A Versatile Framework for Designing Group-Sparse Adversarial Attacks

TL;DR

ATOS presents a unified, convergence-guaranteed framework for designing structured sparse adversarial perturbations in element-wise, pixel-wise, and group-wise forms using Overlapping Sparsed Smoothed L0 (OSL0). It integrates an adaptive intensity regularizer via the LSEAp gradient to control perturbation magnitude without fixed thresholds, and proves convergence properties under smoothness and KL conditions. Empirical results on CIFAR-10 and ImageNet show ATOS achieves 100% attack success with significantly sparser, more localized perturbations and strong interpretability, providing counterfactual explanations for robust models. This framework advances both robustness evaluation and explainability by linking perturbation structure to model vulnerabilities and decision regions while maintaining computational efficiency.

Abstract

Existing adversarial attacks often neglect perturbation sparsity, limiting their ability to model structural changes and to explain how deep neural networks (DNNs) process meaningful input patterns. We propose ATOS (Attack Through Overlapping Sparsity), a differentiable optimization framework that generates structured, sparse adversarial perturbations in element-wise, pixel-wise, and group-wise forms. For white-box attacks on image classifiers, we introduce the Overlapping Smoothed L0 (OSL0) function, which promotes convergence to a stationary point while encouraging sparse, structured perturbations. By grouping channels and adjacent pixels, ATOS improves interpretability and helps identify robust versus non-robust features. We approximate the L-infinity gradient using the logarithm of the sum of exponential absolute values to tightly control perturbation magnitude. On CIFAR-10 and ImageNet, ATOS achieves a 100% attack success rate while producing significantly sparser and more structurally coherent perturbations than prior methods. The structured group-wise attack highlights critical regions from the network's perspective, providing counterfactual explanations by replacing class-defining regions with robust features from the target class.

Figures (3)

• Figure 1: IS comparison of imperceptible group-wise attacks for worst-case target versus threshold $v$ for binary ASM.
• Figure 2: Comparison of our different adversarial attacks on an ImageNet sample, targeting the ViT-S16 model. Column (a) shows an ImageNet sample labeled as "chickadee". Columns (b) to (f) present the results of our respective attacks. The binary mask in each column (row (1)) indicates the positions of perturbations with the number of perturbed pixels on its top, while the bottom part (row (2)) shows the adversarial example to misclassify the image as the worst-case label, "vacuum".
• Figure 3: Counterfactual explanations generated by ATOS-GW-$\ell_\infty$, StrAttack, GSE, and FWnucl (Rows (2) to (5), respectively) for two random samples from the ImageNet dataset in the robust networks of liu2024comprehensive (Model A) and amini2024meansparse (Model B). Row (1) contains the original images with their corresponding labels. Columns (a), (c), (e), and (g) correspond to counterfactual explanations for untargeted cases, while the remaining columns represent worst-case scenarios with their respective targeted labels.

Theorems & Definitions (8)

• definition 1: Smoothed $\ell_0$ norm mohimani2008fast
• definition 2: LSEAp: approximation of the gradient of $\ell_\infty$ heshmati2022designing
• definition 3: Lipschitz gradient nesterov2018lectures
• lemma 1
• lemma 2: Bound on $a x^2 e^{-a x^2}$ for $a>0$
• theorem 1
• theorem 2
• theorem 3