A Black-Box Attack on Optical Character Recognition Systems

TL;DR

This paper introduces an efficient black-box adversarial attack method targeting binary image classifiers used in OCR systems, demonstrating its effectiveness across multiple datasets and neural network architectures.

Contribution

The paper presents a novel combinatorial black-box attack specifically designed for binary image classifiers, filling a gap in adversarial attack research on binary image recognition systems.

Findings

The attack successfully fools classifiers on two datasets.

It outperforms existing methods in efficiency and effectiveness.

The approach is applicable to various neural network architectures.

Abstract

Adversarial machine learning is an emerging area showing the vulnerability of deep learning models. Exploring attack methods to challenge state of the art artificial intelligence (A.I.) models is an area of critical concern. The reliability and robustness of such A.I. models are one of the major concerns with an increasing number of effective adversarial attack methods. Classification tasks are a major vulnerable area for adversarial attacks. The majority of attack strategies are developed for colored or gray-scaled images. Consequently, adversarial attacks on binary image recognition systems have not been sufficiently studied. Binary images are simple two possible pixel-valued signals with a single channel. The simplicity of binary images has a significant advantage compared to colored and gray scaled images, namely computation efficiency. Moreover, most optical character recognition systems (O.C.R.s), such as handwritten character recognition, plate number identification, and bank check recognition systems, use binary images or binarization in their processing steps. In this paper, we propose a simple yet efficient attack method, Efficient Combinatorial Black-box Adversarial Attack, on binary image classifiers. We validate the efficiency of the attack technique on two different data sets and three classification networks, demonstrating its performance. Furthermore, we compare our proposed method with state-of-the-art methods regarding advantages and disadvantages as well as applicability.