The LogBarrier Adversarial Attack: Making Effective Use of Decision Boundary Information

Abstract

Adversarial attacks for image classification are small perturbations to images that are designed to cause misclassification by a model. Adversarial attacks formally correspond to an optimization problem: find a minimum norm image perturbation, constrained to cause misclassification. A number of effective attacks have been developed. However, to date, no gradient-based attacks have used best practices from the optimization literature to solve this constrained minimization problem. We design a new untargeted attack, based on these best practices, using the well-regarded logarithmic barrier method.On average, our attack distance is similar or better than all state-of-the-art attacks on benchmark datasets (MNIST, CIFAR10, ImageNet-1K). In addition, our method performs significantly better on the most challenging images, those which normally require larger perturbations for misclassification. We employ the LogBarrier attack on several adversarially defended models, and show that it adversarially perturbs all images more efficiently than other attacks: the distance needed to perturb all images is significantly smaller with the LogBarrier attack than with other state-of-the-art attacks.

Improved Gradient based Adversarial Attacks for Quantized Networks

“…Adversarial examples are first observed in [27] and subsequently efficient gradient based attacks such as fgsm [12] and pgd [19] are introduced. There exist recent stronger attacks such as [6,9], however, compared to pgd, they are much slower to be used for adversarial training in practice. Some recent works focus on adversarial robustness of bnns [5,10,17,18], however, a strong consensus on the robustness properties of quantized networks is lacking.…”

Symmetric adversarial poisoning against deep learning

“…At test time, it is possible to design a specific invisible perturbation such as a targeted network eventually predicts different outputs on original and disturbed input. Computer vision is especially concerned with accuracy of unprotected network dropping close to 0% under state of the art attack [12] but other fields are concerned (e.g. [13] highlights this issue in cyber security context with performance of a malware detector dropping from 87% to 66% on adversarial malwares).…”

Partial differential equation regularization for supervised machine learning

“…Classification attacks. In [FPO19] we implemented to the barrier method from constrained optimization [NW06] to perform the classification attack (8.1). While attacks vectors are normally small enough to be invisible, for some images, gradient based attacks are visible.…”