Probabilistic Jacobian-based Saliency Maps Attacks
  Neural network classifiers (NNCs) are known to be vulnerable to malicious
adversarial perturbations of inputs including those modifying a small fraction
of the input features named sparse or $L_0$ attacks. Effective and fast $L_0$
attacks, such as the widely used Jacobian-based Saliency Map Attack (JSMA) are
practical to fool NNCs but also to improve their robustness. In this paper, we
show that penalising saliency maps of JSMA by the output probabilities and the
input features of the NNC allows to obtain more powerful attack algorithms that
better take into account each input's characteristics. This leads us to
introduce improved versions of JSMA, named Weighted JSMA (WJSMA) and Taylor
JSMA (TJSMA), and demonstrate through a variety of white-box and black-box
experiments on three different datasets (MNIST, CIFAR-10 and GTSRB), that they
are both significantly faster and more efficient than the original targeted and
non-targeted versions of JSMA. Experiments also demonstrate, in some cases,
very competitive results of our attacks in comparison with the Carlini-Wagner
(CW) $L_0$ attack, while remaining, like JSMA, significantly faster (WJSMA and
TJSMA are more than 50 times faster than CW $L_0$ on CIFAR-10). Therefore, our
new attacks provide good trade-offs between JSMA and CW for $L_0$ real-time
adversarial testing on datasets such as the ones previously cited. Codes are
publicly available through the link
https://github.com/probabilistic-jsmas/probabilistic-jsmas.
