Structured Adversarial Attack StrAttack: Toward General Implementation and Better Interpretability
Structured Adversarial Attack: Towards General Implementation and Better Interpretability
Translation in progress — untranslated text is omitted.
StrAttack slides a mask over the image and introduces group sparsity into the adversarial perturbation to extract key spatial structure, and is a more general attack model for deep neural networks. Its ADMM framework decomposes the problem into analytically solvable subproblems, can be generalized to other attack methods, and yields stronger group sparsity under the same Lp-norm distortion as state-of-the-art attacks. Experiments cover MNIST, CIFAR-10, and ImageNet; the adversarial examples correspond better to discriminative image regions and have stronger interpretability.
- Existing adversarial attacks use lp norms to measure perturbation size; the authors argue that this cannot capture the spatial structure in the input, and that C&W perturbs almost all pixels while the one-pixel attack has excessive single-pixel distortion, so there is a lack of an attack that balances the two.
- Proposes StrAttack: group the perturbation using a sliding mask and add a group sparsity regularizer, formulate the attack as a unified optimization problem, split it with ADMM into subproblems that can be solved analytically, and support overlapping groups and refinement under a fixed sparse structure.
- On MNIST, CIFAR-10, and ImageNet, StrAttack's ASR is comparable to C&W (mostly 100%), with clearly fewer l0 perturbed pixels; it achieves 100% success against both defensive distillation and adversarial training; the authors claim its ASM/CAM interpretability is better.
- The paper does not specifically discuss limitations. The experiments cover only the three image datasets MNIST, CIFAR-10, and ImageNet; the defense evaluation includes three defenses: defensive distillation, adversarial training, and robust adversarial training; efficiency figures such as running time are not reported.
Related papers
Both use: ImageNet
- Self-Progressing Robust TrainingDefensesarXiv