FDA: Feature Disruptive Attack

1. Introduction

• The paper frames the problem against evidence that DNNs are vulnerable to imperceptibly perturbed inputs, with transferable attacks raising concern for decision-critical applications.The introduction cites autonomous driving as an example application.Source: §1 · p. 1
• Existing attacks optimized against pre-softmax or softmax outputs can change predictions while deep features retain clean-sample semantics.Those retained features may still serve feature-driven tasks such as caption generation and style transfer.Source: §1 · pp. 1–2
• OLNR and NLOR quantify attack damage, including cases where the new prediction is semantically distant or the original label retains comparatively high probability.The introduction also identifies fooling rate at kth rank as a statistic for these outcomes.Source: §1 · p. 2
• FDA perturbs features at every network layer to corrupt deep representations and degrade network performance.The introduction contrasts FDA's feature inversion with PGD's inversion, which remains similar to the clean sample.Source: Figure 1 · p. 1, §1 · p. 2
• The authors identify drawbacks in existing attacks and propose FDA to disrupt features, while reporting applications to caption generation and style transfer.They also present FDA as effective in a gray-box setup without access to the task-specific network or methodology.Source: §1 · p. 2
• FDA produces stronger ImageNet white-box adversaries than other attacks, including against state-of-the-art classifiers and defenses.The introduction also reports stronger attacks on caption generation and style transfer, including a gray-box setting without task-specific network or methodology access.Source: §1 · p. 2

Attacks

• Earlier adversarial-sample work spans multiple generation techniques, while other studies examine adversarial samples in tasks beyond image classification.The passage cites Szegedy et al. [49] on adversarial samples and [36] [57] on other tasks.Source: §2 · p. 2
• Unlike Zhou et al., Sabour et al. [43], and Mopuri et al. [41], FDA targets disruption at every layer without a target representation and produces image-specific adversaries.The paper contrasts its objective with Zhou et al.'s multiple objectives, Sabour et al.'s [43] target-layer matching, and Mopuri et al.'s [41] universal perturbation setup.Source: §2 · p. 2

Defenses

• Adversarial training and input transformations are among the defenses surveyed, including randomized transformations proposed by Xie et al. [56].The passage also notes defenses designed for large-scale datasets such as ImageNet.Source: §2 · pp. 2–3

Feature Visualization

• Feature inversion methods reconstruct approximate inputs from feature representations, using optimization with regularization or learned image priors.The paper cites Mahendran et al. [34] for optimization-based inversion and Dosovitskiy et al. [18] for a neural-network approach.Source: §2 · p. 3

Feature-based Tasks

• FDA damages feature-based tasks without task-specific information, whereas previous attacks can leave adversarial samples useful for those tasks.The paper identifies captioning and image retrieval as tasks relying on DNN feature extraction, and style transfer as another deep-feature task.Source: §2 · p. 3

3. Preliminaries

• An adversarial sample changes the prediction from the ground-truth label while remaining within an imperceptibility constraint, typically measured with l2 or l∞ distance.Source: §3 · p. 3
• Many attacks maximize cross-entropy against the ground-truth label; FGSM uses one step, while PGD and I-FGSM use multistep signed-gradient ascent.Momentum and ADAM are also used to maximize the objective.Source: §3 · p. 3
• Most-likely attacks substitute the predicted label after label leaking, while least-likely variants minimize loss against the least-probable class.The cited work motivates least-likely attacks as a way to avoid errors into semantically similar classes.Source: §3 · p. 3
• Carlini et al. [13] identify one objective as strongest; combining it with PGD yields PGD-CW for an l∞ distance metric adversary.Source: §3 · p. 3
• Feature inversion seeks a sample whose representation most closely matches a given representation, using Mahendran et al. [34] and Laplacian pyramid gradient normalization.The paper cites for the feature-inversion formulation.Source: §3 · p. 3

4.1. Drawbacks of existing attacks

• PGD-LL adversarial features invert to representations remarkably similar to the clean sample, illustrating retained high-level semantic information.Feature inversion is shown layer by layer for VGG-16 trained on ImageNet.Source: §4.1 · pp. 3–4

4.2. Proposed evaluation metrics

• NLOR measures the new label’s rank before the attack, while OLNR measures the old label’s rank after it.The metrics capture whether an attack selects a previously low-ranked class and reduces confidence in the clean prediction, which fooling rate alone misses.Source: §4.2 · p. 4

4.3. Proposed attack

• FDA seeks to disrupt features at each layer by lowering activations supporting the current prediction and strengthening activations that do not support it.The attack uses high activations as a usable approximation to prediction-support, with a central-tendency threshold; spatial-mean across channels is reported as most effective.Source: §4.3 · pp. 4–5
• FDA optimizes a layer objective for each nonlinearity and combines the per-layer objectives into the attack.The method’s overview depicts optimization for each selected feature blob and identifies the support set in red, with the remaining spatial feature in blue.Source: §4.3 · p. 5, Figure 3 · p. 5

5.1. Statistical analysis of adversarial features

• With equal optimization budgets, FDA produces much higher intermediate-feature cosine distance and stronger pre-logit dissimilarity, while other attacks' pre-logits can still provide useful information for feature-based tasks.The pre-logit comparisons use cosine and normalized-rank-transformation distances across multiple architectures.Source: §5.1 · pp. 5–6, Table 1 · p. 6

5.2. Attack on Image Recognition

• FDA's generalizable fooling rate is significantly higher at high K; Table 2 also shows other attacks achieve only partial success on NLOR and OLNR.Figure 5 reports fooling rate at the K-th rank across four ImageNet-trained architectures.Source: §5.2 · p. 6, Figure 5 · p. 7, Table 2 · p. 7

5.3. Evaluation against Defense proposals

• FDA outperforms other attacks in white-box tests against adversarially trained models and input-transformation defenses.The evaluations include Simple, Ensemble, and adversarial-logit-pairing training, as well as input-transformation defenses.Source: §5.3 · p. 6, Table 2 · p. 7, Table 3 · p. 7

5.4.1 Caption Generation

• In gray-box SAT, FDA effectively disrupts captioning and content-specific metrics degrade more; white-box performance is comparable to task-specific Hongge et al. [14].The gray-box attack uses adversaries generated from ImageNet-trained Inception-V3 against a fine-tuned SAT model.Source: §5.4.1 · p. 6, Table 5 · p. 8, Table 6 · p. 8

5.4.2 Style-transfer

• FDA disrupts style transfer without task-specific knowledge; unlike PGD, it also applies to Johnson et al.'s [25] single-pass network, which lacks final-layer loss gradients.The paper also reports supplementary qualitative results for disrupting stylized videos.Source: §5.4.2 · p. 8, Figure 6 · p. 8

• Softmax- or pre-softmax-based attacks can retain clean-sample information even when adversarial samples are misclassified with high confidence.Source: §6 · p. 8
• FDA corrupts features at each network layer and is experimentally validated as one of the strongest white-box adversaries.Source: §6 · p. 8
• FDA adversarial features do not allow useful information extraction for feature-based tasks such as style transfer and caption generation.Source: §6 · p. 8