DDSA: Dual-Domain Strategic Attack for Spatial-Temporal Efficiency in Adversarial Robustness Testing

Technical Summary: DDSA – Dual-Domain Strategic Attack for Spatial-Temporal Efficiency in Adversarial Robustness Testing

Problem Statement
Resource-critical applications relying on real-time image transmission and processing—such as search-and-rescue (SAR) operations, agricultural monitoring, and social media classification—face significant challenges from adversarial perturbations. While current robustness testing methods (e.g., FGSM, PGD) are effective, they rely on exhaustive frame-by-frame processing and full-image perturbations. This approach is computationally prohibitive for large-scale deployments where massive image streams require immediate processing. Furthermore, traditional methods fail to account for content heterogeneity; not all images or regions within an image carry equal significance for mission success. For instance, misclassifying a human in a SAR operation is life-threatening, whereas misclassifying vegetation is negligible. Existing frameworks lack mechanisms to prioritize these critical elements, leading to substantial computational waste on non-essential content.

Methodology
The paper proposes DDSA (Dual-Domain Strategic Attack), a resource-efficient adversarial robustness testing framework that optimizes testing through temporal selectivity and spatial precision. The framework operates via three interconnected steps:

1. Temporal Trigger Function:
   This component determines when to attack by evaluating the priority and uncertainty of the predicted class for each input image. A classification priority score ($Q_i$) is computed using:

   • Scenario-awareness ($R^{scena}$): Assigns higher weights to mission-critical classes (e.g., humans) based on domain expertise.
   • Data-driven quality ($R^{data}$): Quantifies classification confidence and prediction strength using softmax probabilities and entropy.
   • Consistency ($R^{consist}$): Assesses model reliability via Bayesian uncertainty estimation using Monte Carlo dropout.
     An attack is initiated only if the priority score exceeds a predefined threshold ($\tau$), filtering out routine or low-risk frames.

2. Spatial Feature Location:
   Once a frame is selected for testing, this component determines where to attack. It employs Integrated Gradients (IG), an Explainable AI (XAI) technique, to generate a saliency map highlighting pixel regions most influential for classification decisions. A binary mask is created by thresholding these importance scores, restricting perturbations to critical regions rather than the entire image.

3. Strategic Attack Generation:
   The final adversarial examples are generated by applying perturbations only to the priority classes (temporal efficiency) and only to the XAI-identified critical pixels (spatial efficiency). The perturbation is calculated as:
   $\tilde{x}_i = x_i + \epsilon \cdot B_i \odot \text{sign}(\nabla_{x_i} J(x_i, y_{true}))$
   where $B_i$ is the binary mask derived from the saliency map.

Key Contributions

• Dual-Domain Optimization: The paper introduces a novel framework that simultaneously addresses temporal content heterogeneity (deciding when to attack) and spatial region significance (deciding where to attack).
• Scenario-Aware Triggering: A mechanism that integrates domain expertise with model uncertainty to filter non-critical frames, reducing meaningless overhead in sequential processing.
• XAI-Guided Targeting: The application of Integrated Gradients to localize influential pixel regions, enabling targeted perturbations that minimize resource usage while maintaining attack effectiveness.
• Resource-Efficient Metric: A safety-related evaluation metric ($P_{total}$) that balances attack success against resource utilization, penalizing unsuccessful attacks and resource waste on non-critical content.

Experimental Results
The authors conducted comprehensive simulations using CIFAR-10, Fashion-MNIST, and VOC2012 datasets with ResNet-18 classifiers.

• Spatial Efficiency: Experiments demonstrated that XAI-guided targeting preserves high attack success rates even with significant spatial reduction. For example, PGD-60 maintained over 98% success rates when perturbing only 40% of image pixels. Strategic attacks required targeting merely 30% of the pixel area to achieve 95% success rates, affecting only 0.0123% of total pixels in the simulation.
• Temporal Efficiency: By filtering out non-critical frames, DDSA achieved an 80–97% reduction in computational time compared to conventional exhaustive testing.
• Large-Scale Simulation: In high-throughput scenarios processing 30,000 images, conventional methods yielded severe negative scores due to indiscriminate processing of non-critical content. In contrast, all DDSA variants achieved positive operational scores, validating the framework's ability to handle massive image streams efficiently.

Significance and Claims
The paper claims that DDSA bridges the gap between laboratory-scale adversarial testing and real-world deployment in resource-constrained environments. By enabling practical, comprehensive robustness testing that focuses computational resources on mission-critical content, the framework supports the reliability of safety-critical systems where computational efficiency directly impacts mission success. The authors assert that their dual-domain strategy achieves substantial temporal-spatial resource conservation without compromising the effectiveness of adversarial attacks on priority classes.