Effective black box adversarial attack with handcrafted kernels
This work addresses adversarial robustness in machine learning, but it is incremental as it builds on existing black box attack methods with a focus on efficiency.
The paper tackles the problem of crafting adversarial examples for black box attacks by proposing a simple framework that uses handcrafted convolutional kernels to simulate a substitution model, resulting in decreased accuracy on adversarial inputs.
We propose a new, simple framework for crafting adversarial examples for black box attacks. The idea is to simulate the substitution model with a non-trainable model compounded of just one layer of handcrafted convolutional kernels and then train the generator neural network to maximize the distance of the outputs for the original and generated adversarial image. We show that fooling the prediction of the first layer causes the whole network to be fooled and decreases its accuracy on adversarial inputs. Moreover, we do not train the neural network to obtain the first convolutional layer kernels, but we create them using the technique of F-transform. Therefore, our method is very time and resource effective.