Abstract
Deep neural networks (DNNs) have been widely deployed in a diverse array of tasks, such as image classification. However, recent research has revealed that intentionally adding some perturbations to the input samples of a DNN can cause the model to misclassify the samples. The adversarial samples have the capability of fooling highly proficient convolutional neural network classifiers in deep learning. The presence of such vulnerable ability in these neural networks may have severe implications on the security of targeted applications. In this work, we show that attacks on CNNs can be successfully implemented even without knowing model parameters of the target network. We use the beetle antennae search algorithm to realize the attack such that human eyes cannot detect the attack. Compared to other adversarial attack algorithms, the resulting adversarial samples from our algorithm are not significantly different from the pre-attack images, which makes the attack undetectable. In this study, the CIFAR-10 dataset was utilized to show the efficacy and advantages of the algorithm on LeNet-5 and ResNet architectures. Our findings indicate that the proposed algorithm produces images with no significant difference from the original images while the attack success rate is high.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Goodfellow, I., Bengio, Y., Courville, A.: Deep Learning. MIT Press, Cambridge (2016)
Szegedy, C., et al.: Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 (2013)
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., Swami, A.: Practical black-box attacks against machine learning. In: Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security, pp. 506–519 (2017)
Tang, K., Shen, J., Chen, Q.A.: Fooling perception via location: a case of region-of-interest attacks on traffic light detection in autonomous driving. In: NDSS Workshop on Automotive and Autonomous Vehicle Security (AutoSec) (2021)
Zhang, C., Benz, P., Karjauv, A., Cho, J.W., Zhang, K., Kweon, I.S.:Investigating top-k white-box and transferable black-box attack. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 15085–15094 (2022)
Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)
Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.:The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 372–387. IEEE (2016)
Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple andaccurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2574–2582 (2016)
Carlini, N., Wagner, D.: Towards evaluating the robustness of neural networks. In: 2017 IEEE Symposium on Security and Privacy, pp. 39–57. IEEE (2017)
Su, J., Vargas, D.V., Sakurai, K.: One pixel attack for fooling deep neural networks. IEEE Trans. Evol. Comput. 23(5), 828–841 (2019)
Khan, A.H., Cao, X., Xu, B., Li, S.: Beetle antennae search: using biomimetic foraging behaviour of beetles to fool a well-trained neuro-intelligent system. Biomimetics 7(3), 84 (2022)
Wang, J., Chen, H.: Bsas: beetle swarm antennae search algorithm for optimization problems. arXiv preprint arXiv:1807.10470 (2018)
Krizhevsky, A., Sutskever, I., Hinton, G.E.: Imagenet classification with deep convolutional neural networks. Commun. ACM 60(6), 84–90 (2017)
Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014)
Szegedy, C., et al.: Going deeper with convolutions. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1–9 (2015)
He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778 (2016)
Huang, G., Liu, Z., Van Der Maaten, L., Weinberger, K.Q.: Densely connected convolutional networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4700–4708 (2017)
Wang, Y., Tan, Y.A., Zhang, W., Zhao, Y., Kuang, X.: An adversarial attack on dnn-based black-box object detectors. J. Netw. Comput. Appl. 161, 102634 (2020)
LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-based learning applied to document recognition. Proc. IEEE 86(11), 2278–2324 (1998)
Cao, H., Si, C., Sun, Q., Liu, Y., Li, S., Gope, P.: Abcattack: a gradient-free optimization black-box attack for fooling deep image classifiers. Entropy 24(3), 412 (2022)
Giulivi, L., et al.: Adversarial scratches: deployable attacks to CNN classifiers. Pattern Recogn. 133, 108985 (2023)
Ali, Y.M.B.: Adversarial attacks on deep learning networks in image classification based on smell bees optimization algorithm. Futur. Gener. Comput. Syst. 140, 185–195 (2023)
Cai, Z., et al.: Context-aware transfer attacks for object detection. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, pp. 149–157 (2022)
Puttagunta, M.K., Ravi, S., Nelson Kennedy Babu, C.: Adversarial examples: attacks and defences on medical deep learning systems. Multimedia Tools Appl. 1–37 (2023)
Ye, J., Wang, Y., Zhang, X., Xu, L., Ni, R.: Adversarial attack algorithm for object detection based on improved differential evolution. In: 6th International Workshop on Advanced Algorithms and Control Engineering (IWAACE 2022), vol. 12350, pp. 669–678. SPIE (2022)
Acknowledgement
This work is supported in part by the National Natural Science Foundation of China under Grant 62206109, the Guangdong Basic and Applied Basic Research Foundation under Grant 2022A1515010976, and the Science and Technology Program of Guangzhou under Grant 202201010457.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Yang, C., Zhang, Y., Khan, A.H. (2023). Undetectable Attack to Deep Neural Networks Without Using Model Parameters. In: Huang, DS., Premaratne, P., Jin, B., Qu, B., Jo, KH., Hussain, A. (eds) Advanced Intelligent Computing Technology and Applications. ICIC 2023. Lecture Notes in Computer Science, vol 14087. Springer, Singapore. https://doi.org/10.1007/978-981-99-4742-3_4
Download citation
DOI: https://doi.org/10.1007/978-981-99-4742-3_4
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-99-4741-6
Online ISBN: 978-981-99-4742-3
eBook Packages: Computer ScienceComputer Science (R0)