Structured Adversarial Attack: Towards General Implementation and Better Interpretability

Abstract

When generating adversarial examples to attack deep neural networks (DNNs), Lp norm of the added perturbation is usually used to measure the similarity between original image and adversarial example. However, such adversarial attacks perturbing the raw input spaces may fail to capture structural information hidden in the input. This work develops a more general attack model, i.e., the structured attack (StrAttack), which explores group sparsity in adversarial perturbations by sliding a mask through images aiming for extracting key spatial structures. An ADMM (alternating direction method of multipliers)-based framework is proposed that can split the original problem into a sequence of analytically solvable subproblems and can be generalized to implement other attacking methods. Strong group sparsity is achieved in adversarial perturbations even with the same level of Lp norm distortion as the state-of-the-art attacks. We demonstrate the effectiveness of StrAttack by extensive experimental results onMNIST, CIFAR-10, and ImageNet. We also show that StrAttack provides better interpretability (i.e., better correspondence with discriminative image regions)through adversarial saliency map (Papernot et al., 2016b) and class activation map(Zhou et al., 2016).

arXiv commentPublished as a conference paper at ICLR 2019

Cited by in corpus (38)

• Adversarial Training against Location-Optimized Adversarial Patches
• Topology Attack and Defense for Graph Neural Networks: An Optimization Perspective
• Adaptative Perturbation Patterns: Realistic Adversarial Learning for Robust Intrusion Detection
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Adversarial T-shirt! Evading Person Detectors in A Physical World
• Robustness Verification of Tree-based Models
• Defending against Backdoor Attack on Deep Neural Networks
• Interpreting Adversarial Examples by Activation Promotion and Suppression
• A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learning
• On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learning
• Evaluations and Methods for Explanation through Robustness Analysis
• On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Method
• ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers
• PuVAE: A Variational Autoencoder to Purify Adversarial Examples
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm
• Nonconvex Zeroth-Order Stochastic ADMM Methods with Lower Function Query Complexity
• Towards the Quantification of Safety Risks in Deep Neural Networks
• RamBoAttack: A Robust Query Efficient Deep Neural Network Decision Exploit
• Garment Design with Generative Adversarial Networks
• Zeroth-Order Hybrid Gradient Descent: Towards A Principled Black-Box Optimization Framework
• Internal Wasserstein Distance for Adversarial Attack and Defense
• Adversarial Attack across Datasets
• Brain-inspired reverse adversarial examples
• Light-weight Calibrator: a Separable Component for Unsupervised Domain Adaptation
• Born Identity Network: Multi-way Counterfactual Map Generation to Explain a Classifier's Decision
• Can Perceptual Guidance Lead to Semantically Explainable Adversarial Perturbations?
• Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• Visually Imperceptible Adversarial Patch Attacks on Digital Images
• Towards an Efficient and General Framework of Robust Training for Graph Neural Networks
• Non-Singular Adversarial Robustness of Neural Networks
• Evaluating Adversarial Attacks on ImageNet: A Reality Check on Misclassification Classes
• Group-Structured Adversarial Training
• Interpreting Attributions and Interactions of Adversarial Attacks
• Towards Imperceptible Universal Attacks on Texture Recognition
• Trace-Norm Adversarial Examples
• Zeroth-Order Stochastic Alternating Direction Method of Multipliers for Nonconvex Nonsmooth Optimization