Efficient Black-Box Search for Adversarial Examples using Relevance Masks
- Machine learning classifiers for image recognition are prevalent in many applications. We study the problem of finding adversarial examples for such classifiers, i.e., to manipulate the images in such a way that they still look like the original images to a human but are misinterpreted by the classifier. Finding adversarial examples corresponds to a search problem in the image space. We focus on black-box attacks that can only use the original classifier to guide the search. The challenge is not to find adversarial examples, but rather to find them efficiently, ideally in real time. We show two novel methods that increase the efficiency of black-box search algorithms for adversarial examples: The first uses a relevance mask, i.e., a bitmask on the original image that restricts the search to those pixels that appear to be more relevant to the attacked classifier than others. The second exploits the discovery of merge drift, a phenomenon that negatively affects search algorithms that are based on the merging of image candidates. WeMachine learning classifiers for image recognition are prevalent in many applications. We study the problem of finding adversarial examples for such classifiers, i.e., to manipulate the images in such a way that they still look like the original images to a human but are misinterpreted by the classifier. Finding adversarial examples corresponds to a search problem in the image space. We focus on black-box attacks that can only use the original classifier to guide the search. The challenge is not to find adversarial examples, but rather to find them efficiently, ideally in real time. We show two novel methods that increase the efficiency of black-box search algorithms for adversarial examples: The first uses a relevance mask, i.e., a bitmask on the original image that restricts the search to those pixels that appear to be more relevant to the attacked classifier than others. The second exploits the discovery of merge drift, a phenomenon that negatively affects search algorithms that are based on the merging of image candidates. We evaluate both concepts on existing and new algorithms.…


| Author: | Felix Freiling, Ramin Tavakoli KolagariORCiD, Katja Auernhammer |
|---|---|
| DOI: | https://doi.org/10.1145/3477997.3478013 |
| Parent Title (English): | Proceedings of the 2020 Workshop on DYnamic and Novel Advances in Machine Learning and Intelligent Cyber Security |
| Publisher: | ACM |
| Place of publication: | New York, NY, USA |
| Document Type: | conference proceeding (article) |
| Language: | English |
| Date of first Publication: | 2022/10/17 |
| Release Date: | 2024/09/10 |
| Tag: | Machine Learning, Attacks, Adversarial Examples, Relevance Masks |
| Article Number: | 2 |
| First Page: | 1 |
| Last Page: | 12 |
| Konferenzangabe: | Dynamics 2020 |
| institutes: | Fakultät Informatik |
| Research Themes: | Digitalisierung & Künstliche Intelligenz |
