Source-linked AI summary
Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, John E. Hopcroft
TL;DR
Existing adversarial attacks often transfer poorly to defended models in black-box settings. The paper introduces NI-FGSM and SIM, combines them with gradient-based attacks, and reports higher transferability and attack success rates on ImageNet, including 93.5% against adversarially trained models. The authors note that the reason for neural networks’ scale invariance remains unclear.
Problem
Existing attacks can achieve high white-box success but often have low black-box transferability, particularly against defense models.
Method
The paper adapts Nesterov accelerated gradients and scale-copy model augmentation into attacks, combining NI-FGSM and SIM into SI-NI-FGSM.
Results
93.5% average attack success rate was achieved by SI-NI-TI-DIM against adversarially trained models in the ImageNet black-box setting, with higher success rates than baseline attacks.
Takeaways & Limitations
NI-FGSM and SIM can be integrated with existing gradient-based attacks to produce more transferable adversarial examples against defended models.
Takeaways & Limitations
The reason why deep neural networks exhibit the scale-invariant property remains unclear.
Abstract
from arXiv · showhide
Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.
1 INTRODUCTION
Adversarial examples can transfer from a crafted model to unknown models, but existing attacks often transfer poorly against defended models. The paper proposes NI-FGSM and SIM to improve transferability and reports stronger black-box attack success.
- Black-box attacks often have low success rates against adversarially trained and input-modified defense models.
- The paper proposes NI-FGSM and SIM as optimization-based methods for improving adversarial-example transferability.
- NI-FGSM adapts Nesterov accelerated gradient to iterative attacks so updates can look ahead and improve transferability.
- SIM optimizes perturbations over scaled copies of input images to avoid overfitting the white-box model and generate more transferable examples.
- 93.5% average success rate was achieved by SI-NI-TI-DIM against adversarially trained models in the ImageNet black-box setting.
- The methods achieved higher attack success rates than existing baselines on normally trained and adversarially trained ImageNet models.
2 PRELIMINARY
The preliminary section reviews optimization-based and gradient-based attacks, their iterative and transferability enhancements, and major defense categories. It also notes the black-box transferability limitation of C&W attacks.
- Non-targeted attacks maximize classifier loss within an ℓ∞-bounded perturbation region around a benign image.
- FGSM generates adversarial examples with a one-step loss-maximizing update, while I-FGSM applies smaller updates iteratively.
- PGD begins from a random point within the allowed norm ball and then performs several I-FGSM iterations.
- MI-FGSM adds momentum to iterative attacks, and DIM optimizes over randomly resized and padded input transformations to improve transferability.
- TIM optimizes perturbations over translated images and can be combined with DIM; TI-DIM is described as the strongest current black-box attack.
- C&W directly optimizes distance between benign and adversarial examples, but its transferability is limited in black-box attacks.
- Defense methods are grouped into adversarial training, which augments training data, and input modification, which alters inputs to mitigate perturbations.
3 METHODOLOGY
The methodology treats adversarial-example generation as optimization and improves transferability through a better optimization algorithm and model augmentation. NI-FGSM looks ahead during gradient updates, while SIM attacks scale-derived models and can combine with other transferability methods.
- Optimization perspective: The paper maps transferability improvements to optimization strategies: better optimization algorithms and model augmentation.This parallels improving model generalization through optimization and data augmentation.
- NI-FGSM: NI-FGSM integrates Nesterov accelerated gradient into iterative attacks by jumping along accumulated gradients before computing each iteration’s gradient.The look-ahead update is intended to stabilize and correct update directions and improve transferability.
- Model augmentation: Model augmentation derives multiple attack models from one model using loss-preserving transformations, avoiding the cost of training an ensemble.The resulting ensemble attack is intended to improve transferability by attacking multiple models simultaneously.
- SIM: SIM uses the observed scale-invariant property of deep networks to optimize perturbations over scale copies of the input image.For scale factor 1/2^i, S_i(x)=x/2^i; SIM uses these copies as augmented models and aims to avoid overfitting to the white-box model.
- Combined attacks: NI-FGSM and SIM combine into SI-NI-FGSM, and the attack further integrates with DIM, TIM, and TI-DIM to boost transferability.The resulting variants include SI-NI-DIM, SI-NI-TIM, and SI-NI-TI-DIM.
4 EXPERIMENTAL RESULTS
Experiments on ImageNet evaluate scale-invariant and Nesterov-based attacks across normally trained, adversarially trained, and other defense models. The proposed methods consistently improve black-box transferability over baselines while retaining nearly perfect white-box success.
- Experimental setup: The evaluation uses 1,000 ImageNet validation images, four normally trained models, three adversarially trained models, and additional advanced defenses.The setup includes Inc-v3, Inc-v4, IncRes-v2, Res-101, Inc-v3ens3, Inc-v3ens4, IncRes-v2ens, HGD, R&P, NIPS-r3, FD, Comdefend, and RS.
- Scale-invariant property: Losses remain smooth and stable for scale sizes from 0.1 to 1.3, supporting optimization over scaled copies of each input image.The study measures average loss over 1,000 images across Inc-v3, Inc-v4, IncRes-v2, and Res-101.
- Ensemble attacks: Across multimodel experiments, the proposed attacks improve success rates over baselines by 10%–30% in black-box settings.SI-NI-TI-DIM achieves a 93.5% average success rate against adversarially trained models.
- Advanced defenses: SI-NI-TI-DIM reaches a 90.3% average attack success rate against advanced defenses, surpassing state-of-the-art attacks by 14.7%.The adversarial examples are crafted on an ensemble of normally trained models and then evaluated against advanced defenses.
- Further analysis: NI-FGSM yields higher transfer attack success than MI-FGSM at the same iteration count and requires fewer iterations to reach the same success rate.The comparison crafts examples on Inc-v3 and transfers them to Inc-v4 and IncRes-v2.
- Further analysis: Against classic attacks, the proposed methods achieve 100% white-box success and significantly outperform other methods in black-box settings.The comparison includes FGSM, I-FGSM, PGD, and C&W.
5 CONCLUSION AND FUTURE WORK
The paper concludes that NI-FGSM and SIM improve adversarial-example transferability, and that their combinations achieve higher success rates against defended models. It also identifies unresolved questions about momentum-method extensions and why scale invariance holds.
- The proposed NI-FGSM and SIM improve adversarial-example transferability and can be combined into SI-NI-FGSM.Integrating SI-NI-FGSM with baseline attacks can further improve transferability.
- Experiments show higher success rates on adversarially trained models and attacks that break other strong defense mechanisms.
- Future work: The authors suggest investigating other momentum methods, such as Adam, for gradient-based iterative attacks.They identify migration of optimization methods into iterative attacks as a key future-work question.
- Future work: The reason deep neural networks exhibit scale-invariant behavior remains unclear, with batch normalization offered as a possible explanation.The authors plan to investigate this explanation more thoroughly.
A DETAILS OF THE ALGORITHMS
Algorithm 2 generates SI-NI-TI-DIM adversarial examples by combining look-ahead updates, gradients from scaled inputs, input transformations, gradient convolution, and momentum accumulation.
- Algorithm variants: Removing Step 10 yields SI-NI-DIM, while removing the transformation T(·; p) in Step 7 yields SI-NI-TIM.
- Inputs and output: The algorithm takes a clean example, classifier and loss function, perturbation size ϵ, iteration count T, scale-copy count m, and decay factor µ, then outputs xadv.
- Iterative update: Each iteration first computes xnes_t by making a jump in the direction of previously accumulated gradients.
- Scale and input transformations: The method sums gradients over m scale copies of the look-ahead input and optionally applies random resizing and padding with probability p.
- Gradient processing: The algorithm convolves the gradients with a predefined kernel W, updates accumulated gradients using decay factor µ, and updates xadv.
B VISUALIZATION OF ADVERSARIAL EXAMPLES
The paper visualizes benign images alongside adversarial images generated with SI-NI-TI-DIM on an ensemble of four models. The reported perturbations are human imperceptible.
- The visualization contains 12 randomly selected benign images and their corresponding adversarial images.
- The adversarial images are crafted on an ensemble comprising Inc-v3, Inc-v4, IncRes-v2, and Res-101 using SI-NI-TI-DIM.
- The generated adversarial perturbations are reported to be human imperceptible.