One-Pixel Attacks

FGSM spreads small changes across many input features. A one-pixel attack moves the same basic idea to an extreme: it changes a single location and searches for the value that crosses a decision boundary.

Finding one useful pixel is a search problem. Differential evolution starts with a population of candidate pixel changes. Each candidate describes a location and new pixel value. The algorithm evaluates the population, creates children from several parents, and keeps a child when it improves the attack.

The mutation rule is $v = x_{r1} + F(x_{r2} - x_{r3})$ . The difference between two candidates supplies a direction. The scaling factor $F$ controls how far to travel in that direction. A third candidate supplies the starting point.

Differential Evolution

Click a parent candidate to inspect the child it produces.

Generation

Best distance

0.150

Candidates

Scaling factor F0.50

Mutation equation

v = xr1 + F(xr2 - xr3)

v = [0.22, 0.82] + 0.50( [0.42, 0.35] - [0.86, 0.58])

v = [0.00, 0.70]

Parent fitness

0.742

Child fitness

0.943

A child replaces its parent only when it scores better. The population can converge toward a useful pixel change, but convergence is not guaranteed.

Select a parent, inspect the mutation equation with real candidate values, and evolve the population toward a vulnerable pixel change.

The algorithm keeps the best candidate it has found, but it cannot promise that a useful one-pixel attack exists. Some populations converge near a solution. Some stall. Some images simply do not have a single pixel that crosses the boundary within the search budget.

Examples of one-pixel adversarial attacks changing image classifications — [Source]

Checkpoint

What does differential evolution guarantee when searching for a one-pixel attack?

←PreviousEvasion and the Fast Gradient Sign MethodAdversarial Attacks Next→Adversarial Patch AttacksAdversarial Attacks