PaperlayerView exact revision on arXiv

Source-linked AI summary

Universal Adversarial Training

Ali Shafahi, Mahyar Najibi, Zheng Xu, John Dickerson, Larry S. Davis, Tom Goldstein

arXiv:1811.11304v2cs.CVcs.CRcs.LG

TL;DR

Universal perturbations enable transferable attacks, while existing adversarial training is costly and ineffective for the larger perturbations often used in universal attacks. The paper develops efficient stochastic-gradient methods for generating universal perturbations and training universally robust networks, including a simultaneous update method with almost no extra cost compared to natural training.

  • Problem

    Existing adversarial training is costly and is not effective for the larger perturbations often used for universal attacks.

  • Method

    The paper formulates universal attack generation as an optimization problem and universal adversarial training as a min-max problem solved with alternating or simultaneous stochastic-gradient methods.

  • Results

    The simultaneous stochastic-gradient method produces approximately universally robust models at almost no cost compared to natural training.

  • Takeaways & Limitations

    Efficient universal perturbation updates make universal adversarial training practical, including on large datasets such as ImageNet.

  • Takeaways & Limitations

    Per-instance robust models with the large perturbation bounds common for universal attacks can be trained only on small datasets such as CIFAR.

Abstract

from arXiv · show

Standard adversarial attacks change the predicted class label of a selected image by adding specially tailored small perturbations to its pixels. In contrast, a universal perturbation is an update that can be added to any image in a broad class of images, while still changing the predicted class label. We study the efficient generation of universal adversarial perturbations, and also efficient methods for hardening networks to these attacks. We propose a simple optimization-based universal attack that reduces the top-1 accuracy of various network architectures on ImageNet to less than 20%, while learning the universal perturbation 13X faster than the standard method. To defend against these perturbations, we propose universal adversarial training, which models the problem of robust classifier generation as a two-player min-max game, and produces robust models with only 2X the cost of natural training. We also propose a simultaneous stochastic gradient method that is almost free of extra computation, which allows us to do universal adversarial training on ImageNet.

1 Introduction

Universal perturbations can fool many images with one image-agnostic update, creating practical and transferable attacks that existing defenses do not efficiently address. The paper introduces faster universal attack optimization and universal adversarial training as an efficient defense.

  • Motivation: Universal perturbations can change image labels with high probability using one update across images.They empower attackers who cannot generate per-instance examples online and facilitate black-box attacks through cross-model transferability.
  • Motivation: Per-instance adversarial training is ineffective for the larger perturbations common in universal attacks and is costly on large datasets.Its training process generates adversarial examples for each mini-batch, increasing computational cost.
  • Contributions: The paper formulates universal perturbation creation as an optimization problem solvable with stochastic gradient methods.This formulation is intended to reduce attack-generation time relative to the prior method.
  • Contributions: Universal adversarial training models robust classifier generation as a min-max problem over network parameters and universal perturbations.Alternating stochastic gradient methods avoid the expensive per-instance adversarial-training inner loop.
  • Contributions: The proposed low-cost defense works in practice on CIFAR-10 and ImageNet while requiring substantially less computation than conventional strong-adversary training.The contribution passage specifically describes alternating and low-cost universal adversarial training methods.

2 Related work

Prior work developed per-instance and universal attacks, but defenses were mainly designed for per-instance perturbations and universal-defense methods remained limited or slow. The paper’s related work positions its approach as a more efficient route to universal robustness.

  • Per-instance attacks: FGSM uses one gradient-sign step, while PGD applies multiple FGSM-like steps with projection and is among the strongest per-instance attacks.R-FGSM adds a random step before FGSM when gradients near clean images are small.
  • Adversarial training: Adversarial training can produce models resistant to per-instance attacks, but weaker training attacks may leave models vulnerable to stronger PGD attacks.PGD-based training is effective but time-consuming because of its inner optimization loop.
  • Universal attacks: Existing robust models were not designed or tested against universal perturbations.This leaves a distinction between robustness to per-instance attacks and robustness to universal attacks.
  • Universal attacks: Universal perturbations can be added directly to test images, and prior work generated them by iteratively optimizing per-instance adversarial losses with DeepFool.Related work also established universal perturbations for segmentation, targeted patches, and data-independent attacks.
  • Universal defenses: Defenses against universal attacks had received little dedicated study, with one approach using a rectifying network trained on perturbations built for the downstream classifier.Other work modeled defense as a min-max game but repeatedly generated universal adversarial examples, making the approach slow.

3 Optimization for universal perturbation

The paper formulates universal perturbation generation as a stochastic optimization problem and uses clipped loss to encourage attacks that fool many instances. Gradient ascent with projection efficiently updates the perturbation, with PGD and ADAM converging faster than other tested optimizers.

  • Problem formulation: Universal perturbations are optimized over training samples to alter classifier predictions while satisfying an ℓp-norm constraint.The fooling ratio measures the fraction of images whose perturbed labels differ from their original labels.
  • Problem formulation: Maximizing the average training loss provides a simple surrogate objective for constructing universal perturbations.The formulation searches for a perturbation that maximizes loss across samples and thereby forces images toward incorrect classes.
  • Clipped objective: Clipping the cross-entropy loss prevents a single severely misclassified image from dominating the objective and better approximates misclassification accuracy.The naive loss is unbounded, so one image could otherwise drive the average loss arbitrarily high.
  • Optimization algorithm: Each stochastic-gradient iteration ascends the loss and projects the perturbation back onto the ℓp-norm ball.The paper evaluates SGD, momentum SGD, PGD, and ADAM for the ascent step.
  • Optimization algorithm: PGD and ADAM converge faster than the other tested optimizers when attacking a naturally trained WRN on CIFAR-10.The experiment uses 5000 training samples, batch size 128, ϵ=8, and learning-rate/step-size 1.
  • Efficiency: The proposed stochastic-gradient formulation accelerates attack generation through minibatch computation and simple updates instead of DeepFool’s inner loop.The method also has convergence guarantees under a decreasing learning rate.

4 Universal adversarial training

Universal adversarial training replaces per-instance perturbation searches with a shared perturbation in a min-max objective, updated alongside network weights. Alternating and simultaneous stochastic-gradient methods reduce the computational burden while producing models robust to universal attacks.

  • Universal adversarial training: Universal adversarial training maximizes loss over one shared perturbation δ while minimizing over network weights w.The perturbation is mini-batch universal and is refined across training iterations.
  • Universal adversarial training: Each alternating-training iteration updates w by gradient descent and δ by ascent, avoiding an expensive inner loop.The same persistent universal perturbation is updated rather than regenerated from scratch for every instance.
  • Universal adversarial training: Universal adversarial training considers FGSM and ADAM rules for updating δ, with FGSM most effective alongside SGD updates to w.The experiments use CIFAR-10 training with ϵ = 8 and Momentum SGD, among other standard settings.
  • Attacking hardened models: Universal models trained with weaker attackers such as uSGD are relatively vulnerable, whereas models trained with uFGSM or per-instance PGD can resist universal perturbations.The evaluation applies uFGSM and uSGD attacks to universally trained models and FGSM or PGD attacks to per-instance-trained models.
  • Attacking hardened models: Per-instance robust training is practical only for small datasets such as CIFAR and small ϵ, limiting its use as a universal-robustness baseline on ImageNet.The paper includes per-instance adversarially trained CIFAR-10 models where such training is feasible.
  • Low-cost universal adversarial training: A simultaneous method computes parameter and perturbation gradients in one backward pass, cutting training time in half with only slightly reduced robustness.The CIFAR-10 model is 86.1% robust against universal perturbations and has 93.5% clean-validation accuracy.

5 Universal perturbations for ImageNet

The proposed stochastic-gradient attack generates universal perturbations efficiently and substantially degrades ImageNet classification accuracy across architectures. Its performance depends on clipping and the amount of training data.

  • 13× faster on average, the stochastic-gradient method generates universal perturbations faster than iterative DeepFool under a fixed computation budget.The method is about 20× faster on InceptionV1 and 6× faster on VGG16.
  • Both the proposed method and iterative DeepFool degrade classification accuracy, and perturbations generated on training samples generalize to validation samples.The comparison uses the same 5000 training data points for both methods.
  • 16.4% and 20.1% top-1 accuracy remain for ResNet-V1 152 and Inception-V3 after adding the generated universal perturbations.The corresponding natural accuracies are 76.8% and 78%.
  • β = 9 produces more successful Inception-V3 attacks than β = ∞, showing an advantage for clipping in the attack objective.The clipping parameter is analyzed using PGD on ImageNet validation accuracy.
  • Attack success improves significantly when the number of training points exceeds the number of classes.The evaluation reports validation accuracy after adding perturbations built from varying amounts of training data.

6 Universal adversarial training ImageNet

Universal adversarial training scales the min-max defense procedure to ImageNet and produces models that resist universal attacks. The main method is more robust than its low-cost variant, while robust performance is demonstrated on AlexNet and ResNet-101.

  • Universal adversarial training is applied to ImageNet using standard 90-epoch, batch-size-256 training parameters and ϵ = 10.The paper notes that no ImageNet model resists per-instance non-targeted perturbations at such a large ϵ.
  • The ImageNet experiments train natural, universally trained, and low-cost universally trained AlexNet models before attacking them with universal perturbations.The low-cost method is described as having no overhead cost.
  • Universal adversarially trained AlexNet is robust against universal attacks generated by both algorithm 1 and algorithm 2.The naturally trained AlexNet is susceptible to universal attacks, and its perturbations have more geometric structure.
  • The low-cost universal-training version is robust but less robust than the main universal adversarial training method.This comparison is reported for ImageNet validation examples.
  • 74.43% top1 and 92.00% top5 accuracies are achieved by universally robust ResNet-101 under universal perturbations.A naturally trained ResNet-101 achieves only 7.23% accuracy in the same setting.

7 Conclusion

The paper combines stochastic-gradient universal attacks with min-max universal adversarial training. Its simultaneous training method uses normalized gradients and adds almost no cost relative to natural or conventional training.

  • Stochastic gradients and a clipped loss function generate universal attacks much faster than previous methods.
  • Universal adversarial training optimizes a min-max problem with alternating or simultaneous stochastic-gradient methods.
  • Normalized-gradient update rules make the simultaneous stochastic-gradient method nearly cost-free compared with natural and conventional training.

A Training curves for UAT

Training curves compare universal adversarial training on CIFAR-10 WideResnet 32-10, focusing on the maximization update rule and resulting robustness. The uFGSM rule yields the most robust model in the reported comparison.

  • The CIFAR-10 training curves are measured on the WideResnet 32-10 architecture.
  • The gap before and after ascent is largest when FGSM updates universal perturbations.
  • uFGSM produces the most robust model among the reported universal adversarial training maximization rules.
  • PGD with signed gradients and ADAM are used to generate universal perturbations for the robust models.

C Universal perturbations for various ImageNet architectures

Universal perturbations generated with the clipped-loss attack can vary visually across mini-batch sizes, even for the same network architecture.

  • Changing the mini-batch size sometimes produces slightly different universal perturbations for the same architecture.The perturbations are generated with the paper’s clipped-loss attack.

D Comparison with iDeepFool on other datasets

The paper evaluates universal perturbation robustness across CIFAR-10 and MNIST and compares universal adversarial training with per-instance defenses. It also examines visual properties and attack behavior across optimizers and robust models.

  • Comparison with iDeepFool on other datasets: Universal perturbations are evaluated on WRN 32-10 for CIFAR-10 and LeNet for MNIST using 5000 training examples and 10 passes over the data.The perturbation bounds are ϵ = 8 for CIFAR-10 and ϵ = 76.5 for MNIST.
  • Comparison with iDeepFool on other datasets: ADAM-updated universal perturbations are evaluated on a CIFAR-10 adversarially trained WideResnet using 5000 training samples, batch-size 128, ϵ=8, and lr/step-size 1.The corresponding figure reports classification accuracy on training data during universal perturbation construction.
  • Comparison with iDeepFool on other datasets: Universal adversarial training with FGSM yields 17.21% accuracy against the specified white-box per-instance PGD attack, compared with 2.57% for ADAM universal training.The comparison concerns hardened models evaluated using a 20-step l∞ per-instance white-box PGD attack.
  • Comparison with iDeepFool on other datasets: The paper compares universal perturbation defenses across natural, per-instance adversarially trained, and universally adversarially trained models.The evaluation includes FGSM and PGD-based universal updates and per-instance training methods.
  • Comparison with iDeepFool on other datasets: The paper reports that its universally trained model is relatively resistant to 20-step PGD attacks, although less robust than the PGD-based robust model.The natural, FGSM robust, and R-FGSM robust models are described as being fooled almost every time.

Transferability and black-box robustness

The paper studies black-box transferability of per-instance attacks across CIFAR-10 WideResnet models and reports that attacks generated from its robust model transfer strongly to other models.

  • Transferability and black-box robustness: The black-box evaluation transfers 20-step PGD per-instance examples between natural, FGSM, R-FGSM, PGD, and universally robust WideResnet models.Adversarial examples are generated on a source model and used against a target model.
  • Transferability and black-box robustness: Attacks built for the universally robust model are the strongest in transferability and can deteriorate both natural and other robust models.The reported accuracies are summarized in Table 6.
  • Transferability and black-box robustness: Universal perturbations for naturally trained ImageNet architectures are described as visually structured.The perturbations are generated using algorithm 2 for different network architectures.
  • Transferability and black-box robustness: The paper suggests that an adversary can first make the source model universally robust before generating transferable attacks.
Loading 1811.11304v2…