A Versatile Framework for Designing Group-Sparse Adversarial Attacks
This work addresses the need for more interpretable and structurally meaningful adversarial attacks in image classification, though it is incremental as it builds on existing sparse attack methods.
The authors tackled the problem of generating structured, sparse adversarial attacks to improve interpretability and model structural changes in deep neural networks, achieving a 100% attack success rate on CIFAR-10 and ImageNet with significantly sparser and more coherent perturbations than prior methods.
Existing adversarial attacks often neglect perturbation sparsity, limiting their ability to model structural changes and to explain how deep neural networks (DNNs) process meaningful input patterns. We propose ATOS (Attack Through Overlapping Sparsity), a differentiable optimization framework that generates structured, sparse adversarial perturbations in element-wise, pixel-wise, and group-wise forms. For white-box attacks on image classifiers, we introduce the Overlapping Smoothed L0 (OSL0) function, which promotes convergence to a stationary point while encouraging sparse, structured perturbations. By grouping channels and adjacent pixels, ATOS improves interpretability and helps identify robust versus non-robust features. We approximate the L-infinity gradient using the logarithm of the sum of exponential absolute values to tightly control perturbation magnitude. On CIFAR-10 and ImageNet, ATOS achieves a 100% attack success rate while producing significantly sparser and more structurally coherent perturbations than prior methods. The structured group-wise attack highlights critical regions from the network's perspective, providing counterfactual explanations by replacing class-defining regions with robust features from the target class.