Generating transferable adversarial examples based on perceptually-aligned perturbation

Graph neural networks (GNN) have been widely used in many machine learning tasks, such as text classification, sequence labeling, protein interface prediction, and knowledge graph. With increasing security concerns, GNN have been proved to be vulnerable and unreliable. Recent years, inspired by adversarial model in computer vision, various attacks on graph data begin to emerge. However, the exist attacks mostly focus on security violation and attack specificity, and very few attacks concern error specificity. In this paper, we focus on dealing with this kind of attack on one node of the graph by slightly manipulating the graph structure. Our goal is to change the label of the node to what we want after attack. We formulate this case as label specificity attack problem. The biggest challenge in solving this problem is the lack of theoretical guidance to perform this attack. For this, we reinterpret structural entropy and define differential structural entropy (DS-entropy) to guide the manipulation. Based on DS-entropy, we propose the target-label principle and max-degree principle to execute our attack, and then design the corresponding algorithm DSEM. We compare our algorithm DSEM with two benchmarks on three classical graph data

Section: Introductionmentioning

confidence: 99%

Label specificity attack: Change your label as I want

Wang

Liu²,

Yin

et al. 2022

“…Most of the existing methods [26][27][28][29][30][31][32] only judge whether an image has been tampered. Furthermore, some methods that provide localization capabilities often rely on heavy, time-consuming pre-/post-processing, for example, patch extraction, [33][34][35][36][37] expectation-maximization, [38][39][40][41][42] feature clustering, [43][44][45][46] and so forth. Whereas, the time complexity of these methods is too high, and the insufficient utilization of feature information in the image context leads to poor detection performance.…”

Section: Introductionmentioning

confidence: 99%

Image splicing forgery detection by combining synthetic adversarial networks and hybrid dense U‐net based on multiple spaces

Yang

Wang

et al. 2022

With the popularity of image editing tools, the originality and information security of images are facing serious threats. The most common threat is splicing forgery that copies a part of the area from one donor image to the acceptor one. Some research works were proposed to protect the image originality, whereas they are still difficult to apply in practice.There are two main reasons: (a) very limited data for learning models; (b) huge attribute differences between the donor and acceptor images. We propose two novel tasks to conquer the above challenges: Synthetic Adversarial Networks (SANs) and Hybrid Dense U-Net (HDU-Net). SAN finds the most secluded position for inserting tampered areas in an image by learning the association between scenes and objects, and can enlarge the original small data set by more than 40 times. We call the data set SF-Data generated by SAN. We combine the dense U-Net that detects the differences of the essential attributes of image with four spaces containing more available feature information to propose HDU-Net. Then, the synthetic data set SF-Data are used to train HDU-Net. We perform various attack experiments on several public data sets to demonstrate the effectiveness and robustness of our method.

“…An attack with black‐box constraints is often modeled around querying the model on inputs, observing the labels, or confidence scores. Therefore, the studies on black‐box attacks might be more practical than that of white‐box ones in real‐world cases, and the researchers have shown an increased interest in black‐box attacks 26,27 . In brief, numerous attempts have been made to realize black‐box attacks, such as the gradient estimation‐based, 28 query‐based, 29,30 or transferability of AEs‐based 31,32 attacks.…”

Section: Introductionmentioning

confidence: 99%

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Wang¹,

Yin²,

Jiang³

et al. 2022

Fooling deep neural networks (DNNs) with black-box optimization has become a popular adversarial attack fashion, as the prior structural knowledge of DNNs is always unknown. Nevertheless, recent black-box adversarial attacks may struggle to balance their attack ability and visual quality of the generated adversarial examples (AEs) in tackling high-resolution images. In this paper, we propose an attention-guided black-box adversarial attack based on the large-scale multiobjective evolutionary optimization, termed LMOA. By considering the spatial semantic information of images, we first take advantage of the attention map to determine the perturbed pixels. Instead of attacking the entire image, reducing the perturbed pixels with the attention mechanism can help to avoid the notorious curse of dimensionality and thereby improve the performance of attacking. Second, a large-scale multiobjective evolutionary algorithm traverse the reduced pixels in the salient region. Benefiting from its characteristics, the generated AEs can fool target DNNs while being invisible by human vision. Extensive experimental results have verified the effectiveness of the proposed LMOA on the ImageNet data set. More importantly, it is more competitive to generate highresolution AEs with the better visual quality than the existing black-box adversarial attacks.