HackerPapers

arXiv:1710.08864cs.LG

One pixel attack for fooling deep neural networks

Jiawei Su, Danilo Vasconcellos Vargas, Sakurai Kouichi

Abstract

Recent research has revealed that the output of Deep Neural Networks (DNN) can be easily altered by adding relatively small perturbations to the input vector. In this paper, we analyze an attack in an extremely limited scenario where only one pixel can be modified. For that we propose a novel method for generating one-pixel adversarial perturbations based on differential evolution (DE). It requires less adversarial information (a black-box attack) and can fool more types of networks due to the inherent features of DE. The results show that 67.97% of the natural images in Kaggle CIFAR-10 test dataset and 16.04% of the ImageNet (ILSVRC 2012) test images can be perturbed to at least one target class by modifying just one pixel with 74.03% and 22.91% confidence on average. We also show the same vulnerability on the original CIFAR-10 dataset. Thus, the proposed attack explores a different take on adversarial machine learning in an extreme limited scenario, showing that current DNNs are also vulnerable to such low dimension attacks. Besides, we also illustrate an important application of DE (or broadly speaking, evolutionary computation) in the domain of adversarial machine learning: creating tools that can effectively generate low-cost adversarial attacks against neural networks for evaluating robustness.

arXiv comments
Journal reference
IEEE Transactions on Evolutionary Computation}, Vol.23 , Issue.5 , pp. 828--841. Publisher: IEEE. 2019
DOI
doi:10.1109/TEVC.2019.2890858
Subjects
cs.LGMachine Learning cs.CVComputer Vision and Pattern Recognition stat.MLMachine Learning (Statistics)

On Hacker News

Linked by 8 identifiable commenters in 8 comments across 8 threads, from Oct 2017 to May 2023. Found in 4 HN submissions from Oct 2017 to Jan 2026. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments8 threads

  1. Prompt injection explained, with video, slides, and a transcript 1 comment

    • https://arxiv.org/abs/1710.08864 (In general, see https://en.wikipedia.org/wiki/Adversarial_machine_learning for a broad overview of such attacks.)

      supriyo-biswasView on HNParent context

  2. Why is Stack Overflow trying to start audio? 1 comment

    • It will always be a game of cat and mouse. Even with Neural networks involved :D. [0] https://arxiv.org/abs/1412.1897 [1] https://arxiv.org/abs/1710.08864

      penagwinView on HNParent context

  3. What Toasters and Distributed Systems Might Have in Common 1 comment

    • On non-linearity of software systems. Correct me if I’m wrong but I’m assuming you mean it in a sense of being probabilistic and not easily predictable. Which is an interesting point because a lot of modern algorithms are like that. Let’s take neural networks. Being able to…

      anton_View on HNParent context

  4. The impossibility of intelligence explosion 1 comment

    • Superseding us in what way? The machine is already better at chess and Go, clearly not at classifying images[1], but the issue here is that the author argues that there is no such thing as a general intelligence. It's all situational. On a separate note, does it even matter?…

      amagView on HNParent context

  5. New Jersey’s experiment to reduce the number of people in jail awaiting trial 1 comment

    • > He knew exactly what to say to the responding officer to cover his ass Replacing human judgment with algorithms is a terrible idea for many reasons, but this might be the worst. Algorithms are deterministic, and thus they can be manipulated. "SEO" services exist in spite of…

      pdkl95View on HNParent context

  6. How Adversarial Attacks Work 1 comment

    • Very recently, it was found that changing a single, carefully placed, pixel is enough to confuse NN classifiers. https://arxiv.org/abs/1710.08864

      trottView on HNParent context

  7. One pixel attack for fooling deep neural networks 1 comment

    • Extensive discussion: https://news.ycombinator.com/item?id=15577885 Also: Paper identifier '1710.08864.pdfhttps:/arxiv.org' not recognized There appears to be a valid arXiv paper identifier within '1710.08864.pdfhttps:/arxiv.org'. Perhaps the link you followed was intended as a…

      ColinWrightView on HNParent context

  8. One pixel attack for deceiving deep neural networks 1 comment

    • If you're on a phone, here's a responsive HTML version of the paper: https://www.arxiv-vanity.com/papers/1710.08864/

      bfirshView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.