Trace-Norm Adversarial Examples

Abstract

White box adversarial perturbations are sought via iterative optimization algorithms most often minimizing an adversarial loss on a $l_p$ neighborhood of the original image, the so-called distortion set. Constraining the adversarial search with different norms results in disparately structured adversarial examples. Here we explore several distortion sets with structure-enhancing algorithms. These new structures for adversarial examples, yet pervasive in optimization, are for instance a challenge for adversarial theoretical certification which again provides only $l_p$ certificates. Because adversarial robustness is still an empirical field, defense mechanisms should also reasonably be evaluated against differently structured attacks. Besides, these structured adversarial perturbations may allow for larger distortions size than their $l_p$ counter-part while remaining imperceptible or perceptible as natural slight distortions of the image. Finally, they allow some control on the generation of the adversarial perturbation, like (localized) bluriness.

References in corpus (15)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Learning What and Where to Draw
• Stable and Controllable Neural Texture Synthesis and Style Transfer Using Histogram Losses
• Semidefinite relaxations for certifying robustness to adversarial examples
• Motivating the Rules of the Game for Adversarial Example Research
• Structured Adversarial Attack: Towards General Implementation and Better Interpretability
• Convex Tensor Decomposition via Structured Schatten Norm Regularization
• Faster Rates for the Frank-Wolfe Method over Strongly-Convex Sets
• ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation
• A Linearly Convergent Conditional Gradient Algorithm with Applications to Online and Stochastic Optimization
• An Affine Invariant Linear Convergence Analysis for Frank-Wolfe Algorithms
• Should Adversarial Attacks Use Pixel p-Norm?
• On the Effect of Low-Rank Weights on Adversarial Robustness of Neural Networks
• Projection Free Rank-Drop Steps