Adversarial Attack Basis Selection via SVD
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing black-box adversarial attack methods lack effective strategies for choosing basis directions, leading to suboptimal query efficiency and perturbation norms, despite achieving high attack success rates.
Innovation Solution
The method introduces prior information via basis choice by computing principal attack directions using singular value decomposition (SVD) of a data matrix constructed from successful attack vectors or input samples, allowing for selective combination of perturbations to achieve the attack objective with improved query efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If numerical coordinate descent methods are used for black-box adversarial attacks, then attack success rate is improved, but query efficiency deteriorates
Solution Approach 1:
The patent performs preliminary analysis to determine principal attack directions before executing the adversarial attack. By pre-computing the most effective perturbation directions using gradient information and singular value decomposition, the method prepares optimal search directions in advance, reducing the number of queries needed during the actual attack phase while maintaining high success rates
Solution Approach 2:
The patent changes the parameter representation by transforming the attack problem into a directional search space. Instead of exploring all possible perturbations uniformly, it identifies and focuses on principal attack directions through gradient analysis and singular value decomposition, thereby changing the search parameters to achieve better query efficiency
2Reliability
If numerical coordinate descent methods are used for black-box adversarial attacks, then attack success rate is improved, but perturbation norm increases
Solution Approach 1:
The patent transforms the perturbation representation by decomposing it into principal directions. By expressing the perturbation as a combination of dominant eigenvectors obtained through singular value decomposition, the method achieves more compact and efficient perturbation representations with smaller norms while maintaining attack effectiveness
Solution Approach 2:
The patent extracts and isolates the most significant attack directions from the full perturbation space. By identifying and extracting only the principal components that contribute most to successful attacks, the method eliminates redundant perturbation components, thereby reducing the overall perturbation norm while preserving attack success
Data Source
AI summary
A computer-implemented method of generating black-box adversarial inputs to a perception component comprises computing an adversarial input by applying a perturbation to an original input, the adversarial input satisfying an attack objective when inputted to the perception component. The perturbation is determined by selectively combining component perturbations selected from a predetermined set of component perturbations. Inputs correspond to respective points in an input vector space, and the component perturbations encode principal attack directions in the input vector space for satisfying said attack objective, the principal attack directions having been determined by analyzing: (i) a set of sample attack directions, or (ii) a set of input samples.