hcliucs/APSD

What it solves

Traditional metrics like $L_p$ norms, PSNR, and SSIM often fail to accurately reflect how humans actually perceive the stealthiness of adversarial perturbations in images. This project provides a way to measure adversarial stealthiness from a human-centric perspective, replacing mathematical distance metrics with human-aligned objective scores.

How it works

The project introduces three main components:

1. Subjective Assessment Protocol: A two-step process where human observers first classify perturbations as "strong" or "weak" stealthiness, then use Scaled Grayscale Difference Maps (SGDM) to provide fine-grained ratings.
2. APSD Dataset: A large-scale benchmark consisting of 10,586 clean-adversarial image pairs across 12 different attack methods (including gradient-based, optimization-based, and generative models) with Mean Opinion Scores (MOS) from 60 human observers.
3. A2SM Model: An attention-based objective model that mimics human scoring habits by combining global and local features using self-, cross-, and spatial-attention mechanisms to predict stealthiness scores.

Who it’s for

Researchers and developers working on adversarial machine learning, image quality assessment, and the security of vision models, who need a way to evaluate how "invisible" an attack is to a human observer.

Highlights

• Human-aligned evaluation: Uses a two-step protocol to capture both subtle and obvious perturbations.
• Comprehensive dataset: Covers 12 attacks across 5 attack families (e.g., FGSM, PGD, AdvGAN).
• High accuracy: The A2SM model achieves high consistency with human visual system (HVS) scores (0.984 PLCC / 0.978 SROCC).
• Large scale: Includes over 10,000 adversarial examples generated from 400 reference images.