A Local Interpretability Model-Based Approach for Black-Box Adversarial Attack

Deep learning models are vulnerable to adversarial examples due to their fragility. Current black-box attack methods typically add perturbations to the whole example, and added perturbations may be large and easily detected by human eyes. This study proposes a Local Interpretable Model-agnostic Explanations (LIME)-based approach for black-box adversarial Attack (LIME-Attack). The approach can reduce the size of perturbations via adding perturbations in discriminative regions of an example. First, LIME is used to interpret a black-box model to obtain discriminative regions of an example. Then, the gradient information of the example is estimated by a derivative-free optimization method (Nature Evolution Strategy). Utilizing the gradient information, two white-box attack methods are adapted to generate perturbations, which are added in discriminative regions of the example to form an adversarial example. LIME-Attack is applied to several typical neural network models. Experiments show that it can achieve a high attack success rate with perturbation size 10%–30% lower than that of comparative methods.