Source-linked AI summary
Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
Yinpeng Dong, Tianyu Pang, Hang Su, Jun Zhu
TL;DR
Transferable adversarial examples enable black-box attacks, but several defenses claim resistance because they use different discriminative regions. The paper introduces a translation-invariant attack that optimizes over translated images and efficiently approximates this process with gradient convolution. On ImageNet, the best attack achieved an 82% average success rate against eight state-of-the-art defenses using transferability alone.
Problem
Several state-of-the-art defenses are reported to resist transferable adversarial examples, making them difficult to evade through black-box attacks.
Method
The method optimizes perturbations over translated versions of an image and efficiently implements this using a predefined-kernel convolution of the gradient, integrating with gradient-based attacks.
Results
82% average success rate was achieved against eight state-of-the-art defenses on ImageNet using transferability alone.
Takeaways & Limitations
Translation-invariant attacks improve transferability against defense models and demonstrate the insecurity of the evaluated defenses.
Takeaways & Limitations
The efficient gradient calculation assumes near translation invariance for very small shifts, with the stated setting restricting translations to no more than 10 pixels per dimension.
Abstract
from arXiv · showhide
Deep neural networks are vulnerable to adversarial examples, which can mislead classifiers by adding imperceptible perturbations. An intriguing property of adversarial examples is their good transferability, making black-box attacks feasible in real-world applications. Due to the threat of adversarial attacks, many methods have been proposed to improve the robustness. Several state-of-the-art defenses are shown to be robust against transferable adversarial examples. In this paper, we propose a translation-invariant attack method to generate more transferable adversarial examples against the defense models. By optimizing a perturbation over an ensemble of translated images, the generated adversarial example is less sensitive to the white-box model being attacked and has better transferability. To improve the efficiency of attacks, we further show that our method can be implemented by convolving the gradient at the untranslated image with a pre-defined kernel. Our method is generally applicable to any gradient-based attack method. Extensive experiments on the ImageNet dataset validate the effectiveness of the proposed method. Our best attack fools eight state-of-the-art defenses at an 82% success rate on average based only on the transferability, demonstrating the insecurity of the current defense techniques.
1. Introduction
Adversarial examples threaten security-sensitive applications, while transferability enables black-box attacks. The paper proposes translation-invariant attacks to evade defenses that rely on different discriminative regions, achieving substantially higher transfer-based attack success.
- Adversarial examples use small perturbations to induce unreasonable predictions and raise security concerns in applications including self-driving, healthcare, and finance.
- Transferability lets adversarial examples crafted for one model fool another, enabling practical black-box attacks against real-world systems.
- Several defenses claim resistance to transferable adversarial examples, making them difficult to evade through black-box attacks.
- Defense models rely on different discriminative regions and attention maps than normally trained models, which can affect adversarial-example transferability.
- The proposed translation-invariant attack optimizes over an ensemble of translated images to reduce sensitivity to the white-box model’s discriminative regions and improve transferability.The method can be implemented by convolving the untranslated-image gradient with a predefined kernel and combined with gradient-based attacks at similar computational complexity.
- 82% average success rate was achieved against eight state-of-the-art defenses using transferability alone on ImageNet.
2. Related Work
Related work covers adversarial examples, transfer-based and query-based black-box attacks, ensemble-based perturbation methods, and defenses against adversarial attacks. This paper focuses on transfer-based black-box attacks for image classification.
- Adversarial examples: Adversarial examples have been studied for high attack success, small perturbations, and physical-world settings, while this paper focuses on image classification.
- Black-box attacks: Transferability supports black-box attacks without model parameters or gradients, whereas query-based approaches can require many impractical queries.
- Attacks for an ensemble of examples: Prior work generates adversarial perturbations over entire data distributions or transformation distributions, with the proposed method differing in its objectives and design.
- Defenses against adversarial attacks: Defense research includes robustness training, input transformations, certified defenses, and adversarial-example detection, while non-certified defenses may rely on obfuscated gradients.
3. Methodology
The methodology generates adversarial examples by optimizing over translated versions of an image, reducing sensitivity to the white-box model’s discriminative regions. It efficiently integrates this translation-invariant gradient with existing gradient-based attacks through kernel convolution.
- Translation-Invariant Attack: The attack optimizes a perturbation over an ensemble of translated images rather than a single input.Translations shift each pixel by i and j pixels, with weighted losses over the translated images.
- Translation-Invariant Attack: The translation-invariant objective makes adversarial examples less sensitive to the white-box model’s discriminative regions, potentially improving transfer to defense models.The method targets the mismatch between discriminative regions used by normally trained and defense models.
- Gradient Calculation: The efficient implementation convolves the gradient at the untranslated image with a kernel under a small-translation assumption.The assumption treats convolutional networks as approximately translation-invariant for shifts of no more than 10 pixels per dimension.
- Kernel Matrix: Kernel weights can be chosen uniformly, linearly, or with a Gaussian design, while larger shifts receive relatively lower weights under the stated design principle.The kernel has size (2k + 1) × (2k + 1), and the three choices are compared empirically.
- Attack Algorithms: The method can be combined with gradient-based attacks including FGSM, BIM, and MI-FGSM by convolving each current gradient before updating the adversarial example.For TI-FGSM and TI-BIM, the convolved gradient is used within the corresponding attack update rule.
4. Experiments
Experiments on ImageNet evaluate translation-invariant attacks across kernels, kernel sizes, attack algorithms, and defense models. The method consistently improves black-box transfer success, with smoother perturbations and an average 82% success rate for TI-DIM against eight defenses.
- Experimental Settings: Experiments use 1,000 ImageNet-compatible images and eight defense models, integrating translation invariance with FGSM, MI-FGSM, and DIM.The attacks are evaluated through black-box transferability against ensemble, denoising, input-transformation, and competition defenses.
- Translation-Invariant Property: Loss surfaces remain generally smooth for translations from −10 to 10 pixels in each dimension, supporting the small-translation assumption used by the attacks.The study evaluates Inc-v3, Inc-v4, IncRes-v2, and Res-v2-152 on translated images.
- The Results of Different Kernels: Linear kernels outperform uniform and Gaussian kernels for TI-FGSM, while Gaussian kernels match or exceed linear kernels for TI-MI-FGSM and TI-DIM.Both linear and Gaussian kernels are more effective than the uniform kernel, so the experiments use the Gaussian kernel afterward.
- The Effect of Kernel Size: Success rates initially increase with kernel size and stabilize beyond 15 × 15, which becomes the selected kernel size for subsequent experiments.The ablation attacks Inc-v3 with Gaussian kernels ranging from length 1 to 21 against five defenses.
- Single-Model Attacks: Translation-invariant attacks improve defense-attack success rates by 5% ∼30% across attack algorithms and white-box models, with TI-DIM reaching about 60% against defenses when attacking IncRes-v2.The method also produces smoother perturbations because gradients are convolved with a kernel before updating the image.
- Ensemble-based Attacks: TI-DIM fools eight state-of-the-art defenses at an average 82% success rate using adversarial examples generated for normally trained models unaware of the defenses.This evaluation is based only on transferability and is reported as evidence that the defenses are not secure against these attacks.
5. Conclusion
The paper concludes that translation-invariant attacks produce adversarial examples less sensitive to white-box discriminative regions and more transferable against defenses. TI-DIM fools eight state-of-the-art defenses with an average success rate of 82%.
- The proposed method optimizes adversarial images over translated versions and can be integrated into any gradient-based attack method.Its efficient implementation convolves the gradient with a pre-defined kernel under an assumption.
- 82% average success rate is achieved by TI-DIM against eight state-of-the-art defenses, using examples generated against four normally trained models.
- The results identify vulnerabilities in current defenses and raise security issues for developing more robust deep learning models.
Appendix
The appendix evaluates the proposed attacks across normally trained models and defense models under multiple attack combinations and norm settings. It also reports that the method remains effective under an L2 norm bound.
- Experiments on normally trained models: The experiments compare FGSM, TI-FGSM, MI-FGSM, TI-MI-FGSM, DIM, and TI-DIM across four source models and six normally trained target models.The source models are Inc-v3, Inc-v4, IncRes-v2, and Res-v2-152; the target models additionally include VGG-16 and Res-v1-152.
- L2 norm experiments: The proposed method is also evaluated under an L2 norm bound with maximum perturbation ϵ = 10·√d, where d is the input-image dimension.The appendix presents corresponding results for FGSM, MI-FGSM, DIM, and ensemble attacks.
- L2 norm experiments: The L2-norm experiments also show the effectiveness of the proposed method.
- Black-box attacks against defenses: The appendix evaluates black-box success rates against eight defenses for FGSM, MI-FGSM, DIM, and their translation-invariant variants.The attacks are crafted from individual source models and from an ensemble of four source models.