ELAA: An efficient local adversarial attack using model interpreters

Abstract

Modern deep neural networks are highly vulnerable to adversarial examples, which attracts more and more researchers' attention to craft powerful adversarial examples. Most of these generation algorithms create global perturbations that would affect the visual quality of adversarial examples. To mitigate such drawbacks, some attacks attempt to generate local perturbations. However, existing local adversarial attacks are time‐consuming and the generated adversarial examples are still distinguishable from clean images. In this paper, we propose a novel efficient local adversarial attack (ELAA) using model interpreters to generate severe local perturbations and improve the imperceptibly of the generated adversarial examples. Specifically, we take advantage of model interpretation methods to search the discriminative regions of clean images. Then, we generate local adversarial examples by adding masks to original clean images. We also propose a new optimization method to reduce the redundancy of local perturbations. Through extensive experiments, we show our ELAA can maintain a high attack ability while preserving the visual quality of clean images. Experimental results also demonstrate our local attack outperforms state‐of‐the‐art local attack methods under various system settings.

Feature autoencoder for detecting adversarial examples

“…38,39 In recent years, more and more attack algorithms have emerged. 40,41 In this paper, we focus on white box adversarial attacks, because the measurement criterion of defense technology is to resist white box attacks.…”

“…The universal perturbations have a remarkable generalization property, which can fool new images with high probability. In the automatic driving vehicle system using DNN to identify traffic signs, attackers classify “stop” signs as “speed limit.” 38,39 In recent years, more and more attack algorithms have emerged 40,41 . In this paper, we focus on white box adversarial attacks, because the measurement criterion of defense technology is to resist white box attacks.…”

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

“…By seeking the relationship between perturbation and object contours, FineFool provides a better attack performance with less perturbation. Guo et al 10 proposed a local attack method (ELAA) that uses a model interpretation approach to find the identification region, which is combined with the original adversarial attack to achieve. Other than the above works, a great deal of work has also been presented, aiming at obtaining AEs that are more robust to unknown and more defensive DNNs 31,38 .…”

“…In the past decade, a series of studies have shown that DNNs are vulnerable to adversarial examples (AEs) by imposing some designed perturbations to original images. [5][6][7][8][9][10] These perturbations are imperceptible to human beings but can easily fool DNNs, which raises invisible threats to the vision-based automatic decision. [11][12][13][14][15] Consequently, the robustness of DNNs encounters great challenges in real-world applications.…”

Robust flocking of multiple intelligent agents with multiple disturbances

“…In [18,19], a disturbance observer (DO) for second-order MIAs was designed to deal with the consensus with external disturbances. A similar idea was used in the cases of modern deep neural networks in [20], the robust finite-time consensus in [21], and the inversion model in [22]. In [23,24], a control method was proposed to achieve the robust consensus with time-delays and exogenous disturbances.…”