The existence of adversarial examples brings huge concern for people to apply Deep Neural Networks (DNNs) in safety-critical tasks. However, how to generate adversarial examples with categorical data is an important problem but lack of extensive exploration. Previously established methods leverage greedy search method, which can be very time-consuming to conduct successful attack. This also limits the development of adversarial training and potential defenses for categorical data. To tackle this problem, we propose Probabilistic Categorical Adversarial Attack (PCAA), which transfers the discrete optimization problem to a continuous problem that can be solved efficiently by Projected Gradient Descent. In our paper, we theoretically analyze its optimality and time complexity to demonstrate its significant advantage over current greedy based attacks. Moreover, based on our attack, we propose an efficient adversarial training framework. Through a comprehensive empirical study, we justify the effectiveness of our proposed attack and defense algorithms.

翻译：对抗样本的存在引发了人们对深度神经网络在安全关键任务中应用的高度关注。然而，如何针对分类数据生成对抗样本是一个重要但缺乏广泛探索的问题。现有方法采用贪婪搜索策略，执行成功攻击可能非常耗时，这也限制了分类数据对抗训练及潜在防御机制的发展。为解决此问题，我们提出概率性分类对抗攻击（PCAA），该方法将离散优化问题转化为可通过投影梯度下降高效求解的连续问题。本文从理论上分析了其最优性与时间复杂度，证明其相较于现有基于贪婪的攻击方法具有显著优势。此外，基于所提攻击方法，我们设计了一种高效的对抗训练框架。通过全面的实证研究，验证了我们提出的攻击与防御算法的有效性。