Abstract:Extensive studies have revealed that the prevalent deep neural networks (DNNs) are vulnerable to adversarial examples in image recognition tasks. However, previous adversarial example attacks always work in either the global semantic space or local semantic attributes, resulting that these attacks may violate the sophisticated attackers' least-effort intentions, whereas adversarial perturbations due to the explicit semantic variations are probably perceived by human vision. In this paper, we propose a two-phase optimization modeling framework to devise a novel Critical Semantic Fusion guided least-effort Adversarial example attack (CSFAdv). Specifically, the first phase fuses the coarse-&fine-grained semantic maps to localize the latent critical semantic attention region (CSAR) from genuine image. Under the friendly guidance of CSAR-feasibility, the second phase absorbs the ReLU-penalization, -regularization and -limitation to formulate a Top-1&Top-2 misclassification optimization problem, which can characterize the holistic least-effort tampering behaviors embodied in localizing the most critical semantic space, doctoring the least amounts of pixels, injecting the limited amplitudes of perturbations and launching the most readily adversarial attacks. Further, to solve this NP-hard problem mildly, we adapt the gradient renewal by means of merging the momentum (past gradient), present gradient and Hessian (future gradient) to formalize a generalized gradient descent algorithm for generating an optimal adversarial image. Finally, we perform numerical experiments to verify the validity of our CSFAdv against seven types of DNN-based image classifiers on three public ImageNet, MNIST and CIFAR10. Empirical illustrations from ten evaluations indices shed light on the superiority of CSFAdv over eight kinds of state-of-the-art attacks and also offer key clues in reinforcing the DNNs' robustness.

Mathematical Analysis of Adversarial Attacks.

Fooling Neural Network Interpretations - Adversarial Noise to Attack Images.

FCGSM: Fast Conjugate Gradient Sign Method for Adversarial Attack on Image Classification

MC-FGSM: Black-box Adversarial Attack for Deep Learning System

Trans-IFFT-FGSM: a novel fast gradient sign method for adversarial attacks

Evaluating Adversarial Robustness: A Comparison Of FGSM, Carlini-Wagner Attacks, And The Role of Distillation as Defense Mechanism

Adversarial Attacks on Image Classification Models: FGSM and Patch Attacks and their Impact

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Efficient Adversarial Attack Based on Moment Estimation and Lookahead Gradient

An Interpretive Adversarial Attack Method: Attacking Softmax Gradient Layer-Wise Relevance Propagation Based on Cosine Similarity Constraint and TS-Invariant

A randomized gradient-free attack on ReLU networks

Adversarial Attacks Hidden in Plain Sight

CSFAdv: Critical Semantic Fusion Guided Least-Effort Adversarial Example Attacks

Dynamics-aware Adversarial Attack of Adaptive Neural Networks

A Review of Adversarial Attacks in Computer Vision

Exploring Adversarial Attacks on Neural Networks: An Explainable Approach

Algebraic Adversarial Attacks on Integrated Gradients

Adversarial Analysis for Source Camera Identification

Adversarial Attack on Communication Signal Modulation Recognition

[Vitamin E as a natural antioxidant. Preventive importance and requirement].

Unscrambling the Rectification of Adversarial Attacks Transferability across Computer Networks