Binary Iterative Method for Non-targeted Adversarial Attack

2026-07-05

AI Summary

This work addresses the inefficiency of existing non-targeted adversarial attacks in jointly optimizing input perturbations and hyperparameters, which often hinders the generation of high-confidence misclassification samples. To overcome this limitation, the authors propose the Binary Iterative Method (BinIM), a novel approach that adopts a divide-and-conquer paradigm to co-optimize perturbations and hyperparameters through end-to-end differentiable search guided by gradient information. Experimental results on one thousand ImageNet images demonstrate that BinIM significantly outperforms current gradient-based methods, reducing the predicted probability of the true class to approximately 2.21×10⁻⁹ while achieving a misclassification confidence of 0.995. These findings underscore BinIM’s enhanced strength and reliability in executing non-targeted adversarial attacks.

Abstract

Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the 'piecewise linearity' of deep learning based models. Since adversarial attacks and adversarial robustness are mathematically defined problems that can be optimised directly with end-to-end differentiable search, adversarial robustness is more widely applicable than other robustness metrics such as corruption and perturbation robustness, and new kinds of adversarial attacks are beneficial for robustness testing. Attacks are targeted or non-targeted depending on whether the image is modified to misclassify to a particular class or to any incorrect class; we focus on the non-targeted setting. Finding the optimal input data points and hyper-parameters for generating non-targeted adversarial attacks remains a challenge for current methods like the Fast Gradient Method, Basic Iterative Method and Virtual Adversarial Method. We propose a new method, the "Binary Iterative Method" (BinIM), which uses a divide-and-conquer paradigm to optimise parameters and hyper-parameters for the generation of non-targeted attacks. We compare our method to other gradient-based adversarial attacks evaluated over pre-trained networks (InceptionV3, InceptionV2, ResNet V2 152) on classification tasks. On 1000 randomly-sampled images from the standard ImageNet dataset, the Binary Iterative Method outperforms all other gradient-based methods, qualitatively making the classifier misclassify with confidence up to 0.995 while reducing the probability of the true label to 2.21e-09 (approximately 0).

Problem

• non-targeted adversarial attack
• adversarial robustness
• hyper-parameter optimization
• gradient-based attack
• deep learning robustness

Innovation

• Binary Iterative Method
• non-targeted adversarial attack
• divide-and-conquer optimization
• adversarial robustness
• gradient-based attack