A Method for Adversarial Example Generation by Perturbing Selected Pixels

Recent research has shown that deep neural networks can intentionally change their output by adding perturbation to the input. Such images are called adversarial examples. An attack method that uses sparse perturbations is Jacobian-based Saliency Map Attack(JSMA), which finds the pixel to perturb by generating a saliency map from the gradient of the output. It deceives the neural network by changing the pixel value to the maximum or minimum value. However, changing the value of a pixel to a maximum or minimum value is not optimal for generating adversarial examples because the perturbation is perceived by human eyes. In this study, we propose a new method to reduce perturbations and generate adversarial examples in which perturbations are not easily recognized by human eyes. Our method generates adversarial examples with smaller perturbations by improving the extraction conditions of pixels in JSMA to be perturbed and the method of adding perturbations. Experimental results show that the method can generate smaller perturbations with a misclassification rate comparable to that of JSMA. This makes the perturbations less recognizable to human eyes.