Localizing Adversarial Attacks To Produces More Imperceptible Noise

2025-09-23

AI Summary

This study addresses the limitations of conventional global adversarial perturbations—namely, poor imperceptibility and practicality—and introduces local adversarial attacks, a novel paradigm that confines perturbations to spatially restricted regions to enhance stealth. We propose a binary-mask-based localization framework that constrains mainstream attacks—including FGSM, PGD, and C&W—to localized image regions, and systematically evaluate their attack success rate (ASR), computational overhead, and visual fidelity (PSNR/SSIM). Results show that local attacks reduce mean pixel perturbation by 37.2%, while improving PSNR by 9.6 dB and SSIM by 0.18, confirming superior imperceptibility. PGD and C&W retain strong robustness under localization: ASR decreases only marginally (within acceptable bounds), with moderate computational overhead. To our knowledge, this is the first systematic investigation demonstrating the favorable trade-off between stealth and effectiveness enabled by localized perturbations, offering new insights for lightweight, highly covert adversarial attack and defense strategies.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Local Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Adversarial attacks in machine learning traditionally focus on global perturbations to input data, yet the potential of localized adversarial noise remains underexplored. This study systematically evaluates localized adversarial attacks across widely-used methods, including FGSM, PGD, and C&W, to quantify their effectiveness, imperceptibility, and computational efficiency. By introducing a binary mask to constrain noise to specific regions, localized attacks achieve significantly lower mean pixel perturbations, higher Peak Signal-to-Noise Ratios (PSNR), and improved Structural Similarity Index (SSIM) compared to global attacks. However, these benefits come at the cost of increased computational effort and a modest reduction in Attack Success Rate (ASR). Our results highlight that iterative methods, such as PGD and C&W, are more robust to localization constraints than single-step methods like FGSM, maintaining higher ASR and imperceptibility metrics. This work provides a comprehensive analysis of localized adversarial attacks, offering practical insights for advancing attack strategies and designing robust defensive systems.

Problem

• Evaluating localized adversarial attacks across FGSM, PGD, and C&W methods
• Constraining noise to specific regions using binary masks
• Analyzing trade-offs between imperceptibility and computational efficiency

Innovation

• Localized adversarial attacks use binary mask constraints
• Iterative methods maintain robustness under localization constraints
• Localized noise achieves higher PSNR and SSIM metrics