An Autoencoder-based Method for Targeted Attack on Deep Neural Network Models

Abstract

This paper presents an autoencoder-based method for a targeted attack on deep neural network models, named AE4DNN. The proposed method aims to improve the existing targeted attacks in terms of their generalization, transferability, and the trade-off between the quality of adversarial examples and the computational cost. The idea of AE4DNN is that an autoencoder model is trained from a balanced subset of the training set. The trained autoencoder model is then used to generate adversarial examples from the remaining subset of the training set, produce adversarial examples from new samples, and attack other DNN models. To demonstrate the effectiveness of AE4DNN, the compared methods are box-constrained L-BFGS, Carlini-Wagner ‖L‖2 attack, and AAE. The comprehensive experiment on MNIST has shown that AE4DNN can gain a better transferability, improve generalization, and generate high quality of adversarial examples while requiring a low cost of computation. This initial result demonstrates the potential ability of AE4DNN in practice, which would help to reduce the effort of testing deep neural network models.