Abstract:Deep neural networks in the area of information security are facing a severe threat from adversarial examples (AEs). Existing methods of AE generation use two optimization models: (1) taking the successful attack as the objective function and limiting perturbations as the constraint; (2) taking the minimum of adversarial perturbations as the target and the successful attack as the constraint. These all involve two fundamental problems of AEs: the minimum boundary of constructing the AEs and whether that boundary is reachable. The reachability means whether the AEs of successful attack models exist equal to that boundary. Previous optimization models have no complete answer to the problems. Therefore, in this paper, for the first problem, we propose the definition of the minimum AEs and give the theoretical lower bound of the amplitude of the minimum AEs. For the second problem, we prove that solving the generation of the minimum AEs is an NPC problem, and then based on its computational inaccessibility, we establish a new third optimization model. This model is general and can adapt to any constraint. To verify the model, we devise two specific methods for generating controllable AEs under the widely used distance evaluation standard of adversarial perturbations, namely Lp constraint and SSIM constraint (structural similarity). This model limits the amplitude of the AEs, reduces the solution space’s search cost, and is further improved in efficiency. In theory, those AEs generated by the new model which are closer to the actual minimum adversarial boundary overcome the blindness of the adversarial amplitude setting of the existing methods and further improve the attack success rate. In addition, this model can generate accurate AEs with controllable amplitude under different constraints, which is suitable for different application scenarios. In addition, through extensive experiments, they demonstrate a better attack ability under the same constraints as other baseline attacks. For all the datasets we test in the experiment, compared with other baseline methods, the attack success rate of our method is improved by approximately 10%.

Towards A Unified Min-Max Framework for Adversarial Exploration and Robustness

Adversarial Attack Generation Empowered by Min-Max Optimization

Towards Desirable Decision Boundary by Moderate-Margin Adversarial Training

Towards Adversarial Robustness with Multidimensional Perturbations Via Contrastive Learning

Attacks Which Do Not Kill Training Make Adversarial Learning Stronger

Based on Max-Min Framework Transferable Adversarial Attacks

Learning Universal Adversarial Perturbation by Adversarial Example

Theoretical Analysis of Adversarial Learning: A Minimax Approach

Exploring the Adversarial Frontier: Quantifying Robustness via Adversarial Hypervolume

Minimum Adversarial Examples

Understanding Robust Overfitting of Adversarial Training and Beyond

Adversarial Distributional Training for Robust Deep Learning

Revisiting Min-Max Optimization Problem in Adversarial Training

Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness.

Minimax rates of convergence for nonparametric regression under adversarial attacks

Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective

Strength-Adaptive Adversarial Training

Towards Sharper Risk Bounds for Minimax Problems

Hyper Adversarial Tuning for Boosting Adversarial Robustness of Pretrained Large Vision Models

Improving Adversarial Robustness Requires Revisiting Misclassified Examples.

On Model Robustness Against Adversarial Examples