A Langevin dynamics based approach to generating sparse adversarial perturbations

Pooladian, A-A.,
*Iannantuono, A.*, Finlay, C., and Oberman, A. M.

2019

Deep neural networks are vulnerable to small changes in the input that lead to misclassification, calledadversarial images. We present an efficient approach togenerating sparse adversarial images, i.e. small with respect to the cardinality function \(\ell_0\), without using gradient information. The lack of gradient oracle isof interest in the case of adversarial attacks: in a practical setting, one can easily query the model to determine whether the image is misclassified or not but rarely will the full network structure be provided. Our method, ProxWalk, is inspired by Metropolis-Adjusted Langevin dynamics; a method for modeling random walks,and the proximal variant. We present results on MNIST, Fashion-MNIST, CIFAR10, and CIFAR100 datasets, and demonstrate that our decision-based attackis on par with modern sparse white-box attacks.