PaperlayerView exact revision on arXiv

Source-linked AI summary

Fast Feature Fool: A data independent approach to universal adversarial perturbations

Konda Reddy Mopuri, Utsav Garg, R. Venkatesh Babu

arXiv:1707.05572v1cs.CV

TL;DR

Existing universal adversarial perturbation methods require target training data, whose availability affects their practical use. Fast Feature Fool instead optimizes multi-layer CNN features without data, producing quasi-imperceptible perturbations that transfer across architectures and datasets. The method reports a 41.31% average transfer rate across five tested networks.

  • Problem

    Existing universal perturbation methods require target training data, and their fooling performance is directly proportional to the amount available.

  • Method

    Fast Feature Fool optimizes a data-independent perturbation to maximize feature activations across multiple CNN layers without using target images.

  • Results

    41.31% average transfer rate was reported across five tested networks, with a minimum fooling rate of 40.17%.

  • Takeaways & Limitations

    The perturbations are triply universal: they fool multiple images, transfer across same-dataset architectures, and retain transferability across different target datasets.

  • Takeaways & Limitations

    The perturbation must satisfy a pixel-intensity constraint ξ to remain quasi-imperceptible to humans.

Abstract

from arXiv · show

State-of-the-art object recognition Convolutional Neural Networks (CNNs) are shown to be fooled by image agnostic perturbations, called universal adversarial perturbations. It is also observed that these perturbations generalize across multiple networks trained on the same target data. However, these algorithms require training data on which the CNNs were trained and compute adversarial perturbations via complex optimization. The fooling performance of these approaches is directly proportional to the amount of available training data. This makes them unsuitable for practical attacks since its unreasonable for an attacker to have access to the training data. In this paper, for the first time, we propose a novel data independent approach to generate image agnostic perturbations for a range of CNNs trained for object recognition. We further show that these perturbations are transferable across multiple network architectures trained either on same or different data. In the absence of data, our method generates universal adversarial perturbations efficiently via fooling the features learned at multiple layers thereby causing CNNs to misclassify. Experiments demonstrate impressive fooling rates and surprising transferability for the proposed universal perturbations generated without any training data.

1 Introduction

The paper addresses the impractical data dependence of universal adversarial perturbation methods by introducing a data-independent approach that fools CNN features without target training data. It reports transferability across architectures and datasets.

  • Motivation: Existing universal perturbation methods require target training data and complex optimization, with fooling performance tied to available data.This dependence is problematic because target training data is generally unavailable to attackers.
  • Contribution: The proposed method generates one perturbation without target data distribution, class-count, or sample-image knowledge.Only the target network is required.
  • Method: Fast Feature Fool optimizes perturbations to misfire features learned at multiple CNN layers, eventually causing misclassification.The approach replaces label-flipping objectives with feature-based optimization.
  • Contribution: The method is presented as computationally efficient for quickly computing universal perturbations for target CNNs.The paper points to Section 4.4 and Table 6 for this claim.
  • Results: The data-independent perturbations transfer across networks trained on the same data and across same architectures trained on different data.The paper reports stronger transfer performance than data-dependent methods.

2 Related Works

Prior work established universal perturbations and black-box transfer attacks, but these approaches rely on sampled data or a trained local replica. The paper instead targets data-independent perturbations using the target CNN’s hierarchical features.

  • Universal perturbations: Universal perturbations use one image-agnostic perturbation to fool most natural images and can transfer across networks trained on the same data.Prior methods iteratively craft the perturbation from samples of the data distribution.
  • Black-box attacks: Oracle-based black-box attacks train a local CNN from target outputs, then transfer adversarial samples to the victim network.The local model is trained using crafted inputs and labels supplied by the target.
  • Proposed distinction: The proposed approach avoids both data-distribution samples and a local target-model replica.It exploits the hierarchical features learned by the target CNN.
  • Proposed distinction: The paper also investigates transferability across architectures trained on different data distributions.This extends prior transferability evaluations beyond a single target distribution.

3 Fast Feature Fool

Fast Feature Fool constructs a data-independent perturbation by optimizing feature activations in a trained CNN rather than using image samples or label-flipping objectives. It jointly strengthens activations across convolutional layers under a pixel-intensity constraint.

  • Objective: The objective is to find a perturbation that fools a classifier on many data points without using any samples.The perturbation is intended to misclassify a majority of target samples.
  • Feature-based strategy: Because data independence prevents label-flipping optimization, the method instead over-saturates features learned at multiple CNN layers.The perturbation produces spurious, uninformative activations that can lead to misclassification.
  • Objective design: The loss uses the product of mean post-nonlinearity activations across selected layers, with K denoting the number of optimized layers.The method typically optimizes convolutional feature-extraction layers before fully connected layers.
  • Objective design: Taking the logarithm of the activation product avoids extreme values and makes simultaneous activation maximization tractable.The product acts as a stronger constraint than summing layer activations because all layers must increase for the loss to decrease.
  • Optimization procedure: Optimization begins from a random perturbation and updates only that perturbation, clipping it after each step to preserve imperceptibility.The network parameters remain fixed and no image data enters the optimization.

4 Experiments

Experiments evaluate Fast Feature Fool on several CNN architectures trained on ILSVRC, using bounded perturbations and visual examples of misclassified images. The evaluation also reports cross-network fooling rates from perturbations crafted for individual architectures.

  • Experimental setup: The experiments evaluate CaffeNet, VGG-F, VGG-16, VGG-19, and GoogLeNet trained on ILSVRC.Universal perturbations are computed for each architecture by optimizing the proposed loss.
  • Experimental setup: ξ = 10 bounds perturbation pixel intensities to [-10,+10], while perturbed images remain perceptually indistinguishable from originals yet are misclassified.Figure 1 displays architecture-specific perturbations, and Figure 2 shows GoogLeNet examples.
  • Transferability: Table 1 reports fooling rates over 50000 ILSVRC validation images, with rows for crafting networks and columns for target networks.Bold diagonal entries represent dedicated optimization for each architecture.

4.1 Transferability across network architectures

The proposed data-independent universal perturbations transfer across different CNN architectures trained on the same dataset, maintaining substantial fooling rates without target-data knowledge.

  • 4.1 Transferability across network architectures: The perturbations transfer across multiple network architectures trained on ILSVRC, including architectures different from the one used to craft them.Table 1 reports dedicated and cross-network fooling rates on 50,000 ILSVRC validation images.
  • 4.1 Transferability across network architectures: 40.17% is the minimum fooling rate across all tested networks.The average transfer rate across five networks is 41.31%.
  • 4.1 Transferability across network architectures: The observed cross-architecture generalization is reported as practically important despite the method having no knowledge of the target data distribution.The perturbations are generated without sampling target images.

4.2 Transferability across data

The paper extends transferability evaluation across datasets and finds that data-independent perturbations are more stable when transferred between architectures trained on ILSVRC and Places-205.

  • 4.2 Transferability across data: The evaluation transfers perturbations between ILSVRC-trained and Places-205-trained versions of the same architectures.Places-205 validation contains 20,500 images from 205 scene categories.
  • 4.2 Transferability across data: The CaffeNet case is an exception in interpretation because its perturbation was tested on AlexNet trained on Places, rather than exactly the same architecture.The caption attributes the larger proposed-method drop in that case to the slight architectural difference.
  • 4.2 Transferability across data: The proposed approach suffers less change in fooling rate across datasets than data-dependent UAPs.Table 2 measures absolute change as |rate on ILSVRC - rate on Places-205|.
  • 4.2 Transferability across data: Data-dependent perturbations quickly lose fooling ability on features trained from a different data distribution, whereas the proposed perturbations are not tied to target data.The comparison includes same-architecture transfers across the two datasets.

4.3 Initialization with smaller network’s perturbation

The initialization experiment tests whether a perturbation from a shallow VGG-F network improves optimization for deeper ILSVRC-trained networks compared with random initialization.

  • 4.3 Initialization with smaller network’s perturbation: The proposed perturbations for GoogLeNet, VGG-16, and VGG-19 are initialized with VGG-F’s perturbation.All networks in this experiment are trained on ILSVRC.
  • 4.3 Initialization with smaller network’s perturbation: The reported improvements over random initialization are attributed to structure and transferability already present in VGG-F’s perturbation.Optimization from this initialization produces slight improvement compared with random initialization.

4.4 Comparison with data dependent universal perturbations

The comparison evaluates data-dependent UAPs with target or non-target data against the proposed no-data method, covering fooling rates across datasets and convergence time. The proposed approach is reported to transfer better without data and to converge faster.

  • 4.4 Comparison with data dependent universal perturbations: The comparison considers data-dependent UAPs using either the target dataset or images from a different dataset.The experiments use ILSVRC and Places-205.
  • 4.4.1 With access to target dataset: UAP fooling performance increases monotonically with the number of target-training samples, reflecting strong data dependence.Figure 3 compares sample sizes of 500, 1,000, 2,000, 4,000, and 10,000 on ILSVRC-trained networks.
  • 4.4.2 Without the access to target dataset: When non-target data are used, data-dependent perturbations experience a significant fooling-rate drop, especially on larger networks such as GoogLeNet.Tables 4 and 5 evaluate the reverse dataset-transfer settings.
  • 4.4.2 Without the access to target dataset: The proposed approach uses no data and achieves significantly better performance on CNNs trained on both ILSVRC and Places-205 in these cross-dataset experiments.The corresponding validation sets are used for evaluation.
  • 4.4.3 Convergence time: The proposed optimization takes only a small fraction of the convergence time required by the data-dependent approach across three ILSVRC-trained architectures.Timing uses the authors’ implementation of UAP with 10,000 sampled training images on an NVIDIA GeForce TITAN-X GPU.

4.5 Implementation details

The implementation extracts activations from all convolutional or concatenation layers and defines a loss from their activation products.

  • 4.5 Implementation details: Activations are extracted from every convolutional or concatenation layer for each network.Inception networks use concatenation layers.
  • 4.5 Implementation details: The loss is formulated as the logarithm of the product of activations across layers and minimized through its negative.The resulting loss is unbounded in the negative direction.

5 Conclusion

The paper presents data-independent perturbations that fool multiple images and transfer across networks trained on the same or different datasets. Experiments characterize them as a more serious threat than data-dependent perturbations and call for further study and robust-model development.

  • 5 Conclusion: The perturbations are triply universal across images, networks trained on the same dataset, and networks trained on different datasets.The paper contrasts their cross-dataset transferability with data-dependent perturbations.
  • 5 Conclusion: Experiments indicate that data-independent universal perturbations can pose a more serious threat than data-dependent counterparts.The authors state that attackers need not know the target dataset or model internals.
  • 5 Conclusion: The authors call for rigorous studies under extreme depth and advanced regularizers, alongside efforts to develop more robust models.These directions are presented as complementary responses to the data-independent threat.
Loading 1707.05572v1…