Deep neural networks are vulnerable to adversarial attacks. Most white-box attacks are based on the gradient of models to the input. Since the computation and memory budget, adversarial attacks based on the Hessian information are not paid enough attention. In this work, we study the attack performance and computation cost of the attack method based on the Hessian with a limited perturbation pixel number. Specifically, we propose the Limited Pixel BFGS (LP-BFGS) attack method by incorporating the BFGS algorithm. Some pixels are selected as perturbation pixels by the Integrated Gradient algorithm, which are regarded as optimization variables of the LP-BFGS attack. Experimental results across different networks and datasets with various perturbation pixel numbers demonstrate our approach has a comparable attack with an acceptable computation compared with existing solutions.
翻译:深神经网络很容易受到对抗性攻击。 大多数白箱攻击都以输入模型的梯度为基础。 由于计算和记忆预算, 以赫西安信息为基础的对抗性攻击没有得到足够的重视。 在这项工作中, 我们根据赫西安人进行攻击方法的攻击性能和计算成本的研究, 其干扰像素编号有限。 具体地说, 我们提议采用Lited Pixel BFGS(LP-BFGS)攻击方法, 并纳入 BFGS 算法。 某些像素被综合渐进算法选为干扰像素, 后者被视为LP- BFGS 攻击的最优化变量 。 不同网络和数据集的实验结果, 以及各种扰动像素数, 表明我们的方法具有可接受的计算方法。