SEIDA: stable and effective image degradation attack

Zitian Li, Jie Yang, Hongjun Wang, Tianrui Li

Abstract: Adversarial attack is an information security technology which adds some imperceptible perturbations to the benign examples and then causes the neural network to make incorrect judgments. As far as we know, most researches on adversarial attacks focuse on using the model information that can be accessed to create noise and reduce the confidence of the benign examples, resulting that the number of queries will gradually increase with the model becoming more complex. This paper proposes a score-based black-box adversarial attack algorithm, Stable and Effective Image Degradation Attack(SEIDA) and its main idea is dropping the structural information to degrade the image. It firstly converts the image to the frequency domain from the space domain through FFT. And then for maximizing the attack efficiency of each iteration, it performs clustering to obtain the search space. After that, with the help of robust principal component analysis, SEIDA relatively increasing the noise information of the image to cause image degradation and then the neural network misclassifies. Finally extensive experiments and experiments results have demonstrated that SEIDA outperforms the state-of-the-art algorithms on CIFAR-10 and ImageNet and that SEIDA minimizes the impact of different models on attack efficiency.

External IDs:dblp:journals/sivp/LiYWL25