Source-linked AI summary
Generating Adversarial Examples with Adversarial Networks
Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, Dawn Song
TL;DR
DNNs are vulnerable to small perturbations, while generating adversarial examples with high perceptual quality and efficiency remains challenging. AdvGAN addresses this with a GAN-based generator for semi-whitebox and black-box attacks, achieving high attack success rates and 92.76% accuracy in a public MNIST black-box challenge.
Problem
Generating adversarial examples with high perceptual quality and efficiency remains an open research challenge despite DNN vulnerability to small perturbations.
Method
AdvGAN trains a GAN-based feed-forward generator to produce adversarial perturbations and uses a dynamically trained distilled model for black-box attacks.
Results
92.76% accuracy placed AdvGAN first among reported black-box attacks in a public MNIST challenge, while the method achieved high attack success rates under state-of-the-art defenses.
Takeaways & Limitations
Once trained, AdvGAN can efficiently generate adversarial perturbations and may help accelerate adversarial training as a defense.
Takeaways & Limitations
The evaluated threat model assumes the adversary is unaware of the defenses and attacks the original model directly before defenses are applied.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples resulting from adding small-magnitude perturbations to inputs. Such adversarial examples can mislead DNNs to produce adversary-selected results. Different attack strategies have been proposed to generate adversarial examples, but how to produce them with high perceptual quality and more efficiently requires more research efforts. In this paper, we propose AdvGAN to generate adversarial examples with generative adversarial networks (GANs), which can learn and approximate the distribution of original instances. For AdvGAN, once the generator is trained, it can generate adversarial perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses. We apply AdvGAN in both semi-whitebox and black-box attack settings. In semi-whitebox attacks, there is no need to access the original target model after the generator is trained, in contrast to traditional white-box attacks. In black-box attacks, we dynamically train a distilled model for the black-box model and optimize the generator accordingly. Adversarial examples generated by AdvGAN on different target models have high attack success rate under state-of-the-art defenses compared to other attacks. Our attack has placed the first with 92.76% accuracy on a public MNIST black-box attack challenge.
1 Introduction
AdvGAN uses conditional generative adversarial networks to generate perceptually realistic adversarial examples more efficiently in semi-whitebox and black-box settings. The method achieves high attack success rates, including 92.76% accuracy in a public MNIST black-box challenge.
- DNNs can be misled by small-magnitude adversarial perturbations, motivating attacks that preserve perceptual quality while improving generation efficiency.Adversarial examples can cause targeted or untargeted misclassification.
- AdvGAN trains a feed-forward network to generate perturbations and a discriminator network to encourage realistic adversarial examples.The approach applies GANs in semi-whitebox and black-box attack settings.
- After training, the feed-forward network can instantly generate adversarial perturbations without continued access to the target model in semi-whitebox attacks.This differs from white-box attacks that require ongoing access to model architecture and parameters.
- AdvGAN generates perceptually realistic examples efficiently and achieves state-of-the-art attack success rates against different target models and defenses.The reported evaluation covers both semi-whitebox and black-box settings.
- 92.76% accuracy placed AdvGAN first in a public MNIST black-box attack challenge.The contribution passage also reports 88.93% accuracy on the published robust model in the semi-whitebox setting.
2 Related Work
Prior adversarial-example attacks commonly rely on white-box access, pixel-space constraints, or slow per-instance optimization. AdvGAN instead uses a discriminator-based conditional GAN framework and extends attacks toward black-box settings where query access is important.
- Adversarial Examples: Earlier white-box attacks include FGSM and optimization-based methods that assume full classifier access.FGSM uses a first-order loss approximation, while optimization methods target constrained perturbations.
- Adversarial Examples: Optimization-based attacks can be slow because they optimize perturbations separately for one instance at a time.Their objectives combine perturbation size with a classification-loss term.
- Generative Adversarial Networks: AdvGAN uses a discriminator to distinguish generated instances from real images, encouraging perceptual quality beyond simple distance-based constraints.Its image-to-image conditional GAN architecture learns a mapping from an original image to a perturbed output.
- Black-box Attacks: Black-box attack research is important because learning systems commonly restrict white-box access.Many approaches use transferability, while relatively little work leverages query-based access to target models.
- Generative Adversarial Networks: AdvGAN adopts an adversarial loss and image-to-image network architecture to map original images to perturbed outputs that resemble real images.Conditional GANs are presented as improving image synthesis quality.
3 Generating Adversarial Examples with Adversarial Networks
AdvGAN trains a generator to produce perturbations that fool a target classifier while remaining close to the original data distribution. For black-box attacks, it uses distilled models, with dynamic joint updates of the generator and distilled model improving attack performance.
- AdvGAN Framework: AdvGAN maps an input x to a perturbation G(x), then sends x+G(x) through a discriminator and target network.The discriminator encourages similarity to original-class data, while the target network supplies the adversarial loss.
- AdvGAN Framework: The GAN loss encourages perturbed instances to be indistinguishable from original-class data.Real samples are drawn from the true class to keep generated instances close to that class.
- AdvGAN Framework: The targeted adversarial loss encourages x+G(x) to be classified as target class t, while untargeted attacks maximize distance from the ground-truth prediction.The paper focuses on targeted attacks after noting that the same framework can support untargeted attacks.
- AdvGAN Framework: A soft hinge loss on the L2 norm bounds perturbation magnitude using a user-specified bound c.The paper also states that this term can stabilize GAN training.
- Semi-whitebox Attack: After training on data and a target model, the generator can produce perturbations for arbitrary inputs without continued access to the model in semi-whitebox attacks.This feed-forward generation avoids repeatedly accessing the original target model during attack generation.
- Black-box Attacks: For black-box attacks, AdvGAN distills the black-box model and attacks the distilled network using cross-entropy matching of their outputs.Dynamic distillation jointly updates the generator and distilled model with queries on generated adversarial examples; experiments report higher attack performance than static distillation.
4 Experimental Results
AdvGAN is evaluated across MNIST, CIFAR-10, and ImageNet-compatible settings in semi-whitebox and black-box attacks, including performance under defenses. The experiments assess attack success, targeted transfer across models or classes, visual quality, and efficiency-related black-box performance.
- 4.1 AdvGAN in semi-whitebox Setting: AdvGAN generates adversarial instances against different MNIST and CIFAR-10 model architectures with high semi-whitebox attack success rates.The evaluation uses models A, B, and C for MNIST and ResNet variants for CIFAR-10.
- 4.1 AdvGAN in semi-whitebox Setting: AdvGAN preserves visual similarity while targeting different classes from the same original instance on MNIST and CIFAR-10.MNIST examples are shown across models A, B, and C, while CIFAR-10 examples target multiple other classes.
- 4.1 AdvGAN in semi-whitebox Setting: 98.3% attack success rate is achieved by AdvGAN under the full loss, compared with 91.1% for the hinge-loss variant and 86.2% for the L2-loss variant under perturbation bound 0.3.These results compare alternative loss functions on MNIST under the same bounded perturbations.
- 4.3 Attack Effectiveness Under Defenses: 92.76% accuracy places AdvGAN ahead of all other reported black-box attacks in the public MNIST challenge.AdvGAN also achieves 88.93% in the challenge’s white-box setting.
- 4.4 High Resolution Adversarial Examples: 49.4% ± 1.96% of workers judged high-resolution AdvGAN examples more realistic than original images, approximately matching random guessing.The evaluation collected 500 choices from 50 workers using paired-image judgments.
5 Conclusion
AdvGAN uses GANs to efficiently generate adversarial perturbations and supports both semi-whitebox and black-box attacks. Across different models, its examples retain high perceptual quality and achieve higher attack success against state-of-the-art defenses than competing methods.
- AdvGAN uses GANs to generate adversarial examples, with a trained feed-forward generator producing perturbations efficiently.
- AdvGAN supports both semi-whitebox and black-box attacks with high attack success rates.
- Across different models, AdvGAN examples preserve high perceptual quality and achieve higher attack success rates against state-of-the-art defenses than competing methods.