One Sparse Perturbation to Fool them All, almost Always!

Constructing adversarial perturbations for deep neural networks is an important direction of research. Crafting image-dependent adversarial perturbations using white-box feedback has hitherto been the norm for such adversarial attacks. However, black-box attacks are much more practical for real-world applications. Universal perturbations applicable across multiple images are gaining popularity due to their innate generalizability. There have also been efforts to restrict the perturbations to a few pixels in the image. This helps to retain visual similarity with the original images making such attacks hard to detect. This paper marks an important step which combines all these directions of research. We propose the DEceit algorithm for constructing effective universal pixel-restricted perturbations using only black-box feedback from the target network. We conduct empirical investigations using the ImageNet validation set on the state-of-the-art deep neural classifiers by varying the number of pixels to be perturbed from a meagre 10 pixels to as high as all pixels in the image. We find that perturbing only about 10% of the pixels in an image using DEceit achieves a commendable and highly transferable Fooling Rate while retaining the visual quality. We further demonstrate that DEceit can be successfully applied to image dependent attacks as well. In both sets of experiments, we outperformed several state-of-the-art methods.

Single Reduct Generation Based on Relative Indiscernibility of Rough Set Theory

In real world everything is an object which represents particular classes. Every object can be fully described by its attributes. Any real world dataset contains large number of attributes and objects. Classifiers give poor performance when these huge datasets are given as input to it for proper classification. So from these huge dataset most useful attributes need to be extracted that contribute the maximum to the decision. In the paper, attribute set is reduced by generating reducts using the indiscernibility relation of Rough Set Theory (RST). The method measures similarity among the attributes using relative indiscernibility relation and computes attribute similarity set. Then the set is minimized and an attribute similarity table is constructed from which attribute similar to maximum number of attributes is selected so that the resultant minimum set of selected attributes (called reduct) cover all attributes of the attribute similarity table. The method has been applied on glass dataset collected from the UCI repository and the classification accuracy is calculated by various classifiers. The result shows the efficiency of the proposed method.