Group-wise Sparse Adversarial Attacks
S. Sadiku, M. Wagner, S. Pokutta

Motivation

Group-wise sparse Attacks

Deep Neural Networks (DNN) are vulnerable to adversarial attacks
Sparse adversarial attacks explore ℓ p neighborhoods with p = 0 via
1. Greedy single-pixel selection
2. Local search techniques
3. Evolutionary algorithms
4. Relaxing ℓ0 via the ℓ1 ballSparse methods do not constrain the magnitude of changed pixels
Generate adversarial attacks that are simultaneously sparse and imperceptible
Impose structure to sparse adversarial attacks by generating group-wise sparse perturbations that are
targeted to the main objective in the image - leads to explainable perturbations
Sheds light on signiﬁcant vulnerabilities in DNNs and oﬀers insights into their failures

GSE Adversarial Attacks
X = [Imin, Imax]M×N×C set of feasible images
L : X × N → R classiﬁcation loss function
Targeted sparse adversarial attacks for given x, target t
pminL(x+w,t)+λ∥w∥
p
M×N×Cw∈RUse forward-backward splitting algorithm for 0 < p < 1Requires solving the proximal operator
1proxλ ∥·∥ pp (w) := arg min ∥y − w∥22 + ∥y∥ ppy∈RM×N×C 2λ
Closed-form solution for p = 1/2 (and p = {0, 2/3})
Tune λ to determine pixel coordinates to perturb
C
1. Build a mask m = sign ∑c=1 |w(k)|:,:,c ∈ {0, 1}M×N
2. Apply Gaussian blur kernel M = m ∗ ∗K ∈ [0, 1]M×N
3. Build(Mi j + 1, if Mi j ̸= 0
Mi j =q,else(k)λi, j,:(k+1)
4. Set λi, j,: = Mi, j

Nesterov Accelerated Gradient over chosen coordinates

Speed Comparison
Untargeted
CIFAR-10
AttackResNet20

GSE (Ours) 0.13s
StrAttack
0.97s
FWnucl0.25s

Targeted

ImageNetCIFAR-10

ImageNetResNet50

ViT_B_16

ResNet20

ResNet50

ViT_B_16

3.18s
15.2s
9.93s

7.05s
33.6s
26.0s

0.16s
1.28s
0.32s

4.42s
18.5s
11.6s

10.3s
34.2s
26.2s

Visual Analysis
Original

GSE example

GSE Perturbation

GSE (Ours)

Figure 2: Targeted adversarial examples generated by GSE. The target isairship for the ﬁrst two rows, and golf cart for the last two rows. The
attacked model is a VGG19.

FWnuclOriginalCAM

Figure 1: Visual comparison of successful untargeted adversarial instances generated by our attack (1), StrAttack (2), and FWnucl (3). The target model is a ResNet50.

Evaluation metrics and Results on Untargeted Attacks(x(i))0<i≤n images of perturbation (w(i))0<i≤nAttack Success Rate ASR = mn for m successful adversaries
Average Number of Changed Pixels
1 m(i)
ACP =∥m∥0,∑mMN i=1Attack

ASR

ACP

GSE (Ours) 100% 41.7
CIFAR-10 StrAttack 100% 118
ResNet20 FWnucl
94.6% 460

ANC ℓ2d2,01.66 0.80 177
7.50 1.02 428
1.99 2.01 594

GSE (Ours) 100% 1629 8.42 1.50 3428
ImageNet
StrAttack 100% 7265 15.3 2.31 11693
ResNet50FWnucl
47.4% 13760 3.79 1.81 16345

Run depth-ﬁrst search (DFS) on m starting from every 1−entry
another DFS has not yet discovered
Average Number of Clusters (ANC) - average the number of DNS
runs until all 1−entries are discovered for m adversaries
For n < M, N and G = {G1, ..., Gk} a set containing the index setsof all overlapping n by n patches in w

GSE (Ours) 100% 941
5.11 1.95 1964
ImageNet
StrAttack 100% 3589 10.8 2.03 8152
ViT_B_16FWnucl
57.9% 7515 5.67 3.04 9152
ResNet20 classiﬁer for CIFAR-10
ResNet50 and ViT_B_16 classiﬁers for ImageNet
Tested on 1,000 samples from each dataset

d2,0(w) := |{i : ∥wGi ∥2 ̸= 0, i = 1, ..., k}|Results on Targeted Attacks
ResNet20
classiﬁer for
CIFAR-10
ResNet50 andViT_B_16
classiﬁers forImageNet
Tested on 1,000samples fromeach dataset

Best caseAttackASRACP ANC ℓ2

Average cased2,0

GSE (Ours) 100% 29.6 1.06 0.68 137
CIFAR-10 StrAttack 100% 78.4 4.56 0.79 352
100% 283 1.18 1.48 515
ResNet20 FWnucl

ASRACP

100% 86.3
100% 231
85.8% 373

Worst case

ANC ℓ2d2,01.76 1.13 262
10.1 1.86 534
2.52 2.54 564

ASRACP

100% 162
100% 406
40.5% 495

ANC ℓ2d2,03.31 1.57 399
15.9 4.72 619
4.27 3.36 609

GSE (Ours) 100% 3516 5.89 2.16 5967 100% 12014 14.6 2.93 16724 100% 21675 22.8 3.51 29538
ImageNetStrAttack 100% 6579 7.18 2.45 9620 100% 15071 18.0 3.97 20921 100% 26908 32.1 6.13 34768
ResNet50
FWnucl
31.1% 9897 3.81 2.02 11295 7.34% 19356 7.58 3.17 26591 0.0% N/A
N/A N/A N/A
GSE (Ours) 100% 916 3.35 2.20 1782 100% 2667 7.72 2.87 4571 100% 5920 14.3 3.60 9228
ImageNet
StrAttack 100% 3550 7.85 2.14 5964 100% 8729 17.2 3.50 13349 100% 16047 27.4 5.68 22447
ViT_B_16
FWnucl
53.2% 5483 4.13 2.77 6718 11.2% 6002 9.73 3.51 7427 0.0% N/A
N/A N/A N/AInterpretability Metrics
CAMStrAttack

Quantitative Interpretability

Z(x) logits of vectorized image x ∈ [Imin, Imax]dAdversarial Saliency Map (ASM), l− true label∂ Z(x)t ∂ Z(x)l[ASM(x, l,t)]i =1S(i)
∂x
∂
xii


∂ Z(x)t∂ Z(x)l
S = i ∈ {1, ..., d}≥ 0 or≤0∂ xi∂ xi
Binary mask B(x, l,t) ∈ {0, 1}d(1, if [ASM(x, l,t)]i > ν[B(x, l,t)]i =0, otherwise
Interpretability score (IS) given perturbation δ ∈ Rd
∥B(x, l,t) ⊙ w∥2IS(w, x, l,t) =∥w∥2fk[i, j] activation of the unit k at the coordinates(i, j) in the last convolutional layer
wlk weights corresponding to label l for unit kClass activation map CAMl [i, j] = ∑k wlk fk[i, j](a) ImageNet ViT_B_16

IS
0.7
0.6
0.5
0.4
0.3
5055

60

65

7075808590 ν(b) CIFAR-10 ResNet20

IS
0.7
0.6
0.5
0.4
0.3
50
GSE (Ours)

55 60 65 70 75 80 85 90 νStrAttack FWnucl SAPF PGD0 Sparse-RSFigure 3: IS vs. percentile ν for targeted versions of GSE vs. ﬁveother attacks. Evaluated on an ImageNet ViT_B_16 classiﬁer (a),and CIFAR-10 ResNet20 classiﬁer (b).

Literature
Bibliography[1] S. Sadiku, M. Wagner, and S. Pokutta. Group-wise Sparse and Explainable Adversarial Attacks. arXiv preprint arXiv:2311.17434, 2023.
[2] K. Xu, S. Liu, P. Zhao, P. Chen, H. Zhang, Q. Fan, D. Erdogmus, Y. Wang and X. Lin. StrAttack: Towards general implementation and better interpretability. ICLR, 2019.
[3] E. Kazemi, T. Kerdreux and L. Wang. Minimally Distorted Structured Adversarial Attacks International Journal of Computer Vision 131.1, pp. 160-176, 2023.
[4] Y. Fan, B. Wu, W. Li, Y. Zhang, M. Li, Z. Li and Y. Yang. Sparse adversarial attack via perturbation factorization. Proceedings of European Conference on Computer Vision, 2020.