PaperlayerView exact revision on arXiv

Source-linked AI summary

EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples

Pin-Yu Chen, Yash Sharma, Huan Zhang, Jinfeng Yi, Cho-Jui Hsieh

arXiv:1709.04114v3stat.MLcs.CRcs.LG

TL;DR

DNNs remain vulnerable to visually indistinguishable adversarial examples, while L1-based attacks have been comparatively underexplored. The paper introduces EAD, an elastic-net attack combining L1- and L2-oriented objectives. Across MNIST, CIFAR10, and ImageNet, EAD matches state-of-the-art attack performance in several settings, improves transferability, and complements adversarial training.

  • Problem

    L1-based adversarial examples have been little explored despite L1 distortion capturing total perturbation and encouraging sparse changes.

  • Method

    EAD formulates attacks on DNNs as an elastic-net regularized optimization problem combining L1 and L2 penalties.

  • Results

    Across MNIST, CIFAR10, and ImageNet, EAD is as successful as state-of-the-art L2 and L∞ attacks and improves attack transferability.

  • Takeaways & Limitations

    L1-based adversarial examples provide a distinct attack set that can complement L2- and L∞-based examples and adversarial training.

  • Takeaways & Limitations

    The paper focuses on targeted attacks, although EAD can also be directly applied to untargeted attacks.

Abstract

from arXiv · show

Recent studies have highlighted the vulnerability of deep neural networks (DNNs) to adversarial examples - a visually indistinguishable adversarial image can easily be crafted to cause a well-trained model to misclassify. Existing methods for crafting adversarial examples are based on $L_2$ and $L_\infty$ distortion metrics. However, despite the fact that $L_1$ distortion accounts for the total variation and encourages sparsity in the perturbation, little has been developed for crafting $L_1$-based adversarial examples. In this paper, we formulate the process of attacking DNNs via adversarial examples as an elastic-net regularized optimization problem. Our elastic-net attacks to DNNs (EAD) feature $L_1$-oriented adversarial examples and include the state-of-the-art $L_2$ attack as a special case. Experimental results on MNIST, CIFAR10 and ImageNet show that EAD can yield a distinct set of adversarial examples with small $L_1$ distortion and attains similar attack performance to the state-of-the-art methods in different attack scenarios. More importantly, EAD leads to improved attack transferability and complements adversarial training for DNNs, suggesting novel insights on leveraging $L_1$ distortion in adversarial machine learning and security implications of DNNs.

Introduction

DNNs can be fooled by nearly imperceptible perturbations, motivating attacks that control image distortion. EAD addresses the limited exploration of L1-based attacks with elastic-net regularization and performs competitively across datasets and attack settings.

  • Carefully designed perturbations can make well-trained DNNs misclassify images while remaining virtually indistinguishable to human perception.
  • Adversarial attacks raise security concerns because adversarial examples threaten applications such as traffic-sign identification and malware detection.The paper also notes effectiveness in the physical world, adversarial training, and DNN interpretation as related uses.
  • L∞ measures maximum pixel-value variation, whereas L2 is used to improve visual quality and L1 captures total perturbation variation while encouraging sparse pixel changes.L1 is also described as a convex surrogate for L0, which measures the number of modified pixels.
  • EAD formulates DNN attacks with elastic-net regularization, combining L1 and L2 penalties to produce L1-oriented adversarial examples.Elastic-net regularization is presented as a standard tool for high-dimensional feature selection.
  • Nearly 99% attack success rate is achieved by EAD when transferring attacks from an undefended DNN to a defensively distilled DNN on MNIST.Experiments cover MNIST, CIFAR10, and ImageNet across different attack scenarios; EAD also complements adversarial training.

Related Work

Related work includes gradient-based attacks, the C&W L2 attack, defensive distillation, and detection methods. These approaches differ in how they craft perturbations, defend models, or identify adversarial inputs.

  • FGM crafts adversarial examples using the gradient of the training loss with respect to the original input and a target class.
  • I-FGM iteratively applies FGM with finer distortion and clips the result to an epsilon ball.Untargeted variants can be implemented similarly.
  • The C&W attack uses an L2-regularized loss based on DNN logit representations rather than the training loss.
  • Defensive distillation retrains the same network using class probabilities from the original network and introduces a softmax temperature parameter.
  • Detection methods use statistical tests to distinguish adversarial from benign examples, but ten such methods failed to detect the C&W attack.

EAD: Elastic-Net Attacks to DNNs

EAD formulates targeted adversarial-example generation as elastic-net optimization, combining attack loss with L1 and L2 distortion penalties. Its FISTA-based solver uses shrinkage and thresholding to promote sparse perturbations while maintaining valid image bounds.

  • EAD formulation: Elastic-net regularization combines L1 and L2 penalties, with β controlling the L1 penalty in EAD's attack formulation.The formulation constrains adversarial images to x ∈ [0, 1]^p and uses c for the attack-loss regularization.
  • Attack loss: Targeted EAD minimizes a logit-based loss that makes target class t most probable, while κ controls its separation from competing classes.
  • EAD formulation: C&W is a special case of EAD when β = 0, because removing the L1 penalty leaves the L2-based formulation.
  • EAD formulation: The L1 perturbation penalty measures total variation and promotes sparsity, yielding distinct adversarial examples with improved transferability and complementing adversarial training.
  • Optimization: The tanh-based change-of-variable approach is ineffective when β > 0 because the L1 penalty is nondifferentiable and adversarial examples become insensitive to β.
  • Optimization: EAD uses ISTA-style updates that apply gradient descent followed by projected shrinkage-thresholding around the original image.Coordinates within β of the original are reset to x0; larger deviations are shrunk and projected into [0, 1].
  • Optimization: FISTA accelerates EAD with momentum and uses a square-root learning-rate decay during iterations.

Performance Evaluation

The evaluation compares EAD with established attacks across MNIST, CIFAR10, and ImageNet. It tests whether EAD preserves attack performance while improving L1-oriented transferability and interaction with adversarial training.

  • Evaluation scope: Experiments span MNIST, CIFAR10, and ImageNet, evaluating EAD against attacks across multiple attack scenarios.
  • Evaluation goals: The evaluation tests whether EAD matches C&W against undefended and defensively distilled DNNs.
  • Evaluation goals: The experiments compare EAD with existing L1-based FGM and I-FGM methods on L1 distortion and attack success rate.
  • Evaluation goals: The evaluation also examines transferability of EAD's L1-based adversarial examples and their complementarity with adversarial training.

Comparative Methods

The comparative evaluation uses C&W, FGM, and I-FGM baselines with specified optimization and attack settings. Table 1 compares COV and EAD on MNIST, while experiments use trained classifiers and sampled correctly classified images.

  • Baselines: C&W is the state-of-the-art L2 targeted baseline and equals EAD when β = 0.
  • Baselines: FGM and I-FGM provide comparison attacks across L1, L2, and L∞ distortion metrics.
  • Attack settings: EAD and C&W use nine binary-search steps, 1000 iterations per step, and initial learning rate α0 = 0.01.
  • Attack settings: I-FGM uses 10 FGM iterations with ϵ-ball clipping and sets each iteration's distortion to ϵ/10.
  • COV comparison: Table 1 reports attack success rate and distortion for COV versus EAD on MNIST; both have similar success rates, but only EAD responds to β with lower L1 distortion.
  • Datasets and models: The classifiers include Carlini–Wagner models for MNIST and CIFAR10 and Inception-v3 for ImageNet, with correctly classified test images selected for attack.

Evaluation Metrics

EAD evaluates successful targeted attacks using attack success rate and average distortion, with EN and L1 decision rules offering different distortion trade-offs.

  • Metrics: ASR measures the percentage of adversarial examples classified as the target class, while L1, L2 and L∞ distortions are averaged over successful examples.These metrics follow the attack evaluation criterion used in the paper.
  • Decision Rules: The EN decision rule selects the successful adversarial example with the lowest elastic-net loss.The elastic-net loss combines the attack objective with L1 and L2-related regularization.
  • Decision Rules: The L1 decision rule selects the successful adversarial example with the least L1 distortion.It prioritizes total perturbation magnitude in L1 rather than the elastic-net loss.
  • Decision Rules: For the same β, the L1 rule reduces L1 distortion but may increase L2 and L∞ distortions relative to the EN rule.Both rules achieve 100% ASR across a wide range of β values on MNIST.
  • Evaluation Setup: Table 2 compares attacks on MNIST, CIFAR10 and ImageNet using ASR and distortion metrics averaged over successful examples.The table identifies which attack attains the least distortion under each metric.
  • Parameter Choice: β = 10^-3 is used in later experiments because it significantly reduces L1 distortion while maintaining comparable L2 and L∞ distortions to β = 0.This setting is reported for MNIST and CIFAR10.

Attack Success Rate and Distortion on MNIST, CIFAR10 and ImageNet

Across MNIST, CIFAR10 and ImageNet, EAD achieves strong attack success while producing low L1 distortion, complementing methods optimized for L2 or L∞ distortion.

  • Overall Performance: 100% ASR is achieved by EAD, the C&W attack and I-FGM, whereas FGM methods fail to produce similarly successful adversarial examples.FGM methods also show substantially larger distortion metrics than the other attacks.
  • Distortion Comparison: EAD, C&W and I-FGM-L∞ attain the least L1, L2 and L∞ distortions, respectively.Each method is strongest under a different distortion metric.
  • L1 Performance: Compared with I-FGM-L1, EAD with the EN rule reduces L1 distortion by roughly 47% on MNIST, 53% on CIFAR10 and 87% on ImageNet.The comparison preserves the reported dataset-specific reductions.
  • Decision-Rule Trade-off: The L1 decision rule further reduces L1 distortion but noticeably increases L2 and L∞ distortion metrics.This trade-off is reported across the evaluated attacks and datasets.
  • Defense Evaluation: Both C&W and EAD successfully break defensive distillation across temperature settings on MNIST and CIFAR10.This result is shown in the defensive-distillation experiment.
  • Interpretation: EAD with the L1 rule maintains 100% ASR across all datasets, indicating that L2 and L∞ metrics alone do not capture all relevant robustness behavior.The resulting adversarial examples are described as visually indistinguishable and distinct from L2- or L∞-based examples.

Breaking Defensive Distillation

EAD breaks defensively distilled networks across temperature settings and extends the C&W formulation by varying the L1 regularization parameter.

  • Attack Success: 100% ASR is attained by EAD for different defensive-distillation temperature values on MNIST and CIFAR10.The C&W method also reaches 100% ASR in this experiment.
  • Defense Setting: Defensive distillation retrains networks using soft class-label probabilities and introduces temperature T to enhance robustness against adversarial perturbations.The experiment tests whether EAD can overcome this defense mechanism.
  • Formulation Connection: Because C&W is a special case of EAD when β = 0, successful attacks across T support exploring L1-regularized variants through β.The paper frames this as a way to vary the L1 regularization while retaining the broader formulation.

Improved Attack Transferability

EAD produces transferable adversarial examples against defensively distilled networks, with transferability improving as κ increases within a useful range. Its advantage is attributed to ISTA-based shrinking and thresholding, although excessively large κ can reduce attack success.

  • When κ = 0, EAD, C&W, and I-FGM all achieve low transfer attack success rates.The attacks generate few transferable adversarial examples without a positive transferability parameter.
  • EAD and C&W improve transfer attack success when κ > 0, while I-FGM remains below 2%.I-FGM lacks a transferability parameter, whereas EAD and C&W can tune κ.
  • Nearly 99% ASR is achieved by EAD at κ = 50, compared with nearly 88% for C&W at κ = 40.
  • ISTA's shrinking and thresholding is identified as an explanation for EAD's improved transferability over the C&W attack.
  • Excessively large κ may reduce transfer attack success for both EAD and C&W because optimization may fail to find a loss-minimizing adversarial example.

Complementing Adversarial Training

The adversarial-training experiment compares C&W and EAD-generated examples by augmenting MNIST training data and evaluating robustness on the test set.

  • Adversarial training used 9,000 examples per method, generated from 1,000 training images across all incorrect labels.
  • C&W and EAD examples were separately added to the original MNIST training set before retraining and testing robustness.
  • The experiment evaluates whether L1- and L2-based adversarial examples alter attack difficulty after adversarial training.

Conclusion

The paper proposes EAD, an elastic-net attack framework that uses L1-oriented adversarial examples against DNNs. Across MNIST, CIFAR10, and ImageNet, EAD matches established attacks in several settings while improving transferability and complementing adversarial training.

  • EAD is an elastic-net regularized framework for crafting adversarial examples against deep neural networks.
  • Across MNIST, CIFAR10, and ImageNet, EAD's L1-based examples are as successful as state-of-the-art L2 and L∞ attacks against undefended and defensively distilled networks.
  • EAD improves attack transferability and complements adversarial training in the reported experiments.
  • The results support using L1-based adversarial examples to study adversarial learning and DNN security implications.

Supplementary Material

The supplementary material details EAD optimization, parameter search, decision-rule comparisons, attack results, transferability, and adversarial-training experiments across the evaluated datasets.

  • Optimization: EAD solves its nondifferentiable L1-penalized formulation with proximal-gradient updates and a proximal operator constrained to the image domain.
  • Grid Search for FGM and I-FGM (Table 4): The FGM and I-FGM distortion parameter ε is selected by fine-grained grid search using the smallest value that produces a successful targeted attack.
  • Decision Rules: For the same β, EAD's L1 decision rule reduces L1 distortion relative to the EN rule but increases L2 and L∞ distortion.
  • Decision Rules: Large β can increase L1 distortion under the L1 rule because excessive shrinking and thresholding prevents monotonic improvement.
  • Complete Attack Results and Visual Illustration on MNIST, CIFAR10 and ImageNet (Tables 8, 9 and 10 and Figures 6, 7 and 8): EAD, C&W, and I-FGM each reach 100% average-case attack success across MNIST, CIFAR10, and ImageNet, with CIFAR10 and ImageNet examples described as visually indistinguishable.
  • Transferability and Adversarial Training: EAD and C&W successfully break defensive distillation across a wide range of temperature parameters, while L1 examples show stronger transferability and complement adversarial training.
Loading 1709.04114v3…