Evolutionary Multilabel Adversarial Examples: An Effective Black-Box Attack

Studies have shown that deep neural networks (DNNs) are vulnerable to adversarial attack. Minor malicious modifications of examples will lead to the DNN misclassification. Such maliciously modified examples are called adversarial examples. So far, the work on adversarial examples is mainly focused on multiclass classification tasks; there is less work in the field of multilabel classification. In this article, for the first time, a differential evolution (DE) algorithm that can effectively generate multilabel adversarial examples is proposed, which is called MLAE-DE. Different from traditional DE, we designed a complementary mutation operator for MLAE-DE, which can improve attack performance and reduce the number of fitness evaluations. As a black-box attack, MLAE-DE does not need to access model parameters and only uses model outputs to generate adversarial examples. Experiments on two typical multilabel classification models and three typical datasets under the black-box settings are conducted in this article. Experimental results demonstrate that, comparing with the existing black-box attack algorithms for multilabel classification models, the attack success rate of our proposed algorithm is much better.