Attention‐guided transformation‐invariant attack for black‐box adversarial examples

Zhu, Jiaqi; Dai, Feng; Yu, Lingyun; Xie, Hongtao; Wang, Lidong; Wu, Bo; Zhang, Yongdong

doi:10.1002/int.22808

Cited by 6 publications

(3 citation statements)

References 44 publications

(77 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Its differential mechanism can effectively maintain the diversity of the population and is thus widely used. The introduction of the DE algorithm makes it unnecessary to know internal information such as model gradients for one-pixel attack, making it a semi-black-box attack [23]. However, probabilistic information about the classification results is still required.…”

Section: One-pixel Attack Modulementioning

confidence: 99%

Adversarial system of one-pixel attack for hyperspectral image classification

Peng,

Zhou,

Sun

et al. 2023

Preprint

View full text Add to dashboard Cite

The introduction of deep learning arouses great success in hyperspectral image (HSI) classification. However, there is a growing concern about adversarial attacks on deep models, which can significantly impact the performance of HSI classification through imperceptible perturbations. In this paper, we first introduce a semi-black-box attack method to hyperspectral domain, one-pixel attack, which fools the HSI classifier by modifying only one pixel with high intensity. It is verified on standard datasets and a well-known HSI classification model, HybridSN. An adversarial system based on one-pixel attack (OPAS) is then proposed by integrating adversarial training into model training. The system not only improves the robustness of the classification model but also enhances the model’s ability to defend against other adversarial attacks. Experimental results demonstrate show that OPAS can achieve nearly 100% defense effectiveness against some basic adversarial attacks. Additionally, an HSI adversarial map is created to visualize one-pixel attack. Through it can be observed the characteristic that one-pixel attack can attack classification boundaries, and this property is further verified in hyperspectral field.

show abstract

Section: One-pixel Attack Modulementioning

confidence: 99%

Adversarial system of one-pixel attack for hyperspectral image classification

Peng,

Zhou,

Sun

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…In other words, changing the pixels in the foreground region of an image is more effective than attacking the entire image. 38,57 The fact motivated us to use an attention mechanism to restrict the attack within the salient pixels in the foreground region. More importantly, from the perspective of optimization, this implementation can greatly reduce the search space and the complexity of the optimization.…”

Section: Motivationmentioning

confidence: 99%

“…It is also worth noting that the foreground region usually contains more texture information than the background one. In other words, changing the pixels in the foreground region of an image is more effective than attacking the entire image 38,57 . The fact motivated us to use an attention mechanism to restrict the attack within the salient pixels in the foreground region.…”

Section: Related Workmentioning

confidence: 99%

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Wang¹,

Yin²,

Jiang³

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Fooling deep neural networks (DNNs) with black-box optimization has become a popular adversarial attack fashion, as the prior structural knowledge of DNNs is always unknown. Nevertheless, recent black-box adversarial attacks may struggle to balance their attack ability and visual quality of the generated adversarial examples (AEs) in tackling high-resolution images. In this paper, we propose an attention-guided black-box adversarial attack based on the large-scale multiobjective evolutionary optimization, termed LMOA. By considering the spatial semantic information of images, we first take advantage of the attention map to determine the perturbed pixels. Instead of attacking the entire image, reducing the perturbed pixels with the attention mechanism can help to avoid the notorious curse of dimensionality and thereby improve the performance of attacking. Second, a large-scale multiobjective evolutionary algorithm traverse the reduced pixels in the salient region. Benefiting from its characteristics, the generated AEs can fool target DNNs while being invisible by human vision. Extensive experimental results have verified the effectiveness of the proposed LMOA on the ImageNet data set. More importantly, it is more competitive to generate highresolution AEs with the better visual quality than the existing black-box adversarial attacks.

show abstract

Deep learning adversarial attacks and defenses on license plate recognition system

Vizcarra,

Alhamed,

Algosaibi

et al. 2024

Cluster Comput

View full text Add to dashboard Cite

The breakthroughs in Machine learning and deep neural networks have revolutionized the handling of critical practical challenges, achieving state-of-the-art performance in various computer vision tasks. Notably, the application of deep neural networks in optical character recognition (OCR) has significantly enhanced the performance of OCR systems, making them a pivotal preprocessing component in text analysis pipelines for crucial applications such as license plate recognition (LPR) systems, where the efficiency of OCR is paramount. However, despite the advancements, the integration of deep neural networks in OCR introduces inherent security vulnerabilities, particularly susceptibility to adversarial examples. Adversarial examples in LPR systems are crafted by introducing perturbations to original license plate images, which can effectively compromise the integrity of the license plate recognition process, leading to erroneous license plate number identification. Given that the primary goal of OCR in this context is to accurately recognize license plate numbers, even a single misinterpreted character can significantly impact the overall performance of the LPR system. The vulnerability of LPR systems to adversarial attacks underscores the urgent need to address the security weaknesses inherited from deep neural networks. In response to these challenges, the exploration of alternative defense mechanisms, such as image denoising and in-painting, presents a compelling approach to bolstering the resilience of LPR systems against adversarial attacks. By prioritizing practical implementation and integration of image denoising and inpainting techniques align with the operational requirements of real-world LPR systems. These methods can be seamlessly integrated into existing pipelines, offering pragmatic and accessible means of enhancing security without imposing significant computational overhead. By embracing a multi-faceted approach that combines the strengths of traditional image processing techniques, the research endeavors to develop comprehensive and versatile defense strategies tailored to the specific vulnerabilities and requirements of LPR systems. This holistic approach aims to fortify LPR systems against adversarial threats, thereby fostering increased trust and reliability in the deployment of OCR and LPR technologies across various domains and applications.

show abstract

Attention‐guided transformation‐invariant attack for black‐box adversarial examples

Cited by 6 publications

References 44 publications

Adversarial system of one-pixel attack for hyperspectral image classification

Adversarial system of one-pixel attack for hyperspectral image classification

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Deep learning adversarial attacks and defenses on license plate recognition system

Contact Info

Product

Resources

About