Journal of Xidian University ›› 2021, Vol. 48 ›› Issue (1): 149-159.doi: 10.19665/j.issn1001-2400.2021.01.017

Previous Articles     Next Articles

TargetedFool:an algorithm for achieving targeted attacks

ZHANG Hua(),GAO Haoran(),YANG Xingguo(),LI Wenmin(),GAO Fei(),WEN Qiaoyan()   

  1. State Key Laboratory of Networking and Switching Technology,Beijing University of Posts and Telecommunications,Beijing 100876,China
  • Received:2020-11-02 Online:2021-02-20 Published:2021-02-03
  • Contact: Haoran GAO;;;;;


With the development of artificial intelligence technology,deep neural networks are widely used in fields such as face recognition,voice recognition,image recognition,and autonomous driving.In recent years,experiments have proved that slight perturbations can cause misclassification of deep neural networks (DNNs) and achieving specific attack effects in a limited time is one of the focuses of research in the field of adversarial attacks.The DeepFool algorithm has a wide range of applications in machine learning platforms such as cleverhans.However,there is still room for research on targeted attacks using the DeepFool algorithm.To solve the problem that generating perturbations takes a long time and that the perturbation is easy for the human eye to observe,this paper proposes the TargetedFool algorithm based on the DeepFool algorithm for generating targeted adversarial examples on typical convolution neural networks (CNNs).Extensive experimental results show that the algorithm proposed in this paper can achieve targeted attacks on the MNIST,CIFAR-10 and ImageNet.The targeted attack described in this paper can achieve a 99.8% deception success rate in an average time of 2.84 s on the ImageNet.In addition,this paper analyzes the reason why the attack algorithm based on the DeepFool cannot generate targeted universal adversarial perturbations.

Key words: deep neural network, deep learning, targeted attack, adversarial examples

CLC Number: 

  • TP301.6