Boosting Adversarial Attacks on Neural Networks with Better Optimizer

<div>Attack success rates (%) of adversarial examples generated for Inc-v3 with AI-FGM, applied to Inc-v3 (white-box), Inc-v4 (black-box and normally trained), and Inc-v3ens4 (black-box and adversarially trained) with <svg height="12.7178pt" id="M121" style="vertical-align:-3.42947pt" version="1.1" viewbox="-0.0498162 -9.28833 12.3012 12.7178" width="12.3012pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M558 587C558 666 497 712 432 712C379 712 330 691 284 650C212 586 178 508 148 348L71 -65C49 -185 35 -229 23 -235L27 -261C49 -259 101 -251 124 -224C131 -216 138 -178 159 -24C171 66 197 200 227 356C264 550 295 668 393 668C443 668 479 632 479 575C479 516 446 458 383 418C361 404 344 398 318 397L296 350C395 338 460 281 460 192C460 110 411 40 300 40C258 40 215 55 192 69L181 51C191 18 222 -16 266 -16C308 -16 351 1 397 26C471 67 545 142 545 221C545 315 486 365 401 395C469 437 558 498 558 587Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,7.228,3.132)"><path d="M389 0V32C297 38 291 46 291 118V635C234 613 175 595 109 583V556L161 554C203 552 207 547 207 497V118C207 46 201 38 110 32V0H389Z"></path></g></svg> and <svg height="12.7178pt" id="M122" style="vertical-align:-3.42947pt" version="1.1" viewbox="-0.0498162 -9.28833 12.3012 12.7178" width="12.3012pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M558 587C558 666 497 712 432 712C379 712 330 691 284 650C212 586 178 508 148 348L71 -65C49 -185 35 -229 23 -235L27 -261C49 -259 101 -251 124 -224C131 -216 138 -178 159 -24C171 66 197 200 227 356C264 550 295 668 393 668C443 668 479 632 479 575C479 516 446 458 383 418C361 404 344 398 318 397L296 350C395 338 460 281 460 192C460 110 411 40 300 40C258 40 215 55 192 69L181 51C191 18 222 -16 266 -16C308 -16 351 1 397 26C471 67 545 142 545 221C545 315 486 365 401 395C469 437 558 498 558 587Z"></path></g><g transform="matrix(.0091,0,0,-0.0091,7.228,3.132)"><path d="M414 144C384 79 371 75 317 75H135L276 221C367 316 408 376 408 465C408 570 327 635 237 635C179 635 131 609 100 575L42 494L67 471C94 510 138 565 205 565C277 565 321 517 321 435C321 348 258 270 195 195C146 137 88 81 33 26V0H411C423 44 433 88 446 135L414 144Z"></path></g></svg> in the range of <span class="nowrap"><svg height="11.5564pt" id="M123" style="vertical-align:-2.26807pt" version="1.1" viewbox="-0.0498162 -9.28833 26.8104 11.5564" width="26.8104pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M300 -147C201 -63 143 98 143 270S200 602 300 686L282 710C136 610 70 450 70 271V270C70 89 136 -72 282 -170L300 -147Z"></path></g><g transform="matrix(.013,0,0,-0.013,4.498,0)"><path d="M241 635C89 635 35 457 35 312C35 153 89 -12 240 -12C390 -12 443 166 443 312C443 466 390 635 241 635ZM238 602C329 602 354 454 354 312C354 172 330 22 240 22C152 22 124 173 124 313S148 602 238 602Z"></path></g><g transform="matrix(.013,0,0,-0.013,10.738,0)"><path d="M95 130C70 130 46 113 46 88C46 72 54 64 59 64C93 55 121 33 121 -3C121 -41 93 -68 44 -88L55 -117C117 -98 186 -56 186 22C186 91 131 130 95 130Z"></path></g><g transform="matrix(.013,0,0,-0.013,15.881,0)"><path d="M384 0V27C293 34 287 42 287 114V635C232 613 172 594 109 583V559L157 557C201 555 205 550 205 499V114C205 42 199 34 109 27V0H384Z"></path></g><g transform="matrix(.013,0,0,-0.013,22.121,0)"><path d="M275 270C275 450 212 609 64 710L45 686C145 604 203 442 203 270S147 -63 45 -147L64 -170C213 -68 275 89 275 270Z"></path></g></svg>.</span> (a) Inc-v3. (b) Inc-v4. (c) Inc-v3<sub>ens4</sub>.</div>

Security and Communication Networks

fig3

Figure 3

Figure 3: Boosting Adversarial Attacks on Neural Networks with Better Optimizer 