Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defenses

Understand

Research on adversarial examples in computer vision tasks has shown that small, often imperceptible changes to an image can induce misclassification, which has security implications for a wide range of image processing systems.

• Considering $L_2$ norm distortions, the Carlini and Wagner attack is presently the most effective white-box attack in the literature.
• However, this method is slow since it performs a line-search for one of the optimization terms, and often requires thousands of iterations.
• In this paper, an efficient approach is proposed to generate gradient-based attacks that induce misclassifications with low $L_2$ norm, by decoupling the direction and the norm of the adversarial perturbation that is added to the image.