Universal Adversarial Attack Via Enhanced Projected Gradient Descent

The goal of textual adversarial attack methods is to replace some words in an input text in order to make the victim model misbehave. This article proposes an effective word-level adversarial attack method based on sememes and an improved quantum-behaved particle swarm optimization (QPSO) algorithm. The sememe-based substitute method, which uses the words sharing the same sememes as the substitutes of the original words, is first employed to form the reduced search space. Then, an improved QPSO algorithm, called historical information-guided QPSO with random drift local attractor (HIQPSO-RD), is proposed to search the reduced search space for adversarial examples. The HIQPSO-RD introduces historical information into the current mean best position of the QPSO, for the purpose of improving the convergence speed of the algorithm, by enhancing its exploration ability and preventing the premature convergence of the swarm. The proposed algorithm uses the random drift local attractor technique to make a good balance between its exploration and exploitation, so that the algorithm can find a better adversarial attack example with low grammaticality and perplexity (PPL). In addition, it employs a two-stage diversity control strategy to enhance the search performance of the algorithm. Experiments on three natural language processing (NLP) datasets, with three commonly used nature language processing models as victim models, show that our method achieves higher attack success rates but lower modification rates than the state-of-the-art adversarial attack methods. Moreover, the results of human evaluations show that adversarial examples generated by our method can better maintain the semantic similarity and grammatical correctness of the original input.

In recent years, with the widespread application of Vision Transformer (ViT) in visual trackers, their robustness has received increasing attention. However, by focusing on global interactions between image patches, ViT reduces sensitivity to local noise, posing new challenges for adversarial attacks. Meanwhile, existing decision-based adversarial attack methods often overlook the differences in noise sensitivity between different patches, further limiting the compression efficiency of adversarial noise, especially in ViT. In visual tracking, existing adversarial attack methods primarily target Siamese network-based trackers, and research on adversarial attacks against Transformer-based trackers, particularly decision-based black-box attacks, is still relatively limited. To implement effective black-box attacks on Transformer-based trackers, this paper innovatively proposes patch-based adversarial noise compression (PANC), a decision-based adversarial attack method. This method effectively compresses adversarial noise patch by patch, significantly improving compression efficiency and attack concealment. PANC also introduces a noise sensitivity matrix that dynamically adds and reduces adversarial noise, optimizing the spatial distribution of noise while decreasing the number of queries. We validated the effectiveness of the proposed PANC attack method on several Transformer-based trackers, including OSTrack, STARK, TransT, and MixformerV2, and three public large-scale benchmark datasets: GOT-10k, TrackingNet, and LaSOT. Experimental results show that compared to the existing state-of-the-art adversarial attack method, the IoU attack, PANC compresses the noise level to 10%, improving the attack effectiveness by 162% with the number of queries of only 45.7%. Furthermore, PANC can serve as an initialization or post-processing optimization strategy for other adversarial attack methods, providing a more flexible and efficient mechanism for adversarial example generation. Our work reveals the vulnerabilities of existing Transformer-based visual trackers and offers new ideas for further improving the efficiency and concealment of adversarial attacks.

With the continuous development of deep learning in the field of Synthetic Aperture Radar (SAR) image processing, it is found that image recognition is vulnerable to interference and the accuracy is greatly reduced. Therefore, if a general adversarial attack method is designed to generate adversarial examples(AEs) capable of deceiving different types of convolutional neural network models, it can protect target images from being correctly recognized by adversaries and safeguard image privacy information. However, most of the current adversarial attack methods have too large attack scope and interference intensity, and do not have the ability to universally attack different neural network models, resulting in poor concealment, deception, and transfer deception of adversarial attacks. In this paper, we propose a general Key Points Sparse Attack (KPSA) method for SAR images, which achieves excellent deception and transfer deception while controlling the attack range and jamming strength. It is a general and efficient adversarial attack method. KPSA uses the generator to generate intensity interference images and imposes amplitude constraint, uses the key points extraction method to generate position interference images to realize sparse attack, uses the difference value(d-value) loss function to achieve fast convergence of the training model, and achieves transfer deception performance without depending on the type of discriminator. The deception rate and transfer deception rate experiments were conducted on MSTAR and ATRNet-STAR. By comparing with the advanced methods in the field of adversarial attacks, it was verified that the KPSA method is superior to the current advanced methods, and it was confirmed that the KPSA method has application value in various complex practical scenarios.

The adversarial attack is a cutting-edge technique used to study the vulnerability of deep neural networks (DNNs). However, most existing studies focus on the additive perturbation-based attack, which cannot represent real-world corruption and limit their applications. In particular, haze is a common natural phenomenon that significantly corrupts an image, which inevitably poses a potential threat to deep models. In this work, for the first attempt, we study the effects of haze on DNNs from the perspective of adversarial attacks and propose two adversarial haze attack methods. We first propose the optimization-based adversarial haze attack (OAdvHaze) that optimizes the parameters of the atmospheric scattering model with the guidance of a DNN to synthesize a hazy image, which leads to a high attack success rate. To achieve a more efficient attack, we further propose a predictive adversarial haze attack (PAdvHaze) employing a DNN to predict the hazing parameters through a one-step way. To validate the effectiveness of both methods, we conducted extensive experiments on two publicly available datasets, i.e., ILSVRC 2012 and NIPS 2017. OAdvHaze and PAdvHaze achieve comparable attack success rates and transferability to state-of-the-art attacks. This work would contribute to the evaluation and enhancement of the robustness of DNNs against haze perturbation that may happen in the real world.

The challenge of classifying multimodal remote sensing images has garnered significant interest in light of the growing diversity of remote sensing image data modalities. Current studies primarily concentrate on increasing the classification task’s accuracy by improving the fusion strategy or incorporating auxiliary architectures. However, there is currently a lack of research in the area of adversarial attack for multimodal remote sensing image classification models as compared to the study of unimodal classification models. To overcome this issue, our research firstly investigates the adversarial robustness of multimodal remote sensing image classification under different fusion strategies, which adopts the improved classical adversarial attack methods to test the adversarial robustness of multimodal remote sensing image classification model architectures with three different fusion strategies; Then a new multimodal adversarial attack method is proposed for the multimodal model, which adopts balanced perturbation loss and cooperative adversarial loss, in which the balanced perturbation loss is used to balance the level of perturbation of different modalities, and the cooperative adversarial loss is used to reduce the conflict of different modality perturbations on the classification result. By combining balanced perturbation loss and cooperative adversarial loss to attack multimodal models, the cooperation between modalities is continuously optimized.Finally, the study demonstrates the weak adversarial robustness of the multimodal remote sensing image classification model, which robustness is easily influenced by the fusion strategies and the attack methods. Additionally, a better attack effect is obtained by the multimodal multiloss cooperative adversarial attack method proposed in this paper.

EnsembleFool: A method to generate adversarial examples based on model fusion strategy

Adversarial examples: A survey of attacks and defenses in deep learning-enabled cybersecurity systems

Explanation-Guided Adversarial Example Attacks

Deep learning has revolutionized image recognition. One significant obstacle still remains, the vulnerability of these models to adversarial attacks. These attacks manipulate images with subtle changes that cause CNN misclassification. While methods, such as adversarial training, have been proposed to defend against adversarial attacks, they incur additional training costs, either extra input samples or auxiliary models. In this work, we propose an efficient approach to deploying robust models that utilize image transformations to remove adversarial noises. We investigate the performance of simple transformations and report several effective ones, including Affine blur, Gaussian blur, Median blur, and Bilateral blur against various adversarial attack methods, such as Fast Gradient Sign Method (FGSM), Randomized + FGSM (RFGSM), and Projected Gradient Descent (PGD). We apply these image transformation techniques to the widely used ImageNet dataset, and experimental results demonstrate the potential of image transformation methods as a strong defense against adversarial attacks in deep learning-based image classification systems, especially when combined with cutting-edge neural network architectures such as ResNet50 and DenseNet121. Our comprehensive results show that these transformations can significantly improve the robustness of CNN models against adversarial attacks on ImageNet, achieving a recovery rate of up to 85% to 90% without incurring extra resource costs.

Automatic diagnosis based on clinical notes has become a popular research field recently, and many proposed deep learning models have achieved competitive performance in diseases inference. However, previous research reveals that deep learning models are susceptible to negligibly perturbed inputs named adversarial examples, which contradicts with the safety and reliability requirements of the medical domain. To analyze the vulnerability and robustness of current automatic diagnosis models, we investigate in the generation of adversarial text examples. The main challenges for generating adversarial text examples are divided into three parts. First, the word embedding space is discrete, which makes it hard to perturb as small as adversarial image examples generation. Second, previous adversarial example generation methods focus mainly on multi-class classification models, while automatic diagnosis is a multi-label classification task. Third, the semantic and medical meaning of clinical notes are vital in disease inference, and even small perturbations can change them to a large extent. In this paper, we address the three main challenges and propose Clinical-Attacker, a general framework for both white-box and black-box adversarial text examples generation against automatic diagnosis models. Experimental results on MIMIC-III dataset demonstrate that our framework can easily alter the predictions of automatic diagnosis models with the semantic and medical meaning preserved.

Some recent articles have revealed that synthetic aperture radar automatic target recognition (SAR-ATR) models based on deep learning are vulnerable to the attacks of adversarial examples and cause security problems. The adversarial attack can make a deep convolutional neural network (CNN)-based SAR-ATR system output the intended wrong label predictions by adding small adversarial perturbations to the SAR images. The existing optimization-based adversarial attack methods generate adversarial examples by minimizing the mean-squared reconstruction error, causing smooth target edge and blurry weak scattering centers in SAR images. In this paper, we build a UNet-generative adversarial network (GAN) to refine the generation of the SAR-ATR models’ adversarial examples. The UNet learns the separable features of the targets and generates the adversarial examples of SAR images. The GAN makes the generated adversarial examples approximate to real SAR images (with sharp target edge and explicit weak scattering centers) and improves the generation efficiency. We carry out abundant experiments using the proposed adversarial attack algorithm to fool the SAR-ATR models based on several advanced CNNs, which are trained on the measured SAR images of the ground vehicle targets. The quantitative and qualitative results demonstrate the high-quality adversarial example generation and excellent attack effectiveness and efficiency improvement.

DiffProtect: Generative adversarial examples using diffusion models for facial privacy protection

Recent years, Machine Learning has been widely used in malware analysis and achieved unprecedented success. However, deep learning models are found to be highly vulnerable to adversarial examples, which leads to the machine learning-based malware analysis methods vulnerable to malware makers. Exploring the attack algorithm can not only promote the generation of more effective malware analysis methods, but also can promote the development of the defense algorithm. Different machine learning models use different malware features as their classification basis, and accordingly there will be different attack methods against them. For malware visualization method, corresponding effective adversarial attack has not yet appeared. Most existing malware adversarial examples for malware visualization are generated at the feature level, and do not consider whether the generated adversarial examples can be executed and complete their original functions. In this paper, we explored how to modify an Android executable file without affecting its original functions and made it become an adversarial example. We proposed an executable adversarial examples attack strategy for machine learning-based malware visualization analysis. Experimental result shows that the executable adversarial examples we generated can be normally run on Android devices without affecting its original functions, and can confuse the malware family classifier with 93% success rate. We explored possible defense methods and hope to contribute to building a more robust malware classification method.

A wide variety of works have explored the reason for the existence of adversarial examples, but there is no consensus on the explanation. We propose to treat the DNN logits as a vector for feature representation, and exploit them to analyze the mutual influence of two independent inputs based on the Pearson correlation coefficient (PCC). We utilize this vector representation to understand adversarial examples by disentangling the clean images and adversarial perturbations, and analyze their influence on each other. Our results suggest a new perspective towards the relationship between images and universal perturbations: Universal perturbations contain dominant features, and images behave like noise to them. This feature perspective leads to a new method for generating targeted universal adversarial perturbations using random source images. We are the first to achieve the challenging task of a targeted universal attack without utilizing original training data. Our approach using a proxy dataset achieves comparable performance to the state-of-the-art baselines which utilize the original training dataset.

More and more security situation awareness strategies in power network use deep learning as the data processing method. However, the endogenous security problem of deep learning poses a challenge to the robustness required for power network security situation awareness, and gives attackers an opportunity to add small perturbation to the network and fail the security situation awareness strategy. In this paper, we build the deep neural networks for the power network dataset. We verify a variety of adversarial example attack methods against deep neural networks, and tested the success rate of attacks on different types of networks to compare the difference of attack methods and target model. We can see from the experiment results that adversarial example attacks can have a great impact on the power network security situation awareness and pose a threat to the power network.