Source-linked AI summary
Learning Transferable Adversarial Examples via Ghost Networks
Yingwei Li, Song Bai, Yuyin Zhou, Cihang Xie, Zhishuai Zhang, Alan Yuille
TL;DR
Black-box transfer attacks benefit from ensembles, but acquiring and aggregating many diverse models is expensive. The paper proposes Ghost Networks, which generate virtual models through network erosion and combine them with longitudinal ensemble. The method improves transferability efficiently, including a large-margin advantage over the No.1 NeurIPS 2017 competition submission.
Problem
Ensemble attacks improve transferability, but independently training diverse models and intensively aggregating them makes large ensembles computationally expensive.
Method
Ghost Networks generate many virtual models by perturbing an existing base network, while longitudinal ensemble fuses them implicitly during attack iterations.
Results
The method improves adversarial-example transferability as a computationally cheap plug-in and outperforms the No.1 NeurIPS 2017 attack submission by a large margin.
Takeaways & Limitations
The approach supports single-model and multi-model attacks and is compatible with residual and non-residual network structures.
Takeaways & Limitations
The evaluation frames qualified intrinsic models as requiring low test error and diversity, and experiments assess these properties using the ILSVRC 2012 validation set.
Abstract
from arXiv · showhide
Recent development of adversarial attacks has proven that ensemble-based methods outperform traditional, non-ensemble ones in black-box attack. However, as it is computationally prohibitive to acquire a family of diverse models, these methods achieve inferior performance constrained by the limited number of models to be ensembled. In this paper, we propose Ghost Networks to improve the transferability of adversarial examples. The critical principle of ghost networks is to apply feature-level perturbations to an existing model to potentially create a huge set of diverse models. After that, models are subsequently fused by longitudinal ensemble. Extensive experimental results suggest that the number of networks is essential for improving the transferability of adversarial examples, but it is less necessary to independently train different networks and ensemble them in an intensive aggregation way. Instead, our work can be used as a computationally cheap and easily applied plug-in to improve adversarial approaches both in single-model and multi-model attack, compatible with residual and non-residual networks. By reproducing the NeurIPS 2017 adversarial competition, our method outperforms the No.1 attack submission by a large margin, demonstrating its effectiveness and efficiency. Code is available at https://github.com/LiYingwei/ghost-network.
Introduction
Black-box attacks rely on transferable adversarial examples, but ensemble methods are computationally expensive because they require independently trained, diverse models and intensive output fusion. Ghost Networks address this bottleneck by generating virtual models through network erosion and combining them with a longitudinal ensemble.
- Transferable adversarial examples exploit inputs that successfully attack different models in black-box settings.
- Ensemble-based attacks generally outperform non-ensemble attacks, but their computational cost typically limits competitions to about ten networks.The cost comes from independently training diverse models and intensively aggregating their outputs.
- Improving transferability without additional cost remains challenging because existing approaches inefficiently acquire and integrate information from multiple models.
- Ghost Networks generate vast numbers of virtual models by applying feature-level erosion to a base network on the fly.These models are neither stored nor independently trained.
- Longitudinal Ensemble implicitly fuses ghost networks during attack iterations instead of aggregating all model outputs at every iteration.This design addresses the complexity of standard ensemble attacks while retaining a large model pool.
- Experiments show improved transferability as a computationally cheap plug-in, with performance exceeding the No.1 NeurIPS 2017 adversarial-competition submission by a large margin.The method is also reported as compatible with single-model attacks, multiple network structures, attack methods, and adversarial settings.
Backgrounds
The background introduces iterative gradient-based attacks that update adversarial images under a perturbation constraint. Momentum I-FGSM additionally accumulates gradients to stabilize update directions and avoid poor local maxima.
- I-FGSM: I-FGSM iteratively learns an adversarial example by updating the input using the sign of its gradient.
- I-FGSM: The clipping operation keeps each generated adversarial example within the ϵ-ball around the original image.The iteration number is n and α denotes the step size.
- MI-FGSM: MI-FGSM integrates a momentum term into the attack process to stabilize update directions and escape poor local maxima.
- MI-FGSM: At each iteration, MI-FGSM uses the sign of the accumulated gradient to generate the next adversarial example.The momentum decay factor is denoted by µ.
Ghost Networks
Ghost Networks generate many virtual models from one trained network by perturbing intermediate features or skip connections, then use them to learn transferable adversarial examples. Dropout and skip-connection erosion control the perturbation magnitude, with larger erosion producing stronger changes to the base network.
- Ghost Networks seek adversarial examples I_adv = I + r that remain visually similar under ||r||∞ < ϵ while fooling the classifier.
- Dropout Erosion: At test time, dropout retains units through the Bernoulli mask and scales activations so the output matches the expected training-time output.The mask elements are sampled from Bernoulli(p), where p is the probability that an element is preserved.
- Dropout Erosion: Dropout erosion generates virtual models by applying feature-level dropout perturbations throughout a base network rather than only enabling default dropout layers.The method densely applies dropout to every block to increase diversity across feature levels.
- Dropout Erosion: The erosion magnitude Λ ranges from no perturbation at Λ = 0 to heavier erosion as Λ approaches 1, reducing the fraction of elements that can be back-propagated.Larger Λ therefore has a greater influence on the base network, especially in deeper networks.
- Dropout Erosion: Ghost networks can be repeatedly sampled from dropout perturbations to form a pool of models without independently training each network.Each sampled Bernoulli parameter set is applied to the base network to obtain another ghost network.
- Skip Connection Erosion: Skip-connection erosion replaces identity skip connections with randomized scalar modulation λ_l sampled from U[1 − Λ, 1 + Λ] after weights are learned.This perturbation is used to attack the model; the network is not trained using the randomized formulation.
MN M2
The proposed longitudinal ensemble replaces costly per-iteration fusion of all candidate networks with iteration-wise sampling of individual ghost networks. It preserves the multi-network attack prior while reducing duplicated computation and retaining compatibility with combined and multi-model attacks.
- Longitudinal Ensemble: Standard ensemble attacks average outputs or gradients from different networks, which becomes costly when Ghost Networks provide a large candidate pool.
- Longitudinal Ensemble: Longitudinal ensemble attacks one ghost network at iteration j, randomizing perturbations across iterations instead of fusing every model each time.This constructs an implicit ensemble during iterative attacks such as I-FGSM and MI-FGSM.
- Longitudinal Ensemble: Sampling one model per iteration removes duplicated computations while retaining the premise that attacking multiple networks can improve transferability.
- Longitudinal Ensemble: Ghost networks are neither stored nor trained, reducing additional time and space costs.
- Longitudinal Ensemble: Longitudinal ensemble can be combined with the standard ensemble and extended to multi-model attacks by treating each base model as a branch.
Experiments
Experiments evaluate Ghost Networks across single-model and multi-model black-box attacks, measuring attack rates, diversity, computational cost, and transferability across normally and adversarially trained networks. The results show that ghost networks provide diverse models cheaply and improve attack performance across settings.
- Experimental Setup: Ghost networks are generated from base models without training or storage, while preserving relatively low error rates.The method applies erosion to intermediate structures on the fly to create virtual models.
- Model Diversity: Ghost-network diversity is comparable to or greater than that of independently trained networks.Diversity is measured using averaged Jensen-Shannon Divergence across network pairs on the ILSVRC 2012 validation set.
- Single-model Attack: Longitudinally fusing ghost networks substantially improves black-box attack rates at nearly the base attack’s computational cost.The ghost networks are generated on the fly, and longitudinal ensemble replaces costly standard aggregation.
- Single-model Attack: Combining standard and longitudinal ensembles consistently outperforms the compared methods across black-box settings, but incurs the standard ensemble’s additional computational cost.The extra overhead comes from standard ensemble aggregation rather than longitudinal ensemble.
- Single-model Attack: The number of intrinsic models is essential for transferability, whereas independently training each model is less necessary.Increasing intrinsic models increases attack rate, and ghost networks provide a computationally cheap alternative.
- Same Architecture and Different Parameters: Using one base model with ghost networks beats three independently trained models by 6.70 for MI-FGSM in multi-model attack.The stronger setting fuses 30 intrinsic models despite using only one base model; three base models plus 30 intrinsic models perform best overall.
- Different Architectures: When holding out Res-50, Ghost Networks raise attack rates from 71.08 to 80.22 for I-FGSM and from 79.32 to 87.14 for MI-FGSM.Improvements are more notable when testing on the three adversarially trained networks.
- NeurIPS 2017 Adversarial Challenge: In the reproduced NeurIPS 2017 challenge setting, Ghost Networks improve average black-box performance from 33.57 to 39.59, a 6.02-point gain.The largest reported improvement is 9.08 on iyswim, suggesting generalization to other defense mechanisms.
Conclusion
The paper introduces ghost networks, virtual models generated through network erosion, combined with a coupled longitudinal ensemble to improve transferable adversarial examples efficiently.
- Ghost networks use network erosion to generate virtual models for improving transferable adversarial examples.The approach is presented as an effective and efficient tool for existing adversarial-example methods.
- The coupled longitudinal ensemble strategy works with ghost networks to improve adversarial-example transferability.
- Feature erosion could potentially extend to residual units and other layers, including batch normalization and ReLU.The paper leaves these extensions as future work.