Maximal Jacobian-based Saliency Map Attack

TL;DR

This paper introduces new variants of the Jacobian-based Saliency Map Attack that improve the efficiency and flexibility of generating adversarial examples for image classification models, demonstrating competitive results on digit and scene datasets.

Contribution

The paper proposes two novel JSMA variants that eliminate the need for specifying target classes and directionality, enhancing attack versatility and speed.

Findings

Variants are faster and more flexible than original JSMA.

Effective in fooling models on handwritten digits and natural scene datasets.

Demonstrates competitive attack quality and speed.

Abstract

The Jacobian-based Saliency Map Attack is a family of adversarial attack methods for fooling classification models, such as deep neural networks for image classification tasks. By saturating a few pixels in a given image to their maximum or minimum values, JSMA can cause the model to misclassify the resulting adversarial image as a specified erroneous target class. We propose two variants of JSMA, one which removes the requirement to specify a target class, and another that additionally does not need to specify whether to only increase or decrease pixel intensities. Our experiments highlight the competitive speeds and qualities of these variants when applied to datasets of hand-written digits and natural scenes.