Abstract
Recent studies have demonstrated that neural networks are vulnerable to adversarial examples. Numerous attacks have been proposed for crafting various types of adversarial examples. However, almost all the existing attacks adopt the \(L_p\)-norm or another distance metric to bound the adversarial perturbations, which inadvertently facilitates the implementation of some defenses. We present a novel non-norm-bounded attack (NNBA) for generating adversarial examples. We formulate the process of generating adversarial examples as an optimization problem, which has just the objective of misclassifying the perturbed examples and does not use the \(L_p\)-norm as the perturbation constraint. The examples generated in this way naturally satisfy the requirements of adversarial examples. Experimental results on the MNIST, CIFAR-10 and ImageNet datasets show that NNBA can successfully generate adversarial examples with small perturbations and high misclassification performance. Moreover, adversarial examples crafted by NNBA achieve high confidence, good robustness and low computational cost. Our work sheds light on a new type of adversarial attack, and we hope it will prompt research on secure and robust machine learning models.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Alakuijala, J., Obryk, R., Stoliarchuk, O., Szabadka, Z., Vandevenne, L., Wassenberg, J.: Guetzli: perceptually guided JPEG encoder. CoRR abs/1703.04421 (2017)
Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: Proceedings of 2017 IEEE Symposium on Security and Privacy, pp. 39–57. IEEE (2017)
Gehring, J., Auli, M., Grangier, D., Yarats, D., Dauphin, Y.N.: Convolutional sequence to sequence learning. In: Proceedings of the 34th International Conference on Machine Learning, pp. 1243–1252 (2017)
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. In: Proceedings of the 3rd International Conference on Learning Representations (2015)
Graves, A., Mohamed, A., Hinton, G.E.: Speech recognition with deep recurrent neural networks. In: IEEE International Conference on Acoustics, Speech and Signal Processing, pp. 6645–6649. IEEE (2013)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)
Kingma, D.P., Ba, J.: Adam: a method for stochastic optimization. In: Proceedings of the 3th International Conference on Learning Representations (2015)
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial machine learning at scale. In: Proceedings of the 5th International Conference on Learning Representations (2017)
Ling, X., Ji, S.: DEEPSEC: a uniform platform for security analysis of deep learning model. In: Proceedings of the 35th International Conference on Machine Learning, pp. 5283–5292 (2018)
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. In: Proceedings of the 6th International Conference on Learning Representations (2018)
Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: DeepFool: a simple and accurate method to fool deep neural networks. In: Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574–2582 (2016)
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: Proceedings of 2016 IEEE European Symposium on Security and Privacy, pp. 372–387 (2016)
Szegedy, C., Vanhoucke, V., Ioffe, S., Shlens, J., Wojna, Z.: Rethinking the inception architecture for computer vision. In: Proceedings of 2016 IEEE Conference on Computer Vision and Pattern Recognition, pp. 2818–2826 (2016)
Szegedy, C., et al.: Intriguing properties of neural networks. In: Proceedings of the 2nd International Conference on Learning Representations (2014)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Switzerland AG
About this paper
Cite this paper
Zhang, M. et al. (2020). Non-norm-bounded Attack for Generating Adversarial Examples. In: Yang, H., Pasupa, K., Leung, A.CS., Kwok, J.T., Chan, J.H., King, I. (eds) Neural Information Processing. ICONIP 2020. Communications in Computer and Information Science, vol 1333. Springer, Cham. https://doi.org/10.1007/978-3-030-63823-8_49
Download citation
DOI: https://doi.org/10.1007/978-3-030-63823-8_49
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-63822-1
Online ISBN: 978-3-030-63823-8
eBook Packages: Computer ScienceComputer Science (R0)