368(\(GANs\))-369([)]TJ
0 1 0 rg 0 1 0 RG
[(13)]TJ
0 g 0 G
[(])-368(ha)20(v)15(e)-369(been)]TJ 0 -11.955 Td [(demonstrated)-405(to)-406(be)-405(ef)25(fecti)25(v)15(e)-406(in)-405(synthesizing)-405(realistic)-406(im-)]TJ 0 -11.955 Td [(ages,)-381(Img2Img)-355(GANs)-355([)]TJ
0 1 0 rg 0 1 0 RG
[(15)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-354(18)]TJ
0 g 0 G
[(])-355(ha)20(v)15(e)-355(been)-355(widely)-355(adopted)]TJ 0 -11.955 Td [(to)-241(de)25(v)15(elop)-240(state-of-the-art)-241(image-to-image)-240(translation)-241(mod-)]TJ 0 -11.956 Td [(els.)-310(The)-250(objecti)25(v)15(e)-250(of)-250(Img2Img)-250(GANs)-250(is)-250(as)-250(follo)25(ws,)]TJ
ET
/S/Span<>BDC
BT
/F87 8.9664 Tf 317.39 221.798 Td [(min)]TJ/F41 5.9776 Tf 4.832 -5.579 Td [(G)]TJ/F87 8.9664 Tf 12.063 5.579 Td [(max)]TJ/F41 5.9776 Tf 5.495 -5.579 Td [(D)]TJ/F66 8.9664 Tf 13.192 5.579 Td [(E)]TJ/F41 5.9776 Tf 5.978 -0.996 Td [(x;y)]TJ/F87 8.9664 Tf 10.938 0.996 Td [([log)]TJ/F88 8.9664 Tf 15.999 0 Td [(D)]TJ/F87 8.9664 Tf 7.855 0 Td [(\()]TJ/F88 8.9664 Tf 3.583 0 Td [(x;)-171(y)]TJ/F87 8.9664 Tf 14.18 0 Td [(\)])-228(+)]TJ/F66 8.9664 Tf 17.407 0 Td [(E)]TJ/F41 5.9776 Tf 5.977 -0.996 Td [(x)]TJ/F87 8.9664 Tf 4.67 0.996 Td [([log)-14(\(1)]TJ/F57 8.9664 Tf 24.703 0 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [(D)]TJ/F87 8.9664 Tf 7.855 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x;)-171(G)]TJ/F87 8.9664 Tf 16.535 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F87 8.9664 Tf 5.223 0 Td [(\)\)\)])]TJ/F88 8.9664 Tf 13.311 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 221.798 Td [(\(1\))]TJ/F75 9.9626 Tf -225.795 -21.246 Td [(where)-319(the)-320(generator)]TJ/F11 9.9626 Tf 83.681 0 Td [(G)]TJ/F75 9.9626 Tf 11.016 0 Td [(learns)-319(to)-320(translate)]TJ/F11 9.9626 Tf 74.844 0 Td [(x)]TJ/F75 9.9626 Tf 8.877 0 Td [(into)-319(a)-320(realistic)]TJ -178.418 -11.955 Td [(tar)18(get)-211(domain)-211(sample,)-219(and)-211(the)-211(discriminator)]TJ/F11 9.9626 Tf 175.49 0 Td [(D)]TJ/F75 9.9626 Tf 10.628 0 Td [(learns)-211(to)-211(dif-)]TJ -186.118 -11.956 Td [(ferentiate)-289(between)-289(a)-289(real)]TJ/F11 9.9626 Tf 101.692 0 Td [(y)]TJ/F75 9.9626 Tf 8.123 0 Td [(and)-289(a)-289(translated)-289(e)15(xample)]TJ/F11 9.9626 Tf 102.669 0 Td [(G)]TJ/F8 9.9626 Tf 7.833 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F8 9.9626 Tf 5.694 0 Td [(\))]TJ/F75 9.9626 Tf 3.874 0 Td [(.)]TJ -233.759 -11.955 Td [(While)-234(the)-234(training)-234(is)-235(allo)25(wed)-234(to)-234(be)-234(conducted)-234(either)-234(in)-235(a)-234(su-)]TJ 0 -11.955 Td [(pervised)-342(setting)-342(\()]TJ/F79 9.9626 Tf 70.457 0 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-365(pix2pix)-342([)]TJ
0 1 0 rg 0 1 0 RG
[(15)]TJ
0 g 0 G
[(]\))-342(or)-342(in)-342(an)-343(unsupervised)]TJ -82.203 -11.955 Td [(setting)-259([)]TJ
0 1 0 rg 0 1 0 RG
[(18)]TJ
0 g 0 G
[(],)-261(we)-259<02727374>-259(e)15(xplore)-259(the)-259(latter)-259(due)-259(to)-259(its)-259(higher)-259(v)15(er)20(-)]TJ 0 -11.955 Td [(satility)65(.)-482(Cycle)1(GAN)-308([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(],)-321(an)-307(unsupervised)-308(Img2Im)1(g)-308(GAN,)]TJ 0 -11.956 Td [(trains)-343(a)-343(pair)-343(of)-344(generator)]TJ/F11 9.9626 Tf 105.063 0 Td [(G)]TJ/F75 9.9626 Tf 11.252 0 Td [(to)-343(translate)-343(in)-343(both)-344(directions)]TJ -116.315 -11.955 Td [(between)-344(the)-344(source)-344(and)-343(tar)18(get)-344(domains.)-592(During)-344(inference)]TJ 0 -11.955 Td [(time,)-292(we)-284(adopt)-284(the)-284(trained)-284(generator)]TJ/F11 9.9626 Tf 148.477 0 Td [(G)]TJ/F75 9.9626 Tf 10.663 0 Td [(on)-284(the)-284(speci\002ed)-284(di-)]TJ -159.14 -11.955 Td [(rection)-202(as)-202(the)-202(tar)18(geted)-201(translation)-202(function)]TJ/F66 9.9626 Tf 167.384 0 Td [(T)]TJ/F75 9.9626 Tf 6.641 0 Td [(.)-294(The)-202(nullifying)]TJ
0 g 0 G
0 g 0 G
ET
endstream
endobj
55 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/lQ_Zr-uWk8gjwYXRBisi6g Do
Q
endstream
endobj
56 0 obj
<< /Font << /F11 238 0 R /F14 239 0 R /F37 240 0 R /F38 241 0 R /F41 242 0 R /F57 228 0 R /F66 243 0 R /F7 244 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R /F87 245 0 R /F88 246 0 R >> /ProcSet [ /PDF /Text ] /XObject << /lQ_Zr-uWk8gjwYXRBisi6g 247 0 R >> >>
endobj
57 0 obj
<< /A << /D (Hfootnote.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 176.471 572.562 182.448 585.776 ] /Subtype /Link /Type /Annot >>
endobj
58 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 244.907 447.912 262.939 460.776 ] /Subtype /Link /Type /Annot >>
endobj
59 0 obj
<< /A << /D (equation.2.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 120.736 343.268 127.71 354.212 ] /Subtype /Link /Type /Annot >>
endobj
60 0 obj
<< /A << /D (cite.carlini2017towards) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 262.237 345.286 269.21 354.212 ] /Subtype /Link /Type /Annot >>
endobj
61 0 obj
<< /A << /D (cite.madry2017towards) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 272.912 345.286 284.868 354.212 ] /Subtype /Link /Type /Annot >>
endobj
62 0 obj
<< /A << /D (cite.szegedy2014intriguing) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 49.116 333.331 61.071 342.257 ] /Subtype /Link /Type /Annot >>
endobj
63 0 obj
<< /A << /D (cite.madry2017towards) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 94.774 309.42 106.729 318.346 ] /Subtype /Link /Type /Annot >>
endobj
64 0 obj
<< /A << /D (cite.papernot2017practical) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 97.822 178.972 109.777 187.759 ] /Subtype /Link /Type /Annot >>
endobj
65 0 obj
<< /A << /D (cite.nesterov2017random) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 445.448 661.22 457.404 670.007 ] /Subtype /Link /Type /Annot >>
endobj
66 0 obj
<< /A << /D (equation.2.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 459.281 576.974 466.254 588.041 ] /Subtype /Link /Type /Annot >>
endobj
67 0 obj
<< /A << /D (Hfootnote.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 430.724 332.784 436.701 345.305 ] /Subtype /Link /Type /Annot >>
endobj
68 0 obj
<< /A << /D (Hfootnote.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 524.073 229.508 530.051 242.029 ] /Subtype /Link /Type /Annot >>
endobj
69 0 obj
<< /A << /D (cite.tu2019autozoom) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 350.814 108.55 360.776 116.09 ] /Subtype /Link /Type /Annot >>
endobj
70 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 525.769 99.086 535.732 106.625 ] /Subtype /Link /Type /Annot >>
endobj
71 0 obj
<< /A << /D (appendix.D) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 510.847 77.164 518.594 87.432 ] /Subtype /Link /Type /Annot >>
endobj
72 0 obj
<< /Length 23877 >>
stream
0 g 0 G
0 g 0 G
BT
/F75 9.9626 Tf 50.112 710.037 Td [(attack)-333(is)-333(designed)-333(to)-334(create)-333(an)-333(adv)15(ersarial)-333(image)]TJ/F11 9.9626 Tf 201.246 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [(0)]TJ/F14 9.9626 Tf 7.096 -3.616 Td [<19>]TJ/F11 9.9626 Tf 12.051 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F75 9.9626 Tf -231.781 -10.461 Td [(such)-355(that)]TJ/F66 9.9626 Tf 40.288 0 Td [(T)]TJ/F75 9.9626 Tf 10.183 0 Td [(cannot)-356(transl)1(ate)]TJ/F11 9.9626 Tf 67.397 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.616 Td [(0)]TJ/F75 9.9626 Tf 6.337 -3.616 Td [(to)]TJ/F11 9.9626 Tf 11.292 0 Td [(y)]TJ/F14 9.9626 Tf 9.956 0 Td [(2)]TJ/F11 9.9626 Tf 11.355 0 Td [(Y)]TJ/F75 9.9626 Tf 7.998 0 Td [(,)-382(b)20(ut)-355(returns)-356(the)]TJ -170.499 -11.955 Td [(original)-250(input)]TJ/F11 9.9626 Tf 56.458 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F75 9.9626 Tf 6.96 1.494 Td [(nearly)-250(unchanged)-250(after)-250(translation.)]TJ/F74 10.9589 Tf -69.112 -20.022 Td [(2.2.)-325(Pr)18(ojected)-325(gradient)-324(descent)-325(f)25(or)-325(adv)10(ersarial)-325<6174ad>]TJ 24.658 -11.955 Td [(tack)]TJ/F75 9.9626 Tf -12.703 -17.965 Td [(Gi)25(v)15(en)-383(a)-383(neural)-383(netw)10(ork)]TJ/F11 9.9626 Tf 101.086 0 Td [(f)]TJ/F8 9.9626 Tf 5.95 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F8 9.9626 Tf 5.694 0 Td [(\))]TJ/F75 9.9626 Tf 7.691 0 Td [(and)-383(an)-383(input-output)-383(pair)]TJ/F8 9.9626 Tf -136.251 -11.956 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x;)-167(y)]TJ/F8 9.9626 Tf 15.364 0 Td [(\))]TJ/F75 9.9626 Tf 3.874 0 Td [(,)-234(the)-231(objec)1(ti)25(v)15(e)-231(of)-230(an)-230(adv)15(ersarial)-231(attack)-230(is)-230(to)-230<026e64>-231(an)-230(ad-)]TJ -23.112 -11.955 Td [(v)15(ersarial)-254(e)15(xample)]TJ/F11 9.9626 Tf 72.824 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F75 9.9626 Tf 7.114 -3.616 Td [(that)-254(1\))-255(does)-254(not)-255(generate)-254(the)-254(e)15(xpected)]TJ -85.632 -11.955 Td [(output)]TJ/F11 9.9626 Tf 27.968 0 Td [(f)]TJ/F8 9.9626 Tf 5.95 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F8 9.9626 Tf 4.58 -3.615 Td [(\))]TJ/F14 9.9626 Tf 6.666 0 Td [(6)]TJ/F8 9.9626 Tf 0 0 Td [(=)]TJ/F11 9.9626 Tf 10.541 0 Td [(y)]TJ/F75 9.9626 Tf 5.242 0 Td [(,)-252(2\))-251(is)-251(a)-252(le)15(gitimate)-251(image,)-252(and)-251(3\))-251(is)-252(within)]TJ -70.516 -11.955 Td [(the)-395(norm-bounded)-395(re)15(gion)-395(centering)]TJ/F11 9.9626 Tf 148.957 0 Td [(x)]TJ/F75 9.9626 Tf 9.63 0 Td [(with)-395(a)-395(small)-395(range)]TJ/F11 9.9626 Tf -158.587 -11.955 Td [<0f>]TJ/F14 9.9626 Tf 6.811 0 Td [<1c>]TJ/F8 9.9626 Tf 12.73 0 Td [(1)]TJ/F75 9.9626 Tf 7.472 0 Td [(measured)-250(in)-250(the)]TJ/F11 9.9626 Tf 65.574 0 Td [(`)]TJ/F10 6.9738 Tf 4.151 -1.495 Td [(p)]TJ/F75 9.9626 Tf 7.095 1.495 Td [(norm,)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 23.522 3.615 Td [(4)]TJ
0 g 0 G
/F79 9.9626 Tf 6.476 -3.615 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 76.547 555.605 Td [(f)]TJ/F87 8.9664 Tf 5.448 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 4.307 Td [<03>]TJ/F87 8.9664 Tf 4.317 -4.307 Td [(\))]TJ/F57 8.9664 Tf 6.144 0 Td [(6)]TJ/F87 8.9664 Tf 0 0 Td [(=)]TJ/F88 8.9664 Tf 9.727 0 Td [(y)-36(;)-514(s:t:)-342(x)]TJ/F44 5.9776 Tf 33.064 4.307 Td [<03>]TJ/F57 8.9664 Tf 6.877 -4.307 Td [(2)]TJ/F87 8.9664 Tf 8.703 0 Td [([0)]TJ/F88 8.9664 Tf 7.168 0 Td [(;)]TJ/F87 8.9664 Tf 4.095 0 Td [(1])]TJ/F41 5.9776 Tf 7.168 4.307 Td [(N)]TJ/F57 8.9664 Tf 10.508 -4.307 Td [(^)-400(k)]TJ/F88 8.9664 Tf 14.335 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 4.307 Td [<03>]TJ/F57 8.9664 Tf 6.365 -4.307 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [(x)]TJ/F57 8.9664 Tf 5.224 0 Td [(k)]TJ/F44 5.9776 Tf 4.608 -0.996 Td [(1)]TJ/F57 8.9664 Tf 10.363 0.996 Td [<14>]TJ/F88 8.9664 Tf 9.728 0 Td [<0f3b>]TJ
ET
EMC
BT
/F75 8.9664 Tf 275.907 555.605 Td [(\(2\))]TJ/F75 9.9626 Tf -225.795 -20.52 Td [(where)]TJ/F11 9.9626 Tf 30.561 0 Td [(N)]TJ/F75 9.9626 Tf 15.314 0 Td [(is)-625(the)-624(image)-625(dimension,)]TJ/F8 9.9626 Tf 112.997 0 Td [([0)]TJ/F11 9.9626 Tf 7.749 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(1])]TJ/F10 6.9738 Tf 7.748 3.615 Td [(N)]TJ/F75 9.9626 Tf 13.78 -3.615 Td [(is)-625(the)]TJ/F11 9.9626 Tf 31.265 0 Td [(N)]TJ/F75 9.9626 Tf 9.09 0 Td [(-)]TJ -232.932 -11.956 Td [(orthotope,)-218(de\002ned)-210(by)-210(the)-210(le)15(gitimate)-210(range)-210(of)-210(v)25(alues)-210(for)-210(each)]TJ 0 -11.955 Td [(pix)15(el)-304(\()]TJ/F79 9.9626 Tf 26.118 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-317(the)]TJ/F79 9.9626 Tf 23.338 0 Td [(pr)37<650278>-304(limit)]TJ/F75 9.9626 Tf 43.791 0 Td [(\),)-317(and)]TJ/F14 9.9626 Tf 26.376 0 Td [(k)]TJ/F11 9.9626 Tf 4.982 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F14 9.9626 Tf 7.189 -3.616 Td [<00>]TJ/F11 9.9626 Tf 10.358 0 Td [(x)]TJ/F14 9.9626 Tf 5.694 0 Td [(k)]TJ/F13 6.9738 Tf 4.981 -1.494 Td [(1)]TJ/F14 9.9626 Tf 12.197 1.494 Td [<14>]TJ/F11 9.9626 Tf 11.504 0 Td [<0f>]TJ/F75 9.9626 Tf 7.069 0 Td [(is)-304(the)]TJ/F11 9.9626 Tf 24.868 0 Td [(N)]TJ/F75 9.9626 Tf 9.09 0 Td [(-)]TJ -232.932 -11.955 Td [(sphere)-226(centered)-225(at)]TJ/F11 9.9626 Tf 73.679 0 Td [(x)]TJ/F75 9.9626 Tf 7.941 0 Td [(with)-226(radius)]TJ/F11 9.9626 Tf 46.556 0 Td [<0f>]TJ/F75 9.9626 Tf 6.291 0 Td [(measured)-226(in)-225(the)]TJ/F11 9.9626 Tf 64.843 0 Td [(`)]TJ/F13 6.9738 Tf 4.151 -1.494 Td [(1)]TJ/F75 9.9626 Tf 8.44 1.494 Td [(-norm)]TJ/F14 9.9626 Tf -211.901 -11.955 Td [<6b016b>]TJ/F75 9.9626 Tf 16.048 0 Td [(de\002ned)-333(according)-333(to)-333(the)-333(requirement)-333(for)-333(the)-333(perturba-)]TJ -16.048 -11.955 Td [(tion)-210(to)-209(be)-210(human-imperceptible)-210(\()]TJ/F79 9.9626 Tf 129.55 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-218(the)]TJ/F79 9.9626 Tf 21.413 0 Td [(norm-bound)-210(limit)]TJ/F75 9.9626 Tf 69.795 0 Td [(\).)]TJ -230.442 -11.955 Td [(W)80(e)-191(denote)-191(the)-190(union)-191(of)-191(the)-191(tw)10(o)-191(limits)-190(as)-191(the)-191(adv)15(ersarial)-191(limit)]TJ/F8 9.9626 Tf 0 -11.956 Td [(\n)]TJ/F14 9.9626 Tf 9.963 0 Td [<11>]TJ/F8 9.9626 Tf 10.516 0 Td [([0)]TJ/F11 9.9626 Tf 7.748 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(1])]TJ/F10 6.9738 Tf 7.749 3.616 Td [(N)]TJ/F14 9.9626 Tf 11.431 -3.616 Td [(^)-389(k)]TJ/F11 9.9626 Tf 15.497 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F14 9.9626 Tf 6.794 -3.616 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F14 9.9626 Tf 5.694 0 Td [(k)]TJ/F13 6.9738 Tf 4.982 -1.494 Td [(1)]TJ/F75 9.9626 Tf 10.931 1.494 Td [(\(illustrated)-250(in)-250(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-250(2\(a\))]TJ
0 g 0 G
[(\).)]TJ -99.434 -11.987 Td [(The)-214(adv)14(er)1(sarial)-215(e)15(xample)-214(is)-215(generated)-214(by)-215(solving)-214(the)-215(con-)]TJ -11.955 -11.955 Td [(strained)-250(optimization)-250(problem)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 129.642 407.932 Td [(x)]TJ/F44 5.9776 Tf 5.224 4.307 Td [<03>]TJ/F87 8.9664 Tf 6.877 -4.307 Td [(=)-285(arg)-186(min)]TJ/F41 5.9776 Tf 16.123 -7.721 Td [(x)]TJ/F12 4.9813 Tf 4.172 1.715 Td [(0)]TJ/F44 5.9776 Tf 2.695 -1.715 Td [(2)]TJ/F38 5.9776 Tf 4.981 0 Td [(\n)]TJ/F57 8.9664 Tf 13.135 7.721 Td [(L)]TJ/F87 8.9664 Tf 6.347 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 4.307 Td [(0)]TJ/F87 8.9664 Tf 2.684 -4.307 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 275.907 407.932 Td [(\(3\))]TJ/F75 9.9626 Tf -225.795 -25.613 Td [(where)]TJ/F14 9.9626 Tf 27.524 0 Td [(L)]TJ/F75 9.9626 Tf 10.058 0 Td [(is)-320(the)-320(adv)15(ersarial)-319(loss)-320(representing)-320(the)-320(attack)-319(ob-)]TJ -37.582 -11.955 Td [(jecti)25(v)15(e,)]TJ/F79 9.9626 Tf 31.459 0 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-282(nullify)-275(the)-275(functionality)-276(of)-275(the)-276(Img2Img)-275(GAN)]TJ -43.205 -11.955 Td [(and)-250(k)10(eep)-250(the)-250(input)-250(unchanged)-250(after)-250(translation.)]TJ 11.955 -11.988 Td [(T)80(o)-322(solv)15(e)-321(Eq.)-525(\()]TJ
1 0 0 rg 1 0 0 RG
[(3)]TJ
0 g 0 G
[(\),)-339(man)15(y)-322(gradient-based)-322(methods)-321([)]TJ
0 1 0 rg 0 1 0 RG
[(5)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-322(20)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
-11.955 -11.955 Td [(28)]TJ
0 g 0 G
[(])-362(ha)20(v)15(e)-361(been)-362(proposed,)-390(among)-361(which)-362(projected)-362(gradient)]TJ 0 -11.955 Td [(descent)-264(\(PGD\))-263(is)-264(pro)15(v)15(en)-263(best)-264(relying)-263(only)-264(on)-264<02727374>-263(order)-264(in-)]TJ 0 -11.955 Td [(formation)-306([)]TJ
0 1 0 rg 0 1 0 RG
[(20)]TJ
0 g 0 G
[(].)-478(PGD)-306(iterati)25(v)15(ely)-306(conducts)-306(gradient)-306(descent)]TJ 0 -11.955 Td [(and)-229(projection)-229(to)-230(adv)25(ance)-229(to)25(w)10(ard)-229(the)-229(optimal)-230(whil)1(e)-230(remain-)]TJ 0 -11.956 Td [(ing)-292(within)-291(the)-292(constrained)-291(re)15(gions.)-435(Speci\002cally)65(,)-302(let)]TJ/F11 9.9626 Tf 208.685 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F10 6.9738 Tf 0 -6.078 Td [(t)]TJ/F75 9.9626 Tf 7.485 2.462 Td [(and)]TJ/F11 9.9626 Tf -221.864 -11.955 Td [(g)]TJ/F10 6.9738 Tf 4.752 -1.494 Td [(t)]TJ/F75 9.9626 Tf 5.908 1.494 Td [(denote)-241(the)-241(adv)15(ersarial)-241(e)15(xample)-241(and)-240(the)-241(gradient)-241(at)-241(the)]TJ/F11 9.9626 Tf 216.069 0 Td [(t)]TJ/F75 6.9738 Tf 3.597 3.616 Td [(th)]TJ/F75 9.9626 Tf -230.326 -15.571 Td [(iteration,)-216(respecti)25(v)15(ely)65(.)-296(The)-207(adv)15(ersarial)-207(e)15(xample)-207(at)-208(the)]TJ/F11 9.9626 Tf 212.721 0 Td [(t)]TJ/F8 9.9626 Tf 4.237 0 Td [(+)-64(1)]TJ/F75 6.9738 Tf 13.368 3.615 Td [(th)]TJ/F75 9.9626 Tf -230.326 -15.57 Td [(iteration)-250(becomes)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 91.702 228.571 Td [(x)]TJ/F44 5.9776 Tf 5.224 4.307 Td [<03>]TJ/F41 5.9776 Tf 0 -5.884 Td [(t)]TJ/F38 5.9776 Tf 2.85 0 Td [(+1)]TJ/F87 8.9664 Tf 12.301 1.577 Td [(=)-285<0528>]TJ/F88 8.9664 Tf 20.221 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 4.307 Td [<03>]TJ/F41 5.9776 Tf 0 -5.884 Td [(t)]TJ/F87 8.9664 Tf 6.365 1.577 Td [(+)]TJ/F88 8.9664 Tf 9.215 0 Td [<11>-36(g)]TJ/F41 5.9776 Tf 9.318 -0.996 Td [(t)]TJ/F87 8.9664 Tf 3.348 0.996 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)-421(g)]TJ/F41 5.9776 Tf 10.731 -0.996 Td [(t)]TJ/F87 8.9664 Tf 5.909 0.996 Td [(=)]TJ/F57 8.9664 Tf 17.606 5.808 Td [(rL)]TJ/F87 8.9664 Tf 14.027 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F87 8.9664 Tf 4.317 1.577 Td [(\))]TJ
ET
q
1 0 0 1 196.915 230.813 cm
[]0 d 0 J 0.379 w 0 0 m 44.102 0 l S
Q
BT
/F57 8.9664 Tf 196.915 222.49 Td [(krL)]TJ/F87 8.9664 Tf 18.634 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 3.088 Td [<03>]TJ/F41 5.9776 Tf 0 -5.191 Td [(t)]TJ/F87 8.9664 Tf 4.317 2.103 Td [(\))]TJ/F57 8.9664 Tf 3.583 0 Td [(k)]TJ/F38 5.9776 Tf 4.608 -0.996 Td [(2)]TJ/F88 8.9664 Tf 5.347 7.077 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 275.907 228.571 Td [(\(4\))]TJ/F75 9.9626 Tf -225.795 -24.692 Td [(where)]TJ/F8 9.9626 Tf 28.607 0 Td [<05>]TJ/F75 9.9626 Tf 11.741 0 Td [(is)-428(the)-429(projection)-428(operation)-429(onto)-428(the)-429(adv)15(ersarial)]TJ -40.348 -11.955 Td [(limit)]TJ/F8 9.9626 Tf 22.543 0 Td [(\n)]TJ/F75 9.9626 Tf 7.195 0 Td [(,)]TJ/F79 9.9626 Tf 6.511 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-404(clippi)1(ng)-373(the)-373(modi\002cation)-373(back)-373(to)-372(the)-373(adv)15(er)20(-)]TJ -45.932 -11.955 Td [(sarial)-250(limit)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(24)]TJ
0 g 0 G
[(].)]TJ/F74 10.9589 Tf 0 -20.023 Td [(2.3.)-189(Blackbox)-189(setting)-188(and)-189(random)-189(gradientfr)18(ee)-189<6573ad>]TJ 24.657 -11.955 Td [(timation)]TJ/F75 9.9626 Tf -12.702 -17.965 Td [(Since)-333(DeepF)15(ak)10(e)-332(models)-333(are)-333(generally)-332(concealed,)-354(nulli-)]TJ -11.955 -11.955 Td [(fying)-307(attack)-306(naturally)-307(occurs)-307(in)-306(a)-307(black-box)-307(setting,)-321(which)]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 109.608 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 64.558 102.742 Td [(4)]TJ/F40 7.9701 Tf 3.487 -2.813 Td [(p)]TJ/F37 7.9701 Tf 7.876 0 Td [(=)-453(2)]TJ/F75 7.9701 Tf 17.068 0 Td [(or)]TJ/F43 7.9701 Tf 9.272 0 Td [(1)]TJ/F75 7.9701 Tf 11.102 0 Td [(is)-330(the)-331(common)-330(choice)-331(for)-330(adv)15(ersarial)-330(attacks.)-552(In)-330(this)]TJ -63.251 -9.464 Td [(paper)40(,)-337(we)-320(adopt)]TJ/F40 7.9701 Tf 54.167 0 Td [(p)]TJ/F37 7.9701 Tf 7.712 0 Td [(=)]TJ/F43 7.9701 Tf 10.036 0 Td [(1)]TJ/F75 7.9701 Tf 11.018 0 Td [(because)-320(it)-320(simpli\002es)-320(the)-320(projection)-320(to)-320(pix)15(el-by-)]TJ -82.933 -9.465 Td [(pix)15(el)-250(numerical)-250(upper)-250(and)-250(lo)25(wer)-250(bounds.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
/F75 9.9626 Tf 258.75 629.037 Td [(only)-194(allo)25(ws)-195(one)-194(to)-194(acquire)-195(zeroth-order)-194(information,)]TJ/F79 9.9626 Tf 207.364 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-205(the)]TJ -217.048 -11.955 Td [(system)-364(output)-364(of)-364(a)-364(speci\002c)-364(query)65(.)-651(Therefore,)-393(to)-364(properly)]TJ 0 -11.955 Td [(e)15(xploit)-354(gradient)-354(descent)-354(optimization,)-380(we)-354(perform)-354(zeroth-)]TJ 0 -11.955 Td [(order)-240(estimations)-241(of)-240(the)-241(gradient)-240(by)-241(le)25(v)15(eraging)-240(the)-241(Random)]TJ 0 -11.955 Td [(Gradient-Free)-363(\(RGF\))-364(estimation)-363([)]TJ
0 1 0 rg 0 1 0 RG
[(22)]TJ
0 g 0 G
[(].)-650(RGF)-363(randomly)-364(se-)]TJ 0 -11.956 Td [(lects)-363(query)-363(v)15(ectors)]TJ/F11 9.9626 Tf 80.413 0 Td [(u)]TJ/F10 6.9738 Tf 5.703 -1.494 Td [(i)]TJ/F75 9.9626 Tf 6.932 1.494 Td [(from)-363(a)-363(unit)-363(sphere)]TJ/F14 9.9626 Tf 79.754 0 Td [(U)]TJ/F75 9.9626 Tf 10.839 0 Td [(to)-363(estimate)-363(a)]TJ -183.641 -11.955 Td [(gradient)]TJ/F8 9.9626 Tf 36.777 0 Td [(^)]TJ/F11 9.9626 Tf -1.639 0 Td [(g)]TJ/F10 6.9738 Tf 4.752 -1.494 Td [(t)]TJ/F75 9.9626 Tf 5.998 1.494 Td [(via)]TJ
ET
/S/Span<>BDC
BT
/F87 8.9664 Tf 330.881 609.717 Td [(^)]TJ/F88 8.9664 Tf -0.31 0 Td [(g)]TJ/F41 5.9776 Tf 4.394 -0.996 Td [(t)]TJ/F87 8.9664 Tf 5.909 0.996 Td [(=)]TJ 10.923 5.799 Td [(1)]TJ
ET
q
1 0 0 1 351.797 611.959 cm
[]0 d 0 J 0.379 w 0 0 m 4.608 0 l S
Q
BT
/F88 8.9664 Tf 351.881 603.636 Td [(q)]TJ/F41 5.9776 Tf 12.097 17.654 Td [(q)]TJ/F89 8.9664 Tf -4.842 -3.055 Td [(X)]TJ/F41 5.9776 Tf 0.702 -18.904 Td [(i)]TJ/F38 5.9776 Tf 2.664 0 Td [(=1)]TJ/F88 8.9664 Tf 12.676 16.194 Td [(L)]TJ/F87 8.9664 Tf 6.271 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F87 8.9664 Tf 6.365 1.577 Td [(+)]TJ/F88 8.9664 Tf 9.216 0 Td [<0e>-38(u)]TJ/F41 5.9776 Tf 9.728 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.162 0.996 Td [(\))]TJ/F57 8.9664 Tf 5.632 0 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [(L)]TJ/F87 8.9664 Tf 6.271 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F57 8.9664 Tf 6.365 1.577 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [<0e>-38(u)]TJ/F41 5.9776 Tf 9.729 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.162 0.996 Td [(\))]TJ
ET
q
1 0 0 1 375.178 611.959 cm
[]0 d 0 J 0.379 w 0 0 m 105.528 0 l S
Q
BT
/F87 8.9664 Tf 423.426 603.636 Td [(2)]TJ/F88 8.9664 Tf 4.607 0 Td [<0e>]TJ 53.869 6.081 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.996 Td [(i)]TJ/F88 8.9664 Tf 3.162 0.996 Td [(;)-171(u)]TJ/F41 5.9776 Tf 9.398 -0.996 Td [(i)]TJ/F57 8.9664 Tf 5.722 0.996 Td [(2)-285(U)]TJ/F88 8.9664 Tf 15.356 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 609.717 Td [(\(5\))]TJ/F75 9.9626 Tf -225.795 -29.59 Td [(where)]TJ/F11 9.9626 Tf 27.44 0 Td [<0e>]TJ/F75 9.9626 Tf 7.907 0 Td [(is)-311(a)-312(small)-311(v)25(ariance.)-494(In)-311(Eq.)-494(\()]TJ
1 0 0 rg 1 0 0 RG
[(5)]TJ
0 g 0 G
[(\),)-327(the)-311(querying)-312(v)15(ec-)]TJ -35.347 -11.955 Td [(tors)-347(are)]TJ/F79 9.9626 Tf 34.032 0 Td [(\003ipped)]TJ/F75 9.9626 Tf 30.848 0 Td [(to)25(w)10(ards)-348(t)1(he)-348(gradient)-347(by)-348(the)-347(multiplication)]TJ -64.88 -11.956 Td [(of)-256(their)-256(o)25(wn)-255(dot)-256(product)-256(with)-256(the)-255(gradient.)-328(Thus,)-257(by)-256(query-)]TJ 0 -11.955 Td [(ing)-233(with)-232(radial)-233(symmetry)65(,)-236(other)-232(directions)-233(orthogonal)-232(to)-233(the)]TJ 0 -11.955 Td [(gradient)-271(will)-271(be)-271(balanced-out)-271(in)-271(the)-271(process)-272(to)-271(estimate)-271(the)]TJ 0 -11.955 Td [(gradient)-250(for)-250(nullifying)-250(attack)-250(ef)25(fecti)25(v)15(ely)65(.)]TJ/F74 11.9552 Tf 0 -25.735 Td [(3.)-250(Pr)18(oblem)-250(f)25(ormulation)]TJ/F75 9.9626 Tf 11.955 -19.538 Td [(F)15(or)-331(Img2Img)-331(GANs,)-351(the)-332(adv)15(ersarial)-331(attack)-331(objecti)25(v)15(e)-331(is)]TJ -11.955 -11.955 Td [(e)15(xpressed)-487(naturally)-487(by)-488(shifting)-487(the)-487(output)-487(of)-487(the)-488(image)]TJ 0 -11.955 Td [(translation)-373(process)-373(relati)25(v)15(e)-373(to)-373(an)-373(attack)-373(tar)18(get)]TJ/F11 9.9626 Tf 190.886 0 Td [(y)]TJ/F75 6.9738 Tf 4.885 -1.494 Td [(tar)18(get)]TJ/F75 9.9626 Tf 16.252 1.494 Td [(,)-404(with)]TJ -212.023 -11.955 Td [(the)-250(corresponding)-250(adv)15(ersarial)-250(loss)]TJ/F11 9.9626 Tf 138.19 0 Td [(L)]TJ/F10 6.9738 Tf 6.78 -1.494 Td [(adv)]TJ/F75 9.9626 Tf 15.693 1.494 Td [(de\002ned)-250(as,)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 372.155 417.961 Td [(L)]TJ/F41 5.9776 Tf 6.271 -1.063 Td [(adv)]TJ/F87 8.9664 Tf 12.323 1.063 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 4.307 Td [<03>]TJ/F87 8.9664 Tf 4.317 -4.307 Td [(\))-285(=)]TJ/F88 8.9664 Tf 15.871 0 Td [(d)]TJ/F87 8.9664 Tf 4.774 0 Td [(\()]TJ/F66 8.9664 Tf 3.584 0 Td [(T)]TJ/F87 8.9664 Tf 5.978 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 4.307 Td [<03>]TJ/F87 8.9664 Tf 4.317 -4.307 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)-171(y)]TJ/F75 6.9738 Tf 8.634 -0.996 Td [(tar)18(get)]TJ/F87 8.9664 Tf 16.252 0.996 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 417.961 Td [(\(6\))]TJ/F75 9.9626 Tf -225.795 -22.248 Td [(where)]TJ/F11 9.9626 Tf 27.192 0 Td [(d)]TJ/F75 9.9626 Tf 8.04 0 Td [(is)-286(the)-287(function)-286(of)-287(squared)-286(Euclidean)-287(distance,)]TJ/F79 9.9626 Tf 186.353 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)]TJ/F11 9.9626 Tf -231.269 -11.955 Td [(d)]TJ/F8 9.9626 Tf 5.185 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x;)-167(y)]TJ/F8 9.9626 Tf 15.363 0 Td [(\))-505(=)-506(\()]TJ/F14 9.9626 Tf 25.567 0 Td [(k)]TJ/F11 9.9626 Tf 4.982 0 Td [(x)]TJ/F14 9.9626 Tf 8.814 0 Td [<00>]TJ/F11 9.9626 Tf 10.87 0 Td [(y)]TJ/F14 9.9626 Tf 5.242 0 Td [(k)]TJ/F7 6.9738 Tf 4.981 -1.495 Td [(2)]TJ/F8 9.9626 Tf 4.469 1.495 Td [(\))]TJ/F7 6.9738 Tf 3.875 3.615 Td [(2)]TJ/F75 9.9626 Tf 4.469 -3.615 Td [(.)-679(By)-373(minimizing)-372(the)-373(loss,)-404(the)-373(at-)]TJ -97.692 -11.956 Td [(tack)-370(model)-370(is)-370(able)-370(to)-370(generate)-370(an)-370(adv)15(ersarial)-370(e)15(xampl)1(e)]TJ/F11 9.9626 Tf 225.976 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F75 9.9626 Tf -231.67 -15.571 Td [(that)-332(causes)-333(the)-332(translation)-333(function)-332(to)-333(returns)-332(output)-333(simi-)]TJ 0 -11.955 Td [(lar)-270(to)-270(the)-270(tar)18(get)-270(image)]TJ/F11 9.9626 Tf 90.74 0 Td [(y)]TJ/F75 6.9738 Tf 4.884 -1.494 Td [(tar)18(get)]TJ/F75 9.9626 Tf 16.252 1.494 Td [(.)-370(In)-270(the)-270(follo)25(wing,)-275(we)-270(formally)]TJ -111.876 -11.955 Td [(introduce)-250(the)-250(nullifying)-250(attack.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 122.858 3.615 Td [(5)]TJ
0 g 0 G
0 g 0 G
/F74 9.9626 Tf -122.858 -25.365 Td [(De\002nition)-258(1.)]TJ
0 g 0 G
/F81 9.9626 Tf 57.151 0 Td [(Nullifying)-258(attac)10(k.)]TJ/F79 9.9626 Tf 75.274 0 Td [(The)-258(nullifying)-258(attac)20(k)-258(aims)]TJ -132.425 -11.955 Td [(to)-240(nullify)-241(the)-240(ima)10(g)10(e)-240(tr)15(anslation)-240(pr)45(ocess)-241(suc)15(h)-240(that)-240(the)-241(adver)20(-)]TJ 0 -11.955 Td [(sarial)-279(e)20(xample)]TJ/F11 9.9626 Tf 61.8 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F79 9.9626 Tf 7.356 -3.615 Td [(is)-279(mapped)-278(bac)20(k)-279(to)-279(the)-278(original)-279(input)]TJ/F11 9.9626 Tf 148.746 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.495 Td [(0)]TJ/F79 9.9626 Tf 4.469 1.495 Td [(,)]TJ -233.759 -11.956 Td [(accor)37(ding)-250(to)-250(the)-250(nullifying)-250(loss)]TJ/F11 9.9626 Tf 126.106 0 Td [(L)]TJ/F79 6.9738 Tf 6.78 -1.494 Td [(Null)]TJ/F8 9.9626 Tf 15.281 1.494 Td [(=)]TJ/F14 9.9626 Tf 10.516 0 Td [(k)]TJ/F66 9.9626 Tf 4.981 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F8 9.9626 Tf 4.58 -3.616 Td [(\))]TJ/F14 9.9626 Tf 6.089 0 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F14 9.9626 Tf 4.47 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.981 3.616 Td [(2)]TJ 0 -6.088 Td [(2)]TJ/F79 9.9626 Tf 4.469 2.472 Td [(.)]TJ/F75 9.9626 Tf -208.164 -21.75 Td [(A)-343(successful)-342(nullifying)-343(attack)-343(can)-343(be)-342(adopted)-343(as)-343(a)-343(w)10(a-)]TJ -11.955 -11.955 Td [(termark)-380(on)-380(personal)-381(images)-380(such)-380(that)-380(unethical)-381(Img2Img)]TJ 0 -11.955 Td [(GANs)-250(\()]TJ/F79 9.9626 Tf 31.262 0 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-250(DeepNude\))-250(cannot)-250(manipulate)-250(the)-250(image.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 173.199 3.615 Td [(6)]TJ
0 g 0 G
/F74 11.9552 Tf -216.207 -29.35 Td [(4.)-250(The)-250(LaS-GSA)-250(method)]TJ/F75 9.9626 Tf 11.955 -19.537 Td [(In)-475(the)-475(follo)25(wing,)-532(we)-475(introduce)-475(the)]TJ/F79 9.9626 Tf 151.845 0 Td [(Limit-A)55(war)37(e)-475(Self-)]TJ -163.8 -11.956 Td [(Guiding)-250(Gr)15(adient)-250(Sliding)-249(Attac)20(k)-250(\(LaS-GSA\))]TJ/F75 9.9626 Tf 178.132 0 Td [(scheme,)-250(a)-250(ne)25(w)]TJ -178.132 -11.955 Td [(black-box)-247(adv)15(ersarial)-247(attack,)-248(to)-247(ef)25(\002ciently)-247(nullify)-248(the)-247(trans-)]TJ 0 -11.955 Td [(lation)-402(process)-402(of)-402(Img2Img)-402(GANs.)-766(First,)-440(the)-402(detrimental)]TJ 0 -11.955 Td [(ef)25(fects)-407(caused)-407(by)-407(the)-407(projection)-407(are)-407(in)40(v)15(estig)5(ated,)-446(leading)]TJ
0 g 0 G
ET
q
1 0 0 1 308.862 128.801 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 323.308 121.935 Td [(5)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(Compared)-297(with)-297(attacking)-297(a)-298(classi)1<026572>40(,)-309(which)-298(only)-297(alternates)-297(a)-297(single)]TJ -17.933 -9.464 Td [(output)-278(label)-278([)]TJ
0 1 0 rg 0 1 0 RG
[(30)]TJ
0 g 0 G
[(],)-284(it)-278(is)-278(more)-278(challenging)-278(to)-278(attack)-277(Img2Img)-278(GAN)-278(because)]TJ 0 -9.465 Td [(the)-250(attack)-250(model)-250(is)-250(required)-250(to)-250(ensure)-250(the)-250(correctness)-250(of)]TJ/F37 7.9701 Tf 179.724 0 Td [(10)]TJ/F38 5.9776 Tf 8.468 2.813 Td [(6)]TJ/F75 7.9701 Tf 6.144 -2.813 Td [(pix)15(els)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(].)]TJ/F75 5.9776 Tf -179.89 -6.916 Td [(6)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(W)80(e)-341(discuss)-341(another)-342(attac)1(k)-342(scheme,)]TJ/F79 7.9701 Tf 116.058 0 Td [(Distorting)-341(Attac)20(k)]TJ/F75 7.9701 Tf 55.696 0 Td [(,)-364(which)-341(forces)]TJ -189.687 -9.464 Td [(the)-250(model)-250(generates)-250(the)-250(deteriorated)-250(output)-250(image)-250(in)-250(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-250(D)]TJ
0 g 0 G
[(.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
73 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/9i6LCblV897YuIvKiW5HkQ Do
Q
endstream
endobj
74 0 obj
<< /Font << /F10 248 0 R /F11 238 0 R /F12 249 0 R /F13 250 0 R /F14 239 0 R /F37 240 0 R /F38 241 0 R /F40 251 0 R /F41 242 0 R /F43 252 0 R /F44 253 0 R /F57 228 0 R /F66 243 0 R /F7 244 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R /F81 234 0 R /F87 245 0 R /F88 246 0 R /F89 254 0 R >> /ProcSet [ /PDF /Text ] /XObject << /9i6LCblV897YuIvKiW5HkQ 255 0 R >> >>
endobj
75 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 190.58 514.832 203.63 528.78 ] /Subtype /Link /Type /Annot >>
endobj
76 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 273.986 514.832 287.594 528.78 ] /Subtype /Link /Type /Annot >>
endobj
77 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 376.699 514.832 389.75 528.78 ] /Subtype /Link /Type /Annot >>
endobj
78 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 250.476 430.763 257.45 439.485 ] /Subtype /Link /Type /Annot >>
endobj
79 0 obj
<< /A << /D (cite.tu2019autozoom) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 88.831 353.298 100.787 362.224 ] /Subtype /Link /Type /Annot >>
endobj
80 0 obj
<< /A << /D (cite.brunner2019guessing) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 103.92 353.298 110.894 362.224 ] /Subtype /Link /Type /Annot >>
endobj
81 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 114.027 353.362 121.001 362.085 ] /Subtype /Link /Type /Annot >>
endobj
82 0 obj
<< /A << /D (subsection.A.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 198.78 136.495 214.331 147.409 ] /Subtype /Link /Type /Annot >>
endobj
83 0 obj
<< /A << /D (subsection.A.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 384.637 432.869 401.294 443.813 ] /Subtype /Link /Type /Annot >>
endobj
84 0 obj
<< /A << /D (equation.2.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 395.763 408.959 402.737 419.916 ] /Subtype /Link /Type /Annot >>
endobj
85 0 obj
<< /A << /D (Hfootnote.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 490.757 397.004 496.735 409.427 ] /Subtype /Link /Type /Annot >>
endobj
86 0 obj
<< /A << /D (cite.bashkirova2019adversarial) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 351.289 374.62 358.263 383.407 ] /Subtype /Link /Type /Annot >>
endobj
87 0 obj
<< /A << /D (cite.papernot2017practical) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 360.681 374.62 372.636 383.407 ] /Subtype /Link /Type /Annot >>
endobj
88 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 405.976 178.256 424.566 189.213 ] /Subtype /Link /Type /Annot >>
endobj
89 0 obj
<< /A << /D (subsection.2.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 398.496 87.743 410.451 98.267 ] /Subtype /Link /Type /Annot >>
endobj
90 0 obj
<< /Length 17999 >>
stream
0 g 0 G
0 g 0 G
0 g 0 G
1 0 0 1 60.508 587.559 cm
q
.15337 0 0 .15337 0 0 cm
q
1220 0 0 781 0 0 cm
/Im2 Do
Q
Q
0 g 0 G
1 0 0 1 -60.508 -587.559 cm
BT
/F75 8.9664 Tf 50.112 573.911 Td [(\(a\))-225(Left:)-298(gre)15(y)-225(bars)-226(denote)-225(pix)15(el)-225(v)25(alues,)-231(the)-225(outer)-225(black)-226(box)]TJ 0 -10.959 Td [(denotes)-340(the)]TJ/F79 8.9664 Tf 44.449 0 Td [(pr)37<650278>-340(limit)]TJ/F75 8.9664 Tf 42.791 0 Td [(\()]TJ/F79 8.9664 Tf 2.986 0 Td [(e)15(.g)]TJ/F75 8.9664 Tf 10.571 0 Td [(.,)]TJ/F87 8.9664 Tf 7.736 0 Td [([0)]TJ/F88 8.9664 Tf 7.168 0 Td [(;)]TJ/F87 8.9664 Tf 4.095 0 Td [(1])]TJ/F75 8.9664 Tf 7.168 0 Td [(\),)-363(and)-340(the)-340(red)-340(box)-341(de-)]TJ -126.964 -10.959 Td [(notes)-276(the)]TJ/F79 8.9664 Tf 34.827 0 Td [(norm-bound)-276(limit)]TJ/F75 8.9664 Tf 65.878 0 Td [(\(in)]TJ/F88 8.9664 Tf 12.433 0 Td [(`)]TJ/F44 5.9776 Tf 3.805 -0.996 Td [(1)]TJ/F75 8.9664 Tf 7.804 0.996 Td [(\).)-387(Right:)-361(the)-276(combined)]TJ/F79 8.9664 Tf -124.747 -10.959 Td [(adver)10(sarial)-250(limit)]TJ/F75 8.9664 Tf 62.342 0 Td [(is)-250(depicted)-250(with)-250(centered)-250(pix)15(el)-250(v)25(alues.)]TJ
0 g 0 G
ET
1 0 0 1 280.042 587.559 cm
q
.17043 0 0 .17043 0 0 cm
q
758 0 0 751 0 0 cm
/Im3 Do
Q
Q
0 g 0 G
1 0 0 1 -280.042 -587.559 cm
BT
/F75 8.9664 Tf 272.864 573.911 Td [(\(b\))-291(In)-292(RGF)80(,)-291(random)-291(v)15(ectors)-291(are)-291(queried)]TJ 0 -10.959 Td [(from)-421(the)-421(unit)-421(circle)-421(\(black\).)-823(In)-422(li)1(mit-)]TJ 0 -10.959 Td [(a)15(w)10(are)-240(RGF)80(,)-240(the)-239(queried)-240(v)15(ector)-240(is)-239(shifted)]TJ 0 -10.959 Td [(to)-250(the)-250(origin-centered)-250(ellipse)-250(\(red\).)]TJ
0 g 0 G
ET
1 0 0 1 431.264 587.559 cm
q
.19167 0 0 .19167 0 0 cm
q
594 0 0 691 0 0 cm
/Im4 Do
Q
Q
0 g 0 G
1 0 0 1 -431.264 -587.559 cm
BT
/F75 8.9664 Tf 431.264 573.911 Td [(\(c\))-211(Starting)-210(from)]TJ/F88 8.9664 Tf 61.443 0 Td [(s)]TJ/F38 5.9776 Tf 4.293 -0.997 Td [(1)]TJ/F87 8.9664 Tf 6.711 0.997 Td [(=)]TJ/F88 8.9664 Tf 9.727 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.387 Td [(t)]TJ/F75 8.9664 Tf 4.317 1.578 Td [(,)-218(PGD)]TJ -91.715 -10.959 Td [(mo)15(v)15(es)-390(to)]TJ/F88 8.9664 Tf 37.106 0 Td [(s)]TJ/F38 5.9776 Tf 4.293 -0.997 Td [(2)]TJ/F75 8.9664 Tf 4.151 0.997 Td [(,)-425(whereas)-389(gradient)]TJ -45.55 -10.959 Td [(sliding)-341(selects)]TJ/F88 8.9664 Tf 54.437 0 Td [(s)]TJ/F38 5.9776 Tf 4.293 -0.996 Td [(4)]TJ/F75 8.9664 Tf 4.151 0.996 Td [(,)-364(closer)-341(to)-341(the)]TJ -62.881 -10.959 Td [(optimum)-250(\(red)-250(x\).)]TJ
0 g 0 G
0 g 0 G
/F75 9.9626 Tf -339.911 -21.619 Td [(Figure)-250(2:)-310(Illustrations)-250(of)]TJ
1 0 0 rg 1 0 0 RG
[-250(\(a\))]TJ
0 g 0 G
[-250(adv)15(ersarial)-250(limit,)]TJ
1 0 0 rg 1 0 0 RG
[-250(\(b\))]TJ
0 g 0 G
[-250(limit-a)15(w)10(are)-250(RGF)80(,)-250(and)]TJ
1 0 0 rg 1 0 0 RG
[-250(\(c\))]TJ
0 g 0 G
[-250(gradient)-250(sliding)-250(mechanism.)]TJ
0 g 0 G
0 g 0 G
-41.241 -27.805 Td [(to)-335(the)-334(introduction)-335(of)-334(the)]TJ/F79 9.9626 Tf 105.77 0 Td [(limit-awar)37(e)-334(RGF)]TJ/F75 9.9626 Tf 72.497 0 Td [(and)-335(the)]TJ/F79 9.9626 Tf 33.226 0 Td [(gr)15(adi-)]TJ -211.493 -11.955 Td [(ent)-230(sliding)-229(mec)15(hanism)]TJ/F75 9.9626 Tf 88.549 0 Td [(,)-234(designed)-229(to)-230(alle)25(viate)-229(the)-230(harmful)-230(ef-)]TJ -88.549 -11.956 Td [(fects.)-476(Then,)-319(we)-305(propose)-305(the)]TJ/F79 9.9626 Tf 116.633 0 Td [(self-guiding)-305(prior)]TJ/F75 9.9626 Tf 74.393 0 Td [(to)-305(fully)-305(e)15(x-)]TJ -191.026 -11.955 Td [(ploit)-280(the)-280(threat)-280(model)-279(for)-280(prior)-280(information)-280(by)-280(deri)25(ving)-280(the)]TJ 0 -11.955 Td [(approximate)-275(solution)-275(of)-274(the)-275(true)-275(gradient,)-281(remo)15(ving)-275(the)-275(re-)]TJ 0 -11.955 Td [(quirement)-296(for)-295(surrog)5(ate)-296(models)-296(or)-295(e)15(xtra)-296(datasets)-296([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(].)-447(Last,)]TJ 0 -11.955 Td [(we)-250(present)-250(the)-250(attack)-250(procedure)-250(of)-250(the)-250(LaS-GSA)-250(method.)]TJ/F74 10.9589 Tf 0 -22.683 Td [(4.1.)-250(Limitawar)18(e)-250(RGF)]TJ/F75 9.9626 Tf 11.955 -18.852 Td [(While)-266(the)-265(combination)-266(of)-266(RGF)-266(estimation)-265(and)-266(PGD)-266(op-)]TJ -11.955 -11.955 Td [(timization)-407(had)-408(been)-408(studied)-407(in)-408(pre)25(vious)-407(black-box)-408(attack)]TJ 0 -11.956 Td [(methods)-264([)]TJ
0 1 0 rg 0 1 0 RG
[(30)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-265(3)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-265(7)]TJ
0 g 0 G
[(],)-268(the)15(y)-264(do)-265(not)-264(consider)-265(the)-264(detrimental)-265(ef-)]TJ 0 -11.955 Td [(fects)-315(of)-314(the)-315(projecting)]TJ/F79 9.9626 Tf 92.221 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-331(clipping,)-331(the)-314(modi\002cation)-315(back)]TJ -101.904 -11.955 Td [(to)-337(the)-336(adv)15(ersarial)-337(limit.)-570(While)-337(the)-336(projection)-337(is)-337(necessary)]TJ 0 -11.955 Td [(for)-215(k)10(eeping)-215(the)-215(adv)15(ersarial)-215(e)15(xample)-215(v)25(alid)-215(and)-215(indistinguish-)]TJ 0 -11.955 Td [(able)-394(from)-393(the)-394(original)-393(image,)-430(it)-393(not)-394(only)-393(deteriorates)-394(the)]TJ 0 -11.955 Td [(ef)25(\002cienc)15(y)-264(of)-264(the)-264(gradient)-263(estimation)-264(process)-264(b)20(ut)-264(also)-264(short-)]TJ 0 -11.956 Td [(ens)-215(the)-214(desired)-215(modi\002cation)-214(to)25(w)10(ards)-215(the)-214(estimated)-215(gradient,)]TJ 0 -11.955 Td [(because)-365(the)-365(projection)]TJ/F79 9.9626 Tf 95.012 0 Td [(pulls)-365(bac)20(k)]TJ/F75 9.9626 Tf 45.428 0 Td [(the)-365(out-of-bound)-365(gradi-)]TJ -140.44 -11.955 Td [(ent.)-306(Therefore,)-239(the)-237(adv)15(ersarial)-236(e)15(xample)-237(is)-237(modi\002ed)-237(to)25(w)10(ards)]TJ 0 -11.955 Td [(an)-235(undesirable)-235(direction,)-237(which)-235(reduces)-235(the)-235(ef)25(fecti)25(v)15(eness)-235(of)]TJ 0 -11.955 Td [(both)-333(the)-332(RGF)-333(estimation)-332(process)-333(and)-333(the)-332(gradient)-333(descent)]TJ 0 -11.955 Td [(process)-338(in)-338(PGD.)-338(Therefore,)-360(we)-339(characterize)-338(the)-338(detrimen-)]TJ 0 -11.956 Td [(tal)-355(ef)25(fects)-356(of)-355(projection)-355(in)-355(tw)10(ofold:)-521(i\))-355(misdirection)-355(of)-356(the)]TJ 0 -11.955 Td [(gradient,)-250(and)-250(ii\))-250(shortening)-250(of)-250(the)-250(optimization)-250(steps.)]TJ 11.955 -12.874 Td [(First,)-258(we)-256(pro)15(v)15(e)-256(that)-256(the)-256(projection)-256(w)10(ould)-256(mislead)-256(the)-256(di-)]TJ -11.955 -11.955 Td [(rection)-278(of)-278(the)-278(estimated)-278(gradient,)-285(harming)-278(the)-278(ef)25(\002cienc)15(y)-278(of)]TJ 0 -11.956 Td [(the)-250(nullifying)-250(attack)-250(process.)]TJ
0 g 0 G
/F74 9.9626 Tf 0 -22.683 Td [(Pr)18(oposition)-405(1.)]TJ
0 g 0 G
/F79 9.9626 Tf 66.608 0 Td [(\(Pr)45(oof)-405(in)-406(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-405(A.1)]TJ
0 g 0 G
[(.\))-776(The)-405(pr)45(ojection)]TJ -66.608 -11.955 Td [(has)-442(a)-441(detrimental)-442(ef)18(fect)-441(on)-442(the)-442(gr)15(adient)-441(estimation,)]TJ/F75 9.9626 Tf 221.585 0 Td [(i.e)]TJ/F79 9.9626 Tf 9.684 0 Td [(.,)]TJ/F11 9.9626 Tf -231.269 -11.955 Td [(g)]TJ/F14 9.9626 Tf 7.323 0 Td [<01>]TJ/F8 9.9626 Tf 4.981 0 Td [<280528>-34(^)]TJ/F11 9.9626 Tf 15.221 0 Td [(g)]TJ/F8 9.9626 Tf 5.109 0 Td [(\))]TJ/F14 9.9626 Tf 6.089 0 Td [<00>]TJ/F8 9.9626 Tf 10.303 0 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F8 9.9626 Tf 5.11 0 Td [(\))]TJ/F14 9.9626 Tf 6.641 0 Td [<14>]TJ/F8 9.9626 Tf 10.516 0 Td [(0)]TJ/F79 9.9626 Tf 4.982 0 Td [(.)]TJ/F75 9.9626 Tf -63.979 -22.683 Td [(T)80(o)-285(alle)25(viate)-285(the)-285(detrimental)-284(ef)25(fects)-285(of)-285(projection,)-294(we)-285(in-)]TJ -11.955 -11.955 Td [(troduce)-234(the)]TJ/F79 9.9626 Tf 46.711 0 Td [(limit-awar)37(e)-234(RGF)]TJ/F75 9.9626 Tf 70.492 0 Td [(to)-234(query)-234(the)-234(v)15(ectors)-233(follo)25(wing)]TJ
0 g 0 G
0 g 0 G
141.547 410.61 Td [(the)-250(adv)15(ersarial)-250(limit,)]TJ/F79 9.9626 Tf 84.522 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)]TJ
ET
/S/Span<>BDC
BT
/F87 8.9664 Tf 371.434 470.292 Td [<0528>]TJ/F88 8.9664 Tf 10.494 0 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.997 Td [(i)]TJ/F87 8.9664 Tf 3.161 0.997 Td [(\))-286(=)]TJ/F88 8.9664 Tf 15.871 0 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.997 Td [(i)]TJ/F57 8.9664 Tf 4.698 0.997 Td [(8)]TJ/F88 8.9664 Tf 5.12 0 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.997 Td [(i)]TJ/F57 8.9664 Tf 5.721 0.997 Td [(!)]TJ/F87 8.9664 Tf 11.776 0 Td [<0528>-34(^)]TJ/F88 8.9664 Tf 10.493 0 Td [(g)]TJ/F87 8.9664 Tf 4.716 0 Td [(\))-286(=)-320(^)]TJ/F88 8.9664 Tf 15.871 0 Td [(g)-36(:)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 470.292 Td [(\(7\))]TJ/F75 9.9626 Tf -225.795 -22.315 Td [(By)-415(e)15(xamining)-414(the)-415(con)40(v)15(e)15(xity)-414(of)-415(the)-415(adv)15(ersarial)-414(limit)-415(\(de-)]TJ 0 -11.955 Td [(tailed)-254(in)-254(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-254(A.3)]TJ
0 g 0 G
[(\),)-255(the)-254(estimated)-254(gradient)-254(will)-254(not)-254(e)15(x-)]TJ 0 -11.955 Td [(ceed)-250(the)-249(limit.)-310(Based)-249(on)-250(the)-249(observ)25(ation,)-250(we)]TJ/F79 9.9626 Tf 179.064 0 Td [(adjust)]TJ/F75 9.9626 Tf 27.024 0 Td [(the)-250(unit)]TJ/F11 9.9626 Tf -206.088 -11.955 Td [(N)]TJ/F75 9.9626 Tf 9.091 0 Td [(-sphere)]TJ/F14 9.9626 Tf 32.989 0 Td [(U)]TJ/F75 9.9626 Tf 10.894 0 Td [(in)-368(Eq.)-665(\()]TJ
1 0 0 rg 1 0 0 RG
[(5)]TJ
0 g 0 G
[(\))-369(to)-368(follo)25(w)-368(the)-369(adv)15(ersarial)-368(limit)-368(by)]TJ -52.974 -11.955 Td [(scaling)-250(the)-250(basis)-250(of)]TJ/F14 9.9626 Tf 78.584 0 Td [(U)]TJ/F75 9.9626 Tf 9.715 0 Td [(into)-250(a)-250(h)5(yperellipsoid)]TJ/F14 9.9626 Tf 84.353 0 Td [(P)]TJ/F75 9.9626 Tf 7.749 0 Td [(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 2.49 3.615 Td [(7)]TJ
0 g 0 G
/F75 9.9626 Tf -170.936 -16.201 Td [(Concretely)65(,)-703(since)-613(adv)15(ersarial)-613(l)1(imit)]TJ/F8 9.9626 Tf 153.734 0 Td [(\n)]TJ/F75 9.9626 Tf 13.298 0 Td [(forms)-613(an)]TJ/F11 9.9626 Tf 44.855 0 Td [(N)]TJ/F75 9.9626 Tf 9.09 0 Td [(-)]TJ -232.932 -11.955 Td [(orthotope)-193([)]TJ
0 1 0 rg 0 1 0 RG
[(2)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-192(24)]TJ
0 g 0 G
[(],)-204(we)-193(carefully)-193(transform)-192(the)-193(coordinate)-193(sys-)]TJ 0 -11.955 Td [(tem)-292(to:)-395(1\))-292(set)-293(the)-292(origin)-292(to)-293(the)-292(current)-292(adv)15(ersarial)-293(e)15(xample)]TJ/F11 9.9626 Tf 0 -11.955 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F10 6.9738 Tf 0 -6.078 Td [(t)]TJ/F75 9.9626 Tf 4.58 2.463 Td [(,)-216(and)-207(2\))-207(adopt)-208(e)25(v)15(ery)-207(pix)15(el)-207(as)-207(an)-208(independent)-207(basis)-207(to)-207(b)20(uild)]TJ -10.274 -11.956 Td [(an)-233(orthonormal)-233(basis)-233(of)-233(the)]TJ/F66 9.9626 Tf 110.659 0 Td [(R)]TJ/F10 6.9738 Tf 7.195 3.616 Td [(N)]TJ/F75 9.9626 Tf 9.877 -3.616 Td [(space.)-304(Thus,)]TJ/F8 9.9626 Tf 52.419 0 Td [(\n)]TJ/F75 9.9626 Tf 9.516 0 Td [(becomes)-233(an)]TJ -189.666 -11.955 Td [(axis-aligned)-249(h)5(yperrectangle)-250(that)-249(includes)-250(the)-249(origin.)-310(Let)]TJ/F8 9.9626 Tf 225.738 0 Td [(\n)]TJ/F10 6.9738 Tf 7.195 -1.494 Td [(i)]TJ/F75 9.9626 Tf -232.933 -10.461 Td [(denote)-359(the)-358(corresponding)-359(range)-358(on)-359(the)]TJ/F11 9.9626 Tf 161.426 0 Td [(i)]TJ/F10 6.9738 Tf 3.433 3.615 Td [(th)]TJ/F75 9.9626 Tf 11.744 -3.615 Td [(axis)-359(of)-358(the)]TJ/F11 9.9626 Tf 47.239 0 Td [(N)]TJ/F75 9.9626 Tf 9.09 0 Td [(-)]TJ -232.932 -11.955 Td [(orthotope)]TJ/F8 9.9626 Tf 41.672 0 Td [(\n)]TJ/F75 9.9626 Tf 7.195 0 Td [(.)-610(T)80(o)-349(maintain)-350(radial)-350(symmetry)65(,)-375(we)-350(de\002ne)-350(the)]TJ -48.867 -11.955 Td [(scale)-354(v)15(ector)]TJ/F11 9.9626 Tf 51.713 0 Td [(b)]TJ/F75 9.9626 Tf 7.802 0 Td [(as)-354(a)-354(v)15(ector)-354(with)-353(the)]TJ/F11 9.9626 Tf 84.985 0 Td [(i)]TJ/F10 6.9738 Tf 3.432 3.615 Td [(th)]TJ/F75 9.9626 Tf 11.698 -3.615 Td [(element)]TJ/F11 9.9626 Tf 35.066 0 Td [(b)]TJ/F10 6.9738 Tf 4.276 -1.495 Td [(i)]TJ/F75 9.9626 Tf 6.843 1.495 Td [(indicat-)]TJ -205.815 -11.955 Td [(ing)-236(the)-236(adjustment)-236(range)-236(\(to)-236(increase)-236(and)-236(decrease)-236(the)-236(pix)15(el)]TJ 0 -11.956 Td [(v)25(alue\))-250(for)]TJ/F11 9.9626 Tf 41.245 0 Td [(i)]TJ/F10 6.9738 Tf 3.432 3.616 Td [(th)]TJ/F75 9.9626 Tf 10.663 -3.616 Td [(pix)15(el,)]TJ/F79 9.9626 Tf 24.757 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 317.842 246.701 Td [(b)]TJ/F41 5.9776 Tf 3.949 -0.996 Td [(i)]TJ/F87 8.9664 Tf 5.721 0.996 Td [(=)-285(\(\n)]TJ/F38 5.9776 Tf 19.967 4.308 Td [(+)]TJ/F41 5.9776 Tf 0 -6.305 Td [(i)]TJ/F88 8.9664 Tf 6.088 1.997 Td [(;)]TJ/F87 8.9664 Tf 4.096 0 Td [(\n)]TJ/F44 5.9776 Tf 6.655 4.308 Td [<00>]TJ/F41 5.9776 Tf 0 -6.305 Td [(i)]TJ/F87 8.9664 Tf 6.255 1.997 Td [(\))]TJ/F88 8.9664 Tf 3.583 0 Td [(=)]TJ/F87 8.9664 Tf 4.608 0 Td [(2)]TJ/F88 8.9664 Tf 4.608 0 Td [(;)]TJ/F87 8.9664 Tf 7.167 0 Td [(\n)]TJ/F38 5.9776 Tf 6.656 4.308 Td [(+)]TJ/F41 5.9776 Tf 0 -6.305 Td [(i)]TJ/F57 8.9664 Tf 8.648 1.997 Td [<11>]TJ/F87 8.9664 Tf 9.727 0 Td [(max\(\n)]TJ/F41 5.9776 Tf 27.39 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.162 0.996 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)]TJ/F87 8.9664 Tf 7.167 0 Td [(\n)]TJ/F44 5.9776 Tf 6.656 4.308 Td [<00>]TJ/F41 5.9776 Tf 0 -6.305 Td [(i)]TJ/F57 8.9664 Tf 8.814 1.997 Td [<11>-285<00>]TJ/F87 8.9664 Tf 18.431 0 Td [(min\(\n)]TJ/F41 5.9776 Tf 25.598 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.162 0.996 Td [(\))]TJ/F88 8.9664 Tf 3.584 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 246.701 Td [(\(8\))]TJ
ET
/S/Span<>BDC
BT
/F57 8.9664 Tf 370.835 205.841 Td [(P)]TJ/F87 8.9664 Tf 9.728 0 Td [(=)]TJ/F57 8.9664 Tf 9.727 0 Td [(f)]TJ/F88 8.9664 Tf 4.608 0 Td [(x)]TJ/F57 8.9664 Tf 7.783 0 Td [(2)]TJ/F66 8.9664 Tf 8.703 0 Td [(R)]TJ/F41 5.9776 Tf 6.476 4.307 Td [(N)]TJ/F87 8.9664 Tf 9.484 -4.307 Td [(:)]TJ/F41 5.9776 Tf 8.562 11.208 Td [(N)]TJ/F89 8.9664 Tf -3.442 -2.69 Td [(X)]TJ/F41 5.9776 Tf 0.702 -18.904 Td [(i)]TJ/F38 5.9776 Tf 2.664 0 Td [(=1)]TJ/F88 8.9664 Tf 12.676 16.185 Td [(x)]TJ/F38 5.9776 Tf 5.224 3.809 Td [(2)]TJ/F41 5.9776 Tf 0 -5.475 Td [(i)]TJ
ET
q
1 0 0 1 448.506 208.083 cm
[]0 d 0 J 0.379 w 0 0 m 9.374 0 l S
Q
BT
/F88 8.9664 Tf 449.143 199.76 Td [(b)]TJ/F38 5.9776 Tf 3.949 3.088 Td [(2)]TJ/F41 5.9776 Tf 0 -5.474 Td [(i)]TJ/F87 8.9664 Tf 8.544 8.467 Td [(=)-285(1)]TJ/F57 8.9664 Tf 14.335 0 Td [(g)]TJ/F88 8.9664 Tf 4.608 0 Td [(:)]TJ
ET
EMC
BT
/F75 8.9664 Tf 534.657 205.841 Td [(\(9\))]TJ/F75 9.9626 Tf -225.795 -24.432 Td [(As)-337(illustrated)-337(in)-337(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-337(2\(b\))]TJ
0 g 0 G
[(,)-359(we)-337(scale)-336(the)-337(unit)]TJ/F11 9.9626 Tf 193.408 0 Td [(N)]TJ/F14 9.9626 Tf 9.091 0 Td [<00>]TJ/F75 9.9626 Tf 7.749 0 Td [(sphere)]TJ -210.248 -11.955 Td [(into)-293(the)-292(h)5(yperellipsoid)]TJ/F14 9.9626 Tf 93.379 0 Td [(P)]TJ/F75 9.9626 Tf 7.748 0 Td [(.)-438(Equipped)-293(with)]TJ/F14 9.9626 Tf 68.586 0 Td [(P)]TJ/F75 9.9626 Tf 7.748 0 Td [(,)-303(the)-293(estimated)]TJ -177.461 -11.955 Td [(gradient)]TJ/F8 9.9626 Tf 36.777 0 Td [(^)]TJ/F11 9.9626 Tf -1.639 0 Td [(g)]TJ/F10 6.9738 Tf 4.752 -1.495 Td [(t)]TJ/F75 9.9626 Tf 5.998 1.495 Td [(can)-250(be)-250(formally)-250(written)-250(as)-250(follo)25(ws,)]TJ
ET
/S/Span<>BDC
BT
/F87 8.9664 Tf 318.022 128.843 Td [(^)]TJ/F88 8.9664 Tf -1.567 0 Td [(g)]TJ/F41 5.9776 Tf 4.394 -0.996 Td [(t)]TJ/F87 8.9664 Tf 5.908 0.996 Td [(=)]TJ 10.923 5.799 Td [(1)]TJ
ET
q
1 0 0 1 337.68 131.085 cm
[]0 d 0 J 0.379 w 0 0 m 4.608 0 l S
Q
BT
/F88 8.9664 Tf 337.764 122.762 Td [(q)]TJ/F41 5.9776 Tf 12.098 17.654 Td [(q)]TJ/F89 8.9664 Tf -4.843 -3.055 Td [(X)]TJ/F41 5.9776 Tf 0.702 -18.904 Td [(i)]TJ/F38 5.9776 Tf 2.664 0 Td [(=1)]TJ/F88 8.9664 Tf 12.677 16.194 Td [(L)]TJ/F41 5.9776 Tf 6.271 -1.062 Td [(adv)]TJ/F87 8.9664 Tf 12.323 1.062 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F87 8.9664 Tf 6.365 1.577 Td [(+)]TJ/F88 8.9664 Tf 9.215 0 Td [<0e>-38(u)]TJ/F41 5.9776 Tf 9.729 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.162 0.996 Td [(\))]TJ/F57 8.9664 Tf 5.631 0 Td [<00>]TJ/F88 8.9664 Tf 9.216 0 Td [(L)]TJ/F41 5.9776 Tf 6.27 -1.062 Td [(adv)]TJ/F87 8.9664 Tf 12.324 1.062 Td [(\()]TJ/F88 8.9664 Tf 3.583 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F57 8.9664 Tf 6.365 1.577 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [<0e>-38(u)]TJ/F41 5.9776 Tf 9.729 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.161 0.996 Td [(\))]TJ
ET
q
1 0 0 1 361.062 131.085 cm
[]0 d 0 J 0.379 w 0 0 m 130.174 0 l S
Q
BT
/F87 8.9664 Tf 421.632 122.762 Td [(2)]TJ/F88 8.9664 Tf 4.608 0 Td [<0e>]TJ 66.192 6.081 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.996 Td [(i)]TJ/F88 8.9664 Tf 3.161 0.996 Td [(;)-514(u)]TJ/F41 5.9776 Tf 12.471 -0.996 Td [(i)]TJ/F57 8.9664 Tf 5.721 0.996 Td [(2)-286(P)]TJ/F88 8.9664 Tf 15.871 0 Td [(:)]TJ
ET
EMC
BT
/F75 8.9664 Tf 530.174 110.349 Td [(\(10\))]TJ
0 g 0 G
ET
q
1 0 0 1 308.862 100.06 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 323.308 93.277 Td [(7)]TJ/F75 7.9701 Tf 3.487 -2.812 Td [(Recall)-322(that)-322(in)-322(Section)]TJ
1 0 0 rg 1 0 0 RG
[-322(2.3)]TJ
0 g 0 G
[(,)-340(the)-322(query)-323(spa)1(ce)-323(of)-322(query)-322(v)15(ector)]TJ/F43 7.9701 Tf 192.939 0 Td [(U)]TJ/F75 7.9701 Tf 8.648 0 Td [(is)-322(re-)]TJ -219.52 -9.465 Td [(quired)-250(to)-250(e)15(xhibit)-250(radio)-250(symmetry)65(.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
91 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/Sm7D3tELIf_3MxkynWtLRQ Do
Q
endstream
endobj
92 0 obj
<< /Font << /F10 248 0 R /F11 238 0 R /F13 250 0 R /F14 239 0 R /F38 241 0 R /F41 242 0 R /F43 252 0 R /F44 253 0 R /F57 228 0 R /F66 243 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R /F87 245 0 R /F88 246 0 R /F89 254 0 R >> /ProcSet [ /PDF /Text /ImageC ] /XObject << /Im2 256 0 R /Im3 257 0 R /Im4 258 0 R /Sm7D3tELIf_3MxkynWtLRQ 259 0 R >> >>
endobj
93 0 obj
<< /A << /D (subsection.A.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 202.412 573.933 217.963 584.847 ] /Subtype /Link /Type /Annot >>
endobj
94 0 obj
<< /A << /D (figure.caption.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 116.831 492.617 134.863 503.561 ] /Subtype /Link /Type /Annot >>
endobj
95 0 obj
<< /A << /D (Hfootnote.8) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 88.588 468.706 94.565 481.227 ] /Subtype /Link /Type /Annot >>
endobj
96 0 obj
<< /A << /D (subsection.A.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 264.893 288.195 281.55 299.139 ] /Subtype /Link /Type /Annot >>
endobj
97 0 obj
<< /A << /D (cite.madry2017towards) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 261.348 230.437 273.303 239.363 ] /Subtype /Link /Type /Annot >>
endobj
98 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 98.957 118.892 105.93 127.614 ] /Subtype /Link /Type /Annot >>
endobj
99 0 obj
<< /A << /D (cite.maheswaranathan2018guided) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 108.386 118.966 120.341 127.753 ] /Subtype /Link /Type /Annot >>
endobj
100 0 obj
<< /A << /D (equation.2.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 115.207 87.743 121.185 96.996 ] /Subtype /Link /Type /Annot >>
endobj
101 0 obj
<< /A << /D (equation.4.11) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 207.436 87.743 217.399 96.996 ] /Subtype /Link /Type /Annot >>
endobj
102 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 491.993 661.081 503.948 670.007 ] /Subtype /Link /Type /Annot >>
endobj
103 0 obj
<< /A << /D (definition.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 388.378 646.768 395.352 657.712 ] /Subtype /Link /Type /Annot >>
endobj
104 0 obj
<< /A << /D (cite.buss2004introduction) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 399.85 554.898 406.824 563.685 ] /Subtype /Link /Type /Annot >>
endobj
105 0 obj
<< /A << /D (subsection.A.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 500.013 552.741 516.671 563.685 ] /Subtype /Link /Type /Annot >>
endobj
106 0 obj
<< /A << /D (cite.zhu2017unpaired) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 528.345 542.463 540.3 551.389 ] /Subtype /Link /Type /Annot >>
endobj
107 0 obj
<< /A << /D (cite.bashkirova2019adversarial) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 386.363 518.692 393.337 527.479 ] /Subtype /Link /Type /Annot >>
endobj
108 0 obj
<< /A << /D (Hfootnote.9) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 316.279 492.291 322.256 505.145 ] /Subtype /Link /Type /Annot >>
endobj
109 0 obj
<< /A << /D (subsection.A.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 431.125 444.804 447.783 455.748 ] /Subtype /Link /Type /Annot >>
endobj
110 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 423.494 348.286 430.468 357.008 ] /Subtype /Link /Type /Annot >>
endobj
111 0 obj
<< /A << /D (cite.maheswaranathan2018guided) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 433.185 348.361 445.14 357.148 ] /Subtype /Link /Type /Annot >>
endobj
112 0 obj
<< /A << /D (Hfootnote.10) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 315.543 166.726 325.007 179.247 ] /Subtype /Link /Type /Annot >>
endobj
113 0 obj
<< /A << /D (equation.2.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 504.354 166.726 511.328 179.247 ] /Subtype /Link /Type /Annot >>
endobj
114 0 obj
<< /A << /D (equation.2.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 533.326 154.771 540.3 165.715 ] /Subtype /Link /Type /Annot >>
endobj
115 0 obj
<< /A << /D (equation.4.11) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 311.183 130.861 323.138 141.805 ] /Subtype /Link /Type /Annot >>
endobj
116 0 obj
<< /A << /D (ALC@unique.24) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 479.421 106.95 486.395 117.894 ] /Subtype /Link /Type /Annot >>
endobj
117 0 obj
<< /A << /D (appendix.C) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 536.807 86.893 544.116 98.614 ] /Subtype /Link /Type /Annot >>
endobj
118 0 obj
<< /A << /D (appendix.B) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 494.332 77.164 501.64 88.886 ] /Subtype /Link /Type /Annot >>
endobj
119 0 obj
<< /Length 25644 >>
stream
0 g 0 G
0 g 0 G
BT
/F75 9.9626 Tf 50.112 710.037 Td [(By)-403(the)-403(con)40(v)15(e)15(xity)-403(of)-403(the)-403(adv)15(ersarial)-403(limit,)]TJ/F8 9.9626 Tf 177.873 0 Td [(^)]TJ/F11 9.9626 Tf -1.639 0 Td [(g)]TJ/F10 6.9738 Tf 4.752 -1.494 Td [(t)]TJ/F75 9.9626 Tf 7.523 1.494 Td [(satis\002es)-403(the)]TJ -188.509 -11.955 Td [(adv)15(ersarial)-303(limit)-303(and)-302(maintains)-303(radial)-303(symmetry)-303(by)-303(adjust-)]TJ 0 -11.955 Td [(ing)-294(the)-295(range)-294(for)-294(increasing)-294(and)-295(decreasing)-294(the)-294(pix)15(el)-295(v)25(alue)]TJ 0 -11.955 Td [(simultaneously)65(.)-560(Moreo)15(v)15(er)40(,)-355(by)-333(adding)-334(the)-333(scale)-333(v)15(ector)40(,)-355(re-)]TJ 0 -11.955 Td [(stricted)-323(pix)15(els)-324(are)-323(ef)25(fecti)25(v)15(ely)-324(squeezed,)-341(and)-324(thus)-323(more)-324(ad-)]TJ 0 -11.956 Td [(justments)-250(can)-250(be)-250(f)10(acilitated)-250(for)-250(less)-250(restricted)-250(pix)15(els.)]TJ/F74 10.9589 Tf 0 -21.44 Td [(4.2.)-250(Gradient)-250(sliding)-250(mechanism)]TJ/F75 9.9626 Tf 11.955 -18.438 Td [(In)-252(addition)-252(to)-251(the)-252(direction)-252(of)-252(the)-252(estimated)-251(gradient,)-253(we)]TJ -11.955 -11.956 Td [(pro)15(v)15(e)-250(that)-250(the)-250(projection)-250(also)-250(shortens)-250(the)-250(gradient)-250(step.)]TJ
0 g 0 G
/F74 9.9626 Tf 0 -21.44 Td [(Pr)18(oposition)-483(2.)]TJ
0 g 0 G
/F79 9.9626 Tf 67.905 0 Td [(\(Pr)45(oof)-483(in)-484(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-483(A.2)]TJ
0 g 0 G
[(.\))-1010(The)-484(absolute)]TJ -67.905 -11.956 Td [(length)-335(of)-335(the)-336(pr)45(ojection)-335(r)37(esult)-335(is)-335(smaller)-335(than)-336(the)-335(original)]TJ 0 -11.955 Td [(estimated)-250(gr)15(adient)-250(vector)111(,)]TJ/F75 9.9626 Tf 105.553 0 Td [(i.e)]TJ/F79 9.9626 Tf 9.683 0 Td [(.,)]TJ/F14 9.9626 Tf 7.472 0 Td [(k)]TJ/F8 9.9626 Tf 4.982 0 Td [<0528>-34(^)]TJ/F11 9.9626 Tf 11.346 0 Td [(g)]TJ/F8 9.9626 Tf 5.109 0 Td [(\))]TJ/F14 9.9626 Tf 3.875 0 Td [(k)]TJ/F7 6.9738 Tf 4.981 -1.494 Td [(2)]TJ/F14 9.9626 Tf 7.237 1.494 Td [<14>-278(k)]TJ/F8 9.9626 Tf 15.838 0 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F14 9.9626 Tf 5.109 0 Td [(k)]TJ/F7 6.9738 Tf 4.982 -1.494 Td [(2)]TJ/F79 9.9626 Tf 4.469 1.494 Td [(.)]TJ/F75 9.9626 Tf -178.34 -21.441 Td [(Thus,)-263(we)-261(propose)-261(the)]TJ/F79 9.9626 Tf 88.166 0 Td [(gr)15(adient)-261(sliding)-260(mec)15(hanism)]TJ/F75 9.9626 Tf 113.207 0 Td [(to)-261(e)15(x-)]TJ -213.328 -11.955 Td [(pand)-351(each)-352(projected)-351(gradient)-352(step)-351(into)-351(a)-352(series)-351(of)-352(sliding-)]TJ 0 -11.955 Td [(steps)]TJ/F14 9.9626 Tf 23.262 0 Td [(f)]TJ/F11 9.9626 Tf 4.981 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.494 Td [(i)]TJ/F14 9.9626 Tf 3.317 1.494 Td [(g)]TJ/F10 6.9738 Tf 4.981 3.615 Td [(M)]TJ 0 -6.208 Td [(i)]TJ/F7 6.9738 Tf 2.819 0 Td [(=1)]TJ/F75 9.9626 Tf 10.585 2.593 Td [(,)-356(where)]TJ/F11 9.9626 Tf 33.715 0 Td [(M)]TJ/F75 9.9626 Tf 14.088 0 Td [(is)-335(the)-335(number)-335(of)-335(steps.)-565(As)-334(illus-)]TJ -102.418 -11.955 Td [(trated)-377(in)-377(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-377(2\(c\))]TJ
0 g 0 G
[(,)-409(instead)-377(of)-377(being)-377(trapped)-377(by)-377(the)-377(ad-)]TJ 0 -11.955 Td [(v)15(ersarial)-291(limit,)-302(the)-291(sliding-steps)-292(circumv)15(ent)-291(along)-291(the)-292(limit)]TJ 0 -11.956 Td [(boundary)65(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 39.472 3.616 Td [(8)]TJ
0 g 0 G
/F75 9.9626 Tf 9.691 -3.616 Td [(W)80(e)-338(carefully)-337(con\002gure)-338(the)-337(steps)-338(such)-337(that)-338(the)]TJ -49.163 -11.955 Td [(total)-235(length)-235(of)-236(these)-235(sliding-steps)-235(is)-235(approximately)-235(the)-236(orig-)]TJ 0 -11.955 Td [(inal)-330(gradient)-329(step)-330(length)-329(before)-330(projection)]TJ/F11 9.9626 Tf 174.093 0 Td [(l)]TJ/F14 9.9626 Tf 7.405 0 Td [<11>-425(k)]TJ/F11 9.9626 Tf 16.966 0 Td [<11>]TJ/F8 9.9626 Tf 5.645 0 Td [(^)]TJ/F11 9.9626 Tf -0.34 0 Td [(g)]TJ/F14 9.9626 Tf 5.109 0 Td [(k)]TJ/F7 6.9738 Tf 4.981 -1.494 Td [(2)]TJ/F75 9.9626 Tf 4.47 1.494 Td [(.)-549(At)]TJ -218.329 -11.955 Td [(step)]TJ/F11 9.9626 Tf 19.273 0 Td [(t)]TJ/F8 9.9626 Tf 6.354 0 Td [(+)-277(1)]TJ/F75 9.9626 Tf 15.486 0 Td [(,)-342(the)-323(gradient)-324(sliding)-323(mechanism)-324(starts)-323(from)-324(the)]TJ -41.113 -11.955 Td [(pre)25(vious)-197(adv)15(ersarial)-197(e)15(xample)]TJ/F11 9.9626 Tf 117.115 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F10 6.9738 Tf 0 -6.078 Td [(t)]TJ/F75 9.9626 Tf 6.545 2.463 Td [(and)-197(the)-197(ne)25(w)-198(adv)15(ersarial)-197(e)15(x-)]TJ -129.354 -11.955 Td [(ample)]TJ/F8 9.9626 Tf 27.767 0 Td [<0528>]TJ/F11 9.9626 Tf 11.347 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F10 6.9738 Tf 0 -6.078 Td [(t)]TJ/F8 9.9626 Tf 7.481 2.463 Td [(+)]TJ/F11 9.9626 Tf 10.65 0 Td [<11>]TJ/F8 9.9626 Tf 5.645 0 Td [(^)]TJ/F11 9.9626 Tf -0.34 0 Td [(g)]TJ/F8 9.9626 Tf 5.109 0 Td [(\))]TJ/F75 9.9626 Tf 7.293 0 Td [(and)-343(iterati)25(v)15(ely)-343(deri)25(v)15(e)-343(the)-344(ne)15(xt)-343(sliding-)]TJ -80.646 -11.956 Td [(steps)-250(from)-250(the)-250(pre)25(vious)-250(tw)10(o)-250(sliding-steps,)]TJ/F79 9.9626 Tf 168.177 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)]TJ
ET
/S/Span<>BDC
BT
/F11 9.9626 Tf 96.324 377.2 Td [(s)]TJ/F7 6.9738 Tf 4.67 -1.494 Td [(1)]TJ/F8 9.9626 Tf 7.237 1.494 Td [(=)]TJ/F11 9.9626 Tf 10.516 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 4.114 Td [<03>]TJ/F10 6.9738 Tf 0 -6.577 Td [(t)]TJ/F11 9.9626 Tf 4.58 2.463 Td [(;)-500(s)]TJ/F7 6.9738 Tf 12.418 -1.494 Td [(2)]TJ/F8 9.9626 Tf 7.237 1.494 Td [(=)-278<0528>]TJ/F11 9.9626 Tf 21.863 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 4.114 Td [<03>]TJ/F10 6.9738 Tf 0 -6.577 Td [(t)]TJ/F8 9.9626 Tf 6.794 2.463 Td [(+)]TJ/F11 9.9626 Tf 9.963 0 Td [<11>]TJ/F8 9.9626 Tf 5.645 0 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F8 9.9626 Tf 5.109 0 Td [(\))]TJ/F11 9.9626 Tf 3.875 0 Td [(;)]TJ -110.953 -25.636 Td [(l)]TJ/F10 6.9738 Tf 2.973 -1.494 Td [(i)]TJ/F8 9.9626 Tf 6.084 1.494 Td [(=)-278(max\(0)]TJ/F11 9.9626 Tf 37.913 0 Td [(;)-167(l)]TJ/F14 9.9626 Tf 9.811 0 Td [<00>]TJ/F10 6.9738 Tf 15.798 12.454 Td [(i)]TJ/F1 9.9626 Tf -5.786 -2.989 Td [(X)]TJ/F10 6.9738 Tf -0.05 -21.448 Td [(k)]TJ/F7 6.9738 Tf 4.404 0 Td [(=1)]TJ/F14 9.9626 Tf 10.087 11.983 Td [(k)]TJ/F11 9.9626 Tf 4.981 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.494 Td [(k)]TJ/F14 9.9626 Tf 7.116 1.494 Td [<00>]TJ/F11 9.9626 Tf 9.963 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.494 Td [(k)]TJ/F13 6.9738 Tf 4.403 0 Td [<00>]TJ/F7 6.9738 Tf 6.227 0 Td [(1)]TJ/F14 9.9626 Tf 4.469 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.982 -1.494 Td [(2)]TJ/F8 9.9626 Tf 4.469 1.494 Td [(\))]TJ/F11 9.9626 Tf 3.874 0 Td [(;)]TJ/F75 9.9626 Tf 32.382 0 Td [(\(11\))]TJ/F11 9.9626 Tf -173.44 -25.332 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.495 Td [(i)]TJ/F8 9.9626 Tf 6.084 1.495 Td [(=)-278<0528>]TJ/F11 9.9626 Tf 21.863 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.495 Td [(i)]TJ/F13 6.9738 Tf 2.818 0 Td [<00>]TJ/F7 6.9738 Tf 6.227 0 Td [(1)]TJ/F8 9.9626 Tf 6.683 1.495 Td [(+)]TJ/F11 9.9626 Tf 9.963 0 Td [(l)]TJ/F10 6.9738 Tf 2.972 -1.495 Td [(i)]TJ/F14 9.9626 Tf 5.531 1.495 Td [<01>]TJ/F8 9.9626 Tf 4.981 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.495 Td [(i)]TJ/F13 6.9738 Tf 2.819 0 Td [<00>]TJ/F7 6.9738 Tf 6.226 0 Td [(1)]TJ/F14 9.9626 Tf 6.683 1.495 Td [<00>]TJ/F11 9.9626 Tf 9.963 0 Td [(s)]TJ/F10 6.9738 Tf 4.67 -1.495 Td [(i)]TJ/F13 6.9738 Tf 2.819 0 Td [<00>]TJ/F7 6.9738 Tf 6.226 0 Td [(2)]TJ/F8 9.9626 Tf 4.47 1.495 Td [(\)\))]TJ/F11 9.9626 Tf 7.749 0 Td [(:)]TJ
ET
EMC
BT
/F75 9.9626 Tf 50.112 303.303 Td [(Note)-363(that)-364(we)-363(still)-363(adopt)-364(project)1(ion)-364(on)-363(the)-363(sliding-steps)-364(to)]TJ 0 -11.955 Td [(follo)25(w)-426(the)-425(adv)15(ersarial)-426(limits)-425(\(detailed)-426(in)-425(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-426(A.4)]TJ
0 g 0 G
[(\).)]TJ 0 -11.955 Td [(The)-319(sliding)-319(process)-319(ter)1(minates)-319(when)-319(the)-319(sum)-319(of)-319(trajectory)]TJ 0 -11.955 Td [(length)-261(e)15(xceeds)]TJ/F11 9.9626 Tf 61.48 0 Td [(l)]TJ/F75 9.9626 Tf 3.169 0 Td [(.)-342(Since)-260(the)-261(sliding-step)-260(doesn')18(t)-261(in)40(v)20(ok)10(e)-261(ne)25(w)]TJ -64.649 -11.955 Td [(queries)-380(to)-381(the)-381(threat)-380(model,)-413(adopting)-381(the)-380(gradient)-381(sliding)]TJ 0 -11.956 Td [(mechanism)-305(for)-305(the)-305(nullifying)-305(attack)-305(does)-305(not)-305(require)-305(addi-)]TJ 0 -11.955 Td [(tional)-250(queries)-250(compared)-250(with)-250(the)-250(con)40(v)15(entional)-250(PGD)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(20)]TJ
0 g 0 G
[(].)]TJ/F74 10.9589 Tf 0 -21.441 Td [(4.3.)-250(Selfguiding)-250(prior)]TJ/F75 9.9626 Tf 11.955 -18.438 Td [(Although)-470(we)-470(ha)20(v)15(e)-470(addressed)-470(the)-470(adv)15(ersarial)-470(limit)-470(by)]TJ -11.955 -11.955 Td [(querying)-214(from)-214(the)-214(limit-a)15(w)10(are)-214(h)5(yperellipsoid)-214(as)-215(wel)1(l)-215(as)-214(per)20(-)]TJ 0 -11.955 Td [(forming)-351(the)-351(gradient)-351(sliding)-351(mechanism,)-377(nullifying)-351(attack)]TJ 0 -11.955 Td [(is)-275(still)-276(dif)25(\002cult)-275(to)-275(be)-275(achie)25(v)15(ed)-276(without)-275(ef)25(fecti)25(v)15(e)-275(prior)-276(infor)20(-)]TJ 0 -11.955 Td [(mation)-352(due)-353(to)-352(the)-352(lar)18(ger)-352(search)-353(space,)]TJ/F79 9.9626 Tf 159.925 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-378(e)25(v)15(ery)-352(possible)]TJ -169.609 -11.955 Td [(modi\002cation)-288(of)-288(each)-288(pix)15(el)-289(on)-288(the)-288(entire)-288(image.)-425(While)-288(se)25(v-)]TJ 0 -11.956 Td [(eral)-196(studies)-197([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-196(21)]TJ
0 g 0 G
[(])-197(utilize)-196(a)-196(transfer)20(-based)-197(prior)-196(that)-197(requires)]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 109.608 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 64.558 102.742 Td [(8)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(While)-370(the)-371(gradient)-370(step)]TJ/F37 7.9701 Tf 79.986 0 Td [<0528>]TJ/F40 7.9701 Tf 9.636 0 Td [<11>]TJ/F37 7.9701 Tf 4.812 0 Td [(^)]TJ/F40 7.9701 Tf -0.276 0 Td [(g)]TJ/F41 5.9776 Tf 4.029 -0.996 Td [(t)]TJ/F37 7.9701 Tf 3.349 0.996 Td [(\))]TJ/F75 7.9701 Tf 6.246 0 Td [(is)-370(compressed)-371(from)-370(the)-371(estimated)]TJ -125.715 -9.464 Td [(gradient)]TJ/F40 7.9701 Tf 28.083 0 Td [<11>]TJ/F37 7.9701 Tf 4.812 0 Td [(^)]TJ/F40 7.9701 Tf -0.276 0 Td [(g)]TJ/F41 5.9776 Tf 4.029 -0.997 Td [(t)]TJ/F75 7.9701 Tf 5.314 0.997 Td [(in)-247(Eq.)-308(\()]TJ
1 0 0 rg 1 0 0 RG
[(5)]TJ
0 g 0 G
[(\),)-248(the)-246(sliding-steps)]TJ/F40 7.9701 Tf 88.698 0 Td [(s)]TJ/F41 5.9776 Tf 3.916 -1.216 Td [(i)]TJ/F75 7.9701 Tf 5.127 1.216 Td [(\(Eq.)-309(\()]TJ
1 0 0 rg 1 0 0 RG
[(11)]TJ
0 g 0 G
[(\)\))-246(e)15(xpand)-247(the)-247(gradient)]TJ -139.703 -9.465 Td [(step)-250(along)-250(the)-250(boundary)-250(to)-250(reco)15(v)15(er)-250(the)-250(full)-250(length)-250(of)]TJ/F40 7.9701 Tf 167.547 0 Td [<11>]TJ/F37 7.9701 Tf 4.811 0 Td [(^)]TJ/F40 7.9701 Tf -0.276 0 Td [(g)]TJ/F41 5.9776 Tf 4.03 -0.996 Td [(t)]TJ/F75 7.9701 Tf 3.348 0.996 Td [(.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
/F75 9.9626 Tf 79.29 629.037 Td [(a)-318(surrog)5(ate)-318(model)-317(trained)-318(on)-318(e)15(xtra)-318(datasets,)-334(it)-318(is)-318(computa-)]TJ 0 -11.955 Td [(tionally)-212(e)15(xpensi)25(v)15(e)-211(to)-212(prepare)-212(a)-211(surrog)5(ate)-212(model.)-297(In)-212(contrast,)]TJ 0 -11.955 Td [(by)-316(carefully)-317(in)40(v)15(estig)5(ating)-316(the)-316(nullifying)-317(process,)-333(Img2Img)]TJ 0 -11.955 Td [(GANs)-346(can)-346(be)-345(e)15(xploited)-346(as)-346(a)-346(self-guide)-345(because)-346(of)-346(the)-346(se-)]TJ 0 -11.955 Td [(mantic)-250(consistenc)15(y)-250(of)-250(the)-250(translation)-250(process)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(].)]TJ 11.955 -12.296 Td [(From)-329(De\002nition)]TJ
1 0 0 rg 1 0 0 RG
[-329(1)]TJ
0 g 0 G
[(,)-350(the)-329(gradient)-329(of)-329(the)-330(null)1(ifying)-330(attack)]TJ -11.955 -11.955 Td [(at)-250(the)]TJ/F11 9.9626 Tf 24.348 0 Td [(t)]TJ/F10 6.9738 Tf 3.598 3.615 Td [(th)]TJ/F75 9.9626 Tf 10.663 -3.615 Td [(step)-250(can)-250(be)-250(deri)25(v)15(ed)-250(as,)]TJ
ET
/S/Span<>BDC
BT
/F14 9.9626 Tf 357.749 615.367 Td [(r)]TJ/F11 9.9626 Tf 8.303 0 Td [(L)]TJ/F10 6.9738 Tf 6.78 -1.494 Td [(N)-107(ul)-6(l)]TJ/F8 9.9626 Tf 17.386 1.494 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 4.113 Td [<03>]TJ/F10 6.9738 Tf 0 -6.576 Td [(t)]TJ/F8 9.9626 Tf 4.58 2.463 Td [(\))-278(=)-277(2)]TJ/F112 9.9626 Tf 22.139 0 Td [(J)]TJ/F10 6.9738 Tf 5.922 4.113 Td [(T)]TJ/F8 9.9626 Tf 6.276 -4.113 Td [(\()]TJ/F66 9.9626 Tf 3.874 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 4.113 Td [<03>]TJ/F10 6.9738 Tf 0 -6.576 Td [(t)]TJ/F8 9.9626 Tf 4.58 2.463 Td [(\))]TJ/F14 9.9626 Tf 6.088 0 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F8 9.9626 Tf 4.47 1.494 Td [(\))]TJ/F11 9.9626 Tf 3.874 0 Td [(;)]TJ
ET
EMC
BT
/F75 9.9626 Tf 528.514 615.367 Td [(\(12\))]TJ -219.652 -23.607 Td [(where)-271(the)-270(Jacobian)-271(matrix)-271(transposed)]TJ/F112 9.9626 Tf 153.479 0 Td [(J)]TJ/F10 6.9738 Tf 5.922 3.615 Td [(T)]TJ/F75 9.9626 Tf 8.973 -3.615 Td [(is)-271(multiplied)-270(to)-271(a)]TJ/F79 9.9626 Tf -168.374 -11.956 Td [(discr)37(epancy)-292(vector)]TJ/F75 9.9626 Tf 75.571 0 Td [(,)]TJ/F79 9.9626 Tf 5.5 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.683 0 Td [(.,)-302(the)-292(dif)25(ference)-291(between)-292(the)-291(current)]TJ -90.754 -11.955 Td [(output)]TJ/F66 9.9626 Tf 27.587 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F10 6.9738 Tf 0 -6.079 Td [(t)]TJ/F8 9.9626 Tf 4.58 2.463 Td [(\))]TJ/F75 9.9626 Tf 5.997 0 Td [(and)-213(the)-213(input)-213(image)]TJ/F11 9.9626 Tf 79.882 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F75 9.9626 Tf 4.469 1.494 Td [(,)-220(the)-213(desired)-214(change)-213(for)]TJ -144.419 -11.955 Td [(the)-250(adv)15(ersarial)-250(output)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(4)]TJ
0 g 0 G
[(])-250(\(detailed)-250(in)-250(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-250(A.5)]TJ
0 g 0 G
[(\).)]TJ 11.955 -12.296 Td [(Due)-202(to)-202(the)-202(semantic)-202(consistenc)15(y)-202(of)-202(Img2Img)-202(GANs)-202([)]TJ
0 1 0 rg 0 1 0 RG
[(33)]TJ
0 g 0 G
[(],)]TJ -11.955 -11.955 Td [(perturbations)-442(to)-442(each)-442(input)-441(pix)15(el)-442(mostly)-442(af)25(fect)-442(the)-442(same)]TJ 0 -11.955 Td [(pix)15(el)-251(in)-252(the)-251(output)-251([)]TJ
0 1 0 rg 0 1 0 RG
[(2)]TJ
0 g 0 G
[(].)-314(Thus,)-252(the)-251(Jacobian)-251(matrix)]TJ/F112 9.9626 Tf 197.894 0 Td [(J)]TJ/F75 9.9626 Tf 8.426 0 Td [(is)-251(suf)25<022d>]TJ -206.32 -11.955 Td [(ciently)-227(diagonal)-227(and)-228(it)-227(is)-227(promising)-228(to)-227(approximate)]TJ/F112 9.9626 Tf 204.074 0 Td [(J)]TJ/F10 6.9738 Tf 5.922 3.615 Td [(T)]TJ/F75 9.9626 Tf 8.541 -3.615 Td [(with)]TJ/F112 9.9626 Tf -218.537 -11.955 Td [(J)]TJ/F75 9.9626 Tf 5.922 0 Td [(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 2.491 3.615 Td [(9)]TJ
0 g 0 G
/F75 9.9626 Tf 9.465 -3.615 Td [(Let)]TJ/F11 9.9626 Tf 16.567 0 Td [(a)]TJ/F75 9.9626 Tf 8.554 0 Td [(denote)-330(the)-330(discrepanc)15(y)-330(v)15(ector)]TJ/F66 9.9626 Tf 124.064 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.615 Td [<03>]TJ/F10 6.9738 Tf 0 -6.078 Td [(t)]TJ/F8 9.9626 Tf 4.581 2.463 Td [(\))]TJ/F14 9.9626 Tf 6.678 0 Td [<00>]TJ/F11 9.9626 Tf 10.553 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.495 Td [(0)]TJ/F75 9.9626 Tf 4.47 1.495 Td [(.)-550(W)80(e)]TJ -215.249 -11.956 Td [(estimate)-334(the)-335(gradient)-335(by)-334(right)-335(multiplying)-334(the)-335(discrepanc)15(y)]TJ 0 -11.955 Td [(v)15(ector)-211(to)-211(the)-210(Jacobian)-211(matrix)]TJ/F112 9.9626 Tf 116.042 0 Td [(J)]TJ/F11 9.9626 Tf 5.923 0 Td [(a)]TJ/F75 9.9626 Tf 5.266 0 Td [(.)-297(Ho)25(we)25(v)15(er)40(,)]TJ/F112 9.9626 Tf 45.584 0 Td [(J)]TJ/F11 9.9626 Tf 5.922 0 Td [(a)]TJ/F75 9.9626 Tf 7.366 0 Td [(is)-211(simply)-211(the)]TJ -186.103 -11.955 Td [(result)-337(of)-336(feeding)-337(the)-336(discrepanc)15(y)-337(v)15(ector)-337(into)-336(the)-337(Img2Img)]TJ 0 -11.955 Td [(GANs)-399(\(detailed)-399(in)-399(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-399(A.6)]TJ
0 g 0 G
[(\).)-757(W)80(e)-400(t)1(h)-1(us)-399(arri)25(v)15(ed)-399(at)-399(a)]TJ 0 -11.955 Td [(suitable)-250(self-guiding)-250(prior)]TJ/F11 9.9626 Tf 105.981 0 Td [(v)]TJ/F75 9.9626 Tf 5.187 0 Td [(,)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 323.378 410.826 Td [(v)]TJ/F57 8.9664 Tf 7.358 0 Td [<11>]TJ/F117 8.9664 Tf 9.727 0 Td [(J)]TJ/F88 8.9664 Tf 5.477 0 Td [(a)]TJ/F57 8.9664 Tf 7.442 0 Td [<19>]TJ 10.923 5.808 Td [(k)]TJ/F88 8.9664 Tf 4.608 0 Td [(a)]TJ/F57 8.9664 Tf 4.882 0 Td [(k)]TJ/F38 5.9776 Tf 4.607 -0.996 Td [(2)]TJ/F87 8.9664 Tf 4.151 0.996 Td [(\()]TJ/F66 8.9664 Tf 3.584 0 Td [(T)]TJ/F87 8.9664 Tf 5.978 0 Td [(\()]TJ/F88 8.9664 Tf 3.583 0 Td [(x)]TJ/F44 5.9776 Tf 5.224 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F87 8.9664 Tf 6.365 1.577 Td [(+)]TJ/F88 8.9664 Tf 9.215 0 Td [<0e>]TJ/F87 8.9664 Tf 4.563 0 Td [(^)]TJ/F88 8.9664 Tf -0.137 0 Td [(a)]TJ/F87 8.9664 Tf 4.882 0 Td [(\))]TJ/F57 8.9664 Tf 5.631 0 Td [<00>]TJ/F66 8.9664 Tf 9.216 0 Td [(T)]TJ/F87 8.9664 Tf 5.977 0 Td [(\()]TJ/F88 8.9664 Tf 3.584 0 Td [(x)]TJ/F44 5.9776 Tf 5.223 3.809 Td [<03>]TJ/F41 5.9776 Tf 0 -5.386 Td [(t)]TJ/F87 8.9664 Tf 4.318 1.577 Td [(\)\))]TJ
ET
q
1 0 0 1 364.305 413.068 cm
[]0 d 0 J 0.379 w 0 0 m 102.621 0 l S
Q
BT
/F88 8.9664 Tf 413.403 404.745 Td [<0e>]TJ 54.719 6.081 Td [(;)]TJ/F87 8.9664 Tf 7.304 0 Td [(^)]TJ/F88 8.9664 Tf -0.137 0 Td [(a)]TJ/F87 8.9664 Tf 7.442 0 Td [(=)]TJ/F88 8.9664 Tf 17.606 5.799 Td [(a)]TJ
ET
q
1 0 0 1 493.654 413.068 cm
[]0 d 0 J 0.379 w 0 0 m 18.248 0 l S
Q
BT
/F57 8.9664 Tf 493.654 404.745 Td [(k)]TJ/F88 8.9664 Tf 4.607 0 Td [(a)]TJ/F57 8.9664 Tf 4.882 0 Td [(k)]TJ/F38 5.9776 Tf 4.608 -0.997 Td [(2)]TJ/F88 8.9664 Tf 5.347 7.078 Td [(:)]TJ
ET
EMC
BT
/F75 8.9664 Tf 530.174 410.826 Td [(\(13\))]TJ/F75 9.9626 Tf -221.312 -25.603 Td [(W)40(ith)-297(the)-298(abo)15(v)15(e)-297(approximation,)-309(we)-297(signi\002cantly)-297(reduce)-298(the)]TJ 0 -11.956 Td [(time)-291(comple)15(xity)-292(from)-291(the)]TJ/F11 9.9626 Tf 105.546 0 Td [(O)]TJ/F8 9.9626 Tf 7.876 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(N)]TJ/F7 6.9738 Tf 9.091 3.616 Td [(2)]TJ/F8 9.9626 Tf 4.469 -3.616 Td [(\))]TJ/F75 9.9626 Tf 6.777 0 Td [(to)]TJ/F11 9.9626 Tf 10.653 0 Td [(O)]TJ/F8 9.9626 Tf 7.876 0 Td [(\(1\))]TJ/F75 9.9626 Tf 15.633 0 Td [(for)-291(the)-292(Jacobian)]TJ -171.796 -11.955 Td [(transposed)]TJ/F112 9.9626 Tf 44.553 0 Td [(J)]TJ/F10 6.9738 Tf 5.922 3.616 Td [(T)]TJ/F75 9.9626 Tf 8.219 -3.616 Td [(to)-195<026e64>-195(a)-195(self-guiding)-195(prior)-195(without)-195(e)15(xploiting)]TJ -58.694 -11.955 Td [(additional)-223(surrog)5(ate)-222(models)-223([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(,)]TJ
0 1 0 rg 0 1 0 RG
[-223(21)]TJ
0 g 0 G
[(],)-228(ef)25(fecti)25(v)15(ely)-223(boosting)-223(the)]TJ 0 -11.955 Td [(nullifying)-250(attack)-250(process.)]TJ/F74 10.9589 Tf 0 -20.947 Td [(4.4.)-250(Optimization)-250(strategy)]TJ/F75 9.9626 Tf 11.955 -18.273 Td [(Equipped)-251(with)-252(the)-251(limit-a)15(w)10(are)-251(RGF)80(,)-251(the)-251(gradient)-252(sliding)]TJ -11.955 -11.955 Td [(mechanism)-305(and)-304(the)-305(self-guiding)-305(prior)40(,)-318(we)-305(present)-305(the)-305<026e616c>]TJ 0 -11.956 Td [(optimization)-378(strate)15(gy)-379(of)]TJ/F79 9.9626 Tf 101.37 0 Td [(Limit-A)55(war)37(e)-378(Self-Guiding)-379(Gr)15(adi-)]TJ -101.37 -11.955 Td [(ent)-297(Sliding)-297(Attac)20(k)-297(\(L)1(a)-1(S-)1(GS)-1(A\))]TJ/F75 9.9626 Tf 118.251 0 Td [(.)-297(Our)-297(self-guiding)-297(prior)-296(is)-297(in-)]TJ -118.251 -11.955 Td [(te)15(grated)-246(into)-245(the)-246(RGF)-246(and)-246(the)-245(PGD)-246(frame)25(w)10(ork)-246(by)-246(querying)]TJ 0 -11.955 Td [(random)-250(v)15(ectors)]TJ/F11 9.9626 Tf 64.039 0 Td [(u)]TJ/F10 6.9738 Tf 5.703 -1.494 Td [(i)]TJ/F75 9.9626 Tf 5.808 1.494 Td [(biased)-250(to)25(w)10(ards)-250(the)-250(self-guiding)-250(prior)]TJ/F11 9.9626 Tf 148.79 0 Td [(v)]TJ/F75 9.9626 Tf 5.187 0 Td [(,)]TJ
ET
/S/Span<>BDC
BT
/F88 8.9664 Tf 318.865 216.927 Td [(u)]TJ/F41 5.9776 Tf 5.303 -0.996 Td [(i)]TJ/F87 8.9664 Tf 5.721 0.996 Td [(=)]TJ/F57 8.9664 Tf 9.728 8.079 Td [(p)]TJ
ET
q
1 0 0 1 347.296 225.195 cm
[]0 d 0 J 0.379 w 0 0 m 5.376 0 l S
Q
BT
/F88 8.9664 Tf 347.296 216.927 Td [<15>]TJ/F87 8.9664 Tf 5.727 0 Td [(^)]TJ/F88 8.9664 Tf -0.351 0 Td [(v)]TJ/F87 8.9664 Tf 6.846 0 Td [(+)]TJ/F57 8.9664 Tf 9.215 7.664 Td [(p)]TJ
ET
q
1 0 0 1 376.413 224.78 cm
[]0 d 0 J 0.379 w 0 0 m 21.247 0 l S
Q
BT
/F87 8.9664 Tf 376.413 216.927 Td [(1)]TJ/F57 8.9664 Tf 6.655 0 Td [<00>]TJ/F88 8.9664 Tf 9.215 0 Td [<15>]TJ/F87 8.9664 Tf 6.317 1.654 Td [(^)]TJ/F88 8.9664 Tf -0.941 -1.654 Td [(t)]TJ/F41 5.9776 Tf 3.328 -0.996 Td [(i)]TJ/F88 8.9664 Tf 3.162 0.996 Td [(;)-514(t)]TJ/F41 5.9776 Tf 10.495 -0.996 Td [(i)]TJ/F87 8.9664 Tf 5.722 0.996 Td [(=)-285(\()]TJ/F88 8.9664 Tf 13.311 0 Td [<18>]TJ/F41 5.9776 Tf 4.04 -0.996 Td [(i)]TJ/F57 8.9664 Tf 5.21 0.996 Td [<00>]TJ/F87 8.9664 Tf 9.215 0 Td [(\()-39(^)]TJ/F88 8.9664 Tf 3.584 0 Td [(v)]TJ/F57 8.9664 Tf 6.846 0 Td [<01>]TJ/F88 8.9664 Tf 4.607 0 Td [<18>]TJ/F41 5.9776 Tf 4.041 -0.996 Td [(i)]TJ/F87 8.9664 Tf 3.161 0.996 Td [(\))-39(^)]TJ/F88 8.9664 Tf 3.584 0 Td [(v)]TJ/F87 8.9664 Tf 4.798 0 Td [(\))]TJ/F88 8.9664 Tf 5.12 0 Td [(;)-171<18>]TJ/F41 5.9776 Tf 8.136 -0.996 Td [(i)]TJ/F57 8.9664 Tf 5.721 0.996 Td [(2)-286(P)]TJ/F88 8.9664 Tf 15.871 0 Td [(;)]TJ
ET
EMC
BT
/F75 8.9664 Tf 530.174 216.927 Td [(\(14\))]TJ/F75 9.9626 Tf -221.312 -21.445 Td [(where)]TJ/F8 9.9626 Tf 28.531 1.838 Td [(^)]TJ/F11 9.9626 Tf -0.966 -1.838 Td [(t)]TJ/F10 6.9738 Tf 3.597 -1.495 Td [(i)]TJ/F8 9.9626 Tf 7.446 1.495 Td [(=)]TJ/F10 6.9738 Tf 19.1 4.084 Td [(t)]TJ/F9 4.9813 Tf 3.009 -0.996 Td [(i)]TJ
ET
q
1 0 0 1 360.544 197.972 cm
[]0 d 0 J 0.398 w 0 0 m 18.218 0 l S
Q
BT
/F13 6.9738 Tf 360.544 192.046 Td [(k)]TJ/F10 6.9738 Tf 4.082 0 Td [(t)]TJ/F9 4.9813 Tf 3.009 -0.996 Td [(i)]TJ/F13 6.9738 Tf 3.156 0.996 Td [(k)]TJ/F6 4.9813 Tf 4.082 -0.996 Td [(2)]TJ/F75 9.9626 Tf 5.084 4.432 Td [(,)]TJ/F8 9.9626 Tf 6.28 0 Td [(^)]TJ/F11 9.9626 Tf -0.379 0 Td [(v)]TJ/F14 9.9626 Tf 9.316 0 Td [<11>]TJ/F8 9.9626 Tf 11.878 0 Td [<0528>]TJ/F10 6.9738 Tf 16.623 3.922 Td [(v)]TJ
ET
q
1 0 0 1 419.593 197.972 cm
[]0 d 0 J 0.398 w 0 0 m 12.399 0 l S
Q
BT
/F13 6.9738 Tf 419.593 192.046 Td [(k)]TJ/F10 6.9738 Tf 4.082 0 Td [(v)]TJ/F13 6.9738 Tf 4.236 0 Td [(k)]TJ/F8 9.9626 Tf 5.277 3.436 Td [(\))]TJ/F75 9.9626 Tf 7.101 0 Td [(is)-324(the)-324(projected)-323(prior)40(,)-343(and)]TJ/F11 9.9626 Tf -131.427 -13.647 Td [<15>]TJ/F14 9.9626 Tf 8.579 0 Td [(2)]TJ/F8 9.9626 Tf 9.409 0 Td [([0)]TJ/F11 9.9626 Tf 7.749 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(1])]TJ/F75 9.9626 Tf 10.058 0 Td [(controls)-232(the)-232(bias)-232(of)-232(the)-231(query)]TJ/F11 9.9626 Tf 117.342 0 Td [(u)]TJ/F10 6.9738 Tf 5.703 -1.495 Td [(i)]TJ/F75 9.9626 Tf 5.628 1.495 Td [(to)25(w)10(ards)-232(the)-232(prior)]TJ/F8 9.9626 Tf -168.517 -11.956 Td [(^)]TJ/F11 9.9626 Tf -0.379 0 Td [(v)]TJ/F75 9.9626 Tf 5.186 0 Td [(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 2.491 3.616 Td [(10)]TJ
0 g 0 G
/F75 9.9626 Tf 12.923 -3.616 Td [(Each)-329(query)-329(v)15(ector)]TJ/F11 9.9626 Tf 77.182 0 Td [(u)]TJ/F10 6.9738 Tf 5.703 -1.494 Td [(i)]TJ/F75 9.9626 Tf 6.595 1.494 Td [(is)-329(plugged)-329(into)-329(Eq.)-547(\()]TJ
1 0 0 rg 1 0 0 RG
[(5)]TJ
0 g 0 G
[(\))-329(to)-329(esti-)]TJ -110.08 -11.955 Td [(mate)-277(the)-277(gradient)-277(and)-277(conduct)-277(the)-277(PGD)-277(process)-277(in)-277(Eq.)-392(\()]TJ
1 0 0 rg 1 0 0 RG
[(4)]TJ
0 g 0 G
[(\).)]TJ 0 -11.955 Td [(After)-246(each)-247(gradient)-246(step,)-247(we)-247(perform)-246(the)-247(sliding-step)-246(in)-247(Eq.)]TJ 0 -11.955 Td [(\()]TJ
1 0 0 rg 1 0 0 RG
[(11)]TJ
0 g 0 G
[(\).)-593(Utilizing)-345(the)-344(three)-344(techniques,)-368(LaS-GSA)-345(ef)25(fecti)25(v)15(ely)]TJ 0 -11.955 Td [(and)-279(ef)25(\002ciently)-279(nulli\002es)-279(the)-279(tar)18(geted)-279(Img2Img)-280(GAN)-279(model.)]TJ 0 -11.955 Td [(The)-250(pseudocode)-250(is)-250(presented)-250(in)-250(Algorithm)]TJ
1 0 0 rg 1 0 0 RG
[-250(1)]TJ
0 g 0 G
[(.)]TJ
0 g 0 G
ET
q
1 0 0 1 308.862 100.408 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 323.308 93.542 Td [(9)]TJ/F75 7.9701 Tf 3.487 -2.813 Td [(The)-223(diagonality)-223(of)-223(the)-223(Jacobian)-223(matrix)]TJ/F115 7.9701 Tf 123.997 0 Td [(J)]TJ/F75 7.9701 Tf 6.809 0 Td [(is)-223(e)25(v)25(aluated)-223(in)-223(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-223(C)]TJ
0 g 0 G
[(.)]TJ/F75 5.9776 Tf -137.282 -6.916 Td [(10)]TJ/F75 7.9701 Tf 6.476 -2.813 Td [(The)-250(optimal)]TJ/F40 7.9701 Tf 40.735 0 Td [<15>]TJ/F75 7.9701 Tf 6.932 0 Td [(is)-250(e)15(xplained)-250(and)-250(deri)25(v)15(ed)-250(in)-250(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-250(B)]TJ
0 g 0 G
[(.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
120 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/kqxclRbRMltyQV9hkUwjZQ Do
Q
endstream
endobj
121 0 obj
<< /Font << /F1 260 0 R /F10 248 0 R /F11 238 0 R /F112 261 0 R /F115 262 0 R /F117 263 0 R /F13 250 0 R /F14 239 0 R /F37 240 0 R /F38 241 0 R /F40 251 0 R /F41 242 0 R /F44 253 0 R /F57 228 0 R /F6 264 0 R /F66 243 0 R /F7 244 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R /F87 245 0 R /F88 246 0 R /F9 265 0 R >> /ProcSet [ /PDF /Text ] /XObject << /kqxclRbRMltyQV9hkUwjZQ 266 0 R >> >>
endobj
122 0 obj
<< /A << /D (equation.4.8) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 175.523 568.857 182.496 579.925 ] /Subtype /Link /Type /Annot >>
endobj
123 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 230.879 558.984 237.853 567.707 ] /Subtype /Link /Type /Annot >>
endobj
124 0 obj
<< /A << /D (cite.liu2017unsupervised) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 215.892 175.506 227.847 184.432 ] /Subtype /Link /Type /Annot >>
endobj
125 0 obj
<< /A << /D (cite.karras2017progressive) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 83.907 139.705 95.862 148.567 ] /Subtype /Link /Type /Annot >>
endobj
126 0 obj
<< /A << /D (cite.taori2019targeted) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 418.054 708.822 430.009 717.828 ] /Subtype /Link /Type /Annot >>
endobj
127 0 obj
<< /A << /D (Hfootnote.11) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 405.528 696.971 414.993 707.45 ] /Subtype /Link /Type /Annot >>
endobj
128 0 obj
<< /A << /D (cite.ilyas2018prior) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 460.178 664.285 472.134 673.072 ] /Subtype /Link /Type /Annot >>
endobj
129 0 obj
<< /A << /D (cite.andriushchenko2020square) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 341.066 640.374 348.04 649.161 ] /Subtype /Link /Type /Annot >>
endobj
130 0 obj
<< /A << /D (cite.nesterov2017random) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 411.812 628.419 423.767 637.206 ] /Subtype /Link /Type /Annot >>
endobj
131 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 507.428 616.389 514.401 625.112 ] /Subtype /Link /Type /Annot >>
endobj
132 0 obj
<< /A << /D (Hfootnote.12) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 375.727 578.442 385.192 590.963 ] /Subtype /Link /Type /Annot >>
endobj
133 0 obj
<< /A << /D (cite.yeh2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 477.972 420.154 489.927 429.08 ] /Subtype /Link /Type /Annot >>
endobj
134 0 obj
<< /A << /D (Hfootnote.13) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 396.97 394.614 406.434 406.747 ] /Subtype /Link /Type /Annot >>
endobj
135 0 obj
<< /A << /D (table.caption.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 344.861 308.57 351.835 319.513 ] /Subtype /Link /Type /Annot >>
endobj
136 0 obj
<< /A << /D (appendix.E) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 393.743 106.086 400.605 116.354 ] /Subtype /Link /Type /Annot >>
endobj
137 0 obj
<< /A << /D (cite.yeh2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 516.978 79.892 526.941 87.432 ] /Subtype /Link /Type /Annot >>
endobj
138 0 obj
<< /Length 28423 >>
stream
0 g 0 G
0 g 0 G
q
1 0 0 1 50.112 719.601 cm
[]0 d 0 J 0.797 w 0 0 m 236.25 0 l S
Q
0 g 0 G
BT
/F74 9.9626 Tf 50.112 710.346 Td [(Algorithm)-408(1)]TJ/F75 9.9626 Tf 57.384 0 Td [(Limit-A)92(w)10(are)-408(Self-Guiding)-408(Gradient)-408(Sliding)]TJ -57.384 -11.955 Td [(Attack)-250(\(LaS-GSA\))]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 694.431 cm
[]0 d 0 J 0.398 w 0 0 m 236.25 0 l S
Q
0 g 0 G
0 g 0 G
BT
/F74 9.9626 Tf 50.112 683.383 Td [(Requir)18(e:)]TJ
0 g 0 G
/F75 9.9626 Tf 42.43 0 Td [(The)-236(translation)-236(model)]TJ/F66 9.9626 Tf 89.52 0 Td [(T)]TJ/F75 9.9626 Tf 6.642 0 Td [(,)-239(input)-236(image)]TJ/F11 9.9626 Tf 54.409 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.495 Td [(0)]TJ/F75 9.9626 Tf 4.47 1.495 Td [(,)-239(projec-)]TJ -186.229 -11.956 Td [(tion)-231(operation)]TJ/F8 9.9626 Tf 57.732 0 Td [<05>]TJ/F75 9.9626 Tf 7.472 0 Td [(,)-235(sampling)-231(v)25(ariance)]TJ/F11 9.9626 Tf 79.458 0 Td [<0e>]TJ/F75 9.9626 Tf 4.805 0 Td [(,)-235(query)-231(number)]TJ/F11 9.9626 Tf 62.551 0 Td [(q)]TJ/F75 9.9626 Tf 4.805 0 Td [(,)]TJ -216.823 -11.955 Td [(iteration)-324(number)]TJ/F11 9.9626 Tf 70.097 0 Td [(e)]TJ/F75 9.9626 Tf 4.639 0 Td [(,)-342(sliding-step)-324(number)]TJ/F11 9.9626 Tf 89.289 0 Td [(M)]TJ/F75 9.9626 Tf 10.751 0 Td [(,)-343(the)-324(learn-)]TJ -174.776 -11.955 Td [(ing)-250(rate)]TJ/F11 9.9626 Tf 32.648 0 Td [<11>]TJ/F75 9.9626 Tf 5.304 0 Td [(.)]TJ
0 g 0 G
/F74 9.9626 Tf -54.888 -11.955 Td [(Ensur)18(e:)]TJ
0 g 0 G
/F75 9.9626 Tf 38.565 0 Td [(The)-250(adv)15(ersarial)-250(e)15(xample)]TJ/F11 9.9626 Tf 100.124 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.615 Td [<03>]TJ
0 g 0 G
/F75 7.9701 Tf -138.628 -15.57 Td [(1:)]TJ
0 g 0 G
/F11 9.9626 Tf 11.182 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F14 9.9626 Tf 7.348 -3.615 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.495 Td [(0)]TJ
0 g 0 G
/F75 7.9701 Tf -42.648 -10.461 Td [(2:)]TJ
0 g 0 G
/F74 9.9626 Tf 11.182 0 Td [(f)25(or)]TJ/F11 9.9626 Tf 14.964 0 Td [(i)]TJ/F8 9.9626 Tf 6.2 0 Td [(=)-278(1)]TJ/F75 9.9626 Tf 17.988 0 Td [(to)]TJ/F11 9.9626 Tf 10.241 0 Td [(e)]TJ/F74 9.9626 Tf 7.13 0 Td [(do)]TJ
0 g 0 G
/F75 7.9701 Tf -67.705 -11.955 Td [(3:)]TJ
0 g 0 G
/F8 9.9626 Tf 21.287 0 Td [(^)]TJ/F11 9.9626 Tf -0.142 0 Td [(a)]TJ/F14 9.9626 Tf 8.033 0 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [<0528>]TJ/F10 6.9738 Tf 16.624 3.923 Td [(a)]TJ
ET
q
1 0 0 1 110.316 602.187 cm
[]0 d 0 J 0.398 w 0 0 m 12.485 0 l S
Q
BT
/F13 6.9738 Tf 110.316 596.261 Td [(k)]TJ/F10 6.9738 Tf 4.082 0 Td [(a)]TJ/F13 6.9738 Tf 4.322 0 Td [(k)]TJ/F8 9.9626 Tf 5.277 3.435 Td [(\))]TJ/F75 9.9626 Tf 3.875 0 Td [(,)]TJ/F11 9.9626 Tf 4.981 0 Td [(a)]TJ/F8 9.9626 Tf 8.033 0 Td [(=)]TJ/F66 9.9626 Tf 10.516 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.616 Td [<03>]TJ/F8 9.9626 Tf 4.581 -3.616 Td [(\))]TJ/F14 9.9626 Tf 6.088 0 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F11 9.9626 Tf 4.47 1.494 Td [(;)]TJ/F8 9.9626 Tf 4.768 0 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F14 9.9626 Tf 7.877 0 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [(0)]TJ/F75 9.9626 Tf 4.981 0 Td [(,)]TJ
0 g 0 G
/F75 7.9701 Tf -172.556 -14.592 Td [(4:)]TJ
0 g 0 G
/F8 9.9626 Tf 21.524 0 Td [(^)]TJ/F11 9.9626 Tf -0.379 0 Td [(v)]TJ/F14 9.9626 Tf 7.954 0 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [<0528>]TJ/F10 6.9738 Tf 16.624 3.923 Td [(v)]TJ
ET
q
1 0 0 1 110.237 587.595 cm
[]0 d 0 J 0.398 w 0 0 m 12.399 0 l S
Q
BT
/F13 6.9738 Tf 110.237 581.669 Td [(k)]TJ/F10 6.9738 Tf 4.082 0 Td [(v)]TJ/F13 6.9738 Tf 4.235 0 Td [(k)]TJ/F8 9.9626 Tf 5.277 3.435 Td [(\))]TJ/F11 9.9626 Tf 3.875 0 Td [(;)-167(v)]TJ/F8 9.9626 Tf 12.382 0 Td [(=)]TJ/F7 6.9738 Tf 11.711 3.923 Td [(1)]TJ
ET
q
1 0 0 1 151.799 587.595 cm
[]0 d 0 J 0.398 w 0 0 m 3.971 0 l S
Q
BT
/F10 6.9738 Tf 151.848 581.669 Td [<0e>]TJ/F8 9.9626 Tf 6.778 3.435 Td [(\()]TJ/F66 9.9626 Tf 3.875 0 Td [(T)]TJ/F8 9.9626 Tf 6.641 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F8 9.9626 Tf 6.794 -3.616 Td [(+)]TJ/F11 9.9626 Tf 9.962 0 Td [<0e>]TJ/F14 9.9626 Tf 7.019 0 Td [<01>]TJ/F8 9.9626 Tf 5.124 0 Td [(^)]TJ/F11 9.9626 Tf -0.143 0 Td [(a)]TJ/F8 9.9626 Tf 5.266 0 Td [(\))]TJ/F14 9.9626 Tf 6.089 0 Td [<00>]TJ/F66 9.9626 Tf 9.962 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F8 9.9626 Tf 4.58 -3.616 Td [(\)\))]TJ
0 g 0 G
/F75 7.9701 Tf -193.708 -13.094 Td [(5:)]TJ
0 g 0 G
/F75 9.9626 Tf 21.145 0 Td [(Find)]TJ/F11 9.9626 Tf 20.762 0 Td [(b)]TJ/F75 9.9626 Tf 6.766 0 Td [(according)-250(to)-250(Eq.)-310(\()]TJ
1 0 0 rg 1 0 0 RG
[(8)]TJ
0 g 0 G
[(\))]TJ
0 g 0 G
/F75 7.9701 Tf -48.673 -11.955 Td [(6:)]TJ
0 g 0 G
/F75 9.9626 Tf 21.145 0 Td [(Estimate)]TJ/F11 9.9626 Tf 37.359 0 Td [<15>]TJ/F13 6.9738 Tf 5.812 3.616 Td [<03>]TJ/F75 9.9626 Tf 7.071 -3.616 Td [(with)]TJ/F66 9.9626 Tf 20.204 0 Td [(T)]TJ/F75 9.9626 Tf 6.641 0 Td [(,)]TJ/F8 9.9626 Tf 5.361 0 Td [(^)]TJ/F11 9.9626 Tf -0.379 0 Td [(v)]TJ/F75 9.9626 Tf 5.186 0 Td [(,)]TJ/F11 9.9626 Tf 4.982 0 Td [(q)]TJ/F75 9.9626 Tf 7.295 0 Td [(according)-250(to)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(])]TJ
0 g 0 G
/F75 7.9701 Tf -120.677 -11.955 Td [(7:)]TJ
0 g 0 G
/F74 9.9626 Tf 21.145 0 Td [(f)25(or)]TJ/F11 9.9626 Tf 14.964 0 Td [(j)]TJ/F8 9.9626 Tf 7.44 0 Td [(=)-278(1)]TJ/F75 9.9626 Tf 17.988 0 Td [(to)]TJ/F11 9.9626 Tf 10.242 0 Td [(q)]TJ/F74 9.9626 Tf 7.295 0 Td [(do)]TJ
0 g 0 G
/F75 7.9701 Tf -79.074 -11.955 Td [(8:)]TJ
0 g 0 G
/F75 9.9626 Tf 31.108 0 Td [(Uniform)-250(sample)]TJ/F11 9.9626 Tf 67.516 0 Td [(r)]TJ/F10 6.9738 Tf 4.494 -1.494 Td [(j)]TJ/F75 9.9626 Tf 6.689 1.494 Td [(from)-250(the)-250(unit)]TJ/F11 9.9626 Tf 54.515 0 Td [(N)]TJ/F75 9.9626 Tf 9.091 0 Td [(-sphere)]TJ/F14 9.9626 Tf 31.81 0 Td [(U)]TJ/F75 9.9626 Tf 7.224 0 Td [(;)]TJ
0 g 0 G
/F75 7.9701 Tf -212.447 -11.955 Td [(9:)]TJ
0 g 0 G
/F11 9.9626 Tf 31.108 0 Td [<18>]TJ/F10 6.9738 Tf 4.358 -1.495 Td [(j)]TJ/F8 9.9626 Tf 6.966 1.495 Td [(=)]TJ/F11 9.9626 Tf 10.516 0 Td [(b)]TJ/F14 9.9626 Tf 6.489 0 Td [<0e>]TJ/F11 9.9626 Tf 7.195 0 Td [(r)]TJ/F10 6.9738 Tf 4.495 -1.495 Td [(j)]TJ
0 g 0 G
/F75 7.9701 Tf -75.112 -10.46 Td [(10:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(t)]TJ/F10 6.9738 Tf 3.597 -1.495 Td [(j)]TJ/F14 9.9626 Tf 6.965 1.495 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [<18>]TJ/F10 6.9738 Tf 4.359 -1.495 Td [(j)]TJ/F14 9.9626 Tf 6.412 1.495 Td [<00>]TJ/F8 9.9626 Tf 9.962 0 Td [(\()-38(^)]TJ/F11 9.9626 Tf 3.875 0 Td [(v)]TJ/F14 9.9626 Tf 7.4 0 Td [<01>]TJ/F11 9.9626 Tf 4.981 0 Td [<18>]TJ/F10 6.9738 Tf 4.359 -1.495 Td [(j)]TJ/F8 9.9626 Tf 4.198 1.495 Td [(\))-38(^)]TJ/F11 9.9626 Tf 3.874 0 Td [(v)]TJ
0 g 0 G
/F75 7.9701 Tf -107.805 -13.134 Td [(11:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(u)]TJ/F10 6.9738 Tf 5.703 -1.495 Td [(j)]TJ/F8 9.9626 Tf 6.965 1.495 Td [(=)]TJ/F14 9.9626 Tf 10.516 8.49 Td [(p)]TJ
ET
q
1 0 0 1 118.46 507.79 cm
[]0 d 0 J 0.398 w 0 0 m 10.392 0 l S
Q
BT
/F11 9.9626 Tf 118.46 499.101 Td [<15>]TJ/F13 6.9738 Tf 5.812 2.878 Td [<03>]TJ/F8 9.9626 Tf 4.959 -2.878 Td [(^)]TJ/F11 9.9626 Tf -0.379 0 Td [(v)]TJ/F8 9.9626 Tf 7.4 0 Td [(+)]TJ/F14 9.9626 Tf 9.963 8.075 Td [(p)]TJ
ET
q
1 0 0 1 154.517 507.375 cm
[]0 d 0 J 0.398 w 0 0 m 27.549 0 l S
Q
BT
/F8 9.9626 Tf 154.517 499.101 Td [(1)]TJ/F14 9.9626 Tf 7.195 0 Td [<00>]TJ/F11 9.9626 Tf 9.963 0 Td [<15>]TJ/F13 6.9738 Tf 5.812 2.878 Td [<03>]TJ/F11 9.9626 Tf 4.58 -2.878 Td [(t)]TJ/F10 6.9738 Tf 3.597 -1.495 Td [(j)]TJ
0 g 0 G
/F75 7.9701 Tf -133.783 -10.461 Td [(12:)]TJ
0 g 0 G
/F8 9.9626 Tf 35.433 0 Td [(^)]TJ/F11 9.9626 Tf -0.34 0 Td [(g)]TJ/F14 9.9626 Tf 7.876 0 Td [( )]TJ/F8 9.9626 Tf 13.071 0 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F8 9.9626 Tf 7.323 0 Td [(+)]TJ/F7 6.9738 Tf 11.159 3.923 Td [(1)]TJ
ET
q
1 0 0 1 126.062 489.636 cm
[]0 d 0 J 0.398 w 0 0 m 3.971 0 l S
Q
BT
/F10 6.9738 Tf 126.11 483.71 Td [<0e>]TJ/F1 9.9626 Tf 6.779 11.505 Td [<00>]TJ/F8 9.9626 Tf 4.566 -8.07 Td [(\()]TJ/F66 9.9626 Tf 3.874 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.616 Td [<03>]TJ/F8 9.9626 Tf 6.794 -3.616 Td [(+)]TJ/F11 9.9626 Tf 9.963 0 Td [<0e>-38(u)]TJ/F10 6.9738 Tf 10.508 -1.494 Td [(j)]TJ/F8 9.9626 Tf 4.198 1.494 Td [(\))]TJ/F14 9.9626 Tf 6.088 0 Td [<00>]TJ/F11 9.9626 Tf 9.963 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F8 9.9626 Tf 4.469 1.494 Td [(\))]TJ/F7 6.9738 Tf 3.874 3.616 Td [(2)]TJ/F14 9.9626 Tf 6.684 -3.616 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(a)]TJ/F7 6.9738 Tf 5.266 3.616 Td [(2)]TJ/F1 9.9626 Tf 4.47 4.454 Td [<01>]TJ
0 g 0 G
/F75 7.9701 Tf -193.591 -20.025 Td [(13:)]TJ
0 g 0 G
/F11 9.9626 Tf 25.13 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(pre)25(v)]TJ/F14 9.9626 Tf 15.484 1.494 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(x)]TJ/F13 6.9738 Tf 5.693 3.616 Td [<03>]TJ/F75 9.9626 Tf 4.58 -3.616 Td [(,)]TJ/F11 9.9626 Tf 4.982 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(curr)]TJ/F14 9.9626 Tf 14.493 1.494 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [<0528>]TJ/F11 9.9626 Tf 11.346 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.616 Td [<03>]TJ/F8 9.9626 Tf 6.794 -3.616 Td [(+)]TJ/F11 9.9626 Tf 9.963 0 Td [<11>]TJ/F14 9.9626 Tf 7.518 0 Td [<01>]TJ/F7 6.9738 Tf 6.177 3.923 Td [(1)]TJ
ET
q
1 0 0 1 206.583 477.681 cm
[]0 d 0 J 0.398 w 0 0 m 3.971 0 l S
Q
BT
/F10 6.9738 Tf 206.617 471.755 Td [(q)]TJ/F8 9.9626 Tf 5.473 3.435 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F8 9.9626 Tf 5.11 0 Td [(\))]TJ/F75 9.9626 Tf 3.874 0 Td [(,)]TJ
0 g 0 G
/F75 7.9701 Tf -168.852 -14.204 Td [(14:)]TJ
0 g 0 G
/F11 9.9626 Tf 25.13 0 Td [(l)]TJ/F14 9.9626 Tf 5.936 0 Td [( )-278(k)]TJ/F11 9.9626 Tf 17.711 0 Td [<11>]TJ/F14 9.9626 Tf 7.518 0 Td [<01>]TJ/F7 6.9738 Tf 6.177 3.922 Td [(1)]TJ
ET
q
1 0 0 1 114.353 463.476 cm
[]0 d 0 J 0.398 w 0 0 m 3.971 0 l S
Q
BT
/F10 6.9738 Tf 114.388 457.55 Td [(q)]TJ/F8 9.9626 Tf 5.473 3.436 Td [(^)]TJ/F11 9.9626 Tf -0.341 0 Td [(g)]TJ/F14 9.9626 Tf 5.109 0 Td [(k)]TJ/F7 6.9738 Tf 4.982 -1.495 Td [(2)]TJ/F11 9.9626 Tf 4.469 1.495 Td [(;)-333(l)]TJ/F75 6.9738 Tf 9.061 -1.495 Td [(slide)]TJ/F14 9.9626 Tf 16.439 1.495 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [(0)]TJ
0 g 0 G
/F75 7.9701 Tf -120.429 -11.956 Td [(15:)]TJ
0 g 0 G
/F74 9.9626 Tf 25.13 0 Td [(f)25(or)]TJ/F11 9.9626 Tf 14.964 0 Td [(k)]TJ/F8 9.9626 Tf 8.267 0 Td [(=)-278(1)]TJ/F75 9.9626 Tf 17.988 0 Td [(to)]TJ/F11 9.9626 Tf 10.242 0 Td [(M)]TJ/F74 9.9626 Tf 13.242 0 Td [(do)]TJ
0 g 0 G
/F75 7.9701 Tf -89.833 -11.955 Td [(16:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [<18>]TJ/F14 9.9626 Tf 7.584 0 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [(max\(0)]TJ/F11 9.9626 Tf 27.397 0 Td [(;)-167(l)]TJ/F14 9.9626 Tf 9.811 0 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(l)]TJ/F75 6.9738 Tf 2.973 -1.494 Td [(slide)]TJ/F8 9.9626 Tf 13.671 1.494 Td [(\))]TJ
0 g 0 G
/F75 7.9701 Tf -119.221 -11.955 Td [(17:)]TJ
0 g 0 G
/F74 9.9626 Tf 35.093 0 Td [(if)]TJ/F11 9.9626 Tf 8.577 0 Td [<18>]TJ/F8 9.9626 Tf 7.585 0 Td [(=)-278(0)]TJ/F74 9.9626 Tf 17.988 0 Td [(then)]TJ
0 g 0 G
/F75 7.9701 Tf -69.243 -11.955 Td [(18:)]TJ
0 g 0 G
/F74 9.9626 Tf 45.055 0 Td [(br)18(eak)]TJ
0 g 0 G
/F75 7.9701 Tf -45.055 -11.955 Td [(19:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.495 Td [(ne)15(xt)]TJ/F14 9.9626 Tf 15.169 1.495 Td [( )]TJ/F8 9.9626 Tf 12.73 0 Td [<0528>]TJ/F11 9.9626 Tf 11.347 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.495 Td [(curr)]TJ/F8 9.9626 Tf 13.939 1.495 Td [(+)]TJ/F11 9.9626 Tf 9.963 0 Td [<18>]TJ/F14 9.9626 Tf 7.031 0 Td [<01>]TJ/F8 9.9626 Tf 4.981 0 Td [(\()]TJ/F11 9.9626 Tf 3.875 0 Td [(x)]TJ/F75 6.9738 Tf 5.693 -1.495 Td [(pre)25(v)]TJ/F14 9.9626 Tf 14.931 1.495 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.495 Td [(curr)]TJ/F8 9.9626 Tf 11.726 1.495 Td [(\)\))]TJ
0 g 0 G
/F75 7.9701 Tf -173.522 -11.955 Td [(20:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.495 Td [(pre)25(v)]TJ/F14 9.9626 Tf 15.483 1.495 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.495 Td [(curr)]TJ
0 g 0 G
/F75 7.9701 Tf -74.694 -10.461 Td [(21:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(curr)]TJ/F14 9.9626 Tf 14.493 1.494 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(ne)15(xt)]TJ
0 g 0 G
/F75 7.9701 Tf -73.704 -10.461 Td [(22:)]TJ
0 g 0 G
/F11 9.9626 Tf 35.093 0 Td [(l)]TJ/F75 6.9738 Tf 2.972 -1.494 Td [(slide)]TJ/F14 9.9626 Tf 16.439 1.494 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(l)]TJ/F75 6.9738 Tf 2.973 -1.494 Td [(slide)]TJ/F8 9.9626 Tf 15.885 1.494 Td [(+)]TJ/F14 9.9626 Tf 9.963 0 Td [(k)]TJ/F11 9.9626 Tf 4.981 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(curr)]TJ/F14 9.9626 Tf 13.94 1.494 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(pre)25(v)]TJ/F14 9.9626 Tf 12.716 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.982 -1.494 Td [(2)]TJ
0 g 0 G
/F75 7.9701 Tf -154.024 -10.461 Td [(23:)]TJ
0 g 0 G
/F11 9.9626 Tf 25.13 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F14 9.9626 Tf 7.347 -3.615 Td [( )]TJ/F11 9.9626 Tf 12.73 0 Td [(x)]TJ/F75 6.9738 Tf 5.694 -1.494 Td [(curr)]TJ
0 g 0 G
/F75 7.9701 Tf -56.595 -10.461 Td [(24:)]TJ
0 g 0 G
/F74 9.9626 Tf 15.167 0 Td [(r)18(etur)15(n)]TJ/F11 9.9626 Tf 32.319 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ
0 g 0 G
ET
q
1 0 0 1 50.112 337.11 cm
[]0 d 0 J 0.398 w 0 0 m 236.25 0 l S
Q
BT
/F74 11.9552 Tf 50.112 306.491 Td [(5.)-250(Experiments)]TJ/F75 9.9626 Tf 11.955 -19.196 Td [(W)80(e)-267(compare)-266(LaS-GSA)-267(with)]TJ/F8 9.9626 Tf 114.963 0 Td [(4)]TJ/F75 9.9626 Tf 7.638 0 Td [(state-of-the-art)-267(black-box)]TJ -134.556 -11.955 Td [(adv)15(ersarial)-319(attack)-318(schemes.)-517(All)-318(attack)-319(methods)-319(are)-319(imple-)]TJ 0 -11.955 Td [(mented)-297(for)]TJ/F8 9.9626 Tf 46.868 0 Td [(3)]TJ/F75 9.9626 Tf 7.943 0 Td [(Img2Img)-297(GANs)-297(rele)25(v)25(ant)-298(to)-297(the)-297(manipulation)]TJ -54.811 -11.955 Td [(of)-313(personal)-313(images:)]TJ/F8 9.9626 Tf 83.625 0 Td [(2)]TJ/F75 9.9626 Tf 8.099 0 Td [(trained)-313(on)-313(closed-up)-313(portraits)-313(and)]TJ/F8 9.9626 Tf 139.545 0 Td [(1)]TJ/F75 9.9626 Tf -231.269 -11.955 Td [(trained)-289(on)-289(full-body)-289(shots.)-427(W)80(e)-290<02727374>-289(present)-289(the)-289(e)15(xperiment)]TJ 0 -11.956 Td [(setup.)-309(Then,)-248(we)-247(present)-247(quantitati)25(v)15(e)-247(and)-248(qualitati)26(v)14(e)-247(e)25(v)25(alua-)]TJ 0 -11.955 Td [(tions)-250(of)-250(the)-250(attack)-250(results)-250(and)-250(an)-250(ablation)-250(study)65(.)]TJ/F74 10.9589 Tf 0 -20.724 Td [(5.1.)-250(Experimental)-250(setup)]TJ/F74 9.9626 Tf 0 -18.199 Td [(Thr)18(eat)-273(Models.)]TJ/F75 9.9626 Tf 75.315 0 Td [(W)80(e)-273(adopt)-273(CycleGAN)-272([)]TJ
0 1 0 rg 0 1 0 RG
[(18)]TJ
0 g 0 G
[(])-273(as)-273(the)-273(def)10(ault)]TJ -75.315 -11.955 Td [(Img2Img)-352(GAN)-352(architecture)-353(for)-352(the)-352(follo)25(wing)-352(threat)-353(mod-)]TJ 0 -11.955 Td [(els:)-609(1\))]TJ/F75 7.9701 Tf 32.435 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.659 0 Td [(,)-437(which)-399(is)-400(trained)-400(on)-399(HQ-CelebA)]TJ -96.723 -11.955 Td [(dataset)-382([)]TJ
0 1 0 rg 0 1 0 RG
[(17)]TJ
0 g 0 G
[(])-382(to)-383(translate)-382(people)-382(with)-382(black)-382(hair)-383(t)1(o)-383(blonde)]TJ 0 -11.955 Td [(hair)40(,)-394(2\))]TJ/F75 7.9701 Tf 33.695 0 Td [(N)-62(O)-61(N)-62(E)]TJ/F75 9.9626 Tf 24.099 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(G)-62(L)-61(A)-62(S)-61(S)-62(E)-61(S)]TJ/F75 9.9626 Tf 37.728 0 Td [(,)-394(which)-365(adds)-365(glasses)-365(to)-366(portraits,)]TJ -101.002 -11.956 Td [(also)-472(t)1(rained)-472(on)-472(HQ-CelebA)-471(dataset,)-527(and)-471(3\))]TJ/F75 7.9701 Tf 188.34 0 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 9.9626 Tf 22.774 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(R)-62(E)-61(D)]TJ/F75 9.9626 Tf 17.165 0 Td [(,)]TJ -233.759 -11.955 Td [(which)-326(is)-326(trained)-326(on)-326(self-prepared)-326(datasets)-327(of)-326(clean)-326(images)]TJ 0 -11.955 Td [(for)-296(people)-296(wearing)-296(blue)-296(and)-296(red)-296(shirts)-296(from)-296(Google)-296(Image)]TJ 0 -11.955 Td [(Search)-286(for)-286(translating)-286(blue)-287(shirts)-286(to)-286(red)-286(shirts.)-419(Besi)1(des,)-296(we)]TJ
0 g 0 G
0 g 0 G
258.75 629.037 Td [(select)]TJ/F8 9.9626 Tf 25.328 0 Td [(100)]TJ/F75 9.9626 Tf 17.587 0 Td [(testing)-265(samples)-266([)]TJ
0 1 0 rg 0 1 0 RG
[(29)]TJ
0 g 0 G
[(])-265(that)-265(are)-266(i.i.d.)-355(to)-266(the)-265(training)]TJ -42.915 -11.955 Td [(set)-250(of)-250(each)-250(threat)-250(model.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 97.663 3.615 Td [(11)]TJ
0 g 0 G
/F74 9.9626 Tf -97.663 -24.461 Td [(Baselines.)]TJ/F75 9.9626 Tf 51.755 0 Td [(The)-448(proposed)]TJ/F79 9.9626 Tf 60.941 0 Td [(LaS-GSA)]TJ/F75 9.9626 Tf 41.542 0 Td [(is)-448(compared)-448(with)]TJ/F8 9.9626 Tf 77.031 0 Td [(4)]TJ/F75 9.9626 Tf -231.269 -11.955 Td [(state-of-the-art)-383(methods.)-708(1\))]TJ/F79 9.9626 Tf 118.433 0 Td [(Bandit)]TJ/F75 9.9626 Tf 30.562 0 Td [([)]TJ
0 1 0 rg 0 1 0 RG
[(14)]TJ
0 g 0 G
[(])-383(adopts)-383(the)-382(time-)]TJ -148.995 -11.955 Td [(dependent)-364(prior)-365(v)15(ector)-364(to)-365(guide)-364(the)-365(sampling)-364(process.)-654(2\))]TJ/F79 9.9626 Tf 0 -11.955 Td [(Squar)37(e)]TJ/F75 9.9626 Tf 29.883 0 Td [([)]TJ
0 1 0 rg 0 1 0 RG
[(1)]TJ
0 g 0 G
[(])-204(performs)-203(localized)-204(square-shaped)-203(updates)-204(at)-203(ran-)]TJ -29.883 -11.956 Td [(dom)-348(positions.)-605(3\))]TJ/F79 9.9626 Tf 77.453 0 Td [(RGF)]TJ/F75 9.9626 Tf 23.176 0 Td [([)]TJ
0 1 0 rg 0 1 0 RG
[(22)]TJ
0 g 0 G
[(])-348(randomly)-349(s)1(amples)-349(the)-348(query)]TJ -100.629 -11.955 Td [(v)15(ectors)-350(from)-349(the)-350(unit)]TJ/F11 9.9626 Tf 89.598 0 Td [(N)]TJ/F75 9.9626 Tf 9.091 0 Td [(-sphere.)-609(4\))]TJ/F79 9.9626 Tf 49.659 0 Td [(Prior)20(-RGF)]TJ/F75 9.9626 Tf 47.896 0 Td [([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(])-350(utilize)]TJ -196.244 -11.955 Td [(the)-365(surrog)5(ate)-365(model)-364(to)-365(bias)-365(the)-365(query)-364(v)15(ectors)-365(in)]TJ/F79 9.9626 Tf 201.842 0 Td [(RGF)]TJ/F75 9.9626 Tf 23.34 0 Td [(to-)]TJ -225.182 -11.955 Td [(w)10(ards)-435(the)-434(transfer)20(-based)-435(prior)-435(v)15(ector)-434(estimated)-435(from)-435(the)]TJ 0 -11.955 Td [(surrog)5(ate)-346(model.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 67.862 3.615 Td [(12)]TJ
0 g 0 G
/F75 9.9626 Tf 13.42 -3.615 Td [(The)-346(querying)-345(v)25(ariance)]TJ/F11 9.9626 Tf 94.735 0 Td [<0e>]TJ/F75 9.9626 Tf 4.805 0 Td [(,)-370(norm-bound)]TJ/F11 9.9626 Tf -180.822 -11.956 Td [<0f>]TJ/F75 9.9626 Tf 4.044 0 Td [(,)-352(and)-331(learning)-332(rate)]TJ/F11 9.9626 Tf 77.869 0 Td [<11>]TJ/F75 9.9626 Tf 8.606 0 Td [(are)-331(set)-332(to)]TJ/F8 9.9626 Tf 40.89 0 Td [(0)]TJ/F11 9.9626 Tf 4.981 0 Td [(:)]TJ/F8 9.9626 Tf 2.768 0 Td [(001)]TJ/F75 9.9626 Tf 14.944 0 Td [(,)]TJ/F8 9.9626 Tf 5.995 0 Td [(0)]TJ/F11 9.9626 Tf 4.982 0 Td [(:)]TJ/F8 9.9626 Tf 2.767 0 Td [(1)]TJ/F75 9.9626 Tf 4.981 0 Td [(,)-352(and)]TJ/F8 9.9626 Tf 23.684 0 Td [(1)]TJ/F75 9.9626 Tf 4.982 0 Td [(,)-352(respec-)]TJ -201.493 -11.955 Td [(ti)25(v)15(ely)65(.)-304(T)80(o)-234(pro)15(vide)-233(transfer)-233(priors)-233(for)-233(the)-234(Prior)20(-RGF)-233(method,)]TJ 0 -11.955 Td [(surrog)5(ate)-355(models)-354(are)-355(prepared)-354(for)-355(each)-355(threat)-354(model)-355(with)]TJ 0 -11.955 Td [(the)]TJ/F79 9.9626 Tf 14.665 0 Td [(same)]TJ/F75 9.9626 Tf 22.964 0 Td [(architectures)-250(and)-250(conditions.)]TJ/F74 9.9626 Tf -37.629 -20.846 Td [(Ev)10(aluations.)]TJ/F75 9.9626 Tf 62.734 0 Td [(T)80(o)-439(e)25(v)25(aluate)-438(the)-439(results)-439(of)-438(dif)25(ferent)-439(attack)]TJ -62.734 -11.955 Td [(schemes,)-412(we)-380(present)-380(a)-380(task-oriented)-379(score,)]TJ/F79 9.9626 Tf 179.931 0 Td [(i.e)]TJ/F75 9.9626 Tf 9.684 0 Td [(.,)-412(the)-380(nulli-)]TJ -189.615 -11.955 Td [(fying)-250(score)]TJ/F11 9.9626 Tf 47.033 0 Td [(s)]TJ/F75 6.9738 Tf 4.67 -1.495 Td [(Null)]TJ/F75 9.9626 Tf 12.898 1.495 Td [(,)]TJ
ET
/S/Span<>BDC
BT
/F11 9.9626 Tf 327.448 461.109 Td [(s)]TJ/F75 6.9738 Tf 4.67 -1.494 Td [(Null)]TJ/F8 9.9626 Tf 12.897 1.494 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 4.114 Td [<03>]TJ/F8 9.9626 Tf 4.58 -4.114 Td [(\))-278(=)]TJ/F1 9.9626 Tf 17.158 14.048 Td [<14>]TJ/F8 9.9626 Tf 5.258 -14.048 Td [(1)]TJ/F14 9.9626 Tf 7.195 0 Td [<00>]TJ/F8 9.9626 Tf 11.159 6.74 Td [(\()]TJ/F14 9.9626 Tf 3.874 0 Td [(k)]TJ/F66 9.9626 Tf 4.981 0 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F8 9.9626 Tf 4.58 -3.615 Td [(\))]TJ/F14 9.9626 Tf 6.089 0 Td [<00>]TJ/F11 9.9626 Tf 9.962 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F14 9.9626 Tf 4.47 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.981 -1.494 Td [(2)]TJ/F8 9.9626 Tf 4.469 1.494 Td [(\))]TJ/F7 6.9738 Tf 3.875 3.615 Td [(2)]TJ
ET
q
1 0 0 1 399.933 463.6 cm
[]0 d 0 J 0.398 w 0 0 m 73.654 0 l S
Q
BT
/F14 9.9626 Tf 413.697 454.275 Td [(k)]TJ/F11 9.9626 Tf 4.981 0 Td [(y)]TJ/F7 6.9738 Tf 4.885 -1.494 Td [(0)]TJ/F14 9.9626 Tf 6.683 1.494 Td [<00>]TJ/F11 9.9626 Tf 9.963 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F14 9.9626 Tf 4.469 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.981 3.432 Td [(2)]TJ 0 -6.088 Td [(2)]TJ/F1 9.9626 Tf 19.43 23.538 Td [<15>]TJ/F14 9.9626 Tf 7.472 -14.048 Td [<02>]TJ/F8 9.9626 Tf 9.962 0 Td [(100)]TJ/F11 9.9626 Tf 14.944 0 Td [(;)]TJ
ET
EMC
BT
/F75 9.9626 Tf 528.514 461.109 Td [(\(15\))]TJ -219.652 -27.865 Td [(where)-384(the)-385(original)-384(translation)-385(dist)1(ance)]TJ/F14 9.9626 Tf 161.363 0 Td [(k)]TJ/F11 9.9626 Tf 4.981 0 Td [(y)]TJ/F7 6.9738 Tf 4.885 -1.494 Td [(0)]TJ/F14 9.9626 Tf 7.675 1.494 Td [<00>]TJ/F11 9.9626 Tf 10.955 0 Td [(x)]TJ/F7 6.9738 Tf 5.693 -1.494 Td [(0)]TJ/F14 9.9626 Tf 4.47 1.494 Td [(k)]TJ/F7 6.9738 Tf 4.981 -1.494 Td [(2)]TJ/F11 9.9626 Tf 4.47 1.494 Td [(;)-167(y)]TJ/F7 6.9738 Tf 9.312 -1.494 Td [(0)]TJ/F8 9.9626 Tf 9.716 1.494 Td [(=)]TJ/F66 9.9626 Tf -228.501 -11.955 Td [(T)]TJ/F8 9.9626 Tf 6.642 0 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F7 6.9738 Tf 5.694 -1.494 Td [(0)]TJ/F8 9.9626 Tf 4.469 1.494 Td [(\))]TJ/F75 9.9626 Tf 6.375 0 Td [(acts)-251(as)-251(a)-251(normalization.)-313(F)15(ollo)25(wing)-251([)]TJ
0 1 0 rg 0 1 0 RG
[(32)]TJ
0 g 0 G
[(],)-251(we)-251(consider)]TJ -27.054 -11.955 Td [(adv)15(ersarial)-402(e)15(xamples)]TJ/F11 9.9626 Tf 89.04 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F75 9.9626 Tf 8.582 -3.615 Td [(successful)-402(if)]TJ/F11 9.9626 Tf 55.038 0 Td [(s)]TJ/F75 6.9738 Tf 4.67 -1.494 Td [(Null)]TJ/F8 9.9626 Tf 12.898 1.494 Td [(\()]TJ/F11 9.9626 Tf 3.874 0 Td [(x)]TJ/F13 6.9738 Tf 5.694 3.615 Td [<03>]TJ/F8 9.9626 Tf 4.58 -3.615 Td [(\))]TJ/F75 9.9626 Tf 7.877 0 Td [(is)-402(greater)]TJ -197.947 -11.955 Td [(than)-343(the)-342(threshold)]TJ/F8 9.9626 Tf 76.651 0 Td [(75)]TJ/F75 9.9626 Tf 9.962 0 Td [(.)]TJ
1 0 0 rg 1 0 0 RG
/F75 6.9738 Tf 2.491 3.615 Td [(13)]TJ
0 g 0 G
/F75 9.9626 Tf 13.329 -3.615 Td [(The)-343(attack)-342(success)-343(rate)-342(\(ASR\))-343(is)]TJ -102.433 -11.955 Td [(de\002ned)-382(as)-383(the)-382(percentage)-383(of)-382(the)-383(suc)1(cessful)-383(attack)-382(on)-383(test)]TJ 0 -11.956 Td [(images)-211(in)]TJ/F8 9.9626 Tf 40.187 0 Td [(100)]TJ/F11 9.9626 Tf 14.944 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(000)]TJ/F75 9.9626 Tf 17.05 0 Td [(query)-211(b)20(udgets.)-297(The)-212(query)-211(count)-212(\(Q\))-211(rep-)]TJ -76.609 -11.955 Td [(resents)-306(the)-306(a)20(v)15(erage)-306(number)-306(of)-307(attempted)-306(queries)-306(\(stopping)]TJ 0 -11.955 Td [(upon)-250(passing)-250(the)-250(threshold\))-250(for)-250(each)-250(e)15(xample.)]TJ/F74 10.9589 Tf 0 -19.903 Td [(5.2.)-250(Quantitati)10(v)10(e)-250(e)15(v)10(aluations)]TJ/F75 9.9626 Tf 11.955 -17.932 Td [(T)80(able)]TJ
1 0 0 rg 1 0 0 RG
[-316(1)]TJ
0 g 0 G
[-317(compares)-316(the)-317(proposed)-316(LaS-GSA)-316(ag)5(ainst)-317(base-)]TJ -11.955 -11.955 Td [(line)-283(methods)-283(in)-283(terms)-282(of)-283(the)-283(attack)-283(success)-283(rate)-283(\(ASR\))-283(and)]TJ 0 -11.956 Td [(the)-207(query)-207(count)-206(\(Q\))-207(of)-207(the)]TJ/F8 9.9626 Tf 103.658 0 Td [(100)]TJ/F75 9.9626 Tf 17.005 0 Td [(testing)-207(images)-207(for)-206(each)-207(threat)]TJ -120.663 -11.955 Td [(model.)-328(F)15(or)-255(all)-256(threat)-256(models,)-257(LaS-GSA)-256(outperforms)-256(all)-256(the)]TJ 0 -11.955 Td [(other)-311(approaches)-311(in)-311(both)-311(ASR)-311(and)-311(Q.)-311(Remarkably)65(,)-327(Bandit)]TJ 0 -11.955 Td [(attack)-289(could)-290(not)-289(pass)-290(the)-289(threshold)-290(score)-289(within)-290(a)]TJ/F8 9.9626 Tf 201.934 0 Td [(100)]TJ/F11 9.9626 Tf 14.944 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(000)]TJ/F75 9.9626 Tf -221.306 -11.955 Td [(query)-342(b)20(udget)-343(for)-342(some)-342(threat)-342(models.)-587(Compared)-342(to)-343(RGF)80(,)]TJ 0 -11.955 Td [(LaS-GSA)-312(also)-311(consistently)-312(achie)25(v)15(es)-311(better)-312(performance)-312(in)]TJ 0 -11.956 Td [(both)-307(ASR)-306(and)-307(Q)-306(by)-307(at)-306(least)]TJ/F8 9.9626 Tf 115.463 0 Td [(10%)]TJ/F75 9.9626 Tf 18.265 0 Td [(,)-321(because)-306(LaS-GSA)-307(care-)]TJ -133.728 -11.955 Td [(fully)-269(e)15(xamines)-269(the)-269(clipping)-269(ef)25(fect)-269(and)-269(e)15(xploits)-269(self-guiding)]TJ 0 -11.955 Td [(prior)-457(to)-456(attack)-457(the)-456(CycleGAN)-456(ef)25(fecti)25(v)15(ely)65(.)-930(Ev)15(en)-457(though)]TJ 0 -11.955 Td [(Prior)20(-RGF)-330(is)-329(equipped)-330(with)-330(a)-330(surrog)5(ate)-329(model,)-350(which)-330(has)]TJ 0 -11.955 Td [(the)-324(identical)-324(CycleGAN)-324(structure)-324(trained)-324(on)-324(an)-324(i.i.d.)-533(test-)]TJ 0 -11.956 Td [(ing)-229(dataset)-230(to)-229(estimate)-229(the)-230(prior)40(,)-233(LaS-GSA)-229(still)-230(outperforms)]TJ
0 g 0 G
ET
q
1 0 0 1 308.862 147.995 cm
[]0 d 0 J 0.398 w 0 0 m 94.499 0 l S
Q
BT
/F75 5.9776 Tf 320.319 141.128 Td [(11)]TJ/F75 7.9701 Tf 6.476 -2.812 Td [(Additional)-298(qualitati)25(v)15(e)-297(results)-298(of)-298(nullifying)-298(attack)-297(on)-298(the)]TJ/F37 7.9701 Tf 182.045 0 Td [(3)]TJ/F75 7.9701 Tf 6.607 0 Td [(Img2Img)]TJ -206.585 -9.465 Td [(GANs,)]TJ/F79 7.9701 Tf 24.095 0 Td [(i.e)]TJ/F75 7.9701 Tf 7.747 0 Td [(.,)]TJ/F75 6.3761 Tf 5.923 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 7.9701 Tf 23.32 0 Td [(2)]TJ/F75 6.3761 Tf 4.384 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 7.9701 Tf 23.726 0 Td [(,)]TJ/F75 6.3761 Tf 3.931 0 Td [(N)-62(O)-61(N)-62(E)]TJ/F75 7.9701 Tf 19.279 0 Td [(2)]TJ/F75 6.3761 Tf 4.384 0 Td [(G)-62(L)-61(A)-62(S)-61(S)-62(E)-61(S)]TJ/F75 7.9701 Tf 31.857 0 Td [(and)]TJ/F75 6.3761 Tf 13.384 0 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 7.9701 Tf 18.219 0 Td [(2)]TJ/F75 6.3761 Tf 4.384 0 Td [(R)-62(E)-61(D)]TJ/F75 7.9701 Tf 15.407 0 Td [(and)-210(distort-)]TJ -200.04 -9.464 Td [(ing)-218(attack)-218(on)]TJ/F37 7.9701 Tf 42.399 0 Td [(3)]TJ/F75 7.9701 Tf 5.971 0 Td [(models,)]TJ/F79 7.9701 Tf 26.806 0 Td [(i.e)]TJ/F75 7.9701 Tf 7.747 0 Td [(.,)]TJ/F75 6.3761 Tf 5.972 0 Td [(S)-62(T)-61(R)]TJ/F75 7.9701 Tf 12.872 0 Td [(2)]TJ/F75 6.3761 Tf 4.383 0 Td [(S)-62(E)-61(G)]TJ/F75 7.9701 Tf 13.023 0 Td [(,)]TJ/F75 6.3761 Tf 3.98 0 Td [(F)12(A)-22(C)-61(A)-62(D)-62(E)]TJ/F75 7.9701 Tf 27.138 0 Td [(2)]TJ/F75 6.3761 Tf 4.384 0 Td [(L)-61(A)-62(B)-62(E)-61(L)]TJ/F75 7.9701 Tf 22.308 0 Td [(,)-224(and)]TJ/F75 6.3761 Tf 17.225 0 Td [(N)-62(I)-62(G)-61(H)-62(T)]TJ/F75 7.9701 Tf 21.798 0 Td [(2)]TJ/F75 6.3761 Tf 4.384 0 Td [(D)-22(A)44(Y)]TJ/F75 7.9701 Tf 13.867 0 Td [(,)]TJ -234.257 -9.465 Td [(are)-250(presented)-250(in)-250(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-250(E)]TJ
0 g 0 G
[(.)]TJ/F75 5.9776 Tf 11.457 -6.916 Td [(12)]TJ/F75 7.9701 Tf 6.476 -2.813 Td [(The)-235(surrog)5(ate)-235(models)-235(are)-235(trained)-234(with)-235(the)-235(same)-235(architecture)-235(and)-235(pro-)]TJ -17.933 -9.464 Td [(cedure)-250(on)]TJ/F37 7.9701 Tf 33.195 0 Td [(100)]TJ/F75 7.9701 Tf 14.695 0 Td [(i.i.d.)-310(samples)-250(of)-250(the)-250(original)-250(training)-250(set.)]TJ/F75 5.9776 Tf -36.433 -6.916 Td [(13)]TJ/F75 7.9701 Tf 6.476 -2.813 Td [(The)-250(threshold)-250(is)-250(determined)-250(by)]TJ/F37 7.9701 Tf 101.163 0 Td [(100)]TJ/F75 7.9701 Tf 14.696 0 Td [(samples)-250(with)]TJ/F37 7.9701 Tf 43.835 0 Td [(50)]TJ/F75 7.9701 Tf 10.46 0 Td [(users)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(32)]TJ
0 g 0 G
[(].)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
139 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/JMpTAgNx10QMtex4Zl9d0Q Do
Q
endstream
endobj
140 0 obj
<< /Font << /F1 260 0 R /F10 248 0 R /F11 238 0 R /F13 250 0 R /F14 239 0 R /F37 240 0 R /F66 243 0 R /F7 244 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R >> /ProcSet [ /PDF /Text ] /XObject << /JMpTAgNx10QMtex4Zl9d0Q 267 0 R >> >>
endobj
141 0 obj
<< /A << /D (cite.ilyas2018prior) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 118.725 685.729 130.68 694.516 ] /Subtype /Link /Type /Annot >>
endobj
142 0 obj
<< /A << /D (cite.andriushchenko2020square) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 121.763 673.773 128.737 682.56 ] /Subtype /Link /Type /Annot >>
endobj
143 0 obj
<< /A << /D (cite.nesterov2017random) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 115.128 661.818 127.084 670.605 ] /Subtype /Link /Type /Annot >>
endobj
144 0 obj
<< /A << /D (cite.cheng2019improving) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 129.141 649.788 136.115 658.511 ] /Subtype /Link /Type /Annot >>
endobj
145 0 obj
<< /A << /D (cite.yeh2020disrupting) /S /GoTo >> /Border [ 0 0 0 ] /C [ 0 1 0 ] /H /I /Rect [ 71.931 150.286 83.886 159.212 ] /Subtype /Link /Type /Annot >>
endobj
146 0 obj
<< /A << /D (table.caption.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 85.577 89.802 92.551 100.746 ] /Subtype /Link /Type /Annot >>
endobj
147 0 obj
<< /Length 16871 >>
stream
0 g 0 G
0 g 0 G
0 g 0 G
q
1 0 0 1 62.949 719.602 cm
[]0 d 0 J 0.398 w 0 0 m 322.877 0 l S
Q
q
1 0 0 1 63.149 707.447 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 69.326 699.078 Td [(Methods)]TJ 51.805 11.956 Td [(Models)]TJ
ET
1 0 0 1 63.348 695.492 cm
q 0.99626401 0 0 0.99626401 0 0 cm 0.39998 w 0 24 m 93.99927 0 l S Q
q
1 0 0 1 93.847 11.955 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
1 0 0 1 -63.348 -695.492 cm
BT
/F75 7.9701 Tf 163.621 711.034 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ
ET
q
1 0 0 1 234.086 707.447 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 7.9701 Tf 240.512 711.034 Td [(N)-62(O)-61(N)-62(E)]TJ/F75 9.9626 Tf 24.099 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(G)-62(L)-61(A)-62(S)-61(S)-62(E)-61(S)]TJ
ET
q
1 0 0 1 313.995 707.447 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 7.9701 Tf 327.226 711.034 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 9.9626 Tf 22.774 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(R)-62(E)-61(D)]TJ
ET
q
1 0 0 1 385.627 707.447 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 157.395 707.248 cm
[]0 d 0 J 0.398 w 0 0 m 228.431 0 l S
Q
q
1 0 0 1 63.149 695.492 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 157.195 695.492 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 163.646 699.078 Td [(ASR)-1839(Q/\(s\))]TJ
ET
q
1 0 0 1 234.086 695.492 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 240.537 699.078 Td [(ASR)-1990(Q/\(s\))]TJ
ET
q
1 0 0 1 313.995 695.492 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 320.446 699.078 Td [(ASR)-1575(Q/\(s\))]TJ
ET
q
1 0 0 1 385.627 695.492 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 62.949 695.293 cm
[]0 d 0 J 0.398 w 0 0 m 322.877 0 l S
Q
q
1 0 0 1 63.149 683.138 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 87.343 686.725 Td [(Bandit)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(14)]TJ
0 g 0 G
[(])]TJ
ET
q
1 0 0 1 157.195 683.138 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 166.695 686.725 Td [(0%)-2589(\(2\))]TJ
ET
q
1 0 0 1 234.086 683.138 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 241.095 686.725 Td [(10%)-1699(90,019)]TJ
ET
q
1 0 0 1 313.995 683.138 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 323.495 686.725 Td [(0%)-2325(\(5\))]TJ
ET
q
1 0 0 1 385.627 683.138 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 63.149 671.183 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 89.285 674.77 Td [(Square)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(1)]TJ
0 g 0 G
[(])]TJ
ET
q
1 0 0 1 157.195 671.183 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 164.204 674.77 Td [(23%)-1547(87,196)]TJ
ET
q
1 0 0 1 234.086 671.183 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 241.095 674.77 Td [(40%)-1699(60,194)]TJ
ET
q
1 0 0 1 313.995 671.183 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 321.004 674.77 Td [(25%)-1284(80,778)]TJ
ET
q
1 0 0 1 385.627 671.183 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 63.149 659.228 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 90.939 662.814 Td [(RGF)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(22)]TJ
0 g 0 G
[(])]TJ
ET
q
1 0 0 1 157.195 659.228 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 164.204 662.814 Td [(71%)-1547(53,237)]TJ
ET
q
1 0 0 1 234.086 659.228 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 241.095 662.814 Td [(88%)-1699(58,049)]TJ
ET
q
1 0 0 1 313.995 659.228 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 321.004 662.814 Td [(23%)-1284(85,969)]TJ
ET
q
1 0 0 1 385.627 659.228 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 63.149 647.273 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 81.908 650.859 Td [(Prior)20(-RGF)-250([)]TJ
0 1 0 rg 0 1 0 RG
[(7)]TJ
0 g 0 G
[(])]TJ
ET
q
1 0 0 1 157.195 647.273 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 164.204 650.859 Td [(69%)-1547(51,330)]TJ
ET
q
1 0 0 1 234.086 647.273 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 241.095 650.859 Td [(78%)-1699(81,580)]TJ
ET
q
1 0 0 1 313.995 647.273 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 321.004 650.859 Td [(23%)-1284(80,463)]TJ
ET
q
1 0 0 1 385.627 647.273 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 62.949 647.074 cm
[]0 d 0 J 0.398 w 0 0 m 322.877 0 l S
Q
q
1 0 0 1 63.149 634.919 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 90.526 638.506 Td [(LaS-GSA)]TJ
ET
q
1 0 0 1 157.195 634.919 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F74 9.9626 Tf 163.372 638.506 Td [(85%)-1464(42,917)]TJ
ET
q
1 0 0 1 234.086 634.919 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F74 9.9626 Tf 240.263 638.506 Td [(95%)-1615(40,298)]TJ
ET
q
1 0 0 1 313.995 634.919 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F74 9.9626 Tf 320.172 638.506 Td [(40%)-1200(79,934)]TJ
ET
q
1 0 0 1 385.627 634.919 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 62.949 634.72 cm
[]0 d 0 J 0.398 w 0 0 m 322.877 0 l S
Q
0 g 0 G
BT
/F75 9.9626 Tf 56.09 616.189 Td [(T)80(able)-286(1:)-382(Quantitati)25(v)15(e)-286(results)-286(of)-285(the)-286(black-box)-286(attack)-286(ag)5(ainst)-286(Img2Img)-286(GANs)-286(with)-286(a)]TJ 0 -11.955 Td [(limit)-215(of)-215(100,000)-215(queries.)-299(W)80(e)-215(report)-215(the)-215(attack)-215(success)-215(rate)-215(\(ASR\))-216(and)-215(the)-215(query)-215(count)]TJ 0 -11.955 Td [(\(Q\))-210(for)-211(all)]TJ/F8 9.9626 Tf 41.693 0 Td [(100)]TJ/F75 9.9626 Tf 17.04 0 Td [(test)-210(samples.)-297(If)-210(the)-211(attack)-210(f)10(ails)-210(in)-211(all)]TJ/F8 9.9626 Tf 143.422 0 Td [(100)]TJ/F75 9.9626 Tf 17.039 0 Td [(test)-210(samples,)-219(the)-210(a)20(v)15(erage)-210<026e616c>]TJ -219.194 -11.955 Td [(score)-250(\(s\))-250(is)-250(presented)-250(with)-250(parentheses.)]TJ
0 g 0 G
ET
q
1 0 0 1 404.641 719.801 cm
[]0 d 0 J 0.398 w 0 0 m 123.676 0 l S
Q
q
1 0 0 1 404.84 707.646 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 413.229 711.233 Td [(Methods)]TJ
ET
q
1 0 0 1 456.486 707.646 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 462.937 711.233 Td [(ASR)-2242(Q)]TJ
ET
q
1 0 0 1 528.118 707.646 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.641 707.447 cm
[]0 d 0 J 0.398 w 0 0 m 123.676 0 l S
Q
q
1 0 0 1 404.84 695.293 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 420.975 698.879 Td [(RGF)]TJ
ET
q
1 0 0 1 456.486 695.293 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 463.495 698.879 Td [(71%)-1284(53,237)]TJ
ET
q
1 0 0 1 528.118 695.293 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.641 695.093 cm
[]0 d 0 J 0.398 w 0 0 m 123.676 0 l S
Q
q
1 0 0 1 404.84 682.939 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 420.701 686.526 Td [(GSA)]TJ
ET
q
1 0 0 1 456.486 682.939 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 463.495 686.526 Td [(76%)-1284(48,849)]TJ
ET
q
1 0 0 1 528.118 682.939 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.84 670.984 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 416.546 674.57 Td [(S-RGF)]TJ
ET
q
1 0 0 1 456.486 670.984 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 463.495 674.57 Td [(81%)-1284(49,743)]TJ
ET
q
1 0 0 1 528.118 670.984 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.84 659.029 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 416.272 662.615 Td [(S-GSA)]TJ
ET
q
1 0 0 1 456.486 659.029 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 463.495 662.615 Td [(84%)-1284(43,694)]TJ
ET
q
1 0 0 1 528.118 659.029 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.84 647.073 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 411.291 650.66 Td [(LaS-RGF)]TJ
ET
q
1 0 0 1 456.486 647.073 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 463.495 650.66 Td [(80%)-1284(51,871)]TJ
ET
q
1 0 0 1 528.118 647.073 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.641 646.874 cm
[]0 d 0 J 0.398 w 0 0 m 123.676 0 l S
Q
q
1 0 0 1 404.84 634.72 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F75 9.9626 Tf 411.017 638.306 Td [(LaS-GSA)]TJ
ET
q
1 0 0 1 456.486 634.72 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
BT
/F74 9.9626 Tf 462.663 638.306 Td [(85%)-1200(42,917)]TJ
ET
q
1 0 0 1 528.118 634.72 cm
[]0 d 0 J 0.398 w 0 0 m 0 11.955 l S
Q
q
1 0 0 1 404.641 634.521 cm
[]0 d 0 J 0.398 w 0 0 m 123.676 0 l S
Q
0 g 0 G
BT
/F75 9.9626 Tf 404.641 615.99 Td [(T)80(able)-493(2:)-796(Ablation)-493(test)-493(results)-493(for)]TJ/F75 7.9701 Tf 0.249 -11.955 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 31.842 0 Td [(with)-219(the)-219(attack)-219(suc-)]TJ -66.721 -11.955 Td [(cess)-245(rate)-244(\(ASR\))-245(and)-244(the)-245(query)-245(count)]TJ 0 -11.955 Td [(\(Q\).)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
1 0 0 1 56.596 498.431 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im5 Do
Q
Q
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im6 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im7 Do
Q
Q
0 g 0 G
1 0 0 1 -56.596 -364.134 cm
BT
/F75 9.9626 Tf 79.432 352.358 Td [(input)]TJ
0 g 0 G
ET
1 0 0 1 125.909 498.431 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im8 Do
Q
Q
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im9 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im10 Do
Q
Q
0 g 0 G
1 0 0 1 -125.909 -364.134 cm
BT
/F75 9.9626 Tf 141.357 352.358 Td [(e)15(xpected)]TJ
0 g 0 G
ET
1 0 0 1 195.222 497.422 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im11 Do
Q
Q
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im12 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im13 Do
Q
Q
0 g 0 G
1 0 0 1 -195.222 -363.125 cm
BT
/F75 9.9626 Tf 207.407 351.349 Td [(LaS-GSA)]TJ
0 g 0 G
ET
1 0 0 1 264.535 497.422 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im14 Do
Q
Q
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im15 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im16 Do
Q
Q
0 g 0 G
1 0 0 1 -264.535 -363.125 cm
BT
/F75 9.9626 Tf 276.402 351.349 Td [(Prior)20(-RGF)]TJ
0 g 0 G
ET
1 0 0 1 333.848 497.422 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im17 Do
Q
Q
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im18 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im19 Do
Q
Q
0 g 0 G
1 0 0 1 -333.848 -363.125 cm
BT
/F75 9.9626 Tf 357.236 351.349 Td [(RGF)]TJ
0 g 0 G
ET
1 0 0 1 403.161 497.41 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im20 Do
Q
Q
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im21 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im22 Do
Q
Q
0 g 0 G
1 0 0 1 -403.161 -363.113 cm
BT
/F75 9.9626 Tf 422.953 351.337 Td [(Bandit)]TJ
0 g 0 G
ET
1 0 0 1 472.474 498.431 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im23 Do
Q
Q
1 0 0 1 0 -67.149 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im24 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -67.148 cm
q
.2584 0 0 .2584 0 0 cm
q
256 0 0 256 0 0 cm
/Im25 Do
Q
Q
0 g 0 G
1 0 0 1 -472.474 -364.134 cm
BT
/F75 9.9626 Tf 491.718 352.358 Td [(Square)]TJ
0 g 0 G
0 g 0 G
-370.348 -20.488 Td [(Figure)-250(3:)-310(Comparing)-250(attack)-250(methods)-250(with)-250(adv)15(ersarial)-250(results)-250(for)-250(model)]TJ/F75 7.9701 Tf 285.705 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.151 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(.)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
ET
1 0 0 1 62.191 252.214 cm
q
.06253 0 0 .06253 0 0 cm
q
1024 0 0 1024 0 0 cm
/Im26 Do
Q
Q
0 g 0 G
1 0 0 1 -62.191 -252.214 cm
BT
/F75 8.9664 Tf 84.991 241.117 Td [(input)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
1 0 0 1 129.774 252.212 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im27 Do
Q
Q
0 g 0 G
1 0 0 1 -129.774 -252.212 cm
BT
/F75 8.9664 Tf 145.926 241.115 Td [(e)15(xpected)]TJ
0 g 0 G
ET
1 0 0 1 198.011 252.293 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im28 Do
Q
Q
1 0 0 1 -198.011 -252.293 cm
BT
/F87 8.9664 Tf 211.854 241.334 Td [(40)]TJ/F88 8.9664 Tf 9.215 0 Td [(=)]TJ/F87 8.9664 Tf 4.608 0 Td [(1)]TJ/F88 8.9664 Tf 4.607 0 Td [(;)]TJ/F87 8.9664 Tf 4.096 0 Td [(056)]TJ
ET
1 0 0 1 265.595 252.293 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im29 Do
Q
Q
1 0 0 1 -265.595 -252.293 cm
BT
/F87 8.9664 Tf 279.437 241.334 Td [(54)]TJ/F88 8.9664 Tf 9.216 0 Td [(=)]TJ/F87 8.9664 Tf 4.607 0 Td [(6)]TJ/F88 8.9664 Tf 4.608 0 Td [(;)]TJ/F87 8.9664 Tf 4.096 0 Td [(331)]TJ
ET
1 0 0 1 333.178 252.293 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im30 Do
Q
Q
1 0 0 1 -333.178 -252.293 cm
BT
/F87 8.9664 Tf 344.717 241.334 Td [(67)]TJ/F88 8.9664 Tf 9.215 0 Td [(=)]TJ/F87 8.9664 Tf 4.608 0 Td [(10)]TJ/F88 8.9664 Tf 9.215 0 Td [(;)]TJ/F87 8.9664 Tf 4.096 0 Td [(551)]TJ
ET
1 0 0 1 400.761 252.293 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im31 Do
Q
Q
1 0 0 1 -400.761 -252.293 cm
BT
/F87 8.9664 Tf 412.3 241.334 Td [(75)]TJ/F88 8.9664 Tf 9.216 0 Td [(=)]TJ/F87 8.9664 Tf 4.607 0 Td [(31)]TJ/F88 8.9664 Tf 9.216 0 Td [(;)]TJ/F87 8.9664 Tf 4.095 0 Td [(651)]TJ
ET
1 0 0 1 468.345 252.293 cm
q
.25014 0 0 .25014 0 0 cm
q
256 0 0 256 0 0 cm
/Im32 Do
Q
Q
1 0 0 1 -468.345 -252.293 cm
BT
/F87 8.9664 Tf 477.58 241.334 Td [(94)]TJ/F88 8.9664 Tf 9.215 0 Td [(=)]TJ/F87 8.9664 Tf 4.608 0 Td [(100)]TJ/F88 8.9664 Tf 13.823 0 Td [(;)]TJ/F87 8.9664 Tf 4.096 0 Td [(000)]TJ
0 g 0 G
/F75 9.9626 Tf -459.21 -20.572 Td [(Figure)-212(4:)-290(The)-212(attack)-212(process)-211(of)-212(LaS-GSA)-212(on)]TJ/F75 7.9701 Tf 178.382 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.151 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(.)-297(From)-212(left)-211(to)-212(right:)-291(the)-212(original)-211(input)-212(image,)-219(e)15(xpected)-212(Img2Img)]TJ -242.67 -11.956 Td [(GAN)-250(output,)-250(and)-250(intermediate)-250(results)-250(of)-250(LaS-GSA)-250(attack,)-250(with)-250(the)-250(score)-250(\()]TJ/F11 9.9626 Tf 295.23 0 Td [(s)]TJ/F75 6.9738 Tf 4.67 -1.494 Td [(Null)]TJ/F75 9.9626 Tf 12.897 1.494 Td [(\)/query)-250(number)-250(sho)25(wn)-250(belo)25(w)65(.)]TJ
0 g 0 G
0 g 0 G
-312.797 -33.474 Td [(Prior)20(-RGF)-321(by)]TJ/F8 9.9626 Tf 58.79 0 Td [(2%)]TJ/F75 9.9626 Tf 16.487 0 Td [(to)]TJ/F8 9.9626 Tf 10.955 0 Td [(17%)]TJ/F75 9.9626 Tf 21.468 0 Td [(re)15(g)5(arding)-322(ASR.)-321(This)-322(is)-321(because)]TJ -107.7 -11.955 Td [(the)-240(output)-241(space)-240(of)-240(GANs)-240(is)-241(much)-240(lar)18(ger)-240(than)-240(image)-241(classi-)]TJ 0 -11.955 Td [<02657273>-235([)]TJ
0 1 0 rg 0 1 0 RG
[(32)]TJ
0 g 0 G
[(],)-238(and)-235(thus)-235(transferring)-235(the)-236(gradient)-235(across)-235(dif)25(ferent)]TJ 0 -11.956 Td [(models)-250(is)-250(much)-250(more)-250(challenging.)]TJ/F74 10.9589 Tf 0 -26.415 Td [(5.3.)-250(Ablation)-250(Study)]TJ/F75 9.9626 Tf 11.955 -20.096 Td [(T)80(able)]TJ
1 0 0 rg 1 0 0 RG
[-263(2)]TJ
0 g 0 G
[-263(presents)-262(the)-263(ablation)-263(studies)-263(on)]TJ/F75 7.9701 Tf 160.007 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf -206.592 -11.955 Td [(with)-408(RGF)-408(and)-408(four)-408(v)25(ariants)-409(of)-408(our)-408(method,)-448(including)-408(1\))]TJ
0 g 0 G
0 g 0 G
/F79 9.9626 Tf 258.75 94.332 Td [(GSA)]TJ/F75 9.9626 Tf 18.261 0 Td [(:)-262(with)-262(only)-262(the)-261(gradient)-262(sliding)-262(mechanism,)-265(2\))]TJ/F79 9.9626 Tf 187.215 0 Td [(S-RGF)]TJ/F75 9.9626 Tf 28.004 0 Td [(:)]TJ -233.48 -11.955 Td [(with)-374(only)-373(the)-374(self-guiding)-374(prior)40(,)-404(3\))]TJ/F79 9.9626 Tf 148.151 0 Td [(S-GSA)]TJ/F75 9.9626 Tf 26.561 0 Td [(:)-374(with)-373(both)-374(the)]TJ -174.712 -11.955 Td [(self-guiding)-287(prior)-288(and)-287(the)-288(gradient)-287(sliding)-288(mechanism,)-297(and)]TJ 0 -11.956 Td [(4\))]TJ/F79 9.9626 Tf 11.603 0 Td [(LaS-RGF)]TJ/F75 9.9626 Tf 38.525 0 Td [(:)-332(with)-331(both)-332(the)-332(limit-a)15(w)10(are)-331(RGF)-332(and)-331(the)-332(self-)]TJ -50.128 -11.955 Td [(guiding)-417(prior)55(.)-809(First,)-458(v)25(ariants)-417(equipped)-417(with)-416(the)-417(gradient)]TJ 0 -11.955 Td [(sliding)-341(mechanism)-340(\(*-GSA\))-341(consistently)-340(impro)15(v)15(e)-341(the)-341(per)20(-)]TJ 0 -11.955 Td [(formance)-446(by)-447(at)-446(least)]TJ/F8 9.9626 Tf 90.827 0 Td [(3%)]TJ/F75 9.9626 Tf 17.731 0 Td [(re)15(g)5(arding)-446(ASR)-447(compared)-446(with)]TJ -108.558 -11.955 Td [(RGF)80(.)-368(Besides,)-397(the)-368(self-guiding)-368(prior)-368(increases)-368(the)-368(o)15(v)15(erall)]TJ
0 g 0 G
0 g 0 G
ET
endstream
endobj
148 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/WaYll-vEQYkQ6yXM26ztAQ Do
Q
endstream
endobj
149 0 obj
<< /Font << /F11 238 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R /F87 245 0 R /F88 246 0 R >> /ProcSet [ /PDF /Text /ImageC ] /XObject << /Im10 268 0 R /Im11 269 0 R /Im12 270 0 R /Im13 271 0 R /Im14 272 0 R /Im15 273 0 R /Im16 274 0 R /Im17 275 0 R /Im18 276 0 R /Im19 277 0 R /Im20 278 0 R /Im21 279 0 R /Im22 280 0 R /Im23 281 0 R /Im24 282 0 R /Im25 283 0 R /Im26 284 0 R /Im27 285 0 R /Im28 286 0 R /Im29 287 0 R /Im30 288 0 R /Im31 289 0 R /Im32 290 0 R /Im5 291 0 R /Im6 292 0 R /Im7 293 0 R /Im8 294 0 R /Im9 295 0 R /WaYll-vEQYkQ6yXM26ztAQ 296 0 R >> >>
endobj
150 0 obj
<< /A << /D (figure.caption.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 91.1 281.085 98.074 292.029 ] /Subtype /Link /Type /Annot >>
endobj
151 0 obj
<< /A << /D (table.caption.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 267.801 137.623 274.775 148.567 ] /Subtype /Link /Type /Annot >>
endobj
152 0 obj
<< /A << /D (figure.caption.8) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 78.51 101.757 85.484 112.701 ] /Subtype /Link /Type /Annot >>
endobj
153 0 obj
<< /A << /D (figure.caption.9) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 426.77 364.411 433.744 375.355 ] /Subtype /Link /Type /Annot >>
endobj
154 0 obj
<< /A << /D (appendix.E) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 487.869 256.815 495.948 267.758 ] /Subtype /Link /Type /Annot >>
endobj
155 0 obj
<< /Length 12183 >>
stream
0 g 0 G
0 g 0 G
0 g 0 G
1 0 0 1 64.559 645.024 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im33 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im34 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im35 Do
Q
Q
0 g 0 G
1 0 0 1 -64.559 -493.078 cm
BT
/F75 9.9626 Tf 91.806 481.303 Td [(input)]TJ
0 g 0 G
ET
1 0 0 1 142.785 645.024 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im36 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im37 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im38 Do
Q
Q
0 g 0 G
1 0 0 1 -142.785 -493.078 cm
BT
/F75 9.9626 Tf 162.645 481.303 Td [(e)15(xpected)]TJ
0 g 0 G
ET
1 0 0 1 221.01 644.015 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im39 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im40 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.972 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im41 Do
Q
Q
0 g 0 G
1 0 0 1 -221.01 -492.07 cm
BT
/F75 9.9626 Tf 237.608 480.294 Td [(LaS-GSA)]TJ
0 g 0 G
ET
1 0 0 1 299.236 645.024 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im42 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im43 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im44 Do
Q
Q
0 g 0 G
1 0 0 1 -299.236 -493.078 cm
BT
/F75 9.9626 Tf 326.483 481.303 Td [(input)]TJ
0 g 0 G
ET
1 0 0 1 377.461 645.024 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im45 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im46 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im47 Do
Q
Q
0 g 0 G
1 0 0 1 -377.461 -493.078 cm
BT
/F75 9.9626 Tf 397.322 481.303 Td [(e)15(xpected)]TJ
0 g 0 G
ET
1 0 0 1 455.687 644.015 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im48 Do
Q
Q
1 0 0 1 0 -75.973 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im49 Do
Q
Q
0 g 0 G
0 g 0 G
1 0 0 1 0 -75.972 cm
q
.29288 0 0 .29288 0 0 cm
q
256 0 0 256 0 0 cm
/Im50 Do
Q
Q
0 g 0 G
1 0 0 1 -455.687 -492.07 cm
BT
/F75 9.9626 Tf 472.284 480.294 Td [(LaS-GSA)]TJ
0 g 0 G
0 g 0 G
-422.172 -19.479 Td [(Figure)-268(5:)-345(Qualitati)25(v)15(e)-268(LaS-GSA)-268(attack)-267(results)-268(ag)5(ainst)-268(model)]TJ/F75 7.9701 Tf 242.177 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(,)]TJ/F75 7.9701 Tf 5.451 0 Td [(N)-62(O)-62(N)-61(E)]TJ/F75 9.9626 Tf 24.1 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(G)-62(L)-61(A)-62(S)-61(S)-62(E)-61(S)]TJ/F75 9.9626 Tf 37.728 0 Td [(,)-272(and)]TJ/F75 7.9701 Tf 22.505 0 Td [(R)-62(E)-61(D)]TJ/F75 9.9626 Tf 17.414 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 9.9626 Tf 25.193 0 Td [(from)-268(top)-267(to)]TJ -449.815 -11.956 Td [(bottom,)-250(each)-250(presenting)-250(the)-250(input)-250(images,)-250(e)15(xpected)-250(output)-250(of)-250(each)-250(model,)-250(and)-250(the)-250<026e616c>-250(output)-250(after)-250(applying)-250(LaS-GSA.)]TJ
0 g 0 G
0 g 0 G
0 -33.474 Td [(ASR)-363(to)]TJ/F8 9.9626 Tf 34.363 0 Td [(80%)]TJ/F75 9.9626 Tf 18.265 0 Td [(,)-391(and)-364(the)-363(limit-a)15(w)10(are)-363(RGF)-363(impro)15(v)15(es)-363(ASR)-363(to)]TJ/F8 9.9626 Tf -52.628 -11.955 Td [(85%)]TJ/F75 9.9626 Tf 18.265 0 Td [(.)-552(Furthermore,)-351(the)-330(results)-331(in)-331(the)-330(query)-331(count)-331(\(Q\))-330(fol-)]TJ -18.265 -11.955 Td [(lo)25(w)-402(a)-403(similar)-402(trend,)-440(in)-402(which)-403(LaS-GSA)-402(reduces)-402(by)]TJ/F8 9.9626 Tf 217.985 0 Td [(20%)]TJ/F75 9.9626 Tf -217.985 -11.956 Td [(of)-272(queries)-273(compared)-272(to)-272(RGF)80(.)-273(Notice)-272(that)-272(LaS-GSA)-273(outper)20(-)]TJ 0 -11.955 Td [(forms)-262(LaS-RGF)-262(by)]TJ/F8 9.9626 Tf 79.779 0 Td [(17)]TJ/F11 9.9626 Tf 9.962 0 Td [(:)]TJ/F8 9.9626 Tf 2.768 0 Td [(2%)]TJ/F75 9.9626 Tf 15.893 0 Td [(re)15(g)5(arding)-262(query)-262(ef)25(\002cienc)15(y)-262(since)]TJ -108.402 -11.955 Td [(the)-309(gradient)-309(sliding)-308(mechanism)-309(carefully)-309(estimates)-309(the)-309(ad-)]TJ 0 -11.955 Td [(v)15(ersarial)-216(limit)-216(and)-217(prolongs)-216(the)-216(optimization)-216(steps)-216(along)-217(the)]TJ 0 -11.955 Td [(constraint)-250(boundary)65(,)-250(leading)-250(to)-250(better)-250(ef)25(\002cienc)15(y)65(.)]TJ/F74 10.9589 Tf 0 -27.128 Td [(5.4.)-250(Qualitati)10(v)10(e)-250(e)15(v)10(aluation)]TJ/F75 9.9626 Tf 11.955 -20.333 Td [(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-403(3)]TJ
0 g 0 G
[-403(compares)-404(the)-403(visual)-403(quality)-403(of)-403(the)-404(attack)-403(re-)]TJ -11.955 -11.955 Td [(sults.)-616(Consistent)-352(with)-352(the)-352(quant)1(itati)25(v)15(e)-352(results,)-378(Bandit)-352(and)]TJ 0 -11.956 Td [(Square)-303(f)10(ail)-303(to)-304(alter)-303(the)-303(image)-303(output.)-470(Square)-303(blurs)-303(the)-304(im-)]TJ 0 -11.955 Td [(age)-216(with)-216(the)-216(v)15(ertical)-216(stripes)-216(because)-217(their)-216(mechanism)-216(f)10(a)20(v)20(ors)]TJ 0 -11.955 Td [(rectangle)-365(perturbations.)-654(F)15(or)]TJ/F75 7.9701 Tf 119.305 0 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.151 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(,)-394(while)-364(other)]TJ -183.593 -11.955 Td [(methods)-260(only)-260(slightly)-260(modify)-260(the)-260(hair)-259(color)-260(to)]TJ/F79 9.9626 Tf 186.762 0 Td [(br)45(own)]TJ/F75 9.9626 Tf 25.016 0 Td [(,)-262(LaS-)]TJ -211.778 -11.955 Td [(GSA)-382(is)-382(the)-382(only)-381(one)-382(that)-382(nulli\002es)-382(the)-382(translation)-382(process)]TJ 0 -11.955 Td [(and)-229(returns)-229(a)-230(black)-229(hair)-229(image)-229(because)-229(it)-230(ef)25(fecti)25(v)15(ely)-229(utilizes)]TJ 0 -11.956 Td [(the)-392(limit-a)15(w)10(are)-391(gradient)-392(estimation)-392(and)-391(the)-392(gradient)-392(slid-)]TJ 0 -11.955 Td [(ing)-291(mechanism)-291(to)-291(ensure)-291(the)-291(correctness)-292(of)-291(nullifying)-291(pro-)]TJ 0 -11.955 Td [(cess)-235(in)-235(both)-236(direction)-235(and)-235(length.)-305(While)-235(LaS-GSA)-236(achie)25(v)15(es)]TJ 0 -11.955 Td [(similar)-410(results)-410(on)]TJ/F75 7.9701 Tf 76.158 0 Td [(N)-62(O)-61(N)-62(E)]TJ/F75 9.9626 Tf 24.099 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(G)-62(L)-61(A)-62(S)-62(S)-61(E)-61(S)]TJ/F75 9.9626 Tf 41.815 0 Td [(and)]TJ/F75 7.9701 Tf 18.721 0 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 9.9626 Tf 22.774 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(R)-62(E)-61(D)]TJ/F75 9.9626 Tf 21.252 0 Td [(com-)]TJ -215.777 -11.955 Td [(pared)-416(with)-415(RGF)-416(and)-415(Prior)20(-RGF)80(,)-416(as)-416(sho)25(wn)-415(in)-416(T)80(able)]TJ
1 0 0 rg 1 0 0 RG
[-416(1)]TJ
0 g 0 G
[(,)-457(it)]TJ 0 -11.955 Td [(requires)-400(fe)25(wer)-400(queries)-401(because)-400(the)-400(self-guiding)-400(prior)-401(can)]TJ 0 -11.956 Td [(pro)15(vide)-441(meaningful)-442(guide)-441(for)-441(the)-441(modi\002cation)-442(direction.)]TJ 0 -11.955 Td [(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-339(4)]TJ
0 g 0 G
[-340(visualizes)-339(the)-340(nullifying)-339(process)-340(of)-339(LaS-GSA)-340(on)]TJ/F75 7.9701 Tf 0.249 -11.955 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(,)-316(which)-302(reco)15(v)15(ers)-303(the)-302(hair)-303(color)-302(from)-303(blond)]TJ -64.537 -11.955 Td [(to)-252(black.)-314(As)-252(query)-251(counts)-252(increase,)-252(the)-252(resulting)-251(output)-252(im-)]TJ
0 g 0 G
0 g 0 G
258.75 334.385 Td [(age)-261(shifts)-261(from)-261(blond)-261(hair)-261(back)-261(to)-261(black.)-343(W)80(e)-261(observ)15(e)-261(that)-261(a)]TJ 0 -11.955 Td [(nullifying)-287(score)]TJ/F11 9.9626 Tf 66.051 0 Td [(s)]TJ/F75 6.9738 Tf 4.67 -1.495 Td [(Null)]TJ/F8 9.9626 Tf 16.355 1.495 Td [(=)-347(75)]TJ/F75 9.9626 Tf 24.034 0 Td [(is)-287(suf)25(\002cient,)-297(with)-288(up)-287(to)]TJ/F8 9.9626 Tf 95.806 0 Td [(30)]TJ/F11 9.9626 Tf 9.962 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(000)]TJ/F75 9.9626 Tf -221.306 -11.956 Td [(queries.)-434(Nonetheless,)-301(with)]TJ/F8 9.9626 Tf 110.389 0 Td [(100)]TJ/F11 9.9626 Tf 14.944 0 Td [(;)]TJ/F8 9.9626 Tf 4.428 0 Td [(000)]TJ/F75 9.9626 Tf 17.845 0 Td [(queries,)-302(t)1(he)-292(nullifying)]TJ -147.606 -11.955 Td [(attack)-336(can)-335(mak)10(e)-336(the)-336(adv)15(ersarial)-336(output)-335(much)-336(closer)-336(to)-336(the)]TJ 0 -11.955 Td [(original)-195(input.)-292(Finally)65(,)-206(Figure)]TJ
1 0 0 rg 1 0 0 RG
[-195(5)]TJ
0 g 0 G
[-195(further)-195(presents)]TJ/F8 9.9626 Tf 189.474 0 Td [(2)]TJ/F75 9.9626 Tf 6.926 0 Td [(additional)]TJ -196.4 -11.955 Td [(samples)-319(for)-319(each)-319(threat)-319(model)-319(to)-320(demonstrate)-319(the)-319(general-)]TJ 0 -11.955 Td [(ity)-358(of)-358(LaS-GSA.)-359(Our)-358(limit-a)15(w)10(are)-358(strate)15(gy)-358(follo)25(ws)-358(the)-359(ad-)]TJ 0 -11.955 Td [(v)15(ersarial)-402(limit)-402(and)-402(k)10(eep)-402(the)-402(adv)15(ersarial)-402(perturbations)-402(im-)]TJ 0 -11.956 Td [(perceptible.)-584(W)40(ith)-341(the)-341(nullifying)-341(attack)-342(scheme,)-364(LaS-GSA)]TJ 0 -11.955 Td [(ef)25(fecti)25(v)15(ely)-330(creates)-331(adv)15(ersarial)-330(e)15(xamples)-331(that)-330(cause)-331(models)]TJ/F75 7.9701 Tf 0.249 -11.955 Td [(B)-62(L)-61(A)-22(C)-62(K)]TJ/F75 9.9626 Tf 29.15 0 Td [(2)]TJ/F75 7.9701 Tf 5.48 0 Td [(B)-62(L)-61(O)-62(N)-62(D)]TJ/F75 9.9626 Tf 29.658 0 Td [(,)]TJ/F75 7.9701 Tf 5.506 0 Td [(N)-62(O)-62(N)-61(E)]TJ/F75 9.9626 Tf 24.1 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(G)-62(L)-61(A)-62(S)-61(S)-62(E)-61(S)]TJ/F75 9.9626 Tf 37.728 0 Td [(,)-278(and)]TJ/F75 7.9701 Tf 22.604 0 Td [(B)-62(L)-61(U)-62(E)]TJ/F75 9.9626 Tf 22.774 0 Td [(2)]TJ/F75 7.9701 Tf 5.479 0 Td [(R)-62(E)-61(D)]TJ/F75 9.9626 Tf 19.877 0 Td [(to)-272(gen-)]TJ -208.084 -11.955 Td [(erate)-271(output)-271(images)-271(that)-271(are)-271(almost)-271(identical)-271(to)-271(the)-271(original)]TJ 0 -11.955 Td [(input)-309(images,)-323(canceling)-309(the)-309(respecti)25(v)15(e)-308(functionality)65(.)-487(More)]TJ 0 -11.956 Td [(qualitati)25(v)15(e)-250(results)-250(are)-250(presented)-250(in)-250(Appendix)]TJ
1 0 0 rg 1 0 0 RG
[-250(E)]TJ
0 g 0 G
[(.)]TJ/F74 11.9552 Tf 0 -27.376 Td [(6.)-250(Conclusion)]TJ/F75 9.9626 Tf 11.955 -20.084 Td [(In)-348(this)-347(w)10(ork,)-372(we)-348(introduce)-347(a)-348(ne)25(w)-348(adv)15(ersarial)-347(attack)-348(on)]TJ -11.955 -11.956 Td [(Img2Img)-333(GANs)-334(in)-333(a)-333(black-box)-333(setting,)-354(namely)]TJ/F79 9.9626 Tf 196.39 0 Td [(Nullifying)]TJ -196.39 -11.955 Td [(Attac)20(k)]TJ/F75 9.9626 Tf 25.255 0 Td [(,)-211(to)-200(defend)-201(ag)5(ainst)-201(malicious)-200(applications)-201(\()]TJ/F79 9.9626 Tf 167.831 0 Td [(e)15(.g)]TJ/F75 9.9626 Tf 11.746 0 Td [(.,)-211(Deep-)]TJ -204.832 -11.955 Td [(F)15(ak)10(e\).)-417(W)80(e)-285(propose)-286(the)]TJ/F79 9.9626 Tf 94.362 0 Td [(Limit-A)55(war)37(e)-286(Self)1(-Guiding)-286(Gr)15(adient)]TJ -94.362 -11.955 Td [(Sliding)-346(Attac)20(k)-345(\(LaS-GSA\))]TJ/F75 9.9626 Tf 107.535 0 Td [(method,)-370(which)-345(incorporates)-346(the)]TJ/F79 9.9626 Tf -107.535 -11.955 Td [(limit-awar)37(e)-308(RGF)]TJ/F75 9.9626 Tf 68.563 0 Td [(,)-308(the)]TJ/F79 9.9626 Tf 20.802 0 Td [(gr)15(adient)-308(sliding)-308(mec)15(hanism)]TJ/F75 9.9626 Tf 111.552 0 Td [(,)-323(and)-308(the)]TJ/F79 9.9626 Tf -200.917 -11.955 Td [(self-guiding)-377(prior)]TJ/F75 9.9626 Tf 75.822 0 Td [(to)-377(cancel)-377(the)-376(image)-377(translation)-377(process)]TJ -75.822 -11.956 Td [(of)-336(Img2Img)-335(GANs.)-567(Experimental)-336(results)-335(demonstrate)-336(the)]TJ 0 -11.955 Td [(ef)25(fecti)25(v)15(eness)-388(and)-387(ef)25(\002cienc)15(y)-388(of)-388(our)-388(proposed)-387(method)-388(in)]TJ/F8 9.9626 Tf 231.269 0 Td [(3)]TJ/F75 9.9626 Tf -231.269 -11.955 Td [(dif)25(ferent)-229(translation)-229(processes.)-303(Future)-229(w)10(ork)-230(includes)-229(reduc-)]TJ 0 -11.955 Td [(ing)-256(the)-256(vulnerability)-256(of)-256(Img2Img)-257(GANs)-256(ag)5(ainst)-256(adv)15(ersarial)]TJ 0 -11.955 Td [(attacks)-250(for)-250(safety-critical)-250(applications.)]TJ
0 g 0 G
0 g 0 G
ET
endstream
endobj
156 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/wpzairz-nV-0VcQs2CNnNg Do
Q
endstream
endobj
157 0 obj
<< /Font << /F11 238 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R /F8 233 0 R >> /ProcSet [ /PDF /Text /ImageC ] /XObject << /Im33 297 0 R /Im34 298 0 R /Im35 299 0 R /Im36 300 0 R /Im37 301 0 R /Im38 302 0 R /Im39 303 0 R /Im40 304 0 R /Im41 305 0 R /Im42 306 0 R /Im43 307 0 R /Im44 308 0 R /Im45 309 0 R /Im46 310 0 R /Im47 311 0 R /Im48 312 0 R /Im49 313 0 R /Im50 314 0 R /wpzairz-nV-0VcQs2CNnNg 315 0 R >> >>
endobj
158 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 92.437 646.009 98.913 655.38 ] /Subtype /Link /Type /Annot >>
endobj
159 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 101.404 646.009 107.879 655.38 ] /Subtype /Link /Type /Annot >>
endobj
160 0 obj
<< /A << /D (page.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 110.37 646.009 116.846 655.38 ] /Subtype /Link /Type /Annot >>
endobj
161 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 269.772 611.758 276.248 621.829 ] /Subtype /Link /Type /Annot >>
endobj
162 0 obj
<< /A << /D (page.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 278.641 611.758 285.117 621.829 ] /Subtype /Link /Type /Annot >>
endobj
163 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 69.035 602.615 75.511 610.848 ] /Subtype /Link /Type /Annot >>
endobj
164 0 obj
<< /A << /D (page.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 114.853 545.984 121.329 555.356 ] /Subtype /Link /Type /Annot >>
endobj
165 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 120.331 501.124 126.807 510.823 ] /Subtype /Link /Type /Annot >>
endobj
166 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 263.756 467.201 270.232 477.272 ] /Subtype /Link /Type /Annot >>
endobj
167 0 obj
<< /A << /D (page.14) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 272.723 467.201 283.682 477.272 ] /Subtype /Link /Type /Annot >>
endobj
168 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 270.158 411.709 276.634 421.78 ] /Subtype /Link /Type /Annot >>
endobj
169 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 229.766 367.177 236.242 377.225 ] /Subtype /Link /Type /Annot >>
endobj
170 0 obj
<< /A << /D (page.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 238.645 367.177 245.12 377.225 ] /Subtype /Link /Type /Annot >>
endobj
171 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 247.523 367.177 253.999 377.225 ] /Subtype /Link /Type /Annot >>
endobj
172 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 256.401 367.177 262.877 377.225 ] /Subtype /Link /Type /Annot >>
endobj
173 0 obj
<< /A << /D (page.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 265.279 367.177 271.755 377.225 ] /Subtype /Link /Type /Annot >>
endobj
174 0 obj
<< /A << /D (page.13) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 274.158 367.177 285.117 377.225 ] /Subtype /Link /Type /Annot >>
endobj
175 0 obj
<< /A << /D (page.14) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 69.035 358.159 79.994 366.266 ] /Subtype /Link /Type /Annot >>
endobj
176 0 obj
<< /A << /D (page.16) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 170.794 289.857 181.753 299.816 ] /Subtype /Link /Type /Annot >>
endobj
177 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 166.167 245.911 172.643 255.283 ] /Subtype /Link /Type /Annot >>
endobj
178 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 167.396 178.784 173.872 188.833 ] /Subtype /Link /Type /Annot >>
endobj
179 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 159.927 123.292 166.403 133.341 ] /Subtype /Link /Type /Annot >>
endobj
180 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 92.437 102.421 98.913 110.726 ] /Subtype /Link /Type /Annot >>
endobj
181 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 351.187 685.859 357.663 695.231 ] /Subtype /Link /Type /Annot >>
endobj
182 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 360.154 685.859 366.629 695.231 ] /Subtype /Link /Type /Annot >>
endobj
183 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 392.037 639.832 398.513 649.204 ] /Subtype /Link /Type /Annot >>
endobj
184 0 obj
<< /A << /D (page.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 401.004 639.832 407.48 649.204 ] /Subtype /Link /Type /Annot >>
endobj
185 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 351.187 583.985 357.663 592.218 ] /Subtype /Link /Type /Annot >>
endobj
186 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 410.957 525.86 417.433 535.232 ] /Subtype /Link /Type /Annot >>
endobj
187 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 399.174 479.833 405.65 489.205 ] /Subtype /Link /Type /Annot >>
endobj
188 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 526.864 444.088 533.339 454.159 ] /Subtype /Link /Type /Annot >>
endobj
189 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 535.83 444.088 542.306 454.159 ] /Subtype /Link /Type /Annot >>
endobj
190 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 459.446 398.15 465.922 408.109 ] /Subtype /Link /Type /Annot >>
endobj
191 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 530.333 352.123 536.809 362.105 ] /Subtype /Link /Type /Annot >>
endobj
192 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 539.3 352.123 545.776 362.105 ] /Subtype /Link /Type /Annot >>
endobj
193 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 383.062 295.366 389.538 305.096 ] /Subtype /Link /Type /Annot >>
endobj
194 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 498.88 260.069 505.356 270.051 ] /Subtype /Link /Type /Annot >>
endobj
195 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 507.847 260.069 514.322 270.051 ] /Subtype /Link /Type /Annot >>
endobj
196 0 obj
<< /A << /D (page.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 516.813 260.069 523.289 270.051 ] /Subtype /Link /Type /Annot >>
endobj
197 0 obj
<< /A << /D (page.16) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 351.187 193.85 362.146 202.083 ] /Subtype /Link /Type /Annot >>
endobj
198 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 503.596 135.049 510.072 145.097 ] /Subtype /Link /Type /Annot >>
endobj
199 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 512.563 135.049 519.038 145.097 ] /Subtype /Link /Type /Annot >>
endobj
200 0 obj
<< /A << /D (page.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 521.529 135.049 528.005 145.097 ] /Subtype /Link /Type /Annot >>
endobj
201 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 396.019 78.74 402.495 88.111 ] /Subtype /Link /Type /Annot >>
endobj
202 0 obj
<< /Length 16951 >>
stream
0 g 0 G
0 g 0 G
BT
/F74 11.9552 Tf 50.112 710.037 Td [(Refer)18(ences)]TJ
0 g 0 G
/F75 8.9664 Tf 4.483 -17.932 Td [([1])]TJ
0 g 0 G
[-556(Maksym)-321(Andriushchenk)10(o,)-338(Francesco)-322(Croce,)-338(Nicolas)-321(Flam-)]TJ 15.436 -10.959 Td [(marion,)-278(and)-273(Matthias)-273(Hein.)-432(Square)-273(attack:)-355(a)-273(query-ef)25(\002cient)]TJ 0 -10.959 Td [(black-box)-213(adv)15(ersarial)-212(attack)-213(via)-213(random)-212(search.)-279(In)]TJ/F79 8.9664 Tf 181.371 0 Td [(Eur)45(opean)]TJ -181.371 -10.959 Td [(Confer)37(ence)-353(on)-352(Computer)-353(V)74(ision)]TJ/F75 8.9664 Tf 117.572 0 Td [(,)-378(pages)-353(484\226501.)-352(Springer)40(,)]TJ -117.572 -10.959 Td [(2020.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(6)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(7)]TJ
0 g 0 G
0 g 0 G
-15.436 -11.656 Td [([2])]TJ
0 g 0 G
[-556(Dina)-211(Bashkiro)15(v)25(a,)-219(Ben)-211(Usman,)-219(and)-211(Kate)-211(Saenk)10(o.)-276(Adv)15(ers)1(arial)]TJ 15.436 -10.959 Td [(self-defense)-196(for)-196(c)15(ycle-consistent)-196(g)5(ans.)-242(In)]TJ/F79 8.9664 Tf 146.709 0 Td [(Advances)-196(in)-196(Neur)15(al)]TJ -146.709 -10.959 Td [(Information)-236(Pr)45(ocessing)-237(Systems)]TJ/F75 8.9664 Tf 114.91 0 Td [(,)-239(pages)-236(635\226645,)-240(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-330(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-239(4)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
-114.91 -10.959 Td [(5)]TJ
0 g 0 G
0 g 0 G
-15.436 -11.656 Td [([3])]TJ
0 g 0 G
[-556(Thomas)-362(Brunner)40(,)-391(Frederik)-363(Diehl,)-390(Michael)-363(T)35(ruong)-363(Le,)-390(and)]TJ 15.436 -10.959 Td [(Alois)-297(Knoll.)-512(Guessing)-297(smart:)-405(Biased)-297(sampling)-298(for)-297(ef)25(\002cient)]TJ 0 -10.958 Td [(black-box)-350(adv)15(ersarial)-349(attacks.)-679(In)]TJ/F79 8.9664 Tf 125.155 0 Td [(Pr)45(oceedings)-350(of)-349(the)-350(IEEE)]TJ -125.155 -10.959 Td [(International)-293(Confer)37(ence)-292(on)-293(Computer)-293(V)74(ision)]TJ/F75 8.9664 Tf 165.912 0 Td [(,)-303(pages)-293(4958\226)]TJ -165.912 -10.959 Td [(4966,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(4)]TJ
0 g 0 G
0 g 0 G
-15.436 -11.656 Td [([4])]TJ
0 g 0 G
[-556(Samuel)-292(R)-293(Buss.)-496(Introduction)-292(to)-293(in)40(v)15(erse)-292(kinematics)-293(with)-292(ja-)]TJ 15.436 -10.959 Td [(cobian)-382(transpose,)-415(pseudoin)40(v)15(erse)-382(and)-383(damped)-382(least)-382(squares)]TJ 0 -10.959 Td [(methods.)]TJ/F79 8.9664 Tf 37.481 0 Td [(IEEE)-307(J)25(ournal)-306(of)-307(Robotics)-306(and)-307(A)20(utomation)]TJ/F75 8.9664 Tf 154.311 0 Td [(,)-321(17\(1-)]TJ -191.792 -10.959 Td [(19\):16,)-250(2004.)]TJ
1 0 0 rg 1 0 0 RG
[-360(5)]TJ
0 g 0 G
0 g 0 G
-15.436 -11.656 Td [([5])]TJ
0 g 0 G
[-556(Nicholas)-256(Carlini)-257(and)-257(Da)20(vid)-257(W)80(agner)55(.)-383(T)80(o)25(w)10(ards)-257(e)25(v)25(aluat)1(ing)-257(the)]TJ 15.436 -10.959 Td [(rob)20(ustness)-252(of)-252(neural)-253(netw)10(orks.)-367(In)]TJ/F79 8.9664 Tf 122.383 0 Td [(2017)-252(IEEE)-253(Symposium)-252(on)]TJ -122.383 -10.959 Td [(Security)-250(and)-250(Privacy)-250(\(SP\))]TJ/F75 8.9664 Tf 93.375 0 Td [(,)-250(pages)-250(39\22657.)-250(IEEE,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(14)]TJ
0 g 0 G
0 g 0 G
-108.811 -11.656 Td [([6])]TJ
0 g 0 G
[-556(Pin-Y)111(u)-380(Chen,)-413(Huan)-380(Zhang,)-414(Y)100(as)1(h)-381(Sharma,)-413(Jinfeng)-380(Y)55(i,)-413(and)]TJ 15.436 -10.959 Td [(Cho-Jui)-245(Hsieh.)-348(Zoo:)-308(Zeroth)-245(order)-244(optimization)-245(based)-245(black-)]TJ 0 -10.959 Td [(box)-274(attacks)-275(to)-274(deep)-275(ne)1(ural)-275(netw)10(orks)-274(without)-275(training)-274(substi-)]TJ 0 -10.958 Td [(tute)-296(models.)-509(In)]TJ/F79 8.9664 Tf 58.936 0 Td [(Pr)45(oceedings)-296(of)-297(the)-296(10th)-296(A)30(CM)-297(W)92(orkshop)-296(on)]TJ -58.936 -10.959 Td [(Arti\002cial)-250(Intellig)10(ence)-250(and)-250(Security)]TJ/F75 8.9664 Tf 123.681 0 Td [(,)-250(pages)-250(15\22626,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-139.117 -11.656 Td [([7])]TJ
0 g 0 G
[-556(Shuyu)-351(Cheng,)-377(Y)55(inpeng)-352(Dong,)-377(T)35(ian)15(yu)-352(P)15(ang,)-377(Hang)-351(Su,)-377(and)]TJ 15.436 -10.959 Td [(Jun)-407(Zhu.)-860(Impro)15(ving)-407(black-box)-406(adv)15(ersarial)-407(attacks)-406(with)-407(a)]TJ 0 -10.959 Td [(transfer)20(-based)-215(prior)55(.)-283(In)]TJ/F79 8.9664 Tf 83.648 0 Td [(Advances)-215(in)-214(Neur)15(al)-215(Information)-215(Pr)45(o-)]TJ -83.648 -10.959 Td [(cessing)-238(Systems)]TJ/F75 8.9664 Tf 56.915 0 Td [(,)-240(pages)-238(10932\22610942,)-240(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-333(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-241(4)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-240(5)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-240(6)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-240(7)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-240(13)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
-56.915 -10.959 Td [(14)]TJ
0 g 0 G
0 g 0 G
-15.436 -11.656 Td [([8])]TJ
0 g 0 G
[-556(Marius)-368(Cordts,)-399(Mohamed)-369(Omran,)-398(Sebastian)-369(Ramos,)-398(T)35(imo)]TJ 15.436 -10.959 Td [(Rehfeld,)-855(Markus)-734(Enzweiler)40(,)-854(Rodrigo)-734(Benenson,)-855(Uwe)]TJ 0 -10.959 Td [(Frank)10(e,)-506(Stef)10(an)-454(Roth,)-506(and)-455(Bernt)-454(Schiele.)-1015(The)-455(cityscapes)]TJ 0 -10.959 Td [(dataset)-399(for)-399(semantic)-400(urban)-399(scene)-399(understanding.)-838(In)]TJ/F79 8.9664 Tf 197.062 0 Td [(Pr)45(oc.)]TJ -197.062 -10.958 Td [(of)-436(the)-436(IEEE)-435(Confer)37(ence)-436(on)-436(Computer)-435(V)74(ision)-436(and)-436(P)80(attern)]TJ 0 -10.959 Td [(Reco)10(gnition)-250(\(CVPR\))]TJ/F75 8.9664 Tf 73.873 0 Td [(,)-250(2016.)]TJ
1 0 0 rg 1 0 0 RG
[-360(16)]TJ
0 g 0 G
0 g 0 G
-89.309 -11.656 Td [([9])]TJ
0 g 0 G
[-556(Hanjun)-316(Dai,)-334(Hui)-317(Li,)-333(T)35(ian)-317(T)35(ian,)-334(Xin)-316(Huang,)-334(Lin)-317(W)80(ang,)-333(Jun)]TJ 15.436 -10.959 Td [(Zhu,)-374(and)-349(Le)-350(Song.)-677(Adv)15(ersarial)-349(attack)-349(on)-350(graph)-349(structured)]TJ 0 -10.959 Td [(data.)-251(In)]TJ/F79 8.9664 Tf 28.696 0 Td [(International)-200(confer)37(ence)-200(on)-200(mac)15(hine)-200(learning)]TJ/F75 8.9664 Tf 163.094 0 Td [(,)-210(pages)]TJ -191.79 -10.959 Td [(1115\2261124.)-250(PMLR,)-250(2018.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.656 Td [([10])]TJ
0 g 0 G
[-556(Ambra)-513(Demontis,)-579(Marco)-514(Melis,)-579(Maura)-513(Pintor)40(,)-579(Matthe)25(w)]TJ 19.919 -10.959 Td [(Jagielski,)-211(Battista)-202(Biggio,)-211(Alina)-202(Oprea,)-211(Cristina)-202(Nita-Rotaru,)]TJ 0 -10.959 Td [(and)-367(F)15(abio)-367(Roli.)-735(Wh)5(y)-367(do)-367(adv)15(ersarial)-367(attacks)-368(trans)1(fer?)-662(e)15(x-)]TJ 0 -10.959 Td [(plaining)-282(transferability)-281(of)-282(e)25(v)25(asion)-282(and)-282(poisoning)-281(attacks.)-462(In)]TJ/F79 8.9664 Tf 0 -10.959 Td [(28th)]TJ/F57 8.9664 Tf 19.463 0 Td [(f)]TJ/F79 8.9664 Tf 4.608 0 Td [(USENIX)]TJ/F57 8.9664 Tf 30.88 0 Td [(g)]TJ/F79 8.9664 Tf 8.129 0 Td [(Security)-393(Symposium)-392(\()]TJ/F57 8.9664 Tf 80.252 0 Td [(f)]TJ/F79 8.9664 Tf 4.608 0 Td [(USENIX)]TJ/F57 8.9664 Tf 30.88 0 Td [(g)]TJ/F79 8.9664 Tf 8.128 0 Td [(Security)]TJ -186.948 -10.959 Td [(19\))]TJ/F75 8.9664 Tf 11.952 0 Td [(,)-250(pages)-250(321\226338,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-31.871 -11.656 Td [([11])]TJ
0 g 0 G
[-556(Y)55(inpeng)-602(Dong,)-690(T)35(ian)15(yu)-602(P)15(ang,)-690(Hang)-603(Su,)-690(and)-602(Jun)-602(Zhu.)]TJ 19.919 -10.958 Td [(Ev)25(ading)-457(defenses)-458(to)-457(transferable)-457(adv)15(ersarial)-458(e)15(xamples)-457(by)]TJ 0 -10.959 Td [(translation-in)40(v)25(ariant)-432(attacks.)-942(In)]TJ/F79 8.9664 Tf 122.939 0 Td [(Pr)45(oceedings)-432(of)-432(the)-432(IEEE)]TJ -122.939 -10.959 Td [(Confer)37(ence)-430(on)-430(Computer)-429(V)74(ision)-430(and)-430(P)80(attern)-430(Reco)10(gnition)]TJ/F75 8.9664 Tf 214.089 0 Td [(,)]TJ -214.089 -10.959 Td [(pages)-250(4312\2264321,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.656 Td [([12])]TJ
0 g 0 G
[-556(github/)1(l)10(wlodo.)-360(Of)25(\002cial)-250(deepnude)-250(algorithm)-250(source)-250(code,)-249(Jul)]TJ 19.919 -10.959 Td [(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.656 Td [([13])]TJ
0 g 0 G
[-556(Ian)-426(Goodfello)25(w)65(,)-471(Jean)-427(Pouget-Abadie,)-471(Mehdi)-427(Mir)1(za,)-471(Bing)]TJ 19.919 -10.959 Td [(Xu,)-222(Da)20(vid)-215(W)80(arde-F)15(arle)15(y)65(,)-222(Sherjil)-216(Ozai)1(r)39(,)-222(Aaron)-215(Courville,)-222(and)]TJ
0 g 0 G
0 g 0 G
258.75 629.037 Td [(Y)110(oshua)-354(Bengio.)-691(Generati)25(v)15(e)-354(adv)15(ersarial)-354(nets.)-691(In)]TJ/F79 8.9664 Tf 181.972 0 Td [(Advances)]TJ -181.972 -10.958 Td [(in)-234(neur)15(al)-235(information)-234(pr)45(ocessing)-235(systems)]TJ/F75 8.9664 Tf 146.85 0 Td [(,)-238(pages)-234(2672\2262680,)]TJ -146.85 -10.959 Td [(2014.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(2)]TJ
0 g 0 G
0 g 0 G
-19.919 -13.151 Td [([14])]TJ
0 g 0 G
[-556(Andre)25(w)-511(Ilyas,)-577(Log)5(an)-511(Engstrom,)-577(and)-511(Aleksander)-511(Madry)65(.)]TJ 19.919 -10.959 Td [(Prior)-202(con)40(victions:)-286(Black-box)-202(adv)15(ersarial)-202(attacks)-202(with)-202(bandits)]TJ 0 -10.959 Td [(and)-272(priors.)-432(In)]TJ/F79 8.9664 Tf 52.327 0 Td [(International)-272(Confer)37(ence)-272(on)-273(Learning)-272(Repr)37(e-)]TJ -52.327 -10.958 Td [(sentations)]TJ/F75 8.9664 Tf 36.367 0 Td [(,)-250(2018.)]TJ
1 0 0 rg 1 0 0 RG
[-360(6)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(7)]TJ
0 g 0 G
0 g 0 G
-56.286 -13.151 Td [([15])]TJ
0 g 0 G
[-556(Phil)1(lip)-459(Isola,)-510(Jun-Y)100(an)-458(Zhu,)-510(T)35(inghui)-458(Zhou,)-510(and)-458(Ale)15(x)15(ei)-458(A)]TJ 19.919 -10.959 Td [(Efros.)-780(Image-to-image)-381(translation)-381(with)-382(conditional)-381(adv)15(er)20(-)]TJ 0 -10.959 Td [(sarial)-313(netw)10(orks.)-561(In)]TJ/F79 8.9664 Tf 72.559 0 Td [(Pr)45(oceedings)-313(of)-313(the)-313(IEEE)-313(confer)37(ence)-313(on)]TJ -72.559 -10.959 Td [(computer)-287(vision)-287(and)-287(pattern)-287(r)37(eco)10(gnition)]TJ/F75 8.9664 Tf 145.854 0 Td [(,)-296(pages)-287(1125\2261134,)]TJ -145.854 -10.958 Td [(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-19.919 -13.151 Td [([16])]TJ
0 g 0 G
[-556(Mousa)-217(T)80(ayseer)-217(Jaf)10(ar)40(,)-224(Mohammad)-218(Ababneh,)-224(Mohammad)-217(Al-)]TJ 19.919 -10.959 Td [(Zoube,)-494(and)-444(Ammar)-445(Elhassan.)-984(F)15(orensi)1(cs)-445(and)-445(analysis)-445(of)]TJ 0 -10.959 Td [(deepf)10(ak)10(e)-446(videos.)-986(In)]TJ/F79 8.9664 Tf 82.139 0 Td [(2020)-446(11th)-445(International)-446(Confer)37(ence)]TJ -82.139 -10.959 Td [(on)-267(Information)-267(and)-267(C)1(ommunication)-267(Systems)-267(\(ICICS\))]TJ/F75 8.9664 Tf 191.28 0 Td [(,)-267(pages)]TJ -191.28 -10.958 Td [(053\226058.)-250(IEEE,)-250(2020.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
0 g 0 G
-19.919 -13.151 Td [([17])]TJ
0 g 0 G
[-556(T)70(ero)-238(Karras,)-240(T)35(imo)-239(Aila,)-240(Samuli)-238(Laine,)-241(and)-238(Jaakk)10(o)-238(Lehtinen.)]TJ 19.919 -10.959 Td [(Progressi)25(v)15(e)-311(gro)25(wing)-311(of)-311(g)5(ans)-311(for)-311(impro)15(v)15(ed)-311(quality)65(,)-326(stability)65(,)]TJ 0 -10.959 Td [(and)-226(v)25(ariation.)-308(In)]TJ/F79 8.9664 Tf 61.124 0 Td [(International)-226(Confer)37(ence)-226(on)-226(Learning)-226(Rep-)]TJ -61.124 -10.959 Td [(r)37(esentations)]TJ/F75 8.9664 Tf 43.504 0 Td [(,)-250(2018.)]TJ
1 0 0 rg 1 0 0 RG
[-360(6)]TJ
0 g 0 G
0 g 0 G
-63.423 -13.15 Td [([18])]TJ
0 g 0 G
[-556(Ming-)1(Y)111(u)-246(Liu,)-246(Thomas)-246(Breuel,)-246(and)-246(Jan)-245(Kautz.)-350(Unsupervised)]TJ 19.919 -10.959 Td [(image-to-image)-252(translation)-252(netw)10(orks.)-367(In)]TJ/F79 8.9664 Tf 147.197 0 Td [(Advances)-252(in)-252(neur)15(al)]TJ -147.197 -10.959 Td [(information)-250(pr)45(ocessing)-250(systems)]TJ/F75 8.9664 Tf 112.67 0 Td [(,)-250(pages)-250(700\226708,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(6)]TJ
0 g 0 G
0 g 0 G
-132.589 -13.15 Td [([19])]TJ
0 g 0 G
[-556(Y)100(anpei)-476(Liu,)-533(Xin)15(yun)-476(Chen,)-533(Chang)-477(Liu,)-533(and)-476(Da)15(wn)-476(Song.)]TJ 19.919 -10.959 Td [(Delving)-425(into)-426(transferable)-425(adv)15(ersarial)-425(e)15(xamples)-426(and)-425(black-)]TJ 0 -10.959 Td [(box)-255(attacks.)-376(In)]TJ/F79 8.9664 Tf 56.004 0 Td [(Pr)45(oceedings)-255(of)-255(5th)-255(International)-255(Confer)37(ence)]TJ -56.004 -10.959 Td [(on)-250(Learning)-250(Repr)37(esentations)]TJ/F75 8.9664 Tf 103.776 0 Td [(,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-123.695 -13.15 Td [([20])]TJ
0 g 0 G
[-556(Aleks)1(ander)-343(Madry)65(,)-365(Aleksandar)-343(Mak)10(elo)15(v)65(,)-365(Ludwig)-342(Schmidt,)]TJ 19.919 -10.959 Td [(Dimitris)-379(Tsipras,)-411(and)-379(Adrian)-380(Vladu.)-773(T)80(o)25(w)10(ards)-379(deep)-379(learn-)]TJ 0 -10.959 Td [(ing)-302(models)-302(resistant)-302(to)-302(adv)15(ersarial)-302(attacks.)-527(In)]TJ/F79 8.9664 Tf 169.007 0 Td [(International)]TJ -169.007 -10.959 Td [(Confer)37(ence)-250(on)-250(Learning)-250(Repr)37(esentations)-250(\(ICLR\))]TJ/F75 8.9664 Tf 174.663 0 Td [(,)-250(2018.)]TJ
1 0 0 rg 1 0 0 RG
[-360(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(5)]TJ
0 g 0 G
0 g 0 G
-194.582 -13.15 Td [([21])]TJ
0 g 0 G
[-556(Niru)-367(Mahesw)10(aranathan,)-397(Luk)10(e)-368(Metz,)-397(Geor)18(ge)-368(T)45(uck)10(er)40(,)-397(Dami)]TJ 19.919 -10.959 Td [(Choi,)-638(and)-561(Jascha)-560(Sohl-Dickstein.)-1354(Guided)-561(e)25(v)20(olutionary)]TJ 0 -10.959 Td [(strate)15(gies:)-543(Augmenti)1(ng)-367(random)-366(search)-366(with)-367(surrog)5(ate)-366(gra-)]TJ 0 -10.959 Td [(dients.)-767(In)]TJ/F79 8.9664 Tf 41.391 0 Td [(International)-377(Confer)37(ence)-377(on)-377(Mac)15(hine)-378(Learning)]TJ -41.391 -10.959 Td [(\(ICML\))]TJ/F75 8.9664 Tf 27.392 0 Td [(,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(5)]TJ
0 g 0 G
0 g 0 G
-47.311 -13.15 Td [([22])]TJ
0 g 0 G
[-556(Y)111(urii)-356(Nestero)15(v)-357(and)-356(Vladimir)-357(Spok)10(oin)15(y)65(.)-701(Random)-356(gradient-)]TJ 19.919 -10.959 Td [(free)-226(minimization)-226(of)-226(con)40(v)15(e)15(x)-226(functions.)]TJ/F79 8.9664 Tf 140.984 0 Td [(F)105(oundations)-226(of)-226(Com-)]TJ -140.984 -10.959 Td [(putational)-250(Mathematics)]TJ/F75 8.9664 Tf 85.431 0 Td [(,)-250(17\(2\):527\226566,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(6)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(7)]TJ
0 g 0 G
0 g 0 G
-105.35 -13.15 Td [([23])]TJ
0 g 0 G
[-556(Luk)]TJ 34.861 0.044 Td []TJ -0.497 -0.044 Td [(a)]TJ 4.232 0.044 Td [<10>]TJ -0.251 -0.044 Td [(s)-416(Neumann,)-458(Michelle)-416(Kar)18(g,)-457(Shanshan)-416(Zhang,)-458(Chris-)]TJ -18.426 -10.959 Td [(tian)-319(Scharfenber)18(ger)40(,)-337(Eric)-320(Pie)15(gert,)-336(Sarah)-320(Mistr)40(,)-336(Olg)5(a)-320(Prok)10(o-)]TJ 0 -10.959 Td [(fye)25(v)25(a,)-484(Robert)-437(Thiel,)-484(Andrea)-437(V)111(edaldi,)-484(Andre)25(w)-437(Zisserman,)]TJ 0 -10.959 Td [(et)-343(al.)-660(Nighto)25(wls:)-497(A)-343(pedestrians)-343(at)-344(night)-343(dataset.)-659(In)]TJ/F79 8.9664 Tf 195.906 0 Td [(Asian)]TJ -195.906 -10.959 Td [(Confer)37(ence)-353(on)-352(Computer)-353(V)74(ision)]TJ/F75 8.9664 Tf 117.572 0 Td [(,)-378(pages)-353(691\226705.)-352(Springer)40(,)]TJ -117.572 -10.959 Td [(2018.)]TJ
1 0 0 rg 1 0 0 RG
[-360(16)]TJ
0 g 0 G
0 g 0 G
-19.919 -13.15 Td [([24])]TJ
0 g 0 G
[-556(Nicol)1(as)-751(P)15(apernot,)-875(P)15(atrick)-750(McDaniel,)-875(Ian)-750(Goodfello)25(w)65(,)]TJ 19.919 -10.959 Td [(Somesh)-219(J)1(ha,)-225(Z)-219(Berkay)-218(Celik,)-225(and)-219(Ananthram)-218(Sw)10(ami.)-292(Practi-)]TJ 0 -10.959 Td [(cal)-264(black-box)-264(attacks)-264(ag)5(ainst)-264(machine)-264(learning.)-405(In)]TJ/F79 8.9664 Tf 183.873 0 Td [(Pr)45(oceed-)]TJ -183.873 -10.959 Td [(ings)-297(of)-298(the)-297(2017)-298(A)30(CM)-297(on)-297(Asia)-298(confer)37(ence)-297(on)-298(comput)1(er)-298(and)]TJ 0 -10.959 Td [(communications)-250(security)]TJ/F75 8.9664 Tf 89.403 0 Td [(,)-250(pages)-250(506\226519,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(4)]TJ
0 g 0 G
0 g 0 G
-109.322 -13.15 Td [([25])]TJ
0 g 0 G
[-556(Deepak)-368(P)15(athak,)-398(Philipp)-369(Krahenb)20(uhl,)-398(Jef)25(f)-368(Donahue,)-398(T)35(re)25(v)20(or)]TJ 19.919 -10.959 Td [(Darrell,)-480(and)-434(Ale)15(x)15(ei)-434(A)-434(Efros.)-950(Conte)15(xt)-434(encoders:)-678(Feature)]TJ 0 -10.959 Td [(learning)-417(by)-417(inpainting.)-895(In)]TJ/F79 8.9664 Tf 103.668 0 Td [(Pr)45(oceedings)-417(of)-417(the)-417(IEEE)-417(con-)]TJ -103.668 -10.959 Td [(fer)37(ence)-364(on)-364(computer)-363(vision)-364(and)-364(pattern)-364(r)37(eco)10(gnition)]TJ/F75 8.9664 Tf 190.156 0 Td [(,)-392(pages)]TJ -190.156 -10.959 Td [(2536\2262544,)-250(2016.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
203 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/NtqEWnHg4cRtLljG1hMZqw Do
Q
endstream
endobj
204 0 obj
<< /Font << /F57 228 0 R /F74 229 0 R /F75 230 0 R /F79 232 0 R >> /ProcSet [ /PDF /Text ] /XObject << /NtqEWnHg4cRtLljG1hMZqw 316 0 R >> >>
endobj
205 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 164.41 674.223 170.886 684.272 ] /Subtype /Link /Type /Annot >>
endobj
206 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 223.077 629.391 229.552 639.44 ] /Subtype /Link /Type /Annot >>
endobj
207 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 271.583 584.649 278.059 594.631 ] /Subtype /Link /Type /Annot >>
endobj
208 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 165.898 539.728 172.374 549.776 ] /Subtype /Link /Type /Annot >>
endobj
209 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 193.371 472.978 199.847 483.027 ] /Subtype /Link /Type /Annot >>
endobj
210 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 202.338 472.978 208.813 483.027 ] /Subtype /Link /Type /Annot >>
endobj
211 0 obj
<< /A << /D (page.4) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 211.304 472.978 217.78 483.027 ] /Subtype /Link /Type /Annot >>
endobj
212 0 obj
<< /A << /D (page.13) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 220.27 472.978 231.229 483.027 ] /Subtype /Link /Type /Annot >>
endobj
213 0 obj
<< /A << /D (page.14) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 233.72 472.978 244.679 483.027 ] /Subtype /Link /Type /Annot >>
endobj
214 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 92.437 429.962 98.913 438.195 ] /Subtype /Link /Type /Annot >>
endobj
215 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 185.499 372.355 191.974 382.426 ] /Subtype /Link /Type /Annot >>
endobj
216 0 obj
<< /A << /D (page.6) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 194.465 372.355 200.941 382.426 ] /Subtype /Link /Type /Annot >>
endobj
217 0 obj
<< /A << /D (page.7) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 203.431 372.355 209.907 382.426 ] /Subtype /Link /Type /Annot >>
endobj
218 0 obj
<< /A << /D (page.15) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 212.398 372.355 223.357 382.426 ] /Subtype /Link /Type /Annot >>
endobj
219 0 obj
<< /A << /D (page.1) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 114.853 317.241 121.329 326.613 ] /Subtype /Link /Type /Annot >>
endobj
220 0 obj
<< /A << /D (page.2) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 123.819 317.241 130.295 326.613 ] /Subtype /Link /Type /Annot >>
endobj
221 0 obj
<< /A << /D (page.3) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 132.786 317.241 139.262 326.613 ] /Subtype /Link /Type /Annot >>
endobj
222 0 obj
<< /A << /D (page.5) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 141.752 317.241 148.228 326.613 ] /Subtype /Link /Type /Annot >>
endobj
223 0 obj
<< /A << /D (page.15) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 150.719 317.241 161.677 326.613 ] /Subtype /Link /Type /Annot >>
endobj
224 0 obj
<< /A << /D (page.16) /S /GoTo >> /Border [ 0 0 0 ] /C [ 1 0 0 ] /H /I /Rect [ 164.168 317.241 175.127 326.613 ] /Subtype /Link /Type /Annot >>
endobj
225 0 obj
<< /Length 5818 >>
stream
0 g 0 G
0 g 0 G
0 g 0 G
BT
/F75 8.9664 Tf 50.112 710.037 Td [([26])]TJ
0 g 0 G
[-556(Andreas)-256(Rossler)40(,)-259(Da)20(vide)-257(Cozzolino,)-258(Luisa)-257(V)111(erdoli)25(v)25(a,)-258(Chris-)]TJ 19.919 -10.959 Td [(tian)-328(Riess,)-348(Justus)-328(Thies,)-347(and)-328(Matthias)-328(Niener)55(.)-610(F)15(aceforen-)]TJ 0 -10.958 Td [(sics++:)-595(Learning)-393(to)-392(detect)-393(manipulated)-392(f)10(acial)-393(images.)-816(In)]TJ/F79 8.9664 Tf 0 -10.959 Td [(CVPR)]TJ/F75 8.9664 Tf 22.416 0 Td [(,)-250(pages)-250(1\22611,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
0 g 0 G
-42.335 -11.956 Td [([27])]TJ
0 g 0 G
[-556(Natanie)1(l)-343(Ruiz,)-365(Sarah)-342(Adel)-342(Bar)18(g)5(al,)-365(and)-342(Stan)-343(Sclarof)25(f.)-654(Dis-)]TJ 19.919 -10.958 Td [(rupting)-403(deepf)10(ak)10(es:)-616(Adv)15(ersari)1(al)-403(attacks)-403(ag)5(ainst)-403(conditional)]TJ 0 -10.959 Td [(image)-243(tra)1(nslation)-243(netw)10(orks)-242(and)-243(f)10(acial)-243(m)1(anipulation)-243(systems.)]TJ 0 -10.959 Td [(In)]TJ/F79 8.9664 Tf 9.711 0 Td [(ECCV)]TJ/F75 8.9664 Tf 22.918 0 Td [(,)-250(pages)-250(236\226251.)-250(Springer)40(,)-250(2020.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
0 g 0 G
-52.548 -11.955 Td [([28])]TJ
0 g 0 G
[-556(Christi)1(an)-303(Sze)15(gedy)65(,)-316(W)80(ojc)1(iech)-303(Zaremba,)-315(Ilya)-303(Sutsk)10(e)25(v)15(er)40(,)-315(Joan)]TJ 19.919 -10.959 Td [(Bruna,)-355(Dumitru)-335(Erhan,)-355(Ian)-335(J)-334(Goodfello)25(w)65(,)-355(and)-335(Rob)-334(Fer)18(gus.)]TJ 0 -10.959 Td [(Intriguing)-393(properties)-392(of)-393(neural)-392(netw)10(orks.)-816(In)]TJ/F79 8.9664 Tf 169.007 0 Td [(International)]TJ -169.007 -10.959 Td [(Confer)37(ence)-250(on)-250(Learning)-250(Repr)37(esentations)-250(\(ICLR\))]TJ/F75 8.9664 Tf 174.663 0 Td [(,)-250(2014.)]TJ
1 0 0 rg 1 0 0 RG
[-360(3)]TJ
0 g 0 G
0 g 0 G
-194.582 -11.955 Td [([29])]TJ
0 g 0 G
[-556(Rohan)-271(T)80(aori,)-278(Amog)-271(Kamsetty)65(,)-278(Brenton)-272(Chu,)-277(and)-272(Nikita)-271(V)111(e-)]TJ 19.919 -10.959 Td [(muri.)-271(T)80(ar)18(geted)-209(adv)15(ersarial)-209(e)15(xamples)-208(for)-209(black)-209(box)-209(audio)-209(sys-)]TJ 0 -10.959 Td [(tems.)-308(In)]TJ/F79 8.9664 Tf 31.436 0 Td [(2019)-226(IEEE)-226(Security)-226(and)-226(Privacy)-226(W)92(orkshops)-226(\(SPW\))]TJ/F75 8.9664 Tf 182.653 0 Td [(,)]TJ -214.089 -10.959 Td [(pages)-250(15\22620.)-250(IEEE,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(6)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.955 Td [([30])]TJ
0 g 0 G
[-556(Chun-Chen)-268(T)45(u,)-273(P)15(aishun)-268(T)35(ing,)-274(P)1(in-Y)111(u)-269(Chen,)-273(Sijia)-268(Liu,)-273(Huan)]TJ 19.919 -10.959 Td [(Zhang,)-418(Jinfeng)-385(Y)55(i,)-418(Cho-Jui)-385(Hsieh,)-419(and)-384(Shin-Ming)-385(Cheng.)]TJ 0 -10.959 Td [(Autozoom:)-769(Autoencoder)20(-based)-479(zeroth)-480(order)-479(optimization)]TJ 0 -10.959 Td [(method)-403(for)-404(att)1(acking)-404(black-box)-403(neural)-403(netw)10(orks.)-851(In)]TJ/F79 8.9664 Tf 200.299 0 Td [(Pr)45(o-)]TJ -200.299 -10.959 Td [(ceedings)-339(of)-339(the)-339(AAAI)-338(Confer)37(ence)-339(on)-339(Arti\002cial)-339(Intellig)10(ence)]TJ/F75 8.9664 Tf 214.089 0 Td [(,)]TJ -214.089 -10.959 Td [(v)20(olume)-250(33,)-250(pages)-250(742\226749,)-250(2019.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(4)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(13)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(14)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.955 Td [([31])]TJ
0 g 0 G
[-556(Sheng-Y)111(u)-529(W)80(ang,)-599(Oli)25(v)15(er)-529(W)80(ang,)-599(Richard)-529(Zhang,)-599(Andre)25(w)]TJ 19.919 -10.959 Td [(Owens,)-285(and)-279(Ale)15(x)15(ei)-278(A)-278(Efros.)-451(Cnn-generated)-278(images)-279(are)-278(sur)20(-)]TJ 0 -10.959 Td [(prisingly)-209(easy)-209(to)-208(spot...)-209(for)-209(no)25(w)65(.)-271(In)]TJ/F79 8.9664 Tf 124.923 0 Td [(CVPR)]TJ/F75 8.9664 Tf 22.416 0 Td [(,)-209(pages)-209(8695\2268704,)]TJ -147.339 -10.959 Td [(2020.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
0 g 0 G
-19.919 -11.955 Td [([32])]TJ
0 g 0 G
[-556(Chin-Y)111(uan)-194(Y)100(eh,)-205(Hsi-W)80(en)-195(Chen,)-205(Shang-Lun)-195(Tsai,)-205(and)-194(Sheng-)]TJ 19.919 -10.959 Td [(De)-321(W)80(ang.)-588(Disrupting)-321(image-translation-based)-321(deepf)10(ak)10(e)-321(al-)]TJ 0 -10.959 Td [(gorithms)-440(with)-440(adv)15(ersarial)-440(attacks.)-967(In)]TJ/F79 8.9664 Tf 146.091 0 Td [(Pr)45(oceedings)-440(of)-440(the)]TJ -146.091 -10.958 Td [(IEEE)-201(W)55(inter)-200(Confer)37(ence)-201(on)-201(Applications)-201(of)-200(Computer)-201(V)74(ision)]TJ 0 -10.959 Td [(W)92(orkshops)]TJ/F75 8.9664 Tf 39.021 0 Td [(,)-250(pages)-250(53\22662,)-250(2020.)]TJ
1 0 0 rg 1 0 0 RG
[-360(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(6)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(7)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(15)]TJ
0 g 0 G
0 g 0 G
-58.94 -11.956 Td [([33])]TJ
0 g 0 G
[-556(Jun-Y)100(an)-471(Zhu,)-527(T)80(aesung)-471(P)15(ark,)-527(Phillip)-472(Isola,)-526(and)-472(Ale)15(x)15(ei)-471(A)]TJ 19.919 -10.958 Td [(Efros.)-1018(Unpaired)-456(image-to-image)-456(translation)-455(using)-456(c)15(ycle-)]TJ 0 -10.959 Td [(consistent)-254(adv)15(ersarial)-254(netw)10(orks.)-372(In)]TJ/F79 8.9664 Tf 127.728 0 Td [(Pr)45(oceedings)-254(of)-254(the)-254(IEEE)]TJ -127.728 -10.959 Td [(international)-388(confer)37(ence)-387(on)-388(computer)-388(vision)]TJ/F75 8.9664 Tf 163.994 0 Td [(,)-422(pages)-388(2223\226)]TJ -163.994 -10.959 Td [(2232,)-250(2017.)]TJ
1 0 0 rg 1 0 0 RG
[-360(1)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(2)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(3)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(5)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(15)]TJ
0 g 0 G
[(,)]TJ
1 0 0 rg 1 0 0 RG
[-250(16)]TJ
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
0 g 0 G
ET
endstream
endobj
226 0 obj
<< /Length 46 >>
stream
q
1 0 0 1 0 0 cm
/v_q483GTfJUqFY-8h-ATWg Do
Q
endstream
endobj
227 0 obj
<< /Font << /F75 230 0 R /F79 232 0 R >> /ProcSet [ /PDF /Text ] /XObject << /v_q483GTfJUqFY-8h-ATWg 317 0 R >> >>
endobj
228 0 obj
<< /BaseFont /LLQQPZ+CMSY9 /FirstChar 0 /FontDescriptor 318 0 R /LastChar 114 /Subtype /Type1 /ToUnicode 319 0 R /Type /Font /Widths 320 0 R >>
endobj
229 0 obj
<< /BaseFont /QBNXLT+NimbusRomNo9L-Medi /Encoding 321 0 R /FirstChar 2 /FontDescriptor 322 0 R /LastChar 173 /Subtype /Type1 /ToUnicode 323 0 R /Type /Font /Widths 324 0 R >>
endobj
230 0 obj
<< /BaseFont /IFIZPG+NimbusRomNo9L-Regu /Encoding 321 0 R /FirstChar 2 /FontDescriptor 325 0 R /LastChar 223 /Subtype /Type1 /ToUnicode 326 0 R /Type /Font /Widths 327 0 R >>
endobj
231 0 obj
<< /BaseFont /EZHWYE+NimbusMonL-Regu /Encoding 321 0 R /FirstChar 44 /FontDescriptor 328 0 R /LastChar 121 /Subtype /Type1 /ToUnicode 329 0 R /Type /Font /Widths 330 0 R >>
endobj
232 0 obj
<< /BaseFont /HXPWOH+NimbusRomNo9L-ReguItal /Encoding 321 0 R /FirstChar 2 /FontDescriptor 331 0 R /LastChar 121 /Subtype /Type1 /ToUnicode 332 0 R /Type /Font /Widths 333 0 R >>
endobj
233 0 obj
<< /BaseFont /TBIANB+CMR10 /FirstChar 1 /FontDescriptor 334 0 R /LastChar 120 /Subtype /Type1 /ToUnicode 335 0 R /Type /Font /Widths 336 0 R >>
endobj
234 0 obj
<< /BaseFont /THQRCA+NimbusRomNo9L-MediItal /Encoding 321 0 R /FirstChar 40 /FontDescriptor 337 0 R /LastChar 121 /Subtype /Type1 /ToUnicode 338 0 R /Type /Font /Widths 339 0 R >>
endobj
235 0 obj
<< /BitsPerComponent 8 /ColorSpace /DeviceRGB /DecodeParms << /BitsPerComponent 8 /Colors 3 /Columns 521 /Predictor 10 >> /Filter /FlateDecode /Height 358 /Subtype /Image /Type /XObject /Width 521 /Length 175999 >>
stream
x^|lپ;{i$TJ H!j&T]QQT^WoD\7^Ͻ<2gݙ~>!!!___g͙;ҩS5;Yftg
gx<]YɓeO>YѣeOWxpg58Yf5<~u#KRKSC$$|d #"G*IWh36x|N½XZ+Ϭ9}֭}o>ukO-{%vIGVNlH+2AsTBAD"D ћH(T6f4Ldox{ y{{{=dp"" P+J&P$"0Q&SDd,Da\-eBjyYjFXt1vm1#626rx|Q[V/C6dv|pc[ϸm=ZIN*EY6zf_1=kqCzO]ja
c'L*M3, 9&ѧ<ſ&+hʨ֒3VN^2bs]{\Tiš㎭>f¥
SoizyW{缱=-}pk.)-Oq>ZA)AE$/HDixI*D2B!$HLA۰J&xHD*@M%XvT@d)42D$D
$l,e`*!nD;,0gN(1lr~Z}nļdϫ/6CBGA悍sKn,jMeTo7nsOe+ֵo(Y6=}=ZF7
-,wF9#Ph{^h_En؎ɋ&e5dmh]`O.,:u7L}n|el`}^҆La%
|26I2L:EE ^$gf)Tx H ?gVq
7B%TR<-1F"v?¦58pGN_AbHqzT刄Y[y^!X;bJp៰aܵGlꛚ`bjĖi1«KS$ɉ0XLsM
kQ.mŔks7pXV'k/tecfs
tu My{fXS|R~CTe!F($ol A&zߧ g l@*6N$xuWd E($2 *Hj!ת۔"\٤<_0ט5&,#b]C
ǦGM->0
_
n- n*n5]c^Rs~v)'%ΫKl+U7}L4?/֖fN 2%Y|0sF9?<#~D薒髦iݰwQ-8qVU_47v';o>ց{awNkUu:*ZkrR. `^@"yHpc0OIDp#@xp8H:`DiLPd2u1-JS-qv9)ı>@KjeTBPyN|贚´1S*G>m!ӻxX4pg6l;DCU3r5f.]<"aؘI##S9Kr)eH
ҧGJj4D.Wlrƚٛ=f} Y]}jmݳ7<饝-7~Ou:ᮛO\<7M|i.JFiHÐ 7E! !W#O tw _C"x"A8TR!6BeSIb} :̮seZQIˎMsfNY_>8{FUW=͆۷10W ݳvW-:K6u-ZLN_[:8nZ~d}vhe+?֞nN
".Į
2IrUeAR;&uYCꦬMsGYXҧW?k&<ƮٯlD{ozwu_[syی'5DB BP d1Elp3@1
8p#