Probabilistic Analysis of Targeted Attacks Using Transform-Domain Adversarial Examples

Zakia Yahya, Muhammad Hassan, Shahzad Younis, Muhammad Shafique

Research output: Contribution to journalArticlepeer-review


In the past decade, Deep Neural Networks (DNNs) have achieved breakthrough collaborations in developing smart intelligent systems within the field of computer vision, natural language processing, autonomous systems, etc. Recent research has revealed that stability of such smart systems is at greater risk when they come across to adversarial perturbations. Although, these perturbations may not be perceivable in nature when seen from naked eye, yet, they are capable enough to fool state-of-the-art DNN classifiers. Till now, much of the previous work related to fool such classifiers focuses on generating adversaries that directly change pixel values of an image in spatial-domain. In this paper, we propose a novel transform-domain imperceptible attack methodology 'TDIAM' to generate adversaries based on image steganography-approach using a 'single carefully selected targeted watermark'. We use three different frequency-domain approaches, i.e., Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT) and Fast Fourier Transform (FFT) to craft perturbations in selective frequency component which makes it robust and it requires less computational time as it is a non-gradient approach. We present our case study on MNIST handwritten digits dataset. Our results demonstrate that the generated perturbation vector successfully fool simple Convolutional Neural Network (CNN), LeNet-5 and AlexNet architectures by increasing probability of adversarial examples for the targeted class (to which the targeted watermark belongs) in both 'black-box' and 'white-box' adversarial attacks. The results have shown that among these three perturbation approaches, DWT based perturbation shown promising results by effectively fooling DNNs while ensuring the high imperceptibility as well.

Original languageEnglish (US)
Article number9000814
Pages (from-to)33855-33869
Number of pages15
JournalIEEE Access
StatePublished - 2020


  • adversarial examples
  • black-box-attacks
  • DNN classifiers
  • imperceptibility
  • perturbations
  • Steganography
  • targeted attacks
  • white-box-attacks

ASJC Scopus subject areas

  • General Computer Science
  • General Materials Science
  • General Engineering


Dive into the research topics of 'Probabilistic Analysis of Targeted Attacks Using Transform-Domain Adversarial Examples'. Together they form a unique fingerprint.

Cite this