Source-linked AI summary
Adversarial Transformation Networks: Learning to Generate Adversarial Examples
Shumeet Baluja, Ian Fischer
TL;DR
Existing adversarial-example methods directly optimize image pixels or compute image gradients, motivating a faster and more diverse alternative. The paper trains feed-forward Adversarial Transformation Networks to make minimal, targeted changes, and reports diverse adversarial perturbations alongside architecture-specific and frequency-related behaviors.
Problem
Existing adversarial-example methods rely on directly computing gradients or solving optimization problems over individual image pixels.
Method
The paper trains feed-forward ATNs self-supervised to transform inputs into targeted adversarial examples while balancing input similarity against classifier-output objectives.
Results
ATNs generate remarkably diverse adversarial perturbations, including spatially coherent target-class regions, while their transformations remain tied to the network they attack.
Takeaways & Limitations
After training, ATNs generate adversarial examples quickly without further target-network access or gradient computations, offering a different attack-generation mechanism.
Takeaways & Limitations
Serially chaining ATNs degrades images and fails to preserve earlier perturbations because the networks were not trained on previously transformed inputs.
Abstract
from arXiv · showhide
Multiple different approaches of generating adversarial examples have been proposed to attack deep neural networks. These approaches involve either directly computing gradients with respect to the image pixels, or directly solving an optimization on the image pixels. In this work, we present a fundamentally new method for generating adversarial examples that is fast to execute and provides exceptional diversity of output. We efficiently train feed-forward neural networks in a self-supervised manner to generate adversarial examples against a target network or set of networks. We call such a network an Adversarial Transformation Network (ATN). ATNs are trained to generate adversarial examples that minimally modify the classifier's outputs given the original input, while constraining the new classification to match an adversarial target class. We present methods to train ATNs and analyze their effectiveness targeting a variety of MNIST classifiers as well as the latest state-of-the-art ImageNet classifier Inception ResNet v2.
1. Introduction and Background
Adversarial examples are small, carefully crafted input perturbations that expose weaknesses in classifiers and can support both attacks and defensive training. Existing generation methods either solve pixel-level optimizations directly or approximate them with gradient-based procedures.
- Adversarial examples are small input perturbations crafted to make trained classifiers produce incorrect outputs.They can be used offensively to fool models or defensively to provide training data at weak points.
- Generating untargeted attacks minimizes input distance while requiring the classifier's output to differ from the original.The targeted formulation instead minimizes distance while requiring classification as a chosen target label.
- Existing methods use direct optimizers such as L-BFGS or Adam, which tend to be slower and more powerful than other approaches.
- Single-step gradient-based methods are fast because they require only one forward and backward pass through the target classifier.
- Attacks can differ by access level, ranging from transfer attacks without internal access to black-box attacks using only online target outputs.
2. Adversarial Transformation Networks
Adversarial Transformation Networks transform inputs into targeted adversarial examples by balancing input similarity with output-space objectives. They are trained as feed-forward networks and can generate attacks at inference without further target-network access or gradient computation.
- ATNs are neural networks that transform inputs into adversarial examples against a target network or set of networks.They may be targeted or untargeted and trained in black-box or white-box settings; this work focuses on targeted white-box ATNs.
- ATN training balances an input-space loss with an output-space loss through a weighting parameter β.LX measures input distortion, while LY is formed to avoid learning the identity function.
- After training, the transformation network can generate adversarial examples without further access to the target network or additional gradient computations.This can be faster than single-step gradient-based approaches when the transformation network is no larger than the target network.
- The output objective makes the classifier assign the transformed input to a chosen target class while preserving selected information from the original output distribution.The reranking function maintains the rank order of non-target classes to reduce distortions.
- ATNs can be trained self-supervised using unlabeled inputs and the target network's outputs, without requiring target-network training labels.
- Two ATN forms generate either only a perturbation or an adversarial autoencoding of the input.The perturbation form uses a residual-block variation, while the autoencoding form reconstructs the input subject to the output-space regularizer.
3. MNIST Experiments
The MNIST experiments train targeted Adversarial Transformation Networks against Classifierp to change an input’s predicted class while preserving the ordering of other outputs. Lower reconstruction weight β increases attack success but reduces visual fidelity, while generated examples generally retain digit structure.
- Experimental setup: Ten targeted ATNs transform inputs so Classifierp predicts a chosen digit while preserving the original digit as the second-highest classification.The ATNs are trained separately for each target digit and use a target distribution that changes the top class while retaining the relative ordering of other classes.
- Attack success and fidelity: As β decreases, the ability to fool Classifierp increases, while fidelity to the underlying digit diminishes.β weights the input-reconstruction loss relative to the output-matching loss; β = 0.010 can fail for a target transformation that succeeds at β = 0.005 and 0.001.
- Experimental setup: The experiments average success across ten ATNs, three architectures, and three β values against Classifierp.Each Table 2 measurement averages the ten target-specific networks, ATN0−9.
- Attack success and fidelity: In the highest-β examples, each target row transforms initially correct digits into the target class while retaining the original class as the second-highest output.The displayed transformations cover initially correct digits 0–9 and target classifications across rows and columns.
- Visual transformations: Most adversarial examples preserve empty image regions and the overall digit shape, often darkening light strokes rather than adding salt-and-pepper noise.Vertical components are emphasized in several transformations, especially those producing the digit 1, while patterns are less consistent for digits such as 8.
- Output-order preservation: The secondary-output analysis measures average rank differences before and after transformation, excluding the intentionally targeted top-class change.This evaluates how well ATNs preserve the target classifier’s output ordering beyond the deliberate misclassification.
4. A Deeper Look into ATNs
The paper examines whether ATNs transfer across classifiers, whether classifier internals improve attacks, and how multiple ATNs behave when applied in parallel or serially. Training against multiple networks improves transfer to unseen networks, while serial chaining increases image degradation and fails to preserve classification order.
- 4.1. Adversarial Transfer to Other Networks: ATNs trained on a single classifier produce transformations tied to that network rather than broadly general attacks.Even a classifier sharing the training classifier’s architecture is not more susceptible than classifiers with different architectures.
- 4.1. Adversarial Transfer to Other Networks: Training one ATN against three classifiers preserves high attack success on those training networks and demonstrates that a shared transformation can defeat multiple networks.The multi-network ATN minimizes the adversarial loss for all three target networks while retaining the reconstruction-error objective.
- 4.1. Adversarial Transfer to Other Networks: Multi-network training substantially increases success on unseen classifiers, although transfer remains below the success rates on networks used during training.The authors suggest that training against more target networks could further increase transferability.
- 4.1. Adversarial Transfer to Other Networks: For trained networks, most transformed images fool all three classifiers, whereas for unseen networks, most transformations fool only one.Figure 5 measures the percentage of test-set images succeeding on exactly 0–3 training networks and exactly 0–2 unseen networks.
- 4.2. “Insider” Information: Using hidden activations from the classifier improves conditional second-place correctness rather than first-place attack success.The ATNs use the classifier’s penultimate fully connected layer as additional input, potentially helping preserve the original class ordering.
- 4.3. Serial and Parallel ATNs: Serially chaining ten ATNs increases all-ten attack successes from 283 of 1000 parallel cases to 741, but progressively degrades images until they are usually unrecognizable.The improvement occurs because each transformation diminishes the underlying original image, while repeated transformations cause fading.
- 4.3. Serial and Parallel ATNs: Serial chaining does not preserve the intended ordering of successive adversarial and original classifications because later ATNs are not trained on images modified by earlier ATNs.The paper leaves training on previously modified images as future work to address this train–test distribution difference.
5. ImageNet Experiments
ImageNet experiments show that ATNs can attack Inception ResNet v2 using diverse architectures and target classes, with autoencoding ATNs outperforming perturbation ATNs while producing qualitatively different adversaries.
- Experimental setup: The experiments trained 20 ATNs across five architectures and four target classes against Inception ResNet v2 on ImageNet.The target classifier was evaluated on 1000 validation images, and figures were selected before training to avoid cherrypicking.
- Results: AAE ATNs achieved higher top-1 adversarial accuracy and training success than perturbation ATNs.This comparison is reported across the 20 model/target combinations in Table 8.
- Results: Perturbation ATNs preserve more original pixels by concentrating large changes in small regions, whereas AAE ATNs distribute differences across wider image regions.The perturbation approach often focuses changes along edges or corners, while autoencoding architectures modify the input more broadly.
- Detailed discussion: AAE architectures can produce checkerboard artifacts or smooth outputs, while their adversarial signal often replaces original high-frequency patterns.Resize-based convolutions avoid checkerboarding but produce smooth outputs; convolutional architectures struggle to reconstruct edges exactly.
- Adversarial diversity: ATNs generate diverse adversarial perturbations targeting a single network, unlike earlier approaches that often produced qualitatively uniform noise-like changes.The paper also relates some perturbations to DeepDream-style outputs, including spatially coherent target-class regions.
- High frequency data: High-frequency regions can attract AAE perturbations because reconstruction loss imposes a lower error bound there.The paper illustrates this behavior with changes concentrated around the edges of a dog’s face while leaving much of the sky unchanged.
6. Conclusions and Future Work
The paper concludes that ATNs replace per-input adversarial optimization with trained transformation networks that execute quickly and generate diverse successful examples. It identifies adversarial training as an important direction for future work.
- Conclusions: ATNs train neural networks to convert inputs into adversarial examples instead of computing gradients or optimizing each input individually.The approach is presented as fundamentally different from current gradient-descent procedures on individual examples.
- Conclusions: Architecture choice substantially changes the form of generated adversaries, including the contrast between autoencoding and perturbation ATNs.The architecture comparison includes three autoencoding designs and two perturbation designs.
- Conclusions: The method is described as efficient to train, fast to execute, and capable of producing diverse, successful adversarial examples.At inference, a trained ATN needs no further access to the target network or additional gradient computations.
- Future work: ATNs may provide more diverse adversaries for adversarial training, but this application remains future work.The paper proposes training ATNs against random subsets of output classes and inserting their examples into target-network training.
- Future work: The paper also suggests training adversarial detectors on ATN outputs and using realism-oriented objectives such as GAN discriminators.These directions are proposed to improve ATN outputs and extend evaluation beyond classifiers.