$\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples
<|reference_start|>$\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples: Evaluating the adversarial robustness of deep networks to gradient-based attacks is challenging. While most attacks consider $\ell_2$- and $\ell_\infty$-norm constraints to craft input perturbations, only a few investigate sparse $\ell_1$- and $\ell_0$-norm attacks. In particular, $\ell_0$-norm attacks remain the least studied due to the inherent complexity of optimizing over a non-convex and non-differentiable constraint. However, evaluating adversarial robustness under these attacks could reveal weaknesses otherwise left untested with more conventional $\ell_2$- and $\ell_\infty$-norm attacks. In this work, we propose a novel $\ell_0$-norm attack, called $\sigma$-zero, which leverages a differentiable approximation of the $\ell_0$ norm to facilitate gradient-based optimization, and an adaptive projection operator to dynamically adjust the trade-off between loss minimization and perturbation sparsity. Extensive evaluations using MNIST, CIFAR10, and ImageNet datasets, involving robust and non-robust models, show that $\sigma$-zero finds minimum $\ell_0$-norm adversarial examples without requiring any time-consuming hyperparameter tuning, and that it outperforms all competing sparse attacks in terms of success rate, perturbation size, and efficiency.<|reference_end|>
@article{cinà2024$\sigma$-zero:,
    title={$\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial
  Examples},
    author={Antonio Emanuele Cin`a, Francesco Villani, Maura Pintor, Lea
  Sch"onherr, Battista Biggio, and Marcello Pelillo},
    journal={arXiv preprint arXiv:2402.01879},
    year={2024},
    archivePrefix={arXiv},
    eprint={2402.01879},
    primaryClass={cs.LG cs.CR cs.CV}
}