论文标题
随机稀疏对抗攻击
Stochastic sparse adversarial attacks
论文作者
论文摘要
本文介绍了随机稀疏的对抗攻击（SSAA），其构成神经网络分类器（NNC）的简单，快速和纯粹基于噪声的靶向攻击。 SSAA提供了稀疏（或$ L_0 $）攻击的新示例，此前仅提出了很少的方法。这些攻击是通过利用广泛用于马尔可夫流程的小型扩展想法来设计的。在小型和大型数据集（CIFAR-10和Imagenet）上进行的实验说明了SSAA的几个优点与现状方法相比。例如，在不靶向的情况下，我们称为投票折叠高斯攻击（VFGA）的方法有效地缩放了ImageNet，并且比SparseFool（最多$ \ frac {2} {5} $）的$ L_0 $得分明显低得多，同时更快。此外，当两种攻击在大量样本上都完全成功时，VFGA在Imakenet上的$ L_0 $得分比Sparse-R可以更好。
This paper introduces stochastic sparse adversarial attacks (SSAA), standing as simple, fast and purely noise-based targeted and untargeted attacks of neural network classifiers (NNC). SSAA offer new examples of sparse (or $L_0$) attacks for which only few methods have been proposed previously. These attacks are devised by exploiting a small-time expansion idea widely used for Markov processes. Experiments on small and large datasets (CIFAR-10 and ImageNet) illustrate several advantages of SSAA in comparison with the-state-of-the-art methods. For instance, in the untargeted case, our method called Voting Folded Gaussian Attack (VFGA) scales efficiently to ImageNet and achieves a significantly lower $L_0$ score than SparseFool (up to $\frac{2}{5}$) while being faster. Moreover, VFGA achieves better $L_0$ scores on ImageNet than Sparse-RS when both attacks are fully successful on a large number of samples.
