Saliency Attack: Towards Imperceptible Black-box Adversarial Attack

Deep neural networks are vulnerable to adversarial examples, even in the black-box setting where attacker is only accessible model output. Recent studies have devised effective attacks with high query efficiency. However, such performance often accompanied by compromises attack imperceptibility, hindering practical use of these approaches. In this article, we propose restrict perturbations a small salient region generate examples that can hardly be perceived. This approach readily compatible many existing and significantly improve their imperceptibility little degradation success rates. Furthermore, Saliency Attack, new aiming refine achieve better imperceptibility. Extensive experiments show compared state-of-the-art attacks, our achieves much scores, including most apparent distortion (MAD), L 0 2 distances, also obtains true rate number judged human-like threshold on MAD. Importantly, generated interpretable some extent. Finally, it demonstrated robust different detection-based defenses.