GreedyFool: Distortion-Aware Sparse Adversarial Attack

Abstract

Modern deep neural networks(DNNs) are vulnerable to adversarial samples. Sparse adversarial samples are a special branch of adversarial samples that can fool the target model by only perturbing a few pixels. The existence of the sparse adversarial attack points out that DNNs are much more vulnerable than people believed, which is also a new aspect for analyzing DNNs. However, current sparse adversarial attack methods still have some shortcomings on both sparsity and invisibility. In this paper, we propose a novel two-stage distortion-aware greedy-based method dubbed as "GreedyFool". Specifically, it first selects the most effective candidate positions to modify by considering both the gradient(for adversary) and the distortion map(for invisibility), then drops some less important points in the reduce stage. Experiments demonstrate that compared with the startof-the-art method, we only need to modify 3× fewer pixels under the same sparse perturbation setting. For target attack, the success rate of our method is 9.96% higher than the start-of-the-art method under the same pixel budget. Code can be found at https://github.com/LightDXY/GreedyFool.

Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

“…Dong et al [66] proposed a so-called GreedyFool algorithm that performs a sparse distortion in the input image based on gradients of its pixels. With improved sparsity, the perceptibly of their gradient-based perturbations becomes lower.…”

Adversarial Attack Using Sparse Representation of Feature Maps

“…The sparse adversarial attacks are compared with the stateof-the-art attacks i.e. C&W [6] Corner Search [26] Sparse Fool [25], Greedy Fool [27] and FGSM [5]. C&W [6] is considered to generate adversarial examples with minimum ℓ 2 noise, yet it is impractical because of its high number of iterations [7], [8].…”

“…Sparse attacks have been recently introduced in the field of adversarial attacks. Some of the early sparse attacks in adversarial setting includes JSMA [24], Sparse Fool [25], Corner Search [26] and Greedy Fool [27]. Sparse Fool [25] disrupts the geometrical properties of the images whereas, Corner Search [26] aims at minimizing the distance of the perturbation to the original image.…”

Distortion-aware adversarial attack against steganalysis detectors

“…In order to resist steganalyzer, Dong et al [12] proposed using generative adversarial network to generate a distortion map. However, this method has some disadvantages, such as slow generation speed and unable to migrate.…”