An adversarial attack method based on pixel location characteristics

Abstract Deep learning techniques have been widely used in various fields. However, they face significant security challenges due to the existence of adversarial examples. Traditional black-box adversarial attack methods mainly rely on swarm intelligence optimization algorithms to identify optimal perturbation pixels, which requires intensive computational resources. In some typical applications such as medical image recognition, public datasets are often used to train deep learning models. It is worth noting that such dataset inherently contains some basis features for deep learning models to learn discriminative representations. And these features can serve as critical cues for constructing adversarial samples. Inspired by this observation, a novel adversarial attack method was proposed. First, some sensitive locations are identified within the dataset without querying the target model. Moreover, the adversarial attack samples are constructed based on these locations. Different from white-box and black-box attack, dataset characteristics are utilized to construct adversarial attack samples. The proposed method investigates naturally occurring vulnerabilities in the data, offering new insights for enhancing data augmentation techniques and attack strategies, while also providing a promising direction for improving model robustness. Experimental results demonstrate that this method can achieve attack effectiveness comparable to the Particle Swarm Optimization (PSO) algorithm.