GreedyFool: Distortion-Aware Sparse Adversarial Attack
arXiv:2010.13773
Abstract
Modern deep neural networks(DNNs) are vulnerable to adversarial samples. Sparse adversarial samples are a special branch of adversarial samples that can fool the target model by only perturbing a few pixels. The existence of the sparse adversarial attack points out that DNNs are much more vulnerable than people believed, which is also a new aspect for analyzing DNNs. However, current sparse adversarial attack methods still have some shortcomings on both sparsity and invisibility. In this paper, we propose a novel two-stage distortion-aware greedy-based method dubbed as "GreedyFool". Specifically, it first selects the most effective candidate positions to modify by considering both the gradient(for adversary) and the distortion map(for invisibility), then drops some less important points in the reduce stage. Experiments demonstrate that compared with the start-of-the-art method, we only need to modify fewer pixels under the same sparse perturbation setting. For target attack, the success rate of our method is 9.96\% higher than the start-of-the-art method under the same pixel budget. Code can be found at https://github.com/LightDXY/GreedyFool.
To appear in NeurIPS 2020, code: https://github.com/LightDXY/GreedyFool
References in corpus (14)
- Intriguing properties of neural networks
- Ensemble Adversarial Training: Attacks and Defenses
- Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
- ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
- Towards Deep Learning Models Resistant to Adversarial Attacks
- Synthesizing Robust Adversarial Examples
- The Space of Transferable Adversarial Examples
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- Generating Adversarial Examples with Adversarial Networks
- MagNet: a Two-Pronged Defense against Adversarial Examples
- Improving Black-box Adversarial Attacks with a Transfer-based Prior
- Functional Adversarial Attacks
- A randomized gradient-free attack on ReLU networks
- Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once