Google's Cloud Vision API is Not Robust to Noise

Google has recently introduced the Cloud Vision API for image analysis. According to the demonstration website, the API "quickly classifies images into thousands of categories, detects individual objects and faces within images, and finds and reads printed words contained within images." I...

Full description

Saved in:
Bibliographic Details
Published in2017 16th IEEE International Conference on Machine Learning and Applications (ICMLA) pp. 101 - 105
Main Authors Hosseini, Hossein, Baicen Xiao, Poovendran, Radha
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.12.2017
Subjects
adversarial machine learning
Biological system modeling
Gaussian noise
Google
Google Cloud Vision API
Image Noise
Image restoration
machine learning
Noise measurement
Perturbation methods
Robustness
Online AccessGet full text

Cover

More Information
Summary:Google has recently introduced the Cloud Vision API for image analysis. According to the demonstration website, the API "quickly classifies images into thousands of categories, detects individual objects and faces within images, and finds and reads printed words contained within images." It can be also used to "detect different types of inappropriate content from adult to violent content." In this paper, we evaluate the robustness of Google Cloud Vision API to input perturbation. In particular, we show that by adding sufficient noise to the image, the API generates completely different outputs for the noisy image, while a human observer would perceive its original content. We show that the attack is consistently successful, by performing extensive experiments on different image types, including natural images, images containing faces and images with texts. For instance, using images from ImageNet dataset, we found that adding an average of 14.25% impulse noise is enough to deceive the API. Our findings indicate the vulnerability of the API in adversarial environments. For example, an adversary can bypass an image filtering system by adding noise to inappropriate images. We then show that when a noise filter is applied on input images, the API generates mostly the same outputs for restored images as for original images. This observation suggests that cloud vision API can readily benefit from noise filtering, without the need for updating image analysis algorithms.
DOI:10.1109/ICMLA.2017.0-172