Abstract:This work studies the sparse adversarial attack, which aims to generate adversarial perturbations onto partial positions of one benign image, such that the perturbed image is incorrectly predicted by one deep neural network (DNN) model. The sparse adversarial attack involves two challenges, i.e., where to perturb, and how to determine the perturbation magnitude. Many existing works determined the perturbed positions manually or heuristically, and then optimized the magnitude using a proper algorithm designed for the dense adversarial attack. In this work, we propose to factorize the perturbation at each pixel to the product of two variables, including the perturbation magnitude and one binary selection factor (i.e., 0 or 1). One pixel is perturbed if its selection factor is 1, otherwise not perturbed. Based on this factorization, we formulate the sparse attack problem as a mixed integer programming (MIP) to jointly optimize the binary selection factors and continuous perturbation magnitudes of all pixels, with a cardinality constraint on selection factors to explicitly control the degree of sparsity. Besides, the perturbation factorization provides the extra flexibility to incorporate other meaningful constraints on selection factors or magnitudes to achieve some desired performance, such as the group-wise sparsity or the enhanced visual imperceptibility. We develop an efficient algorithm by equivalently reformulating the MIP problem as a continuous optimization problem. Extensive experiments demonstrate the superiority of the proposed method over several state-of-the-art sparse attack methods. The implementation of the proposed method is available at https://github.com/wubaoyuan/Sparse-Adversarial-Attack.

Certifiable Robustness to Discrete Adversarial Perturbations for Factorization Machines

L G ] 1 7 A pr 2 01 8 A Boosting Framework of Factorization Machine

A Boosting Framework of Factorization Machine.

Robust Factorization Machine - A Doubly Capped Norms Minimization.

Fast Convolutional Factorization Machine with Enhanced Robustness

Privacy-Preserving Convex Factorization Machine

Deep Factorization Model for Robust Recommendation

Boosting Factorization Machines Via Saliency-Guided Mixup

An Intelligent Field-Aware Factorization Machine Model

Augment then Smooth: Reconciling Differential Privacy with Certified Robustness

Robustness Analysis on Foundational Segmentation Models

Improving Machine Learning Robustness via Adversarial Training

It's Simplex! Disaggregating Measures to Improve Certified Robustness

Towards Certified Probabilistic Robustness with High Accuracy

Beyond Robustness: Resilience Verification of Tree-Based Classifiers

Certified Adversarial Robustness of Machine Learning-based Malware Detectors via (De)Randomized Smoothing

On the Certified Robustness for Ensemble Models and Beyond

On the Vulnerability of Adversarially Trained Models Against Two-faced Attacks

Certified Adversarial Robustness Under the Bounded Support Set.

Sparse Adversarial Attack via Perturbation Factorization

Online Compact Convexified Factorization Machine.