Sinkhorn Adversarial Attack and Defense

Area of Science:

• Computer Vision
• Machine Learning Security
• Deep Learning

Background:

• Adversarial attacks are a significant concern in machine learning, predominantly operating within the Lp space.
• Existing methods often lack robustness and specialized formulations for image data.

Purpose of the Study:

• To propose a novel adversarial attack method utilizing Wasserstein distance for generating adversarial samples.
• To address limitations of existing Lp-based attacks by employing an unbalanced optimal transport formulation suitable for images.

Main Methods:

• A novel approach generating adversarial samples via Wasserstein distance and unbalanced optimal transport.
• Perturbation is introduced as pixel mass distribution, guided by a cost metric.
• Adversarial samples are created using a gradient step, then projected into a Wasserstein ball relative to the original sample.

Main Results:

• Demonstrated a significant decrease in the performance of state-of-the-art classifiers on datasets like MNIST, Fashion-MNIST, CIFAR-10, and Tiny ImageNet.
• Achieved superior performance in adversarial defense against multiple state-of-the-art attacks when tested on adversarially trained classifiers.

Conclusions:

• The proposed Wasserstein distance-based attack is effective in degrading classifier performance.
• The method shows promise for robust adversarial defense, outperforming existing techniques against various attacks.