Exploiting epistemic uncertainty of the deep learning models to generate adversarial samples

TL;DR

This paper introduces a novel adversarial attack method leveraging epistemic uncertainty from Monte-Carlo Dropout, significantly improving attack success rates on multiple datasets by targeting uncertain model predictions.

Contribution

It proposes a new attack approach based on epistemic uncertainty, expanding adversarial techniques beyond loss function-based methods.

Findings

Attack success rates increased on MNIST Digit, Fashion, and CIFAR-10 datasets.

Epistemic uncertainty can effectively guide adversarial perturbations.

Hybrid attack approach outperforms traditional methods.

Abstract

Deep neural network architectures are considered to be robust to random perturbations. Nevertheless, it was shown that they could be severely vulnerable to slight but carefully crafted perturbations of the input, termed as adversarial samples. In recent years, numerous studies have been conducted in this new area called "Adversarial Machine Learning" to devise new adversarial attacks and to defend against these attacks with more robust DNN architectures. However, almost all the research work so far has been concentrated on utilising model loss function to craft adversarial examples or create robust models. This study explores the usage of quantified epistemic uncertainty obtained from Monte-Carlo Dropout Sampling for adversarial attack purposes by which we perturb the input to the areas where the model has not seen before. We proposed new attack ideas based on the epistemic uncertainty of the model. Our results show that our proposed hybrid attack approach increases the attack success rates from 82.59% to 85.40%, 82.86% to 89.92% and 88.06% to 90.03% on MNIST Digit, MNIST Fashion and CIFAR-10 datasets, respectively.