Source-linked AI summary
Improving Transferability of Adversarial Examples with Input Diversity
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, Alan Yuille
TL;DR
CNNs are vulnerable to imperceptible perturbations, but adversarial attacks often transfer poorly to black-box models. The paper applies random input transformations during iterative attacks to improve transferability, reaching a 73.0% average success rate against NIPS 2017 defenses and baselines.
Problem
Existing iterative attacks can overfit white-box network parameters, limiting adversarial-example success on black-box models.
Method
The method applies random, differentiable input transformations at each iteration and integrates input diversity with iterative attacks.
Results
73.0% average success rate outperforms the top-1 NIPS 2017 attack submission by 6.6 percentage points.
Takeaways & Limitations
The attack strategy is proposed as a benchmark for evaluating network robustness and adversarial defenses.
Takeaways & Limitations
The paper assumes unknown black-box network parameters can be evaluated through loss comparisons involving those models.
Abstract
from arXiv · showhide
Though CNNs have achieved the state-of-the-art performance on various vision tasks, they are vulnerable to adversarial examples --- crafted by adding human-imperceptible perturbations to clean images. However, most of the existing adversarial attacks only achieve relatively low success rates under the challenging black-box setting, where the attackers have no knowledge of the model structure and parameters. To this end, we propose to improve the transferability of adversarial examples by creating diverse input patterns. Instead of only using the original images to generate adversarial examples, our method applies random transformations to the input images at each iteration. Extensive experiments on ImageNet show that the proposed attack method can generate adversarial examples that transfer much better to different networks than existing baselines. By evaluating our method against top defense solutions and official baselines from NIPS 2017 adversarial competition, the enhanced attack reaches an average success rate of 73.0%, which outperforms the top-1 attack submission in the NIPS competition by a large margin of 6.6%. We hope that our proposed attack strategy can serve as a strong benchmark baseline for evaluating the robustness of networks to adversaries and the effectiveness of different defense methods in the future. Code is available at https://github.com/cihangxie/DI-2-FGSM.
1. Introduction
CNNs are vulnerable to adversarial examples, while attacks often transfer poorly across networks. The paper improves transferability by applying diverse input transformations during iterative attacks and reports higher black-box success rates.
- CNNs can fail when clean images receive human-imperceptible perturbations, producing adversarial examples.
- Iterative attacks generally outperform single-step attacks in white-box settings but transfer less effectively to different networks.
- The proposed method applies random, differentiable transformations such as resizing and padding to inputs at each attack iteration.
- On ImageNet, the method achieves higher black-box success rates while maintaining similar white-box success rates compared with traditional iterative attacks.
- 73.0% average success rate exceeds the top-1 NIPS 2017 attack submission by 6.6 percentage points.
2. Related Work
Related work includes gradient-based attacks, adversarial training defenses, and transformation-based approaches. The paper distinguishes its input-diversity strategy from EOT by emphasizing black-box transferability and a different optimization procedure.
- Adversarial-example attacks include single-step FGSM and iterative methods such as I-FGSM, with iterative attacks typically stronger in white-box settings.
- The proposed input-diversity strategy is related to EOT but focuses on black-box transferability rather than white-box transformation robustness.
- Unlike EOT, the method does not apply an expectation step during each attack iteration.
- Adversarial training and ensemble adversarial training augment training data with perturbations to improve network robustness.
3. Methodology
The methodology develops diverse-input variants of iterative gradient-sign attacks to reduce overfitting and improve adversarial-example transferability, while also describing momentum and ensemble extensions.
- Motivation: The attack seeks adversarial examples that maintain high success rates on both known white-box and unknown black-box models.Iterative attacks can overfit to the parameters of the source network, whereas single-step attacks may underfit.
- Diverse Input Patterns: DI2-FGSM applies a random differentiable transformation to the input at each I-FGSM iteration with probability p.Random resizing and random padding are the stated transformation instantiations.
- Diverse Input Patterns: The transformation probability p controls the trade-off between white-box and black-box success rates; p = 0 reduces DI2-FGSM to I-FGSM.The method reports that random resizing and padding produced the best transferability among tested transformations.
- Attack Family: The attack family connects FGSM, I-FGSM, MI-FGSM, DI2-FGSM, and M-DI2-FGSM through transformation probability, momentum decay, and iteration-count settings.When N = 1, I-FGSM reduces to FGSM; other reductions follow from p = 0 or µ = 0.
- Momentum and Attack Relationships: M-DI2-FGSM combines momentum with diverse inputs to form a stronger attack that addresses overfitting through both mechanisms.The family relationships are determined by parameter settings: p = 0 removes input diversity and µ = 0 removes momentum.
- Ensemble Attacks: Attacking an ensemble fuses logits from K models using nonnegative weights, generating examples intended to transfer more broadly.The ensemble strategy is motivated by requiring an adversarial image to remain adversarial across multiple networks.
4. Experiment
Experiments on ImageNet evaluate input diversity across single-network, ensemble, transferability, and parameter studies. The method generally improves black-box success while preserving strong white-box performance, with gains extending to C&W and competition defenses.
- Experimental Setup: The experiments use 5000 correctly classified ImageNet validation images, seven normally or adversarially trained networks, and perturbations capped at ϵ = 15.The default configuration uses α = 1, N = min(ϵ + 4, 1.25ϵ), momentum decay µ = 1, and transformation probability p = 0.5.
- Single-Network Attacks: M-DI2-FGSM substantially improves black-box transferability over baselines while maintaining high white-box success rates.For attacks crafted on IncRes-v2, it reaches 67.4% on Inc-v4 and 25.1% on Inc-v3ens3, compared with MI-FGSM’s 45.9% and 15.3%.
- Generalization Beyond FGSM: Input diversity also enhances C&W attacks, producing significantly better performance on black-box models than C&W alone.The D-C&W experiment uses 1000 correctly classified images, 250 iterations, learning rate 0.01, and confidence 10.
- Ensemble Attacks: In ensemble attacks, M-DI2-FGSM achieves 44.6% on a held-out Inc-v3ens3 model, versus 12.9% for I-FGSM, 36.3% for DI2-FGSM, and 22.8% for MI-FGSM.Its white-box success is slightly lower than I-FGSM and MI-FGSM, reflecting the difficulty of attacking multiple networks simultaneously.
- Ablation Studies: Increasing p raises black-box success but lowers white-box success, while increasing N generally improves both except for black-box adversarially trained models.Smaller α improves white-box success for both methods and can further improve M-DI2-FGSM under black-box evaluation.
- NIPS 2017 Competition: M-DI2-FGSM reaches a 73.0% average success rate against NIPS 2017 defenses and baselines, exceeding MI-FGSM’s 66.4%.The enhanced attack combines diverse inputs with momentum and outperforms the other evaluated methods.
5. Conclusions
The paper improves adversarial-example transferability by applying input diversity during iterative attacks. On ImageNet, the enhanced method improves black-box success while maintaining similar white-box performance and reaches a 73.0% average success rate.
- The method applies random transformations to input images at each iteration to improve adversarial-example transferability.
- ImageNet results show significantly higher black-box success rates while maintaining similar white-box success rates compared with traditional iterative attacks.
- 73.0% average success rate was achieved against top defenses and NIPS 2017 baselines, exceeding the competition’s top-1 attack by 6.6%.
- The authors propose the attack strategy as a benchmark for evaluating network robustness and defense effectiveness.