A New Kind of Adversarial Example
This work addresses adversarial vulnerability in machine learning, offering a novel perspective, but it is incremental as it builds on existing targeted attacks with efficiency improvements.
The paper tackles the problem of creating adversarial examples that fool humans but not models by adding perceptible perturbations, and demonstrates that their proposed NKE attack efficiently fools deep neural networks on MNIST and CIFAR-10 datasets.
Almost all adversarial attacks are formulated to add an imperceptible perturbation to an image in order to fool a model. Here, we consider the opposite which is adversarial examples that can fool a human but not a model. A large enough and perceptible perturbation is added to an image such that a model maintains its original decision, whereas a human will most likely make a mistake if forced to decide (or opt not to decide at all). Existing targeted attacks can be reformulated to synthesize such adversarial examples. Our proposed attack, dubbed NKE, is similar in essence to the fooling images, but is more efficient since it uses gradient descent instead of evolutionary algorithms. It also offers a new and unified perspective into the problem of adversarial vulnerability. Experimental results over MNIST and CIFAR-10 datasets show that our attack is quite efficient in fooling deep neural networks. Code is available at https://github.com/aliborji/NKE.