Search

Recent investigations have demonstrated that deep neural networks are susceptible to subtly modified input data. This paper introduces a novel untargeted white-box adversarial attack termed the dynamic programming-based sub-pixel score method (SPSM) attack (DPSPSM). This technique modifies conventional gradient-based white-box adversarial methods, which are typically restricted by a predetermined Hamming distance, by incorporating a dynamic programming framework. The method is driven by a pixel score metric approach, the SPSM, which is developed herein. Unlike traditional gradient-based adversarial attacks that introduce nearly imperceptible modifications across the entire image, DPSPSM operates rapidly and maintains robustness by altering only a restricted number of input pixels. The introduced algorithm quantizes the gradient updates using a score computed for every pixel, which aggregates the contributions across all channels. Experimental outcomes indicate that the DPSPSM successfully misleads the model, achieving a success rate of 30.45% on the CIFAR-10 test set and 29.30% on the CIFAR-100 test set.

The pressing issue of adversarial vulnerability in classifiers, particularly those implemented via deep neural networks, is examined. This problem is investigated through a generalization applicable to any classification models generated by machine learning techniques. The insufficiency of conventionally accepted metrics for evaluating classifier quality is highlighted, including metrics deployed to validate the efficacy of defense mechanisms against adversarial manipulation. The underlying causes behind the generation of adversarial examples and other machine learning-based classification errors are explored. A methodology for simulating adversarial attacks is introduced, demonstrating the core phenomena encountered during such exploits. The necessity of establishing quality metrics specifically tailored to quantify potential classifier vulnerability to adversarial threats is emphasized. To evaluate robustness against adversarial interference, the application of the multidimensional EDCAP metric (Excess, Deficit, Coating, Approx, Pref) is proposed. Furthermore, a technique is presented for constructing a novel multiclass classifier, termed EnAE (Ensemble of Auto-Encoders), which leverages an ensemble of single-class classifiers governed by the EDCAP evaluation criteria. The EnAE classification framework employs a hard voting mechanism and is capable of identifying anomalous input data. The introduced metric, construction framework, and classifier are validated across multiple datasets characterized by feature spaces of moderate dimensionality.