Creating High-Resolution Adversarial Images Against Convolutional Neural Networks with the Noise Blowing-Up Method

Convolutional Neural Networks (CNNs) are widely used for image recognition tasks but are vulnerable to attacks. Most existing attacks create adversarial images of a size equal to the CNN’s input size; mainly because creating adversarial images in the high-resolution domain leads to substantial speed, adversity, and visual quality challenges. In a previous work, we developed a method that lifts any existing attack working efficiently in the CNN’s input size domain to the high-resolution domain. This method successfully addressed the first two challenges but only partially addressed the third one. The present article provides a crucial refinement of this strategy that, while keeping all its other features, substantially increases the visual quality of the obtained high-resolution adversarial images. The refinement amounts to a blowing-up to the high-resolution domain of the adversarial noise created in the low-resolution domain. Adding this blown-up noise to the clean original high-resolution image leads to an almost indistinguishable high-resolution adversarial image. The noise blowing-up strategy is successfully tested on an evolutionary-based black-box targeted attack against VGG-16 trained on ImageNet, with 10 high-resolution clean images.