Re:One pixel attack for deceiving deep neural networks
by rlanday on Sunday October 29, 2017 @01:14AM
(#15578046)
You don't necessarily need to know the whole model, but you need accurate enough prediction score outputs for each category. I think if you have that, that's enough to numerically approximate the gradient of the output scores and perform gradient descent.
[ Parent
| on HN ]
Re:One pixel attack for deceiving deep neural networks
by zeitbeule on Sunday October 29, 2017 @03:54AM
(#15578419)
Someone just published a new attack at ICLR that does not even need confidence scores but works solely on the final decision output of the network and works as well as the best known attacks (that so far required gradients): https://openreview.net/forum?id=SyZI0GWCZ¬eId=SyZI0GWCZ