A non-global disturbance targeted adversarial example algorithm combined with C&W and Grad-Cam

• Published in: Neural computing & applications Vol. 35; no. 29; pp. 21633 - 21644
• Main Authors: Zhu, Yinghui, Jiang, Yuzhen
• Format: Journal Article
• Language: English
• Published: London Springer London 01.10.2023; Springer Nature B.V
• Subjects: Algorithms; Artificial Intelligence; Computational Biology/Bioinformatics; Computational Science and Engineering; Computer Science; Data Mining and Knowledge Discovery; Image Processing and Computer Vision; Machine learning; Original Article; Perturbation; Probability and Statistics in Computer Science; Robustness; Adversarial example; Targeted attack; Salient region; Category explanation
• ISSN: 0941-0643; 1433-3058
• DOI: 10.1007/s00521-023-08921-2

Adversarial examples are artificially crafted to mislead deep learning systems into making wrong decisions. In the research of attack algorithms against multi-class image classifiers, an improved strategy of applying category explanation to the generation control of targeted adversarial example is proposed to reduce the perturbation noise and improve the adversarial robustness. On the basis of C&W adversarial attack algorithm, the method uses Grad-Cam, a category visualization explanation algorithm of CNN, to dynamically obtain the salient regions according to the signal features of source and target categories during the iterative generation process. The adversarial example of non-global perturbation is finally achieved by gradually shielding the non-salient regions and fine-tuning the perturbation signals. Compared with other similar algorithms under the same conditions, the method enhances the effects of the original image category signal on the perturbation position. And it makes up for the shortcomings of the adversarial example algorithm in terms of interpretability and teaching intuitiveness. Experimental results show that the improved adversarial examples have higher PSNR. In addition, in a variety of different defense processing tests, the examples can keep high adversarial performance and show strong attacking robustness.