[Paper Review] ASP:A Fast Adversarial Attack Example Generation Framework based on Adversarial Saliency Prediction

Fuxun Yu, Qide Dong+1 more|arXiv (Cornell University)|Feb 15, 2018

Adversarial Robustness in Machine Learning15 references3 citations

TL;DR

This paper proposes ASP, a fast adversarial example generation framework that leverages adversarial saliency prediction to significantly accelerate attack generation while reducing perturbation rates. By predicting high-impact pixel regions for attack, ASP achieves up to 12× speed-up, 2× lower perturbation rate, and 87% attack success rate on MNIST and CIFAR-10, outperforming FGM, BIM, and DeepFool.

ABSTRACT

With the excellent accuracy and feasibility, the Neural Networks have been widely applied into the novel intelligent applications and systems. However, with the appearance of the Adversarial Attack, the NN based system performance becomes extremely vulnerable:the image classification results can be arbitrarily misled by the adversarial examples, which are crafted images with human unperceivable pixel-level perturbation. As this raised a significant system security issue, we implemented a series of investigations on the adversarial attack in this work: We first identify an image's pixel vulnerability to the adversarial attack based on the adversarial saliency analysis. By comparing the analyzed saliency map and the adversarial perturbation distribution, we proposed a new evaluation scheme to comprehensively assess the adversarial attack precision and efficiency. Then, with a novel adversarial saliency prediction method, a fast adversarial example generation framework, namely "ASP", is proposed with significant attack efficiency improvement and dramatic computation cost reduction. Compared to the previous methods, experiments show that ASP has at most 12 times speed-up for adversarial example generation, 2 times lower perturbation rate, and high attack success rate of 87% on both MNIST and Cifar10. ASP can be also well utilized to support the data-hungry NN adversarial training. By reducing the attack success rate as much as 90%, ASP can quickly and effectively enhance the defense capability of NN based system to the adversarial attacks.

Motivation & Objective

• Address the high computational cost and low precision of existing adversarial attack methods.
• Improve attack efficiency and reduce perturbation magnitude for more targeted and effective attacks.
• Enable scalable adversarial training by generating high-quality adversarial examples rapidly.
• Provide a comprehensive evaluation scheme to assess attack precision and efficiency based on saliency analysis.
• Enhance neural network robustness through data-hungry adversarial training supported by fast attack generation.

Proposed method

• Propose a novel adversarial saliency prediction method to identify the most vulnerable pixels in an image for attack.
• Use saliency maps derived from gradient-based analysis to guide targeted perturbation placement.
• Introduce a pre-trained adversarial pattern prediction module to avoid iterative gradient computation during attack generation.
• Construct a fast attack framework (ASP) that generates high-quality adversarial examples with minimal computational overhead.
• Apply the generated adversarial examples to adversarial training, improving model robustness against future attacks.
• Develop a comprehensive evaluation scheme combining saliency analysis and perturbation distribution comparison to measure attack precision and efficiency.

Experimental results

Research questions

• RQ1 How can adversarial saliency prediction improve the precision and efficiency of adversarial example generation?
• RQ2 Can a pre-trained saliency model reduce the computational cost of generating adversarial examples without sacrificing attack success rate?
• RQ3 To what extent does ASP outperform existing methods like FGM, BIM, and DeepFool in terms of speed, perturbation magnitude, and attack success rate?
• RQ4 How effective is ASP in supporting data-hungry adversarial training for enhancing model robustness?
• RQ5 What is the impact of ASP-generated adversarial examples on reducing the success rate of subsequent attacks on defended models?

Key findings

• ASP achieves up to 12× speed-up in adversarial example generation compared to BIM and DeepFool on CIFAR-10, with 2.1s for 1000 images versus 25.1s for BIM.
• On MNIST, ASP reduces perturbation rate by up to 2× compared to FGM, BIM, and DeepFool, with the lowest perturbation concentration.
• ASP maintains a high attack success rate of 87–92% on both MNIST and CIFAR-10, outperforming FGM (7.2% success rate) and matching or exceeding BIM and DeepFool.
• In adversarial training, ASP reduces the attack success rate of subsequent attacks by 45% to 90%, significantly enhancing model robustness.
• The ASE (Attack Success Efficiency) metric confirms that ASP’s predicted saliency patterns are more effective than gradient-based methods, with higher precision and lower computational cost.
• ASP’s pre-trained pattern prediction enables fast inference with minimal overhead, making it suitable for large-scale adversarial training and real-time applications.