  Vignetting is an inherited imaging phenomenon within almost all optical
systems, showing as a radial intensity darkening toward the corners of an
image. Since it is a common effect for photography and usually appears as a
slight intensity variation, people usually regard it as a part of a photo and
would not even want to post-process it. Due to this natural advantage, in this
work, we study vignetting from a new viewpoint, i.e., adversarial vignetting
attack (AVA), which aims to embed intentionally misleading information into
vignetting and produce a natural adversarial example without noise patterns.
This example can fool the state-of-the-art deep convolutional neural networks
(CNNs) but is imperceptible to humans. To this end, we first propose the
radial-isotropic adversarial vignetting attack (RI-AVA) based on the physical
model of vignetting, where the physical parameters (e.g., illumination factor
and focal length) are tuned through the guidance of target CNN models. To
achieve higher transferability across different CNNs, we further propose
radial-anisotropic adversarial vignetting attack (RA-AVA) by allowing the
effective regions of vignetting to be radial-anisotropic and shape-free.
Moreover, we propose the geometry-aware level-set optimization method to solve
the adversarial vignetting regions and physical parameters jointly. We validate
the proposed methods on three popular datasets, i.e., DEV, CIFAR10, and Tiny
ImageNet, by attacking four CNNs, e.g., ResNet50, EfficientNet-B0, DenseNet121,
and MobileNet-V2, demonstrating the advantages of our methods over baseline
methods on both transferability and image quality.
