# Evolution Attack On Neural Networks

## TL;DR

This paper introduces a black-box attack method on neural networks using evolution algorithms, demonstrating that covariance matrix adaptive evolution strategies are most effective in generating adversarial examples without gradient information.

## Contribution

The paper formalizes adversarial example generation as an optimization problem and evaluates various evolution algorithms, highlighting the effectiveness of covariance matrix adaptive strategies.

## Key findings

- Covariance matrix adaptive evolution strategy outperforms other algorithms.
- Evolution algorithms can effectively generate adversarial examples in a black-box setting.
- Regularizations influence the quality of adversarial examples.

## Abstract

Many studies have been done to prove the vulnerability of neural networks to adversarial example. A trained and well-behaved model can be fooled by a visually imperceptible perturbation, i.e., an originally correctly classified image could be misclassified after a slight perturbation. In this paper, we propose a black-box strategy to attack such networks using an evolution algorithm. First, we formalize the generation of an adversarial example into the optimization problem of perturbations that represent the noise added to an original image at each pixel. To solve this optimization problem in a black-box way, we find that an evolution algorithm perfectly meets our requirement since it can work without any gradient information. Therefore, we test various evolution algorithms, including a simple genetic algorithm, a parameter-exploring policy gradient, an OpenAI evolution strategy, and a covariance matrix adaptive evolution strategy. Experimental results show that a covariance matrix adaptive evolution Strategy performs best in this optimization problem. Additionally, we also perform several experiments to explore the effect of different regularizations on improving the quality of an adversarial example.