一句话：提出 OPPSLA，利用程序草图合成与随机搜索生成单像素对抗样本，显著减少查询并提升成功率。
单像素对抗攻击通过修改一个像素欺骗图像分类器，但扰动不可微且搜索空间大，现有方法需大量查询，难以满足几千次查询限制。本文提出基于程序合成的方法 OPPSLA：给定分类器和训练集，它利用表达性程序草图，将攻击表示为输入像素与分类器输出上的类型化条件表达式，并用受 Metropolis-Hastings 启发的随机搜索最小化查询数。该方法可扩展为最小化扰动像素数的少像素攻击。在 CIFAR-10 和 ImageNet 的多个深度网络上，OPPSLA 取得当前最佳成功率，查询数常比现有攻击少一个数量级；合成程序还可迁移到其他分类器，而现有攻击需逐分类器重跑。
Neural networks are successful in various tasks but are also susceptible to adversarial examples. An adversarial example is generated by adding a small perturbation to a correctly-classified input with the goal of causing a network classifier to misclassify. In one pixel attacks, an attacker aims to fool an image classifier by modifying a single pixel. This setting is challenging for two reasons: the perturbation region is very small and the perturbation is not differentiable. To cope, one pixel attacks iteratively generate candidate adversarial examples and submit them to the network until finding a successful candidate. However, existing works require a very large number of queries, which is infeasible in many practical settings, where the attacker is limited to a few thousand queries to the network. We propose a novel approach for computing one pixel attacks. The key idea is to leverage program synthesis and identify an expressive program sketch that enables to compute adversarial examples using significantly fewer queries. We introduce OPPSLA, a synthesizer that, given a classifier and a training set, instantiates the sketch with customized conditions over the input’s pixels and the classifier’s output. OPPSLA employs a stochastic search, inspired by the Metropolis-Hastings algorithm, that synthesizes typed expressions enabling minimization of the number of queries to the classifier. We further show how to extend OPPSLA to compute few pixel attacks minimizing the number of perturbed pixels. We evaluate OPPSLA on several deep networks for CIFAR-10 and ImageNet. We show that OPPSLA obtains a state-of-the-art success rate, often with an order of magnitude fewer queries than existing attacks. We further show that OPPSLA’s programs are transferable to other classifiers, unlike existing one pixel attacks, which run from scratch on every classifier and input.
@article{paperbot2014,
title = {One Pixel Adversarial Attacks via Sketched Programs},
author = {Tom Yuviler and Dana Drachsler-Cohen},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {PLDI},
year = {2023},
doi = {10.1145/3591301}
}