Abstract:Numerous methods for crafting adversarial examples were proposed recently with high success rate. Since most existing machine learning based classifiers normalize images into some continuous, real vector, domain firstly, attacks often craft adversarial examples in such domain. However, adversarial examples may become benign after denormalizing them back into the discrete integer domain, known as the discretization problem. This problem was mentioned in some work, but has received relatively little attention. In this work, we first conduct a comprehensive study of existing methods and tools for crafting. We theoretically analyze 34 representative methods and empirically study 20 representative open source tools for crafting adversarial images. Our study reveals that the discretization problem is far more serious than originally thought. This suggests that the discretization problem should be taken into account seriously when crafting adversarial examples and measuring attack success rate. As a first step towards addressing this problem in black-box scenario, we propose a black-box method which reduces the adversarial example searching problem to a derivative-free optimization problem. Our method is able to craft adversarial images by derivative-free search in the discrete integer domain. Experimental results show that our method is comparable to recent white-box methods (e.g., FGSM, BIM and C\&W) and achieves significantly higher success rate in terms of adversarial examples in the discrete integer domain than recent black-box methods (e.g., ZOO, NES-PGD and Bandits). Moreover, our method is able to handle models that is non-differentiable and successfully break the winner of NIPS 2017 competition on defense with 95\% success rate. Our results suggest that discrete optimization algorithms open up a promising area of research into effective black-box attacks.

An Explainable Adversarial Attacks on Privacy-Preserving Image Classification

You See What I Want You to See: Exploring Targeted Black-Box Transferability Attack for Hash-based Image Retrieval Systems

Encryption Inspired Adversarial Defense for Visual Classification

Exploiting Plaintext-Related Mechanism for Secure Color Image Encryption.

Adversarial Defense via Image Denoising with Chaotic Encryption

Exploiting vulnerabilities of deep neural networks for privacy protection

Recoverable Privacy-Preserving Image Classification through Noise-like Adversarial Examples

Defending Against Physically Realizable Attacks on Image Classification

A chaotic image encryption algorithm based on 3-D bit-plane permutation

An Image Encryption Scheme Based on Three-Dimensional Brownian Motion and Chaotic System

Security Evaluation of Compressible Image Encryption for Privacy-Preserving Image Classification against Ciphertext-only Attacks

Robust Image Classification: Defensive Strategies against FGSM and PGD Adversarial Attacks

Perception Improvement for Free: Exploring Imperceptible Black-box Adversarial Attacks on Image Classification

Adversarial Attacks Hidden in Plain Sight

Taking Care of the Discretization Problem:A Black-Box Adversarial Image Attack in Discrete Integer Domain

A New Defense Against Adversarial Images: Turning a Weakness into a Strength

Attacks on Image Encryption Schemes for Privacy-Preserving Deep Neural Networks

Taking Care of The Discretization Problem: A Black Box Adversarial Image Attack in Discrete Integer Domain

Defense against adversarial attacks based on color space transformation

Block-Wise Image Transformation With Secret Key for Adversarially Robust Defense

Evaluating the Robustness of Deep Learning Models against Adversarial Attacks: An Analysis with FGSM, PGD and CW