Basic Iterative Method Research Articles

Adversarial Attacks and Defenses in Multivariate Time-Series Forecasting for Smart and Connected Infrastructures

The emergence of deep learning models has revolutionized various industries over the last decade, leading to a surge in connected devices and infrastructures. However, these models can be tricked into making incorrect predictions with high confidence, leading to disastrous failures and security concerns. To this end, we explore the impact of adversarial attacks on multivariate time-series forecasting and investigate methods to counter them. Specifically, we employ untargeted white-box attacks, namely the Fast Gradient Sign Method (FGSM) and the Basic Iterative Method (BIM), to poison the inputs to the training process, effectively misleading the model. We also illustrate the subtle modifications to the inputs after the attack, which makes detecting the attack using the naked eye quite difficult. Having demonstrated the feasibility of these attacks, we develop robust models through adversarial training and model hardening. We are among the first to showcase the transferability of these attacks and defenses by extrapolating our work from the benchmark electricity data to a larger, 10-year real-world data used for predicting the time-to-failure of hard disks. Our experimental results confirm that the attacks and defenses achieve the desired security thresholds, leading to a 72.41% and 94.81% decrease in RMSE for the electricity and hard disk datasets respectively after implementing the adversarial defenses.

Hybrid two-level protection system for preserving pre-trained DNN models ownership

Recent advancements in deep neural networks (DNNs) have made them indispensable for numerous commercial applications. These include healthcare systems and self-driving cars. Training DNN models typically demands substantial time, vast datasets and high computational costs. However, these valuable models face significant risks. Attackers can steal and sell pre-trained DNN models for profit. Unauthorised sharing of these models poses a serious threat. Once sold, they can be easily copied and redistributed. Therefore, a well-built pre-trained DNN model is a valuable asset that requires protection. This paper introduces a robust hybrid two-level protection system for safeguarding the ownership of pre-trained DNN models. The first-level employs zero-bit watermarking. The second-level incorporates an adversarial attack as a watermark by using a perturbation technique to embed the watermark. The robustness of the proposed system is evaluated against seven types of attacks. These are Fast Gradient Method Attack, Auto Projected Gradient Descent Attack, Auto Conjugate Gradient Attack, Basic Iterative Method Attack, Momentum Iterative Method Attack, Square Attack and Auto Attack. The proposed two-level protection system withstands all seven attack types. It maintains accuracy and surpasses current state-of-the-art methods.

Adversarial example denoising and detection based on the consistency between Fourier-transformed layers

Deep neural networks (DNNs) have achieved considerable success in a variety of tasks, and this success has led to an increase in the importance of the security and robustness of algorithms where DNNs are applied. In fact, previous studies have identified that neural networks are vulnerable to adversarial examples that are generated by adding a small amount of noise to the input images. Detection-based methods that can detect adversarial examples among input images are a popular defense technique against adversarial examples. However, these methods reject the detected adversarial images, making it difficult to use the input image for further analysis. In this study, we propose a novel denoising-based detection method that simultaneously denoises and detects an input image when defending against adversarial examples. Our method primarily analyzes images in the feature maps of the target classifier layers based on the consistency between the Fourier domains. We first generate adversarial examples and train the denoising network by minimizing the similarity between the non-adversarial and denoised adversarial images in the feature maps of the Fourier-transformed layers. The predicted denoised images are then input to the adversarial example detector, which determines whether the images are adversarial by exploring the characteristics of the concatenated input and denoised images. There are three main contributions in this paper: (1) We propose a novel denoising-based detection method that simultaneously denoises and detects an input image when defending against adversarial examples. (2) We improve the denoising method for adversarial examples that reconstructs adversarial examples based on the Fourier-transformed feature maps. (3) We improve the detection method by using denoised images in addition to the input images. We tested our proposed method against the fast gradient sign method, basic iterative method, projected gradient descent, Deepfool, and Carlini and Wagner adversarial attack algorithms on two Canadian Institute for Advanced Research (CIFAR) datasets, i.e., CIFAR-10 and CIFAR-100. Our method, which employed a frequency-based denoising mechanism in combination with a detection mechanism, demonstrated significant accuracy improvements in the denoising and detection performances when compared to other state-of-the-art methods.

A method for recovering adversarial samples with both adversarial attack forensics and recognition accuracy

Adversarial samples deceive machine learning models through small but elaborate modifications that lead to erroneous outputs. The severity of the adversarial sample problem has come to the forefront with the widespread use of machine learning in areas such as security systems, autonomous driving, speech recognition, finance, and medical diagnostics. Malicious attackers can use adversarial samples to circumvent security detection systems, interfere with autonomous driving perception, mislead speech recognition, defraud financial systems, and even cause medical diagnosis errors. The emergence of adversarial samples exposes the vulnerability of existing models and poses challenges for information tracing and forensics after the incident. The main goal of current adversarial sample restoration methods is to improve model robustness. Traditional approaches focus only on improving the model’s classification accuracy, ignoring the importance of adversarial information, which is crucial for understanding the attack mechanism and strengthening future defenses. To address this issue, we propose an adversarial sample restoration method based on the similarity between clean and adversarial sample blocks to balance the needs of adversarial forensics and recognition accuracy. We implement the Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), and Momentum Iterative Attack (MIA) attacks on MNIST, F-MNIST, and EMNIST datasets and perform experimental validation. The results demonstrate that our restoration method significantly enhances the model’s classification accuracy across various datasets and attack scenarios. Comparative analysis shows that the restored samples maintain a high similarity with the original adversarial samples, proving the method’s effectiveness. In addition, we performed performance tests on pre- and post-recovery samples. Taking the MNIST dataset as an example, we observed that the model performance metrics, such as MAPE, MAE, RMSE, and VAPE, of the restored samples improved by 88%, 88%, 65%, and 82%, respectively, after using the FGSM attack. This indicates that our restoration method successfully preserves the information of the generation mechanism of the adversarial samples and improves the model’s performance. This approach balances forensic capability and prediction accuracy, demonstrates a new direction in adversarial sample research, and substantially impacts security defense in practical applications.

Trustworthy cyber-physical power systems using AI: dueling algorithms for PMU anomaly detection and cybersecurity

Energy systems require radical changes due to the conflicting needs of combating climate change and meeting rising energy demands. These revolutionary decentralization, decarbonization, and digitalization techniques have ushered in a new global energy paradigm. Waves of disruption have been felt across the electricity industry as the digitalization journey in this sector has converged with advances in artificial intelligence (AI). However, there are risks involved. As AI becomes more established, new security threats have emerged. Among the most important is the cyber-physical protection of critical infrastructure, such as the power grid. This article focuses on dueling AI algorithms designed to investigate the trustworthiness of power systems’ cyber-physical security under various scenarios using the phasor measurement units (PMU) use case. Particularly in PMU operations, the focus is on areas that manage sensitive data vital to power system operators’ activities. The initial stage deals with anomaly detection applied to energy systems and PMUs, while the subsequent stage examines adversarial attacks targeting AI models. At this stage, evaluations of the Madry attack, basic iterative method (BIM), momentum iterative method (MIM), and projected gradient descend (PGD) are carried out, which are all powerful adversarial techniques that may compromise anomaly detection methods. The final stage addresses mitigation methods for AI-based cyberattacks. All these three stages represent various uses of AI and constitute the dueling AI algorithm convention that is conceptualised and demonstrated in this work. According to the findings of this study, it is essential to investigate the trade-off between the accuracy of AI-based anomaly detection models and their digital immutability against potential cyberphysical attacks in terms of trustworthiness for the critical infrastructure under consideration.

Adversarial Attacks against Deep-Learning-Based Automatic Dependent Surveillance-Broadcast Unsupervised Anomaly Detection Models in the Context of Air Traffic Management.

Deep learning has shown significant advantages in Automatic Dependent Surveillance-Broadcast (ADS-B) anomaly detection, but it is known for its susceptibility to adversarial examples which make anomaly detection models non-robust. In this study, we propose Time Neighborhood Accumulation Iteration Fast Gradient Sign Method (TNAI-FGSM) adversarial attacks which fully take into account the temporal correlation of an ADS-B time series, stabilize the update directions of adversarial samples, and escape from poor local optimum during the process of iterating. The experimental results show that TNAI-FGSM adversarial attacks can successfully attack ADS-B anomaly detection models and improve the transferability of ADS-B adversarial examples. Moreover, the TNAI-FGSM is superior to two well-known adversarial attacks called the Fast Gradient Sign Method (FGSM) and Basic Iterative Method (BIM). To the best of our understanding, we demonstrate, for the first time, the vulnerability of deep-learning-based ADS-B time series unsupervised anomaly detection models to adversarial examples, which is a crucial step in safety-critical and cost-critical Air Traffic Management (ATM).

Adversarial Defensive Framework for State-of-Health Prediction of Lithium Batteries

Neural Networks are subject to malicious data poisoning attacks affecting the ability of the model to make accurate predictions. The attacks are generated using adversarial techniques imperceptible to the human eye since they use minimal noise to alter features which end up affecting boundary decisions of the prediction Model. Predicting lithium-ion batteries' State of Health (SOH) in a adversarial context becomes a challenging task especially if the model is expected to always predict at a very high accuracy level. Our article presents three novel contributions. The first contribution is a SOH prediction model that shows one of the best accuracy rates in the literature ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$R2=99.82\%$</tex-math></inline-formula> ) and yet uses the simplest LSTM model configuration compared to literature. The second contribution is the implementation of three state-of-the-art adversarial data poisoning attacks at decision time, knowingly Fast Gradient Method (FGSM), Momentum Iterative Method (MIM) and Basic Iterative Method (BIM) and the assessment of their impact on the original prediction accuracy. Most of literature use the attacks in a classification context while we are applying it to a time series prediction context. The third and most important contribution of this article is presenting a generic defense strategy combined with a feature engineering method that can be genrelized to prevent any potential adversarial attack attempt on any prediction model in a time-series prediction context using the same suggested feature engineering approach as suggested in this paper. The accuracy of the model is assessed using error estimators Root Mean Square Error (RMSE), Mean Absolute Error (MAE) and the R square (R2).The results show that adversarial data poisoning attacks are lethal to a time-series prediction model and our proposed defense strategy is able to detect and flag the existence of malicious data using a Simple Vector Machine (SVM) classifier with a very high confidence rate ( <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$area\,uder\,curve=0.996$</tex-math></inline-formula> ) which allow our model to defend against any potential unseen adversarial attack.

Detection of adversarial attacks based on differences in image entropy

AbstractAlthough deep neural networks (DNNs) have achieved high performance across various applications, they are often deceived by adversarial examples generated by adding small perturbations. To combat adversarial attacks, many detection methods have been proposed, including feature squeezing and trapdoor. However, these methods rely on the output of DNNs or involve training a separate network to detect adversarial examples, which leads to high computational costs and low efficiency. In this study, we propose a simple and effective approach called the entropy-based detector (EBD) to protect DNNs from various adversarial attacks. EBD detects adversarial examples by comparing the difference in entropy between the input sample before and after bit depth reduction. We show that EBD can detect over 98% of the adversarial examples generated by attacks using fast-gradient sign method, basic iterative method, momentum iterative method, DeepFool and CW attacks when the false positive rate is 2.5% for CIFAR-10 and ImageNet datasets.

SOLARNet: A single stage regression based framework for efficient and robust object recognition in aerial images

Object recognition and localization play a crucial role in aerial images and their applications. The aerial images are challenging due to the large aspect ratio, arbitrary orientation, variation in scales, and non-uniform and cluttered object distribution. To address these challenges, we propose an efficient and robust model called the Simultaneous Object Localization and Recognition Network (SOLARNet), which is a fusion network that integrates two different sub-networks: PixelAttentionDetector (PD) and RotationDetector (RD). The PD considers features from different scales and cluttered objects, while RD handles rotation invariance, giving horizontal and oriented object detection results. The state-of-the-art model fails to improve accuracy when images are adversarially attacked. SOLARNet is not only efficient in terms of accuracy but also robust concerning to Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), Jacobian Based Saliency Map (JSM) adversarial attacks, which is the crucial factor for any mission-critical system. We have performed experiments and achieved the accuracy on the publicly available DOTA dataset (75.00% mAP, 66.40% mAP) and DIOR dataset (88.60% mAP, 81.50% mAP) for horizontal and oriented object recognition tasks respectively while having high inference speed. Qualitative and quantitative results reported in this paper substantiate the superiority of SOLARNet over other state-of-the-art methodologies.

EIFDAA: Evaluation of an IDS with function-discarding adversarial attacks in the IIoT

The complexity of the Industrial Internet of Things (IIoT) presents higher requirements for intrusion detection systems (IDSs). An adversarial attack is a threat to the security of machine learning-based IDSs. For such a complex situation, this paper analyses adversarial attackers’ ability to deceive IDSs used in the IIoT and proposes the evaluation of an IDS with function-discarding adversarial attacks in the IIoT (EIFDAA), a framework that can evaluate the defence performance of machine learning-based IDSs against various adversarial attack algorithms. This framework is composed of two main processes: adversarial evaluation and adversarial training. Adversarial evaluation can diagnose IDS that is unfitting in adversarial environments. Then, adversarial training is used to treat the weak IDS. In this framework, five well-known adversarial attacks, the fast-gradient sign method (FGSM), basic iterative method (BIM), projected gradient descent (PGD), DeepFool and Wasserstein generative adversarial network with gradient penalty (WGAN-GP) are used to convert attack samples into adversarial samples to simulate the adversarial environment. This study evaluates the capability of mainstream machine learning techniques as intrusion detection models to defend against adversarial attacks, and retrains these detectors to improve the robustness of IDSs through adversarial training. In addition, the framework includes an adversarial attack model that discards the attack function of the attack samples in the IIoT. Through the experimental results on the X-IIoTID dataset, the dropped adversarial detection rate of these detectors to nearly zero demonstrates that an adversarial attack has black-box attack capabilities for these IDSs. Additionally, the improved IDSs retrained with adversarial samples can effectively defend against adversarial attackers while maintaining the original detection rate for the attack samples. EIFDAA is expected to be a solution that can be applied to IDS for improving the robustness in the IIoT.

Comparison of Basic Iterative Methods Used to Solve of Heat and Fluid Flow Problems

In this research, a comparison of the convergence rate of different basic methods is made in order to solve the Poisson equation, which is similar to some of the resulting equations in computational fluid mechanics. The Jacobi method, the point Gauss-Seidel method, the successive over-relaxation method (SOR), the line Gauss method (TDMA), the ADI method and Strongly Implicit (SIP) method are among the iterative approaches investigated, which are then compared to find the most optimal method. The selection criteria included the number of iterations and the time needed to reach convergence. In both selection criteria, the SIP approach has been shown to be the most efficient.

Enhancing the robustness of vision transformer defense against adversarial attacks based on squeeze-and-excitation module.

Vision Transformer (ViT) models have achieved good results in computer vision tasks, their performance has been shown to exceed that of convolutional neural networks (CNNs). However, the robustness of the ViT model has been less studied recently. To address this problem, we investigate the robustness of the ViT model in the face of adversarial attacks, and enhance the robustness of the model by introducing the ResNet- SE module, which acts on the Attention module of the ViT model. The Attention module not only learns edge and line information, but also can extract increasingly complex feature information; ResNet-SE module highlights the important information of each feature map and suppresses the minor information, which helps the model to perform the extraction of key features. The experimental results show that the accuracy of the proposed defense method is 19.812%, 17.083%, 18.802%, 21.490%, and 18.010% against Basic Iterative Method (BIM), C&W, DeepFool, DI2FGSM, and MDI2FGSM attacks, respectively. The defense method in this paper shows strong robustness compared with several other models.

SIEMS: A Secure Intelligent Energy Management System for Industrial IoT Applications

Microgrids are industrial technologies that can provide energy resources for the Internet of Things (IoT) demands in smart grids. Hybrid microgrids supply quality power to the IoT devices and ensure high resiliency in supply and demand for PV-based grid-tied microgrids. In this system, the usage of predictive energy management systems (EMS) is essential to dispatch power from different resources, while the battery energy storage system (BESS) is feeding the loads. In this article, we deploy a one-day-ahead prediction algorithm using a deep neural network for a fast-response BESS in an intelligent energy management system (I-EMS) that is called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SIEMS</i> . The main role of the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SIEMS</i> is to maintain the SOC at high rates based on the one-day-ahead information about solar power, which depends on meteorological conditions. The remaining power is supplied by the main grid for sustained power streaming between BESS and end-users. Considering the usage of information and communication technology components in the microgrids, the main objective of this article is focused on the hybrid microgrid performance under cyber-physical security adversarial attacks. Fast gradient sign, basic iterative, and DeepFool methods, which are investigated for the first time in power systems e.g., smart grid and microgrids, in order to produce perturbation for training data. To secure the microgrid’s <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">SIEMS</i> , we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">two</i> Defence algorithms based on defensive distillation and adversarial training strategies for the first time in EMSs. We apply and evaluate these benchmark adversarial attack and Defence methods against the proposed machine learning models to increase the robustness of the models in the system against adversarial attacks.

EnsembleDet: ensembling against adversarial attack on deepfake detection

Deepfakes and manipulation techniques such as adversarial attacks pose a significant threat to society today. It is essential for the detection methods used against them to be more robust than ever. Generation techniques such as neural texture, along with adversarial attacks, result in visually realistic manipulated media and make it difficult for the current state-of-the-art (SoTA) to detect the manipulation. We propose an ensemble-based approach and a genetic algorithm-based approach for fake imagery detection that has been perturbed using fast gradient sign method and basic iterative method techniques. We collectively put such methods under the umbrella term, “EnsembleDet.” We evaluate the proposed approaches using a perturbed version of the benchmark dataset of FaceForensics++, which consists of data generated from manipulation techniques such as Face2Face, neural textures, among others. We present a comparative analysis of quantitative results with SoTA, XceptionNet, and MesoNet, which depict the superiority of the proposed methods over the current SoTA. We also highlight the aspects where the proposed methods have a scope for improvement.

Adversarial security mitigations of mmWave beamforming prediction models using defensive distillation and adversarial retraining

The design of a security scheme for beamforming prediction is critical for next-generation wireless networks (5G, 6G, and beyond). However, there is no consensus about protecting beamforming prediction using deep learning algorithms in these networks. This paper presents the security vulnerabilities in deep learning for beamforming prediction using deep neural networks in 6G wireless networks, which treats the beamforming prediction as a multi-output regression problem. It is indicated that the initial DNN model is vulnerable to adversarial attacks, such as Fast Gradient Sign Method , Basic Iterative Method , Projected Gradient Descent , and Momentum Iterative Method , because the initial DNN model is sensitive to the perturbations of the adversarial samples of the training data. This study offers two mitigation methods, such as adversarial training and defensive distillation, for adversarial attacks against artificial intelligence-based models used in the millimeter-wave (mmWave) beamforming prediction. Furthermore, the proposed scheme can be used in situations where the data are corrupted due to the adversarial examples in the training data. Experimental results show that the proposed methods defend the DNN models against adversarial attacks in next-generation wireless networks.

An advanced approach of Regula-Falsi method exploiting the bisection method

We design a new numerical method which is the advanced version of the Regula-Falsi [1] method where the bisection technique [2] is used. We briefly discuss these two methods with their respective graphs. We provide an algorithm along with the graphical representation of our proposed method. Finally, we compare our proposed method with some basic iterative methods using a data table.

Empirical Perturbation Analysis of Two Adversarial Attacks: Black Box versus White Box

Through the addition of humanly imperceptible noise to an image classified as belonging to a category ca, targeted adversarial attacks can lead convolutional neural networks (CNNs) to classify a modified image as belonging to any predefined target class ct≠ca. To achieve a better understanding of the inner workings of adversarial attacks, this study analyzes the adversarial images created by two completely opposite attacks against 10 ImageNet-trained CNNs. A total of 2×437 adversarial images are created by EAtarget,C, a black-box evolutionary algorithm (EA), and by the basic iterative method (BIM), a white-box, gradient-based attack. We inspect and compare these two sets of adversarial images from different perspectives: the behavior of CNNs at smaller image regions, the image noise frequency, the adversarial image transferability, the image texture change, and penultimate CNN layer activations. We find that texture change is a side effect rather than a means for the attacks and that ct-relevant features only build up significantly from image regions of size 56×56 onwards. In the penultimate CNN layers, both attacks increase the activation of units that are positively related to ct and units that are negatively related to ca. In contrast to EAtarget,C’s white noise nature, BIM predominantly introduces low-frequency noise. BIM affects the original ca features more than EAtarget,C, thus producing slightly more transferable adversarial images. However, the transferability with both attacks is low, since the attacks’ ct-related information is specific to the output layers of the targeted CNN. We find that the adversarial images are actually more transferable at regions with sizes of 56×56 than at full scale.

Robust stacking ensemble model for darknet traffic classification under adversarial settings

Encrypted traffic tunnelled by Tor or VPN is referred to as darknet traffic. The ability to detect, identify, and characterize darknet traffic is critical for detecting network traffic generated by a cyber-attack. Darknet classification models based on Machine Learning / Deep Learning (ML/DL) usually demonstrate high False Positive Rate (FPR) and lower F1-score which are essential metrics for network traffic analysis. Additionally, ML/DL models used in such tasks are susceptible to adversarial perturbed samples that can cause the network security solution to malfunction. This work proposes a Stacking Ensemble (SE) model to combine the predictions of three base learners, 1) Random Forest, 2) K-Nearest Neighbors, and 3) Decision Tree in the most efficient way for improving the overall performance of darknet characterization. A two-layered autoencoder-based defence mechanism consisting of a detector and denoiser is devised to increase the robustness of the network security system against adversarial attacks. The performance of the proposed model is demonstrated through extensive experiments using the CIC-Darknet-2020 dataset. The robustness of the model is tested against three highly transferable adversarial attacks, 1) Fast Gradient Sign Method (FGSM), 2) Basic Iterative Method (BIM), 3) DeepFool and a realistic 4) Boundary attack. The experimental results show that the SE model outperforms the baseline Deep Image and other competitor models by achieving an accuracy score of 98.89% and an FPR of 0.43% in the case of darknet traffic identification. Furthermore, an accuracy of 97.88% is achieved in the case of darknet traffic flow characterization. In addition, the statistical properties of the packet flow are identified as the most commonly affected features by adversarial attacks through the Mean Adversarial Perturbation (MAP) metric.

Finite Difference Method for Solving Poisson’s Equation in Two Dimensions with Alternating Direction Implicit Method

This paper presents some numerical techniques for the solution of two dimensional Poisson’s equations. The discrete approximation of Poisson’s equations is based on Finite difference method over a regular domain 16 R"&gt; . In this research five point difference approximations is used for Poisson’s equation .To solve the resulting finite difference approximation basic iterative methods; Jacobi, Gauss-Seidal and successive over relaxation (SOR) have been used. Several model problems of Poisson’s equations are solved by the iterative methods to identify the efficiency of the iterative methods. And we study the convergence, consistence and stability of the schemes. Alternating direction implicit (ADI) method is a finite difference method (FDM) to solve partial differential equations (PDEs). We employ ADI method to solve Poisson’s equations for dirichlet boundary conditions. The discretized equation is modified near the boundaries to incorporate arbitrary domain shapes. The ADI method performs much better than traditional iterative methods because of usage of efficient tri-diagonal solvers. Keywords: Iteration, Discretized , Finite Difference method (FDM), Alternating direct implicit method (ADI), Poisson’s equation, stability and convergence. DOI: 10.7176/APTA/85-01 Publication date: November 30 th 2021

Multitask adversarial attack with dispersion amplification

Recently, adversarial attacks have drawn the community’s attention as an effective tool to degrade the accuracy of neural networks. However, their actual usage in the world is limited. The main reason is that real-world machine learning systems, such as content filters or face detectors, often consist of multiple neural networks, each performing an individual task. To attack such a system, adversarial example has to pass through many distinct networks at once, which is the major challenge addressed by this paper. In this paper, we investigate multitask adversarial attacks as a threat for real-world machine learning solutions. We provide a novel black-box adversarial attack, which significantly outperforms the current state-of-the-art methods, such as Fast Gradient Sign Attack (FGSM) and Basic Iterative Method (BIM, also known as Iterative-FGSM) in the multitask setting.