Attention-Guided Black-box Adversarial Attacks with Large-Scale Multiobjective Evolutionary Optimization

TL;DR

This paper introduces LMOA, a black-box adversarial attack method that uses attention maps and multiobjective evolutionary optimization to generate high-quality, imperceptible adversarial examples for high-resolution images.

Contribution

The paper proposes a novel attention-guided multiobjective evolutionary approach for black-box adversarial attacks, improving attack success and visual quality on high-resolution images.

Findings

Effective in fooling DNNs on ImageNet

Produces high-resolution, visually imperceptible adversarial examples

Outperforms existing black-box attack methods

Abstract

Fooling deep neural networks (DNNs) with the black-box optimization has become a popular adversarial attack fashion, as the structural prior knowledge of DNNs is always unknown. Nevertheless, recent black-box adversarial attacks may struggle to balance their attack ability and visual quality of the generated adversarial examples (AEs) in tackling high-resolution images. In this paper, we propose an attention-guided black-box adversarial attack based on the large-scale multiobjective evolutionary optimization, termed as LMOA. By considering the spatial semantic information of images, we firstly take advantage of the attention map to determine the perturbed pixels. Instead of attacking the entire image, reducing the perturbed pixels with the attention mechanism can help to avoid the notorious curse of dimensionality and thereby improves the performance of attacking. Secondly, a large-scale multiobjective evolutionary algorithm is employed to traverse the reduced pixels in the salient region. Benefiting from its characteristics, the generated AEs have the potential to fool target DNNs while being imperceptible by the human vision. Extensive experimental results have verified the effectiveness of the proposed LMOA on the ImageNet dataset. More importantly, it is more competitive to generate high-resolution AEs with better visual quality compared with the existing black-box adversarial attacks.