Deep Q learning for fooling neural networks

TL;DR

This paper introduces a reinforcement learning approach using Deep Q Networks to generate adversarial examples for neural networks in a semi black-box setting, effectively fooling models across multiple datasets.

Contribution

It presents a novel RL-based method for generating adversarial examples by training a DQN to modify image pixels with limited model access, advancing black-box attack techniques.

Findings

Effective attack policy learned on MNIST, CIFAR-10, and Imagenet.

RL-based approach outperforms random pixel modifications.

Generates non-targeted adversarial images successfully.

Abstract

Deep learning models are vulnerable to external attacks. In this paper, we propose a Reinforcement Learning (RL) based approach to generate adversarial examples for the pre-trained (target) models. We assume a semi black-box setting where the only access an adversary has to the target model is the class probabilities obtained for the input queries. We train a Deep Q Network (DQN) agent which, with experience, learns to attack only a small portion of image pixels to generate non-targeted adversarial images. Initially, an agent explores an environment by sequentially modifying random sets of image pixels and observes its effect on the class probabilities. At the end of an episode, it receives a positive (negative) reward if it succeeds (fails) to alter the label of the image. Experimental results with MNIST, CIFAR-10 and Imagenet datasets demonstrate that our RL framework is able to learn an effective attack policy.