Low Rank Affine Adversarial Attacks on Image Classifiers

Abstract

Neural networks for image classification are vulnerable to adversarial attacks; an imperceptible perturbation to an image can cause a change in classification. Standard attack algorithms use explicit or approximate partial derivative information with respect to the input data. Here, we explore the idea of using a less expensive, universal affine surrogate. We find that this approach can match, or even outperform, a traditional gradient-based algorithm. Training the affine attack model leads us naturally towards transformations that are close to low rank, reflecting the structure of the problem. Truncating to a precisely low rank transformation does not degrade the performance of the model.

This paper is to appear in the Springer INdAM Series, following the INdAM Workshop on Low-Rank Structures and Numerical Methods in Matrix and Tensor Computations.

Please cite this paper as:

@incollection{issagali2026lowrank,
  title     = {Low Rank Affine Adversarial Attacks on Image Classifiers},
  author    = {Issagali, Aizhan and Higham, Catherine F. and Higham, Desmond J. and Tudisco, Francesco},
  booktitle = {INdAM Workshop on Low-Rank Structures and Numerical Methods in Matrix and Tensor Computations},
  series    = {Springer INdAM Series},
  publisher = {Springer},
  year      = {2026},
  note      = {Accepted for publication; to appear}
}

Abstract

Please cite this paper as:

Keywords