Universal Black-Box Adversarial Patch Attack with Optimized Genetic Algorithm

Universal adversarial patch attacks pose a significant threat to deep models since a single patch can be applied to massive images yielding misclassification. One pioneering work called HARDBEAT [1] has been developed by combining gradient estimation and genetic algorithm (GA) to generate the universal adversarial patch. However, HARDBEAT can produce only a limited number of patch patterns to optimize the adversarial patch, resulting in the premature convergence of GA without achieving the universal patches with a high attack success rate (ASR). In this article, we propose an improved HARDBEAT (ImHARDBEAT) wherein an optimized GA is presented to overcome such a premature convergence issue. Specifically, our ImHARDBEAT designs a conditional crossover operation that can retain the higher ASR patterns during later iterations. Furthermore, we introduce a large mutation rate to expand the exploring space, dramatically reducing the probability of local optima. Extensive experiments are conducted on four popular datasets, involving eight models. Experimental results demonstrate the superiority of our ImHARDBEAT over current state-of-the-art methods including HARDBEAT.