An Adversarial Attack via Feature Contributive Regions

1 INTRODUCTION . The development of deep learning technology has promoted the successful application of deep neural networks ( DNNs ) in various fields , such as image classification ( Krizhevsky et al. , 2012 ; Simonyan & Zisserman , 2014 ) , computer vision ( He et al. , 2016 ; Taigman et al. , 2014 ) , natural language processing ( Devlin et al. , 2018 ; Goldberg , 2017 ) , etc . In particular , convolutional neural networks ( CNNs ) , a typical DNNs , have shown excellent performance applied in image classification . However , many works have shown that CNNs are extremely vulnerable to adversarial examples ( Szegedy et al. , 2013 ) . The adversarial example is crafted from clean example added by well-designed perturbations that are almost imperceptible to human vision , while can fool CNNs . Scholars have proposed a variety of methods to craft adversarial samples , such as L-BFGS ( Szegedy et al. , 2013 ) , FGSM ( Goodfellow et al. , 2014 ) , I-FGSM ( Kurakin et al. , 2016 ) , PGD ( Madry et al. , 2017 ) and C & W ( Carlini & Wagner , 2017 ) . These attack strategies can successfully mislead CNNs to make incorrect predictions , restricting the application of CNNs in certain security-sensitive areas ( such as autonomous driving , financial payments based on face recognition , etc. ) . Therefore , learning how to generate adversarial examples is of great significance . We can categorize these attacks into two categories , i.e. , the global attacks and the local attacks , according to the region added perturbations . The global attacks tempt to perturb all pixels of the clean image , such as FGSM ( Goodfellow et al. , 2014 ) , PGD ( Madry et al. , 2017 ) and C & W ( Carlini & Wagner , 2017 ) ; the local attacks only modify some pixels of the clean image , such as one-pixel attacks ( Su et al. , 2019 ) and JSMA ( Papernot et al. , 2016b ) . At present , the global attacks perturb all pixels on the whole image , which not only fail to destroy the feature contributive regions ( the critical semantics of an image ) , but they also increase the degree of image distortion . We explain in detail in the experimental part . The local attacks seem to be able to solve this problem , but the current proposed local attacks don ’ t well realize that focus on undermining the image feature contributive regions . Papernot et al . ( 2016b ) proposed a method of crafting adversarial example based on the Jacobian Saliency Map by constraining the ` 0 norm of the perturbations , which means that only a few pixels in the image are modified . However , this method has the disadvantage of over-modifying the value of the pixels , making the added perturbations easily perceptible by the naked eye , and its adversarial strength is weak ( Akhtar & Mian , 2018 ) . Su et al . ( 2019 ) proposed an extremely adversarial attack—one-pixel attack . One-pixel attack can fool CNNs by changing 1 to 5 pixels , but this method is better for low-resolution images attack ( such as CIFAR-10 ) , and the attack success rate for high-resolution images will be greatly reduced ( such as ImageNet ) , and the cost is very large ` 1 distortion ( Xu et al. , 2018 ) . In this paper , we propose a novel attack method to overcome the redundant perturbations of the global attacks and the poor strength of the proposed local attacks . Inspired by the work of CAM ( Zhou et al. , 2016 ) and Grad-CAM ( Selvaraju et al. , 2017 ) , it is the most effective way to reduce image distortion , high efficiency and reduce computational complexity by adding perturbations to the critical semantics . As we all know , CNN is an end-to-end representation learning model , which starts from simple low-level features and combines them into abstract high-level features layer by layer . Thus , Grad-CAM ( Selvaraju et al. , 2017 ) uses the gradient information of the last convolutional layer as the metric to understand the decision of each neuron for target classification , and explains in a visual way that not all image pixels contribute to the model classification . Similarly , as shown in Figure 1 , the red area is the main contributive area . Therefore , perturbing the image globally is not the most efficient strategy . We propose the FCRs attack strategy , which only adds perturbations in Feature Contributive Regions ( FCRs ) with the aim of generating sparse and more excellent perturbations . Especially , compared with existing local attacks , our proposed method perturbs continuous semantic regions rather than discrete pixels . In this work , we use Grad-CAM to locate regions that have a greater impact on the classification decision of CNNs . To ensure the similarity between the adversarial example and the corresponding clean image as much as possible , the objective function we optimize is the sum of the two parts of the function : the ` 2 norm of the perturbations and the loss function of the generated adversarial examples . We thus use the stochastic gradient descent optimization algorithm to find efficient perturbations . In order to avoid the situation where the perturbations do not update when the objective function tends to zero , we also introduce inverse temperature T under the inspiration of Hinton et al . ( 2015 ) . Compared to previous work , the contributions of our work are summarized as follows : • We propose an attack via feature contributive regions ( FCRs ) for achieving a trade-off between the powerful attack and the small perturbations . More importantly , this work implements an effective local attack algorithm by redefining an objective function . • Specially , we novelly propose an inverse temperature T , which avoids the situation where the loss function of the generated adversarial example tends to be zero when the stochastic gradient descent optimization algorithm is used to find the perturbations . • Comprehensive experiments demonstrate that FCRs attack consistently outperforms stateof-the-art methods on the CIFAR-10 and ILSVRC-2012 datasets . In addition , we verify the importance of FCRs by dividing the original clean image into two parts ( i.e. , FCRs and Non-FCRs ) . 2 RELATED WORK . In many cases , the CNNs are vulnerable to adversarial attacks which have caused extensive research in academia . Szegedy et al . ( 2013 ) used the constrained L-BFGS algorithm to craft adversarial ex- amples . L-BFGS attack has a high attack success rate , but the computational cost is also high ( Narodytska & Kasiviswanathan , 2017 ) . Therefore , Goodfellow et al . ( 2014 ) proposed FGSM , which can quickly generate adversarial examples but has a low attack success rate . Kurakin et al . ( 2016 ) proposed the Iterative attack method ( I-FGSM ) on the basis of FGSM and Madry et al . ( 2017 ) proposed PGD . Dong et al . ( 2018 ) proposed an iterative algorithm based on momentum ( MI-FGSM ) to improve the transferability of adversarial samples . Xie et al . ( 2019 ) combined the input diversity strategy with iterative attacks on I-FGSM and MI-FGSM to further improve the transferability of adversarial examples . The aforementioned attacks belong to the gradient attack family , and they destroy the semantic information of the whole image . Papernot et al . ( 2016b ) proposed an attack method based on the Jacobian Saliency Map by minimizing the ` 0 norm of adversarial perturbations and used a greedy algorithm to find saliency pixels . However , this method has the problems of over-modifying pixels too much and weak attack intensity . Su et al . ( 2019 ) proposed an adversarial attack method based on the differential evolution algorithm . This method also focuses on the number of pixels to be modified , but does not limit the power of a single change , thus leading to very large ` 1 distortion ( Xu et al. , 2018 ) . In this work , we expect to achieve a more effective attack that can be as successful as existing attacks but achieves a trade-off between the perturbation power and the number of perturbed pixels . We will show that the proposed FCRs attack is able to destroy the feature contribution regions that make attacks successful , but without incurring extra pixel-level perturbations . Related to our work is Deng & Zeng ( 2019 ) , who proposed a spatial transformed attack method based on attention mechanism . This work expands the stadv ( Xiao et al. , 2018 ) to A-stadv . The purpose of this work is to generate adversarial examples with less interference and less visible . The author only conducts experiments on the ImageNet dataset , and does not discuss the black-box attack effect of this method . But while verifying that many pixel-level perturbations are redundant , our work proposes a new algorithm to craft perturbations , and demonstrates its white-box and blackbox attack effects on the CIFAR-10 and ILSVRC2012 datasets . In addition , Xu et al . ( 2019 ) used CAM to explain adversarial perturbations but their target is not to generate adversarial examples , but to understand and interpret adversarial examples . Zhang et al . ( 2020 ) proposed a target-free method to generate adversarial examples via principal component analysis and made adversarial examples relate to the data manifold , but their experiment showed that the performances of their method were not always better than FGS and C & W . Here we pay more attention to the feature contribution regions and finally , we achieve a trade-off between the powerful attack and the number of perturbed pixels . 3 METHODOLOGY . Inspired by “ attention mechanism ” ( Zagoruyko & Komodakis , 2016 ) , we believe the classifier ’ s performance is greatly affected by some specific feature regions that is termed as feature contributive regions ( FCRs ) in this paper . This intuition is also confirmed by Deng & Zeng ( 2019 ) proposed Astadv which is an attention based on spatial transformed adversarial example . Therefore , if we find FCRs and add perturbations to them , it will be more effective to fool the classifier with fewer perturbations than previous methods . Our idea is to divide an image into two semantic parts : FCRs and Non-FCRs and then perturbs feature contributive regions . The result of fewer perturbations ensures maximumly adversarial effects on local regions of clean images . 3.1 NOTIONS . Deep neural networks ( DNNs ) : A DNN can be expressed as a high-dimensional approximation function : f ( X , θ ) : Rm → Rn , whereX ∈ Rm is the input variable , Y ∈ Rn is the true class , X and θ represents the model parameters . In this work , we focus on a specific DNN , convolutional neural networks ( CNNs ) that are typically comprised of convolutional layers with some method of periodic downsampling ( either through pooling or strided convolutions ) . Here , we define the Logits layer . The input before the softmax layer of the CNNs , namely the Logits layer ( the penultimate layer ) : Yj = w T j A , j = 1 , 2 , . . . , C , where w T j is the weight matrix and A is the input vector of the Logits layer , which contains a mapping function X 7→ A . Then the softmax function can be expressed as Sj = expYj/ ∑c i=1 expYi , and the final model can be expressed as f ( X ) = S ( wTj A ) . Given an input X , then the predicted class of X can be expressed as Ŷ = argmaxj=1 , ... , k f ( X ) j . The goal of model training is to minimize the cross-entropy loss function , which can be expressed as : J = − C∑ j=1 Yj logSj = − logSj ( 1 ) where Y is a 1 × C vector and there are C values in it . Only one value is 1 ( corresponding to the true label ) , and the other C − 1 values are all 0 . For N input-label pairs ( Xi , Yi ) , the cross-entropy loss function of the model can be expressed as : J = − 1 N N∑ i=1 C∑ j=1 Yj logSj = − 1 N N∑ i=1 logSj ( 2 ) Adversarial examples : An adversarial example can be represented as X ′ = X + δ , where δ is the perturbation . Normally , the perturbation δ is constrained by the ` 0 , ` 2 or ` ∞ norm , that is ‖X ′ −X‖p ≤ . For untargeted attacks , we only need to search for an X ′ satisfying Y ′ = argmaxj f ( X ′ ) j , where Y ′ 6= Y and we also do not need to specify which class will be misclassified ; for targeted attacks , we specify a target class Y ∗ 6= Y , so that the target model not only misclassifies the example , but also needs to classify them into the specified class . In general , the targeted attacks are more difficult than untargeted attacks .

Summary: This paper focuses on the problem of generating sparse l2-adversarial examples in a white-box and surrogate/transfer setting. The authors consider “local attacks” – perturbing on a limited number of pixels while achieving high attack success rate. The main contribution of this work is to define the region to perturb using grad-cam based saliency maps to identify regions that have a greater impact on the classification decision. Having identified this region, the author use SGD to find the adversarial perturbations. The experimental results show that a high attack success rate can be achieved with this method.