Abstract:Deep neural networks in the area of information security are facing a severe threat from adversarial examples (AEs). Existing methods of AE generation use two optimization models: (1) taking the successful attack as the objective function and limiting perturbations as the constraint; (2) taking the minimum of adversarial perturbations as the target and the successful attack as the constraint. These all involve two fundamental problems of AEs: the minimum boundary of constructing the AEs and whether that boundary is reachable. The reachability means whether the AEs of successful attack models exist equal to that boundary. Previous optimization models have no complete answer to the problems. Therefore, in this paper, for the first problem, we propose the definition of the minimum AEs and give the theoretical lower bound of the amplitude of the minimum AEs. For the second problem, we prove that solving the generation of the minimum AEs is an NPC problem, and then based on its computational inaccessibility, we establish a new third optimization model. This model is general and can adapt to any constraint. To verify the model, we devise two specific methods for generating controllable AEs under the widely used distance evaluation standard of adversarial perturbations, namely Lp constraint and SSIM constraint (structural similarity). This model limits the amplitude of the AEs, reduces the solution space’s search cost, and is further improved in efficiency. In theory, those AEs generated by the new model which are closer to the actual minimum adversarial boundary overcome the blindness of the adversarial amplitude setting of the existing methods and further improve the attack success rate. In addition, this model can generate accurate AEs with controllable amplitude under different constraints, which is suitable for different application scenarios. In addition, through extensive experiments, they demonstrate a better attack ability under the same constraints as other baseline attacks. For all the datasets we test in the experiment, compared with other baseline methods, the attack success rate of our method is improved by approximately 10%.

Adversarial Example Generation using Evolutionary Multi-objective Optimization

Evolutionary Multi-objective Optimization for Contextual Adversarial Example Generation

A Multi-objective Examples Generation Approach to Fool the Deep Neural Networks in the Black-Box Scenario

Query-Efficient Generation of Adversarial Examples for Defensive DNNs via Multi-Objective Optimization

An Adversarial Attack Based On Multi-Objective Optimization In The Black-Box Scenario: Moea-Apga Ii

Generating Adversarial Examples with an Optimized Quality

Image Adversarial Example Generation Method Based on Adaptive Parameter Adjustable Differential Evolution

RAE-TPE: A Reversible Adversarial Example Generation Method Based on Thumbnail Preserving Encryption

Evoattack: suppressive adversarial attacks against object detection models using evolutionary search

Evolution Attack On Neural Networks

Imperceptible and Sparse Adversarial Attacks Via a Dual-Population-Based Constrained Evolutionary Algorithm

Art-Attack: Black-Box Adversarial Attack via Evolutionary Art

Generating Adversarial Examples with Task Oriented Multi-Objective Optimization

Generating Minimalist Adversarial Perturbations to Test Object-Detection Models: An Adaptive Multi-Metric Evolutionary Search Approach

Genetic Algorithm with Multiple Fitness Functions for Generating Adversarial Examples

A New Kind of Adversarial Example

An efficient general black-box adversarial attack approach based on multi-objective optimization for high dimensional images

Gradient-free adversarial attack algorithm based on differential evolution

Minimum Adversarial Examples

A General Framework for Adversarial Examples with Objectives

EGM: an Efficient Generative Model for Unrestricted Adversarial Examples