Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack

Authors: Francesco Croce, Matthias Hein
Published: 2019-07-03 | Updated: 2020-07-20

Source: https://arxiv.org/abs/1907.02044

PDF: https://arxiv.org/pdf/1907.02044

Labels Predicted by AI

敵対的攻撃 ポイズニング 敵対的サンプルの脆弱性

Please note that these labels were automatically added by AI. Therefore, they may not be entirely accurate.
For more details, please see the About the Literature Database page.

Abstract

The evaluation of robustness against adversarial manipulation of neural networks-based classifiers is mainly tested with empirical attacks as methods for the exact computation, even when available, do not scale to large networks. We propose in this paper a new white-box adversarial attack wrt the l_p-norms for p ∈ {1, 2, ∞} aiming at finding the minimal perturbation necessary to change the class of a given input. It has an intuitive geometric meaning, yields quickly high quality results, minimizes the size of the perturbation (so that it returns the robust accuracy at every threshold with a single run). It performs better or similar to state-of-the-art attacks which are partially specialized to one l_p-norm, and is robust to the phenomenon of gradient masking.