Saliency Attack: Towards Imperceptible Black-box Adversarial Attack

Zeyu Dai, Shengcai Liu, Qing Li, Ke Tang

Research output: Journal article publicationJournal articleAcademic researchpeer-review

6 Citations (Scopus)

Abstract

Deep neural networks are vulnerable to adversarial examples, even in the black-box setting where the attacker is only accessible to the model output. Recent studies have devised effective black-box attacks with high query efficiency. However, such performance is often accompanied by compromises in attack imperceptibility, hindering the practical use of these approaches. In this article, we propose to restrict the perturbations to a small salient region to generate adversarial examples that can hardly be perceived. This approach is readily compatible with many existing black-box attacks and can significantly improve their imperceptibility with little degradation in attack success rates. Furthermore, we propose the Saliency Attack, a new black-box attack aiming to refine the perturbations in the salient region to achieve even better imperceptibility. Extensive experiments show that compared to the state-of-the-art black-box attacks, our approach achieves much better imperceptibility scores, including most apparent distortion (MAD), L0 and L2 distances, and also obtains significantly better true success rate and effective query number judged by a human-like threshold on MAD. Importantly, the perturbations generated by our approach are interpretable to some extent. Finally, it is also demonstrated to be robust to different detection-based defenses.

Original languageEnglish
Article number45
Pages (from-to)1-20
JournalACM Transactions on Intelligent Systems and Technology
Volume14
Issue number3
DOIs
Publication statusPublished - 1 Apr 2023

Keywords

  • Adversarial example
  • black-box adversarial attack
  • deep neural networks
  • saliency map

ASJC Scopus subject areas

  • Theoretical Computer Science
  • Artificial Intelligence

Fingerprint

Dive into the research topics of 'Saliency Attack: Towards Imperceptible Black-box Adversarial Attack'. Together they form a unique fingerprint.

Cite this