$σ$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples

TL;DR

The paper tackles robustness evaluation under sparse adversarial perturbations by proposing σ-zero, a gradient-based attack that minimizes the ℓ0-norm of perturbations through a differentiable surrogate and an adaptive sparsity projection. The method optimizes a loss term plus a surrogate ℓ0-norm, with an adaptive projection Πτ to enforce sparsity while keeping the perturbed input within valid bounds. Empirical results on MNIST, CIFAR-10, and ImageNet across numerous models show σ-zero yields smaller perturbations and higher attack success rates than state-of-the-art sparse attacks, with competitive runtime and robustness to hyperparameter choices. The work provides a strong, scalable tool for robustness evaluation against sparse perturbations and offers insights to guide the development of more resilient models against such attacks.

Abstract

Evaluating the adversarial robustness of deep networks to gradient-based attacks is challenging. While most attacks consider $\ell_2$- and $\ell_\infty$-norm constraints to craft input perturbations, only a few investigate sparse $\ell_1$- and $\ell_0$-norm attacks. In particular, $\ell_0$-norm attacks remain the least studied due to the inherent complexity of optimizing over a non-convex and non-differentiable constraint. However, evaluating adversarial robustness under these attacks could reveal weaknesses otherwise left untested with more conventional $\ell_2$- and $\ell_\infty$-norm attacks. In this work, we propose a novel $\ell_0$-norm attack, called $σ$-zero, which leverages a differentiable approximation of the $\ell_0$ norm to facilitate gradient-based optimization, and an adaptive projection operator to dynamically adjust the trade-off between loss minimization and perturbation sparsity. Extensive evaluations using MNIST, CIFAR10, and ImageNet datasets, involving robust and non-robust models, show that $σ$\texttt{-zero} finds minimum $\ell_0$-norm adversarial examples without requiring any time-consuming hyperparameter tuning, and that it outperforms all competing sparse attacks in terms of success rate, perturbation size, and efficiency.

Figures (10)

• Figure 1: The leftmost plot shows the execution of $\mathtt{\sigma}$-zero on a two-dimensional problem. The initial point $\boldsymbol{\mathbf{x}}$ (red dot) is updated via gradient descent to find the adversarial example $\boldsymbol{\mathbf{x}}^\star$ (green star) while minimizing the number of perturbed features (i.e., the $\ell_0$ norm of the perturbation). The gray lines surrounding $\boldsymbol{\mathbf{x}}$ demarcate regions where the $\ell_0$ norm is minimized. The rightmost plot shows the adversarial images (top row) and the corresponding perturbations (bottom row) found by $\mathtt{\sigma}$-zero during the three steps highlighted in the leftmost plot, along with their prediction and $\ell_0$ norm.
• Figure 2: Robustness evaluation curves (ASR vs. perturbation budget $k$) for M2 on MNIST (left), C1 on CIFAR-10 (middle), and I1 on ImageNet (right).
• Figure 3: Ablation study on $\sigma$ (y-axis) and $\tau_0$ (x-axis) for CIFAR-10 C10 (top-row), ImageNet I1, (bottom-row). For each combination, we report the attack success rate at different $k$ and the median $\ell_0$ perturbation value.
• Figure 4: Ablation study on $t$ for CIFAR-10 C3 and C4. For each, we report the attack success rate at the 50 feature budget (left) and the median $\ell_0$ norm of the adversarial perturbation (right).
• Figure 5: Robustness evaluation curves for fixed-budget attacks on C3. For each budget level $k$, each attack has been run with $1000$ iterations (left-most plot) and $5000$ iterations (right-most plot). Sparse-RS has been run with double the iterations as it relies solely on forward calls.