2,472 research outputs found
Boosting the Transferability of Adversarial Attacks with Global Momentum Initialization
Deep neural networks are vulnerable to adversarial examples, which attach
human invisible perturbations to benign inputs. Simultaneously, adversarial
examples exhibit transferability under different models, which makes practical
black-box attacks feasible. However, existing methods are still incapable of
achieving desired transfer attack performance. In this work, from the
perspective of gradient optimization and consistency, we analyze and discover
the gradient elimination phenomenon as well as the local momentum optimum
dilemma. To tackle these issues, we propose Global Momentum Initialization (GI)
to suppress gradient elimination and help search for the global optimum.
Specifically, we perform gradient pre-convergence before the attack and carry
out a global search during the pre-convergence stage. Our method can be easily
combined with almost all existing transfer methods, and we improve the success
rate of transfer attacks significantly by an average of 6.4% under various
advanced defense mechanisms compared to state-of-the-art methods. Eventually,
we achieve an attack success rate of 95.4%, fully illustrating the insecurity
of existing defense mechanisms
The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples
Adversarial examples are known to have a negative effect on the performance
of classifiers which have otherwise good performance on undisturbed images.
These examples are generated by adding non-random noise to the testing samples
in order to make classifier misclassify the given data. Adversarial attacks use
these intentionally generated examples and they pose a security risk to the
machine learning based systems. To be immune to such attacks, it is desirable
to have a pre-processing mechanism which removes these effects causing
misclassification while keeping the content of the image. JPEG and JPEG2000 are
well-known image compression techniques which suppress the high-frequency
content taking the human visual system into account. JPEG has been also shown
to be an effective method for reducing adversarial noise. In this paper, we
propose applying JPEG2000 compression as an alternative and systematically
compare the classification performance of adversarial images compressed using
JPEG and JPEG2000 at different target PSNR values and maximum compression
levels. Our experiments show that JPEG2000 is more effective in reducing
adversarial noise as it allows higher compression rates with less distortion
and it does not introduce blocking artifacts
Attack Type Agnostic Perceptual Enhancement of Adversarial Images
Adversarial images are samples that are intentionally modified to deceive
machine learning systems. They are widely used in applications such as CAPTHAs
to help distinguish legitimate human users from bots. However, the noise
introduced during the adversarial image generation process degrades the
perceptual quality and introduces artificial colours; making it also difficult
for humans to classify images and recognise objects. In this letter, we propose
a method to enhance the perceptual quality of these adversarial images. The
proposed method is attack type agnostic and could be used in association with
the existing attacks in the literature. Our experiments show that the generated
adversarial images have lower Euclidean distance values while maintaining the
same adversarial attack performance. Distances are reduced by 5.88% to 41.27%
with an average reduction of 22% over the different attack and network types
- …