Efficient Black-Box Search for Adversarial Examples using Relevance Masks

  • Machine learning classifiers for image recognition are prevalent in many applications. We study the problem of finding adversarial examples for such classifiers, i.e., to manipulate the images in such a way that they still look like the original images to a human but are misinterpreted by the classifier. Finding adversarial examples corresponds to a search problem in the image space. We focus on black-box attacks that can only use the original classifier to guide the search. The challenge is not to find adversarial examples, but rather to find them efficiently, ideally in real time. We show two novel methods that increase the efficiency of black-box search algorithms for adversarial examples: The first uses a relevance mask, i.e., a bitmask on the original image that restricts the search to those pixels that appear to be more relevant to the attacked classifier than others. The second exploits the discovery of merge drift, a phenomenon that negatively affects search algorithms that are based on the merging of image candidates. WeMachine learning classifiers for image recognition are prevalent in many applications. We study the problem of finding adversarial examples for such classifiers, i.e., to manipulate the images in such a way that they still look like the original images to a human but are misinterpreted by the classifier. Finding adversarial examples corresponds to a search problem in the image space. We focus on black-box attacks that can only use the original classifier to guide the search. The challenge is not to find adversarial examples, but rather to find them efficiently, ideally in real time. We show two novel methods that increase the efficiency of black-box search algorithms for adversarial examples: The first uses a relevance mask, i.e., a bitmask on the original image that restricts the search to those pixels that appear to be more relevant to the attacked classifier than others. The second exploits the discovery of merge drift, a phenomenon that negatively affects search algorithms that are based on the merging of image candidates. We evaluate both concepts on existing and new algorithms.show moreshow less

Export metadata

Additional Services

Search Google Scholar
Metadaten
Author:Felix Freiling, Ramin Tavakoli KolagariORCiD, Katja Auernhammer
DOI:https://doi.org/10.1145/3477997.3478013
Parent Title (English):Proceedings of the 2020 Workshop on DYnamic and Novel Advances in Machine Learning and Intelligent Cyber Security
Publisher:ACM
Place of publication:New York, NY, USA
Document Type:conference proceeding (article)
Language:English
Date of first Publication:2022/10/17
Release Date:2024/09/10
Tag:Machine Learning, Attacks, Adversarial Examples, Relevance Masks
Article Number:2
First Page:1
Last Page:12
Konferenzangabe:Dynamics 2020
institutes:Fakultät Informatik
Research Themes:Digitalisierung & Künstliche Intelligenz
Verstanden ✔
Diese Webseite verwendet technisch erforderliche Session-Cookies. Durch die weitere Nutzung der Webseite stimmen Sie diesem zu. Unsere Datenschutzerklärung finden Sie hier.