Improving adversarial attack success by smart noise allocation
Don't Waste the Noise: Importance-Guided Perturbation Allocation under Joint Global and Local Constraints
Machine LearningArtificial IntelligenceComputer Vision and Pattern Recognition
Summary
When trying to trick AI models by adding small changes to inputs, it's important to decide where to add those changes without exceeding limits. The authors propose a method that guides these changes toward the most important parts of the input based on the model's sensitivity, making attacks more effective. Their approach redistributes the allowed changes rather than increasing the total amount, improving success rates in various test scenarios. This shows that carefully allocating limited perturbations matters in adversarial optimization.
What this means in practice
- •For security analysts: Enhance evaluation of model robustness by generating stronger adversarial examples with effective noise distribution.
- •For machine learning engineers: Improve adversarial training datasets by incorporating perturbations focused on sensitive input regions to better harden models.
Authors
Melika Shirian, Kianoosh Vadaei
Abstract
Adversarial optimization under a shared $\ell_1$ budget requires deciding not only how much perturbation to use, but also where that limited budget should be spent. This allocation problem becomes particularly important when individual input coordinates are subject to local magnitude constraints, which restrict the extent to which perturbation can be concentrated on a small number of locations. We introduce an importance-guided allocation mechanism that uses a fixed clean-gradient prior to steer perturbation toward model-sensitive regions while leaving the feasible perturbation set unchanged. A centered allocation objective encourages perturbation at above-average importance locations and discourages unnecessary expenditure elsewhere, thereby redistributing rather than enlarging the available budget. Across ten robust model--dataset configurations under a common capacity-limited threat setting, the proposed method improves attack success over matched APGD- and PMA-based baselines by $2.52$ to $17.70$ percentage points. Allocation analysis shows that these gains are accompanied by substantially greater perturbation mass in high-importance regions without increased global $\ell_1$ consumption. Mechanism ablations further show that centered non-uniform redistribution provides part of the benefit, while model-derived importance yields an additional improvement. These results identify perturbation allocation as a distinct and practically relevant dimension of adversarial optimization under shared-budget, locally constrained threat models.