STRUCTURED ADVERSARIAL ATTACK: TOWARDS GENERAL IMPLEMENTATION AND BETTER INTERPRETABILITY
When generating adversarial examples to attack deep neural networks (DNNs), p norm of the added perturbation is usually used to measure the similarity between original image and adversarial example. However, such adversarial attacks perturbing the raw input spaces may fail to capture structural information hidden in the input. This work develops a more general attack model, i.e., the structured attack (StrAttack), which explores group sparsity in adversarial perturbations by sliding a mask through images aiming for extracting key spatial structures. An ADMM (alternating direction method of multipliers)-based framework is proposed that can split the original problem into a sequence of analytically solvable subproblems and can be generalized to implement other attacking methods. Strong group sparsity is achieved in adversarial perturbations even with the same level of p -norm distortion (p ∈ {1, 2, ∞}) as the stateof-the-art attacks. We demonstrate the effectiveness of StrAttack by extensive experimental results on MNIST, CIFAR-10 and ImageNet. We also show that StrAttack provides better interpretability (i.e., better correspondence with discriminative image regions) through adversarial saliency map (Papernot et al., 2016b) and class activation map (Zhou et al., 2016). Our code is available at https://github.com/KaidiXu/StrAttack.
The paper proposes a novel approach to generate adversarial examples based on structured sparsity principles. In particular the authors focus on the intuition that adversarial examples in computer vision might benefit from encoding information about the local structure of the data. To this end, lp *group* norms can be used in contrast to standard global lp norms when constraining or penalizing the optimization of the adversarial example. The authors propose an optimization strategy to address this problem. The authors evaluate the proposed approach on real data, comparing it against state-of-the-art competitors, which do not leverage the structured sparsity idea.
The paper is well written and easy to follow. The presentation of the algorithms for i) the non-overlapping and ii) overlapping groups as well as iii) the proposed refinement are clear. The experimental evaluation is interesting and convincing (the further experiments in the supplementary material add value to the overall discussion). 
The main downside of the paper is that the proposed idea essentially consists in replacing the standard \ell_p norm penalty/constraints with a group-\ell_p one. While this provides interesting technical questions from the algorithmic perspective, from the point of view of the novelty, the paper does not appear an extremely strong contribution,