Probability-Distribution-Guided Adversarial Sample Attacks for Boosting Transferability and Interpretability

Hongying Li, Miaomiao Yu, Xiaofei Li, Jun Zhang (), Shuohao Li, Jun Lei and Hairong Huang
Additional contact information
Hongying Li: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Miaomiao Yu: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Xiaofei Li: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Jun Zhang: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Shuohao Li: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Jun Lei: Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410000, China
Hairong Huang: Teacher Training School, Zhongxian, Chongqing 404300, China

Mathematics, 2023, vol. 11, issue 13, 1-22

Abstract: In recent years, with the rapid development of technology, artificial intelligence (AI) security issues represented by adversarial sample attack have aroused widespread concern in society. Adversarial samples are often generated by surrogate models and then transfer to attack the target model, and most AI models in real-world scenarios belong to black boxes; thus, transferability becomes a key factor to measure the quality of adversarial samples. The traditional method relies on the decision boundary of the classifier and takes the boundary crossing as the only judgment metric without considering the probability distribution of the sample itself, which results in an irregular way of adding perturbations to the adversarial sample, an unclear path of generation, and a lack of transferability and interpretability. In the probabilistic generative model, after learning the probability distribution of the samples, a random term can be added to the sampling to gradually transform the noise into a new independent and identically distributed sample. Inspired by this idea, we believe that by removing the random term, the adversarial sample generation process can be regarded as the static sampling of the probabilistic generative model, which guides the adversarial samples out of the original probability distribution and into the target probability distribution and helps to boost transferability and interpretability. Therefore, we proposed a score-matching-based attack (SMBA) method to perform adversarial sample attacks by manipulating the probability distribution of the samples, which showed good transferability in the face of different datasets and models and provided reasonable explanations from the perspective of mathematical theory and feature space. Compared with the current best methods based on the decision boundary of the classifier, our method increased the attack success rate by 51.36% and 30.54% to the maximum extent in non-targeted and targeted attack scenarios, respectively. In conclusion, our research established a bridge between probabilistic generative models and adversarial samples, provided a new entry angle for the study of adversarial samples, and brought new thinking to AI security.

Keywords: probability distribution; adversarial sample; transferability; interpretability (search for similar items in EconPapers)
JEL-codes: C (search for similar items in EconPapers)
Date: 2023
References: View complete reference list from CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/2227-7390/11/13/3015/pdf (application/pdf)
https://www.mdpi.com/2227-7390/11/13/3015/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jmathe:v:11:y:2023:i:13:p:3015-:d:1188600

Access Statistics for this article

Mathematics is currently edited by Ms. Emma He

More articles in Mathematics from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().