LSDAT: Low-Rank and Sparse Decomposition for Decision-based Adversarial Attack
Not on the map. Why?
Abstract (arXiv)
We propose LSDAT, an image-agnostic decision-based black-box attack that exploits low-rank and sparse decomposition (LSD) to dramatically reduce the number of queries and achieve superior fooling rates compared to the state-of-the-art decision-based methods under given imperceptibility constraints. LSDAT crafts perturbations in the low-dimensional subspace formed by the sparse component of the input sample and that of an adversarial sample to obtain query-efficiency. The specific perturbation of interest is obtained by traversing the path between the input and adversarial sparse components. It is set forth that the proposed sparse perturbation is the most aligned sparse perturbation with the shortest path from the input sample to the decision boundary for some initial adversarial sample (the best sparse approximation of shortest path, likely to fool the model). Theoretical analyses are provided to justify the functionality of LSDAT. Unlike other dimensionality reduction based techniques aimed at improving query efficiency (e.g, ones based on FFT), LSD works directly in the image pixel domain to guarantee that non-ℓ2 constraints, such as sparsity, are satisfied. LSD offers better control over the number of queries and provides computational efficiency as it performs sparse decomposition of the input and adversarial images only once to generate all queries. We demonstrate ℓ0, ℓ2 and ℓ_∞ bounded attacks with LSDAT to evince its efficiency compared to baseline decision-based attacks in diverse low-query budget scenarios as outlined in the experiments.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 39 of its 59 references that are in the map. First posted on arXiv 19 Mar 2021.
Builds on
39 of 59 references.
References · 39
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2016Adversarial examples in the physical worldcited by 1,762
- 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
- 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
- 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
27 more
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
- 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
- 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
- 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
- 2019Simple Black-box Adversarial Attackscited by 249
- 2018Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priorscited by 145
- 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
- 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
- 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
- 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
- 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
- 2019Sparse and Imperceivable Adversarial Attackscited by 95
- 2018SparseFool: a few pixels make a big differencecited by 94
- 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
- 2018GenAttack: Practical Black-box Attacks with Gradient-Free Optimizationcited by 82
- 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
- 2020Sparse-RS: a versatile framework for query-efficient sparse black-box adversarial attackscited by 65
- 2019Black-Box Adversarial Attack with Transferable Model-based Embeddingcited by 57
- 2018Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attackscited by 46
- 2016Adversarial Perturbations Against Deep Neural Networks for Malware Classificationcited by 42
- 2020GreedyFool: Distortion-Aware Sparse Adversarial Attackcited by 37
- 2020AdvFlow: Inconspicuous Black-box Adversarial Attacks using Normalizing Flowscited by 35
- 2019On the Design of Black-box Adversarial Examples by Leveraging Gradient-free Optimization and Operator Splitting Methodcited by 21
- 2020Simple and Efficient Hard Label Black-box Adversarial Attacks in Low Query Budget Regimescited by 17
- 2020Rapid Robust Principal Component Analysis: CUR Accelerated Inexact Low Rank Estimationcited by 16
- 2017Black-Box Attacks against RNN based Malware Detection Algorithmscited by 13
Built on by
Citing papers per year: 2021: 1.
1 paper.