Abstract:Extensive studies have revealed that the prevalent deep neural networks (DNNs) are vulnerable to adversarial examples in image recognition tasks. However, previous adversarial example attacks always work in either the global semantic space or local semantic attributes, resulting that these attacks may violate the sophisticated attackers' least-effort intentions, whereas adversarial perturbations due to the explicit semantic variations are probably perceived by human vision. In this paper, we propose a two-phase optimization modeling framework to devise a novel Critical Semantic Fusion guided least-effort Adversarial example attack (CSFAdv). Specifically, the first phase fuses the coarse-&fine-grained semantic maps to localize the latent critical semantic attention region (CSAR) from genuine image. Under the friendly guidance of CSAR-feasibility, the second phase absorbs the ReLU-penalization, -regularization and -limitation to formulate a Top-1&Top-2 misclassification optimization problem, which can characterize the holistic least-effort tampering behaviors embodied in localizing the most critical semantic space, doctoring the least amounts of pixels, injecting the limited amplitudes of perturbations and launching the most readily adversarial attacks. Further, to solve this NP-hard problem mildly, we adapt the gradient renewal by means of merging the momentum (past gradient), present gradient and Hessian (future gradient) to formalize a generalized gradient descent algorithm for generating an optimal adversarial image. Finally, we perform numerical experiments to verify the validity of our CSFAdv against seven types of DNN-based image classifiers on three public ImageNet, MNIST and CIFAR10. Empirical illustrations from ten evaluations indices shed light on the superiority of CSFAdv over eight kinds of state-of-the-art attacks and also offer key clues in reinforcing the DNNs' robustness.

Salient Feature Extractor for Adversarial Defense on Deep Neural Networks

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

An Adversarial Attack Via Feature Contributive Regions

D-DAE: Defense-Penetrating Model Extraction Attacks.

Detection defense against adversarial attacks with saliency map

A Universal Defense Strategy Against Adversarial Attacks Based on Attention-Guided

Improving the Robustness of Deep Convolutional Neural Networks Through Feature Learning

DefenseFea: an Input Transformation Feature Searching Algorithm Based Latent Space for Adversarial Defense

FineFool: A novel DNN object contour attack on image recognition based on the attention perturbation adversarial technique

SAD: Saliency-based Defenses Against Adversarial Examples

CSFAdv: Critical Semantic Fusion Guided Least-Effort Adversarial Example Attacks

New Adversarial Image Detection Based on Sentiment Analysis

ROSA: Robust Salient Object Detection Against Adversarial Attacks

Preprocessing-based Adversarial Defense for Object Detection Via Feature Filtration.

Defense against Adversarial Cloud Attack on Remote Sensing Salient Object Detection

Attention-SA: Exploiting Model-approximated Data Semantics for Adversarial Attack

FDINet: Protecting against DNN Model Extraction via Feature Distortion Index

DetectS Ec: Evaluating the Robustness of Object Detection Models to Adversarial Attacks

Boosting Transferability of Adversarial Samples Via Saliency Distribution and Frequency Domain Enhancement

Feature-Guided Black-Box Safety Testing of Deep Neural Networks

Detecting Localized Adversarial Examples: A Generic Approach Using Critical Region Analysis