2024/02/02 by Antonio Emanuele Ciná, Cinà, Antonio Emanuele, Francesco Villani +9 · 2 citations
Computer Science · #Advanced Image Processing Techniques #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Generative Adversarial Networks and Image Synthesis #Machine Learning (cs.LG)
paper · pdf · doi:10.48550/arxiv.2402.01879
openalex publication_date 2024/02/02 · openalex created_date 2024/02/07 · openalex updated_date 2026/07/31
Evaluating the adversarial robustness of deep networks to gradient-based attacks is challenging. While most attacks consider ℓ2- and ℓ_∞-norm constraints to craft input perturbations, only a few investigate sparse ℓ1- and ℓ0-norm attacks. In particular, ℓ0-norm attacks remain the least studied due to the inherent complexity of optimizing over a non-convex and non-differentiable constraint. However, evaluating adversarial robustness under these attacks could reveal weaknesses otherwise left untested with more conventional ℓ2- and ℓ_∞-norm attacks. In this work, we propose a novel ℓ0-norm attack, called σ-zero, which leverages a differentiable approximation of the ℓ0 norm to facilitate gradient-based optimization, and an adaptive projection operator to dynamically adjust the trade-off between loss minimization and perturbation sparsity. Extensive evaluations using MNIST, CIFAR10, and ImageNet datasets, involving robust and non-robust models, show that σ-zero finds minimum ℓ0-norm adversarial examples without requiring any time-consuming hyperparameter tuning, and that it outperforms all competing sparse attacks in terms of success rate, perturbation size, and efficiency.