Sparse and Imperceivable Adversarial Attacks

Abstract

Neural networks have been proven to be vulnerable to a variety of adversarial attacks. From a safety perspective, highly sparse adversarial attacks are particularly dangerous. On the other hand the pixelwise perturbations of sparse attacks are typically large and thus can be potentially detected. We propose a new black-box technique to craft adversarial examples aiming at minimizing l 0distance to the original image. Extensive experiments show that our attack is better or competitive to the state of the art. Moreover, we can integrate additional bounds on the componentwise perturbation. Allowing pixels to change only in region of high variation and avoiding changes along axisaligned edges makes our adversarial examples almost nonperceivable. Moreover, we adapt the Projected Gradient Descent attack to the l 0 -norm integrating componentwise constraints. This allows us to do adversarial training to enhance the robustness of classifiers against sparse and imperceivable adversarial manipulations.In this paper we are dealing specifically with sparse ad-arXiv:1909.05040v1 [cs.LG]

Back in Black: A Comparative Evaluation of Recent State-Of-The-Art Black-Box Attacks

“…CornerSearch [36] proposes a black-box attack based on finding an adversarial example with respect to the l 0 norm. Abandoning norm based constraints completely, Patch Attack [37] replaces a certain area of the image with an adversarial patch.…”

“…We cover three non-traditional norm attacks in this section. The first attack we summarize is the sparse and imperceivable attack [36] which focuses on black-box attacks with respect to the l 0 norm. The second non-traditional norm attack we survey is Patch Attack [37].…”

“…The Sparse and Imperceivable attacks proposed in [36] are l 0 , black-box attacks that produce adversarial inputs while minimizing the number of perturbed pixels. The attacks come in multiple forms, but the general goal and scheme remains the same.…”

“…Score based Attacks qMeta [24] wc = 1, wq = 0, wϵ = 0 P-RGF [25] wc = 1, wq = 0, wϵ = 1 ZO-ADMM [26] wc = 1, wq = 0, wϵ = 0 TREMBA [27] wc = 1, wq = 0, wϵ = 1 Square [28] wc = 1, wq = 0, wϵ = 1 ZO-NGD [26] wc = 1, wq = 0, wϵ = 1 PPBA [30] wc = 1, wq = 0, wϵ = 1 Decision based Attacks qFool [31] wc = 0, wq = 1, wϵ = 0 HSJA [10] wc = 1, wq = 1, wϵ = 0 GeoDA [32] wc = 0, wq = 1, wϵ = 0 QEBA [33] wc = 1, wq = 1, wϵ = 1 RayS [34] wc = 1, wq = 0, wϵ = 1 SurFree [12] wc = 1, wq = 1, wϵ = 1 NonLinear-BA [35] wc = 1, wq = 0, wϵ = 0 Transfer based Attacks Adaptive [22] wc = 1, wq = 0, wϵ = 1 DaST [9] wc = 1, wq = 0, wϵ = 1 PO-TI [23] wc = 1, wq = 0, wϵ = 1 Non-traditional Attacks CornerSearch [36] wc = 1, wq = 0, wϵ = 0 ColorFool [38] wc = 1, wq = 0, wϵ = 0 Patch [37] wc = 1, wq = 0, wϵ = 0 scenario. Likewise, for black-box transfer attacks using our framework can also yield insights.…”

Efficient and Robust Classification for Sparse Attacks

“…They were initially shown to be effective in causing classification errors throughout different machine learning models [5,6,7]. Following this, a lot of effort has been put into generating increasingly more complex attack models that can utilize a small amount of semantic-preserving modifications, while still being able to fool a classifier [8,9,10]. Typically, this is done by constraining the perturbations with an p -norm, where the most common settings use either ∞ [11,12,9,8,13,14,15], 2 [16,9,17,18,19], or 1 [20,21].…”