Generating Adversarial Samples With Constrained Wasserstein Distance

In recent years, deep neural network (DNN) approaches prove to be useful in many machine learning tasks, including classification. However, small perturbations that are carefully crafted by attackers can lead to the misclassification of the images. Previous studies have shown that adversarial subspaces lie off (but close to) the data submanifold and detection techniques based on the distributional difference between adversarial and normal samples have been proposed. These distribution-based detection techniques achieve excellent performance in characterizing adversarial samples. In this paper, We propose W-PGD to generate adversarial samples close to normal data distribution to bypass those detecting mechanisms. We trained a neural network WassNet to estimate the difference between two distributions using Wasserstein distance and use the gradient of WassNet to constrain the Wasserstein distance between adversarial and normal samples’ distribution. Our experiment shows that W-PGD can effectively decrease the detection rate of distribution-based detection techniques and generate adversarial samples with constrained Wasserstein distance.