Generating Adversarial Examples Using Parameter-Free Penalty Method

Deep neural networks are extremely vulnerable to adversarial examples. An adversarial example is a perturbed input intended to cause deep neural networks to behave incorrectly. Despite much research about the techniques of generating adversarial perturbations, most optimization-based attacks that minimize the perturbations solve a constrained nonlinear programming problem by adding the misclassifying constraint to the objective function using a penalty parameter or a Lagrange multiplier, which is usually found by using binary search. However, this is inefficient due to the many iterations in binary search. The penalty method is one of the most commonly used iterative methods for solving constrained optimization prob-lems. It solves a constrained problem by converting it to an unconstrained one. In this work, we propose a novel white-box adversarial attack based on a parameter-free penalty method, which could generate adversarial examples with small perturbations at a high success rate. Extensive experiments on three test benches have been conducted, and results show that our method can obtain a good balance between the attack success rate and the perturbation size.