The best time to plant a tree was 20 years ago. The second best time is now. Chinese Proverb
Idea Transcript
One pixel attack for fooling convolutional neural network Danilo Vasconcellos Vargas Kyushu University
Nature: Atari Games
Nature: Alpha-Go
AI is getting extremely intelligent!
Convolutional neuron network(CNN)
Existing attacks against CNNs
Adversarial pixel-perturbation[2]
[2] Goodfellow, I.J., Shlens, J. and Szegedy, C., 2014. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572.
Existing attacks against CNNs
Artificial images[3]
[3] Nguyen, A., Yosinski, J. and Clune, J., 2015. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (pp. 427-436).
Our work: just one pixel
Figure. One image can be simultaneously perturbed to nine other classes.
Summary of the results In cifar-10 data-set (10 classes), each test image can be perturbed to 2 target classes on average. About 70% images can be perturbed to at least one target classes (sensitive images), with 75% classification confidence on average.