Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack

Abstract

The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the $l_p$-norms for $p\in \{1,2,\infty \}$ aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one $l_p$-norm, and is robust to the phenomenon of gradient masking.

References in corpus (10)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• Evaluating Robustness of Neural Networks with Mixed Integer Programming
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• Learning with a Strong Adversary
• Adversarial Patch
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Improving the Robustness of Deep Neural Networks via Stability Training
• Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

Cited by in corpus (19)

• Adversarial Weight Perturbation Helps Robust Generalization
• Fixing Data Augmentation to Improve Adversarial Robustness
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Pixle: a fast and effective black-box attack based on rearranging pixels
• Towards Understanding Fast Adversarial Training
• InfoAT: Improving Adversarial Training Using the Information Bottleneck Principle
• Adversarial Example Games
• Jacobian Adversarially Regularized Networks for Robustness
• Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detection
• Adversarial Robustness through the Lens of Convolutional Filters
• Imbalanced Gradients: A Subtle Cause of Overestimated Adversarial Robustness
• SOAR: Second-Order Adversarial Regularization
• Robust Proxy: Improving Adversarial Robustness by Robust Proxy Learning
• Understanding and Achieving Efficient Robustness with Adversarial Supervised Contrastive Learning
• What it Thinks is Important is Important: Robustness Transfers through Input Gradients
• Removing Undesirable Feature Contributions Using Out-of-Distribution Data
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Fast Local Attack: Generating Local Adversarial Examples for Object Detectors
• Bridged Adversarial Training