Sequential sampling for noisy optimisation with CMA-ES

Groves, Matthew J.; Branke, Juergen

doi:10.1145/3205455.3205559

Cited by 2 publications

(1 citation statement)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The DE utilized in this research belongs to a big class of algorithms called evolutionary strategies [48] which includes other variants such as Adaptive DE [49] and Covariance matrix adaptation evolution strategy (CMA-ES) [50], [51], [52]. In fact, there are a couple of recent developments [61], [62], [63] in evolutionary strategies and related areas that could further improve the current method, allowing for more efficient and accurate attacks.…”

Section: Future Workmentioning

confidence: 99%

One Pixel Attack for Fooling Deep Neural Networks

Vargas

Sakurai

2019

IEEE Trans. Evol. Computat.

1,902

1,067

View full text Add to dashboard Cite

Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-pixel adversarial perturbations based on differential evolution (DE). It requires less adversarial information (a black-box attack) and can fool more types of networks due to the inherent features of DE. The results show that 68.36% of the natural images in Kaggle CIFAR-10 test dataset and 16.04% of the ImageNet (ILSVRC 2012) test images can be perturbed to at least one target class by modifying just one pixel with 73.22% and 22.91% confidence on average. We also show the same vulnerability on original CIFAR-10 dataset. Thus, the proposed attack explores a different take on adversarial machine learning in an extreme limited scenario, showing that current DNNs are also vulnerable to such low dimension attacks. Besides, we also illustrate an important application of DE (or broadly speaking, evolutionary computation) in the domain of adversarial machine learning: creating tools that can effectively generate lowcost adversarial attacks against neural networks for evaluating robustness.

show abstract