PaperlayerView exact revision on arXiv

Source-linked AI summary

Curls & Whey: Boosting Black-Box Adversarial Attacks

Yucheng Shi, Siyu Wang, Yahong Han

arXiv:1904.01160v1cs.CV

TL;DR

Black-box iterative attacks can lack trajectory diversity and retain redundant perturbation noise. Curls & Whey combines two-direction updates with noise refinement and interpolation for targeted attacks; experiments report smaller ℓ2 perturbations and stronger transferability than existing iterative attacks.

  • Problem

    Black-box iterative attacks based on substitute models follow monotonic gradient-ascent paths despite differing model boundaries, and can retain redundant noise.

    Source: §3.2 · p. 3

  • Method

    Curls & Whey combines ascent and descent in Curls iteration, refines perturbations with Whey optimization, and integrates interpolation for targeted attacks.

    Source: §1 · pp. 1–2

  • Results

    On ImageNet and Tiny-ImageNet, Curls & Whey generates smaller ℓ2 distances and stronger transferability than existing iterative attacks.

    Source: §1 · p. 2, §5 · p. 9

  • Takeaways & Limitations

    The approach shows transferability against ensemble and adversarially trained models and extends iterative attacks to targeted black-box misclassification.

    Source: §1 · p. 2

    The paper evaluates noise magnitude in ℓ2 norm and uses a substitute model to address the target model’s lack of backpropagation access.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

Image classifiers based on deep neural networks suffer from harassment caused by adversarial examples. Two defects exist in black-box iterative attacks that generate adversarial examples by incrementally adjusting the noise-adding direction for each step. On the one hand, existing iterative attacks add noises monotonically along the direction of gradient ascent, resulting in a lack of diversity and adaptability of the generated iterative trajectories. On the other hand, it is trivial to perform adversarial attack by adding excessive noises, but currently there is no refinement mechanism to squeeze redundant noises. In this work, we propose Curls & Whey black-box attack to fix the above two defects. During Curls iteration, by combining gradient ascent and descent, we `curl' up iterative trajectories to integrate more diversity and transferability into adversarial examples. Curls iteration also alleviates the diminishing marginal effect in existing iterative attacks. The Whey optimization further squeezes the `whey' of noises by exploiting the robustness of adversarial perturbation. Extensive experiments on Imagenet and Tiny-Imagenet demonstrate that our approach achieves impressive decrease on noise magnitude in l2 norm. Curls & Whey attack also shows promising transferability against ensemble models as well as adversarially trained models. In addition, we extend our attack to the targeted misclassification, effectively reducing the difficulty of targeted attacks under black-box condition.

1. Introduction

Curls & Whey addresses black-box iterative attacks’ monotonic trajectories and redundant perturbation noise. It combines two-direction Curls iteration with Whey refinement and extends the approach to targeted attacks.

1. Introduction

  • Black-box iterative attacks struggle because substitute- and target-model decision boundaries differ, while monotonic gradient-ascent paths can leave redundant noise.The introduction identifies a need for post-iteration refinement to remove that noise.Source: §1 · p. 1
  • On ImageNet and Tiny-ImageNet, Curls & Whey produces smaller ℓ2 perturbations and stronger transferability than existing iterative attacks under the same query limitation.The paper also reports transferability against ensemble and adversarially trained models.Source: §1 · p. 2
  • The attack extends to targeted black-box misclassification by integrating interpolation into the iterative process.The authors report that this significantly decreases the difficulty of targeted misclassification.Source: §1 · p. 2
  • Curls iteration combines gradient ascent and descent to diversify trajectories and improve adversarial-example transferability.The approach also weakens the diminishing marginal effect of monotonically adding noise along gradient ascent.Source: §1 · pp. 1–2
  • Whey optimization exploits perturbation robustness to squeeze redundant noise after iterative attack generation.The method groups perturbations by pixel value, filters each group, and then stochastically distills pixels.Source: §1 · p. 2

2. Related Work

Related work covers one-step and iterative gradient attacks, along with methods that modify iterative updates or improve transferability. It also describes adversarial training and model ensembles as defenses.

2. Related Work

  • In black-box attacks, querying the target model and transferring adversarial examples from a substitute model is one practical approach.Transferability refers to examples generated by one model fooling another.Source: §2 · p. 2
  • FGSM is presented as a classical one-step attack that calculates a noise direction from the cross-entropy gradient.The supplied discussion introduces its gradient calculation.Source: §2 · p. 2
  • I-FGSM adds small noise steps toward an upper noise bound, but further iterations yield little attack-effect improvement as t rises and α falls.The text notes that I-FGSM has the highest attack effect among current iterative attacks in white-box settings.Source: §2 · p. 2
  • MI-FGSM smooths noise-direction adjustments with momentum, while the diminishing marginal effect of iteration steps remains.Source: §2 · p. 2
  • vr-IGSM averages gradients over Gaussian-noised images to reduce local fluctuations and improve transferability.The related-work section also identifies adversarial training and model ensembles as widely used defenses.Source: §2 · p. 2

3. Curls & Whey Attack

Curls & Whey combines a more adaptable iterative attack with a refinement stage to reduce perturbation while retaining adversarial examples. The section also describes an interpolation-based initialization for targeted black-box attacks.

3.1. Notation

  • The attack measures perturbation in ℓ2 norm and uses a substitute model because the target model cannot be back propagated.A successful attack aims to change the target model’s classification with as little noise as possible.Source: §3.1 · pp. 2–3

3.2. Diminishing Marginal Effect on Iteration Steps

  • Black-box monotone ascent can miss the target boundary across model discrepancies, while increasing iteration counts eventually yields little noise reduction.The authors attribute the diminishing effect to shorter steps and increasingly smooth, convergent trajectories.Source: §3.2 · p. 3

3.3. Curls Iteration

  • Curls replaces monotone ascent with a descent-then-ascent path guided by target-model loss, aiming to diversify trajectories and cross target boundaries.It also uses an average direction across adversarial examples to guide the first step of an iteration round.Source: §3.3 · pp. 3–4

3.4. Whey Optimization

  • Whey groups perturbation pixels by value, halves a selected group, and checks whether the example remains adversarial before accepting the reduction.It then performs a finer-grained squeeze by setting pixel values to zero with probability δ.Source: §3.4 · pp. 4–5

3.5. Targeted Attack

  • For targeted attacks, the method interpolates between the original image and a target-class image, then uses binary search to find a target-class starting point.The interpolation coefficient is determined by binary search, after which the starting point guides the first gradient-ascent step.Source: §3.5 · p. 5

4. Experiments

Experiments compare Curls & Whey with other attacks across ImageNet and Tiny-ImageNet, multiple models, and targeted and untargeted settings. The method generally reduces black-box perturbation magnitude, and the ablations examine its components and parameter choices.

4.1. Experiment Settings

  • Experiments evaluate black-box iterative attacks using 10,000 ImageNet validation images correctly classified by all target models and 2,000 Tiny-ImageNet images, comparing eight neural-network architectures.A smaller ℓ2 distance indicates a stronger attack effect and higher transferability.Source: §4.1 · pp. 5–6

4.2. Black-box Attack on Multiple Models

  • Curls & Whey achieves smaller median ℓ2 noise magnitude than other methods on black-box attacks, with reductions of 20%–30% and sometimes 40% across most model combinations.The comparison covers off-diagonal substitute-to-target model pairs.Source: Table 1 · p. 6, §4.2 · p. 6

4.3. Ablation Study

  • Curls iteration, binary search, and both Whey optimization steps each reduce noise magnitude; iteration gains diminish at higher T, while s has a local optimum near 10 and relatively small bs suffices.For the inception-resnet v2 substitute and inception v3 target, the reported local optimum for s is around 10.Source: §4.3 · p. 7

4.4. Targeted Attack Results

  • For targeted black-box attacks, Curls & Whey reduces noise magnitude relative to three decision-based attacks and addresses the difficulty of targeted misclassification with interpolation.The experiments use five target categories per image and compare resnet18 and inceptionv3 as substitute models.Source: §4.4 · p. 8, Figure 6 · p. 8

4.5. Attack on Defence and Ensemble Models

  • Against adversarially trained models and an ensemble, Curls & Whey still produces adversarial examples with lower noise magnitude than other attacks.The reported setup uses resnet18 as the substitute model.Source: §4.5 · pp. 8–9, Table 4 · p. 8

5. Conclusion

Curls & Whey combines trajectory-diversifying Curls iteration with noise-squeezing Whey optimization, and integrates interpolation to reduce the difficulty of targeted black-box attacks. On Tiny-ImageNet and ImageNet, it generates adversarial examples with smaller ℓ2 distance and stronger transferability than existing iterative attacks across a variety of target models.

5. Conclusion

  • Curls & Whey combines Curls iteration and Whey optimization, and integrates interpolation for targeted black-box attacks; experiments report smaller ℓ2 distances and stronger transferability than existing iterative attacks.The reported experiments cover Tiny-ImageNet and ImageNet and a variety of target models.Source: §5 · p. 9

Supplemental Material

The supplemental material presents additional experimental results and adversarial examples, including untargeted black-box attacks on ImageNet and targeted black-box attacks on Tiny-ImageNet.

Supplemental Material

  • Supplemental results include untargeted black-box attacks on ImageNet, targeted black-box attacks on Tiny-ImageNet, and adversarial examples from both datasets.Source: Supplemental Material · p. 11

A. Untargeted Attack

On ImageNet, Curls & Whey has smaller median ℓ2 perturbation magnitude than the compared methods in black-box model pairs, while its white-box results are weaker than some methods.

A. Untargeted Attack

  • On ImageNet, Curls & Whey achieves smaller median ℓ2 perturbation magnitude than FGSM, I-FGSM, MI-FGSM, and vr-IGSM in black-box (off-diagonal) attacks across four models.The 4×4 comparisons use 1,000 × 10 validation images, with 10 images per category. With Gaussian noise, Curls & Whey and vr-IGSM perform less well on white-box (diagonal) results.Source: A. Untargeted Attack · p. 11

B. Targeted Attack

For targeted black-box attacks on Tiny-Imagenet, Curls & Whey is reported to reduce perturbation magnitude substantially compared with other methods. Table 6 reports median and average ℓ2 distances.

B. Targeted Attack

  • Curls & Whey significantly reduces targeted black-box perturbation magnitude compared with the other methods evaluated.The comparisons use median and average perturbation distances on Tiny-Imagenet.Source: B. Targeted Attack · p. 11, Table 6 · p. 12
  • Table 6 reports median and average ℓ2 perturbation distances for targeted attacks on Tiny-Imagenet.The evaluation uses 200 × 10 images, with 10 images per category, and compares four DNN models.Source: B. Targeted Attack · p. 11, Table 6 · p. 12
  • The targeted examples show three different added noises taking each original image into three other categories.Figure 8 presents the original image, target-category images, noises, and adversarial examples in each group.Source: Figure 8 · p. 14

Related papers

Loading 1904.01160v1…