Perception-in-the-Loop Adversarial Examples

Understand

We present a scalable, black box, perception-in-the-loop technique to find adversarial examples for deep neural network classifiers.

• Black box means that our procedure only has input-output access to the classifier, and not to the internal structure, parameters, or intermediate confidence values.
• Perception-in-the-loop means that the notion of proximity between inputs can be directly queried from human participants rather than an arbitrarily chosen metric.
• Our technique is based on covariance matrix adaptation evolution strategy (CMA-ES), a black box optimization approach.