A New Kind of Adversarial Example

TL;DR

This paper introduces NKE, a novel adversarial attack that creates images perceptible to humans but still fool deep neural networks, highlighting a new vulnerability in AI models.

Contribution

The paper presents NKE, an efficient gradient-based method to generate adversarial examples that deceive models while remaining perceptible to humans, offering a new perspective on adversarial vulnerability.

Findings

NKE effectively fools neural networks on MNIST and CIFAR-10.

The attack is more efficient than evolutionary algorithms.

It provides insights into human-model perception gaps.

Abstract

Almost all adversarial attacks are formulated to add an imperceptible perturbation to an image in order to fool a model. Here, we consider the opposite which is adversarial examples that can fool a human but not a model. A large enough and perceptible perturbation is added to an image such that a model maintains its original decision, whereas a human will most likely make a mistake if forced to decide (or opt not to decide at all). Existing targeted attacks can be reformulated to synthesize such adversarial examples. Our proposed attack, dubbed NKE, is similar in essence to the fooling images, but is more efficient since it uses gradient descent instead of evolutionary algorithms. It also offers a new and unified perspective into the problem of adversarial vulnerability. Experimental results over MNIST and CIFAR-10 datasets show that our attack is quite efficient in fooling deep neural networks. Code is available at https://github.com/aliborji/NKE.