AdvKnn: Adversarial Attacks On K-Nearest Neighbor Classifiers With Approximate Gradients

Abstract

Deep neural networks have been shown to be vulnerable to adversarial examples---maliciously crafted examples that can trigger the target model to misbehave by adding imperceptible perturbations. Existing attack methods for k-nearest neighbor~(kNN) based algorithms either require large perturbations or are not applicable for large k. To handle this problem, this paper proposes a new method called AdvKNN for evaluating the adversarial robustness of kNN-based models. Firstly, we propose a deep kNN block to approximate the output of kNN methods, which is differentiable thus can provide gradients for attacks to cross the decision boundary with small distortions. Second, a new consistency learning for distribution instead of classification is proposed for the effectiveness in distribution based methods. Extensive experimental results indicate that the proposed method significantly outperforms state of the art in terms of attack success rate and the added perturbations.

Submitted to ICASSP 2020, Implementation https://github.com/fiona-lxd/AdvKnn

References in corpus (8)

• Sequence to Sequence Learning with Neural Networks
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Countering Adversarial Images using Input Transformations
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
• Defending Against Adversarial Examples with K-Nearest Neighbor

Cited by in corpus (4)

• Increasing the Confidence of Deep Neural Networks by Coverage Analysis
• Distributionally Robust Local Non-parametric Conditional Estimation
• Provably Robust Metric Learning
• ASK: Adversarial Soft k-Nearest Neighbor Attack and Defense