Physical Black-Box Adversarial Attacks Through Transformations

Wenbo Jiang

doi:10.1109/TBDATA.2022.3227318

2023-06-01

PRE

Rongxing Lu (Rongxing Lu)

DOI：10.1109/TBDATA.2022.3227318

原文链接

原文求助

摘要

En 中文

Deep learning has shown impressive performance in numerous applications. However, recent studies have found that deep learning models are vulnerable to adversarial attacks, where the attacker adds imperceptible perturbations into benign samples to induce misclassifications. Adversarial attacks in the digital domain focus on constructing imperceptible perturbations. However, they are always less effective in the physical world because the perturbations may be destroyed when captured by the camera. Most physical adversarial attacks require adding invisible adversarial features (e.g., a sticker or a laser) to the target object, which may be noticed by human eyes. In this work, we propose to employ image transformation to generate more natural adversarial samples in the physical world. Concretely, we propose two attack algorithms to satisfy different attack goals: Efficient-AATR employs a greedy strategy to generate adversarial samples with fewer queries; Effective-AATR employs an adaptive particle swarm optimization algorithm to search for the most effective adversarial samples within the given the number of queries. Extensive experiments demonstrate the superiority of our attacks compared with state-of-the-art adversarial attacks under mainstream defenses.

Keyword:

Perturbation methods

Closed box

Training

Robustness

Big Data

Optimization

Laser theory

Black-box attack

deep learning

physical adversarial attack