Objective

2

Convolutional neural networks （CNNs） and other deep networks have revolutionized the field of computer vision， particularly in the area of image recognition， leading to significant advancements in various visual tasks. Recent studies have unequivocally demonstrated that the performance of deep neural networks is significantly compromised in the presence of adversarial examples. Maliciously crafted inputs can cause a notable decline in the accuracy and reliability of deep learning models. Traditional adversarial attacks based on adversarial patches tend to concentrate a significant amount of perturbations in the masked regions of an image. However， crafting imperceptible perturbations for patch attack is highly challenging. Adversarial patches consist solely of noise and are visually redundant， lacking any practical significance in their existence. To address this issue， this paper proposes a novel approach called quick response （QR） code-based sparse adversarial patch attack. A QR code is a square symbol consisting of alternating dark and light modules， extensively employed in images. It uses a specialized encoding technique to store meaningful information. Utilizing QR codes as adversarial patches not only inherits the robustness of traditional adversarial patches but also increases the likelihood of evading suspicion. A crucial detail to highlight is that global-based perturbations can potentially disrupt the integrity of the valuable information stored in the QR code. Particularly when attacking robust images， excessive superimposed perturbations can significantly affect the white background of the QR code， thus ultimately rendering the generated adversarial QR code unscannable， preventing its successful detection and decoding. In this regard， we hope to ensure the integrity of QR code by limiting the amount of noise. Inspired by sparse attacks， we integrate the QR code patch with sparse attack techniques to control the sparsity of adversarial perturbations. By doing so， our proposed method effectively limits the number of noise points， minimizing the influence of noise on the QR code pixels and ensuring the robustness of the encoded information. Furthermore， our approach exhibits attack performance and maintains a certain level of imperceptibility， making it a compelling solution.

Method

2

Building upon the aforementioned analysis， our proposed method follows a step-by-step approach. First， we gather the prediction information of the target model on the input image. Next， we calculate the gradient that steers the prediction result away from the category with the highest probability. Simultaneously， we create a mask to confine the perturbation noise within the colored area of the QR code， thereby preserving the original information. Taking inspiration from recent advances， we employ the Lp-Box alternating direction method of multipliers algorithm to optimize the sparsity of added perturbation points. This optimization aims to ensure that the original information carried by QR codes remains intact even under the efficient conditions for successful adversarial attacks. By mitigating the impact of densely added high-distortion points， our approach achieves a balance between high attack success rates and preserving the inherent recognizability of QR codes. The final result is an adversarial patch that remains imperceptible to human observers.

Result

2

Experiments were conducted on the Inception-v3 and ResNet-50 models using the ImageNet dataset. Our method was compared against representative adversarial attacks in non-target scenarios， considering the attack success rate and

<math id="M1"><msub><mrow><mi>L</mi></mrow><mrow><mi mathvariant="normal">p</mi></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083432&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083435&type=

2.70933342

-norm perturbation. To assess the similarity between adversarial examples and t

he original image， we utilized several similarity measures （peak signal-to-noise ratio（PSNR）， erreur relative globale adimensionnelle de synthèse（ERGAS）， structural similarity index measure（SSIM）， spectral angle mapping（SAM）） to calculate the similarity scores and compared them with other attacks. We also evaluated the robustness of our attack after applying several defense algorithms as pre-processing steps. In addition， we investigated the impact of different QR code sizes on the attack success rate and

<math id="M2"><msub><mrow><mi>L</mi></mrow><mrow><mi mathvariant="normal">p</mi></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083437&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083439&type=

2.70933342

-norm of the perturbation of our method. Experimental results demonstrate that our approach achieves a balance between attack success rate and imperceptible noise in non-target scenarios. The adversarial examples generated by our method exhibit the smallest

L

0

norm of perturbation among all the methods. Although our method may not always achieve the best similarity scores， visual results demonstrate that our crafted adversarial noise is optimally imperceptible. Moreover， even after pre-processing with various defense methods， our method continues to outperform other attacks. In the ablation study on QR code sizes for non-target attacks， we observed that reducing the QR code size from 55 × 55 pixels to 50 × 50 pixels led to a 3.8% decrease in the attack success rate. Conversely， increasing the size to 60 × 60 pixels resulted in a 2.7% improvement compared with 55 × 55 pixels. Similarly， reduc

ing the size to 65 × 65 pixels led to a 1.1% decrease compared with 60 × 60 pixels， while increasing it to 70 × 70 pixels resulted in a 6.4% improvement compared with 65 × 65 pixels. With regard to the

<math id="M3"><msub><mrow><mi>L</mi></mrow><mrow><mi mathvariant="normal">p</mi></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083442&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083445&type=

2.70933342

-norm of perturbations， we found a positive correlation between the

<math id="M4"><msub><mrow><mi>L</mi></mrow><mrow><mn mathvariant="normal">1</mn></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083461&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083464&type=

2.70933342

-norm and the number of perturbation points， whereas the

<math id="M5"><msub><mrow><mi>L</mi></mrow><mrow><mn mathvariant="normal">2</mn></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083468&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083452&type=

2.70933342

-norm and

<math id="M6"><msub><mrow><mi>L</mi></mrow><mrow><mn mathvariant="normal">0</mn></mrow></msub></math>

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083472&type=

3.21733332

https://html.publish.founderss.cn/rc-pub/api/common/picture?pictureId=62083475&type=

2.70933342

-norm perturbations exhibited a negative correlation with the number of perturbed points.

Conclusion

2

The proposed QR code-based adversarial patch attack is more reasonable for real attack scenarios. By utilizing sparsity algorithms， we ensure the preservation of the information carried by the two-dimensional code itself， resulting in the generation of more perplexing adversarial samples. This approach provides novel insights into the research of highly imperceptible adversarial patches.