Most of the approaches proposed so far to craft targeted adversarial examples
against Deep Learning classifiers are highly suboptimal and typically rely on
increasing the likelihood of the target class, thus implicitly focusing on
one-hot encoding settings. In this paper, we propose a more general,
theoretically sound, targeted attack that resorts to the minimization of a
Jacobian-induced MAhalanobis distance (JMA) term, taking into account the
effort (in the input space) required to move the latent space representation of
the input sample in a given direction. The minimization is solved by exploiting
the Wolfe duality theorem, reducing the problem to the solution of a
Non-Negative Least Square (NNLS) problem. The proposed algorithm provides an
optimal solution to a linearized version of the adversarial example problem
originally introduced by Szegedy et al. \cite{szegedy2013intriguing}. The
experiments we carried out confirm the generality of the proposed attack which
is proven to be effective under a wide variety of output encoding schemes.
Noticeably, the JMA attack is also effective in a multi-label classification
scenario, being capable to induce a targeted modification of up to half the
labels in a complex multilabel classification scenario with 20 labels, a
capability that is out of reach of all the attacks proposed so far. As a
further advantage, the JMA attack usually requires very few iterations, thus
resulting more efficient than existing methods.

在这篇论文中，我们提出了一种更通用、在理论上更可靠的有针对性攻击方法，它通过最小化雅可比诱导的马氏距离 (JMA) 项来实现，考虑了将输入样本的潜在空间表示向某个方向移动所需的努力。所提出的算法通过利用沃尔夫对偶定理来求解这个最小化问题，将问题简化为求解一个非负最小二乘（NNLS）问题。实验证明所提出的攻击具有广泛的适用性，可在多种输出编码方案下发挥有效作用。值得注意的是，JMA 攻击也在多标签分类场景中表现出了良好的效果，能够改变复杂的具有 20 个标签的多标签分类情境中最多一半的标签，这是所有迄今为止提出的攻击方法所无法做到的。此外，JMA 攻击通常只需要很少的迭代次数，因此比现有的方法更高效。