Toward Visual Distortion in Black-Box Attacks.

Area of Science:

• Computer Vision
• Machine Learning Security
• Adversarial Machine Learning

Background:

• Black-box attacks often introduce visual distortion to adversarial examples.
• Minimizing this distortion is crucial for realistic adversarial attacks.

Purpose of the Study:

• To propose a novel black-box attack that directly minimizes visual distortion.
• To achieve adversarial examples with imperceptible perturbations.

Main Methods:

• Learning the noise distribution of adversarial examples.
• Utilizing perceptual distance to quantify and minimize visual distortion.
• Approximating gradients of non-differentiable loss functions via noise sampling.

Main Results:

• Achieved 100% success rate on InceptionV3, ResNet50, and VGG16bn.
• Demonstrated significantly lower visual distortion compared to state-of-the-art black-box attacks.
• Theoretically proved the convergence of the proposed model.

Conclusions:

• The novel black-box attack effectively minimizes visual distortion.
• The method offers a promising direction for creating realistic adversarial examples.
• Publicly available code facilitates further research and development.