.png){kind=icon}
.png){kind=icon}
Return
Model scheduling and sample selection for ensemble adversarial example attacks
.png){kind=icon}
PRE
AI
DOI：10.1016/j.patcog.2022.108824.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Adversarial examples refer to the malicious inputs that can mislead deep neural networks (DNNs) to falsely classify them. In practice, some adversarial examples are transferable and hence can deceive different target models. In multi-stage ensemble adversarial example attacks, adversaries can generate strongly transferable adversarial examples through iteratively perturbing legitimate examples to attack well-trained source models in a white-box manner. Limited by computational and memory resources (e.g., GPU memory), however, adversaries cannot handle all models and all legitimate examples at a time. This brings an important but never studied research issue: how to optimally schedule source models and appropriately select samples to improve adversarial example transferability and reduce unnecessary computational overheads? To shed light on this problem, we develop a novel multi-stage ensemble adversarial example attack method based on our proposed strategies of model scheduling and sample selection. The first strategy schedules source models to be attacked in every stage, based on the criteria of decision boundary similarity and model diversity. The second selects input samples to be handled by ensemble attacks, according to their sensitivity level for adversarial perturbations. To our knowledge, we are the first to study model scheduling and sample selection for multi-stage ensemble attacks. We conduct extensive experiments on three datasets with a variety of source and target models. Experiments show that our model scheduling based ensemble attack outperforms the all-model ensemble attack and the state-of-the-art ensemble attacks SCES, SMBEA and EnsembleFool in transferability. Moreover, our sample selection strategy improves attack success rate by about 138%. (C) 2022 Elsevier Ltd. All rights reserved.
Keywords:
Adversarial example
Black-box attack
Model scheduling
Sample selection
Journal
IF:
7.6
Papers:
1.3W
Citations:
4.5W
Organization
No organization information available