Simultaneously Optimizing Perturbations and Positions for Black-Box Adversarial Patch Attacks.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep neural networks (DNNs) are vulnerable to adversarial attacks, particularly adversarial patches, which pose significant real-world risks.
• Existing methods for generating adversarial patches often optimize either position or perturbation, but not both simultaneously.
• The robustness of DNNs is a critical concern for secure and reliable AI applications.

Purpose of the Study:

• To propose a novel method for simultaneously optimizing the position and perturbation of adversarial patches.
• To achieve a high attack success rate in a black-box setting for adversarial patch attacks.
• To enhance the efficiency and effectiveness of adversarial attacks on deep neural networks.

Main Methods:

• A reinforcement learning framework is utilized to simultaneously optimize patch position and perturbation parameters.
• The method treats patch position and hyper-parameters for perturbations as variables within the reinforcement learning framework.
• Rewards are obtained from the target model with a limited number of queries to guide optimization.

Main Results:

• The proposed method significantly improves attack success rates on Face Recognition (FR) tasks across four representative models.
• Experimental results demonstrate enhanced query efficiency compared to previous methods.
• The approach shows practical application value through successful tests on commercial FR services and in physical environments.

Conclusions:

• Simultaneously optimizing adversarial patch position and perturbation is crucial for maximizing attack success.
• The proposed reinforcement learning-based method offers an effective and efficient approach for generating robust adversarial patches.
• The method demonstrates strong generalization capabilities, applicable to tasks beyond face recognition, such as traffic sign recognition.