A Method for Robustness Testing of Intelligent Classification Models: Adversarial Sample Generation under Score-based Gray-box Single-pixel Attacks

Utilizing adversarial samples is essential for assessing the robustness of intelligent classification models. However, certain adversarial sample generation methods based on the grey-box approach face challenges, including low attack efficiency and limited interpretability. This paper presents the Score-based Gray-box Single-pixel Attacks (SGSA) method, a novel approach for generating adversarial samples. Initially, the feature map of the model's final layer is extracted, along with computing the discrepancy between the predicted score of each feature map and the original prediction score. By employing the Leaky ReLU activation function, the score of each pixel is computed. Subsequently, these scores are sorted in ascending order. Initiating the attack from the pixel with the lowest score, the most effective attack direction is determined by comparing the outcomes of both forward and reverse adversarial attacks on each pixel. The results demonstrate that this method not only achieves high attack efficiency but also offers interpretability in selecting attack locations, and the attack efficiency has doubled. Furthermore, this method offers valuable guidance for both testing and enhancing the model's robustness to some degree.