Adversarial examples: attacks and defenses in the physical world

Ren, Huali; Huang, Teng; Yan, Hongyang

doi:10.1007/s13042-020-01242-z

Cited by 67 publications

(37 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…[11][12][13][14][15] Consequently, the robustness of DNNs encounters great challenges in real-world applications. 16,17 For example, the existence of AEs can pose severe security threats for traffic sign recognition in autonomous driving. 18 AEs in object detection will also influence the region proposals and bring undesirable segmentation and classification.…”

Section: Introductionmentioning

confidence: 99%

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Wang¹,

Yin²,

Jiang³

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

Fooling deep neural networks (DNNs) with black-box optimization has become a popular adversarial attack fashion, as the prior structural knowledge of DNNs is always unknown. Nevertheless, recent black-box adversarial attacks may struggle to balance their attack ability and visual quality of the generated adversarial examples (AEs) in tackling high-resolution images. In this paper, we propose an attention-guided black-box adversarial attack based on the large-scale multiobjective evolutionary optimization, termed LMOA. By considering the spatial semantic information of images, we first take advantage of the attention map to determine the perturbed pixels. Instead of attacking the entire image, reducing the perturbed pixels with the attention mechanism can help to avoid the notorious curse of dimensionality and thereby improve the performance of attacking. Second, a large-scale multiobjective evolutionary algorithm traverse the reduced pixels in the salient region. Benefiting from its characteristics, the generated AEs can fool target DNNs while being invisible by human vision. Extensive experimental results have verified the effectiveness of the proposed LMOA on the ImageNet data set. More importantly, it is more competitive to generate highresolution AEs with the better visual quality than the existing black-box adversarial attacks.

show abstract

Section: Introductionmentioning

confidence: 99%

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Wang¹,

Yin²,

Jiang³

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

show abstract

“…Deep neural networks (DNNs) have achieved superior performance in many applications. [1][2][3][4] However, recent works have shown that DNNs are vulnerable to adversarial examples, [5][6][7][8] that is, input images perturbed by imperceptible noise can lead to inaccurate predictions of DNNs. The existence of adversarial examples raises concerns in security-sensitive applications, for example, self-driving cars 9 and face recognition.…”

Section: Introductionmentioning

confidence: 99%

Boosting cross‐task adversarial attack with random blur

Zhang

Tan

et al. 2022

Int J of Intelligent Sys

View full text Add to dashboard Cite

“…Adversarial machine learning is concerned with attack techniques that aim to deceive models by adding visually imperceptible noises to the input [21,29]. An adversarial example is an instance generated from adversarial machine learning.…”

Section: Introductionmentioning

confidence: 99%

Attack-less adversarial training for a robust adversarial defense

Lee

Kang

2021

Appl Intell

View full text Add to dashboard Cite

Adversarial examples have proved efficacious in fooling deep neural networks recently. Many researchers have studied this issue of adversarial examples by evaluating neural networks against their attack techniques and increasing the robustness of neural networks with their defense techniques. To the best of our knowledge, adversarial training is one of the most effective defense techniques against the adversarial examples. However, the method is not able to cope with new attacks because it requires attack techniques in the training phase. In this paper, we propose a novel defense technique, Attack-Less Adversarial Training (ALAT) method, which is independent from any attack techniques, thereby is useful in preventing future attacks. Specifically, ALAT regenerates every pixel of an image into different pixel value, which commonly eliminates the majority of the adversarial noises in the adversarial example. This pixel regeneration is useful in defense because the adversarial noises are the core problem that make the neural networks produce high misclassification rate. Our experiment results with several benchmark datasets show that our method not only relieves over-fitting issue during the training of neural networks with a large number of epochs, but also boosts the robustness of the neural network.

show abstract

Adversarial examples: attacks and defenses in the physical world

Cited by 67 publications

References 32 publications

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Attention‐guided black‐box adversarial attacks with large‐scale multiobjective evolutionary optimization

Boosting cross‐task adversarial attack with random blur

Attack-less adversarial training for a robust adversarial defense

Contact Info

Product

Resources

About