Abstract
Recently, many studies have proposed adversarial defenses of image preprocessing based on gradient masking to deal with the threats of adversarial examples in deep learning models. These defenses have been broken through in white-box threat models, where attackers have full knowledge of target models. However, they have not been proved to be invalid in gray-box threat models, where attackers only partially know about target models. In this paper, by integrating stochastic initial perturbations into momentum iterative attack, we propose SMIM which is an efficient adversarial attack method. Based on this, BPDA attack framework is applied to the attack in the gray-box setting. Experiments show that this method can generate adversarial examples with strong attack ability and transferability on seemingly non-differentiable defensive models, thereby evading defenses with only partial knowledge of target models.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Athalye, A., Carlini, N., Wagner, D.: Obfuscated gradients give a false sense of security: circumventing defenses to adversarial examples. arXiv:1802.00420 (2018)
Akhtar, N., Mian, A.: Threat of adversarial attacks on deep learning in computer vision: a survey. IEEE Access 6, 14410–14430 (2018)
Guo, C., Rana, M., Cisse, M., van der Maaten, L.: Countering adversarial images using input transformations. arXiv:1711.00117 (2017)
Shaham, U., Garritano, J., Yamada, Y., Weinberger, E., Cloninger, A., Cheng, X., Stanton, K., Kluger, Y.: Defending against adversarial images using basis functions transformations. arXiv:1803.10840 (2018)
Chen, C.-M., Wang, K.-H., Wu, T.-Y., Wang, E.K.: On the security of a three-party authenticated key agreement protocol based on chaotic maps. Data Sci. Pattern Recognit. 1(2), 1–10 (2017)
Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., Li, J.: Boosting adversarial attacks with momentum. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9185–9193 (2018)
Chen, C.-M., Linlin, X., Tsu-Yang, W., Li, C.-R.: On the security of a chaotic maps-based three-party authenticated key agreement protocol. J. Netw. Intell. 1(2), 61–65 (2016)
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. arXiv:1312.6199 (2013)
Kurakin, A., Goodfellow, I., Bengio, S.: Adversarial examples in the physical world. arXiv:1607.02533 (2016)
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv:1412.6572 (2014)
Xu, W., Evans, D., Qi, Y.: Feature squeezing: detecting adversarial examples in deep neural networks. arXiv:1704.01155 (2017)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2020 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Gong, Y., Wang, S., Jiang, X., Zhan, D. (2020). An Adversarial Attack Method in Gray-Box Setting Oriented to Defenses Based on Image Preprocessing. In: Pan, JS., Li, J., Tsai, PW., Jain, L. (eds) Advances in Intelligent Information Hiding and Multimedia Signal Processing. Smart Innovation, Systems and Technologies, vol 156. Springer, Singapore. https://doi.org/10.1007/978-981-13-9714-1_10
Download citation
DOI: https://doi.org/10.1007/978-981-13-9714-1_10
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-13-9713-4
Online ISBN: 978-981-13-9714-1
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)