PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
arXiv:2004.05682
Abstract
Patch-based attacks introduce a perceptible but localized change to the input that induces misclassification. A limitation of current patch-based black-box attacks is that they perform poorly for targeted attacks, and even for the less challenging non-targeted scenarios, they require a large number of queries. Our proposed PatchAttack is query efficient and can break models for both targeted and non-targeted attacks. PatchAttack induces misclassifications by superimposing small textured patches on the input image. We parametrize the appearance of these patches by a dictionary of class-specific textures. This texture dictionary is learned by clustering Gram matrices of feature activations from a VGG backbone. PatchAttack optimizes the position and texture parameters of each patch using reinforcement learning. Our experiments show that PatchAttack achieves > 99% success rate on ImageNet for a wide range of architectures, while only manipulating 3% of the image for non-targeted attacks and 10% on average for targeted attacks. Furthermore, we show that PatchAttack circumvents state-of-the-art adversarial defense methods successfully.
arXiv commentTo appear in ECCV 2020
References in corpus (18)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- Intriguing properties of neural networks
- End to End Learning for Self-Driving Cars
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
- DeepXplore: Automated Whitebox Testing of Deep Learning Systems
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Black-box Adversarial Attacks with Limited Queries and Information
- Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
- DARTS: Deceiving Autonomous Cars with Toxic Signs
- Simple Black-box Adversarial Attacks
- Deceiving Google's Perspective API Built for Detecting Toxic Comments
- Query-Efficient Hard-label Black-box Attack:An Optimization-based Approach
- Cross-Domain Transferability of Adversarial Perturbations
- Transferability of Adversarial Examples to Attack Cloud-based Image Classifier Service
- Cloud-based Image Classification Service Is Not Robust To Simple Transformations: A Forgotten Battlefield
- Identifying Model Weakness with Adversarial Examiner