PaperlayerView exact revision on arXiv

Source-linked AI summary

Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets

Dongxian Wu, Yisen Wang, Shu-Tao Xia, James Bailey, Xingjun Ma

arXiv:2002.05990v1cs.LGcs.CRcs.CVstat.ML

TL;DR

Existing transfer attacks largely treat neural networks as undifferentiated components, leaving architectural effects on adversarial transferability underexplored. The paper proposes SGM, which emphasizes skip-connection gradients using a decay factor. Across broad transfer-attack experiments, SGM substantially improves transferability and can be combined with existing techniques.

  • Problem

    Prior transfer techniques ignore internal DNN architectural characteristics, leaving whether architecture exposes greater adversarial-example transferability unexplored.

  • Method

    SGM generates adversarial examples by emphasizing gradients from skip connections over residual modules through a decay factor.

  • Results

    SGM greatly improves adversarial-example transferability across comprehensive attacks against unsecured and secured DNNs, including when combined with existing transfer techniques.

  • Takeaways & Limitations

    Skip connections can expose highly transferable adversarial examples, motivating research into architectural vulnerability and secure DNN design.

Abstract

from arXiv · show

Skip connections are an essential component of current state-of-the-art deep neural networks (DNNs) such as ResNet, WideResNet, DenseNet, and ResNeXt. Despite their huge success in building deeper and more powerful DNNs, we identify a surprising security weakness of skip connections in this paper. Use of skip connections allows easier generation of highly transferable adversarial examples. Specifically, in ResNet-like (with skip connections) neural networks, gradients can backpropagate through either skip connections or residual modules. We find that using more gradients from the skip connections rather than the residual modules according to a decay factor, allows one to craft adversarial examples with high transferability. Our method is termed Skip Gradient Method(SGM). We conduct comprehensive transfer attacks against state-of-the-art DNNs including ResNets, DenseNets, Inceptions, Inception-ResNet, Squeeze-and-Excitation Network (SENet) and robustly trained DNNs. We show that employing SGM on the gradient flow can greatly improve the transferability of crafted attacks in almost all cases. Furthermore, SGM can be easily combined with existing black-box attack techniques, and obtain high improvements over state-of-the-art transferability methods. Our findings not only motivate new research into the architectural vulnerability of DNNs, but also open up further challenges for the design of secure DNN architectures.

1 INTRODUCTION

Skip connections expose an architectural weakness that can make adversarial examples more transferable. The paper proposes SGM, which emphasizes skip-connection gradients and improves transfer attacks across models and techniques.

  • Skip connections preserve low-level features and support deeper DNNs, but their architectural role in adversarial transferability was previously unexplored.
  • 62.10% black-box success improved from 52.52% when the attack skipped the last two residual modules in ResNet-18.The toy experiment used BIM on 5000 ImageNet validation images with maximum L∞ perturbation ϵ = 16 and tested black-box transfer against VGG19.
  • SGM crafts adversarial examples by using more gradients from skip connections than residual modules through a single decay factor.The decay factor reduces gradients from residual modules, making SGM simple and compatible with existing gradient-based attacks.
  • The findings identify skip connections as a security weakness and motivate research on architectural vulnerability and secure DNN design.
  • Comprehensive experiments against 10 state-of-the-art DNNs show that SGM greatly improves adversarial-example transferability.Combining SGM with existing transfer techniques also improves state-of-the-art transferability benchmarks by a large margin.

2 RELATED WORK

Related work distinguishes white-box, black-box, and transfer attacks, while prior transfer methods largely ignore internal architectural characteristics. This paper addresses that gap by directly exploiting skip connections.

  • White-box attacks access target-model parameters, whereas black-box attacks operate without information about the target model.
  • Adversarial examples seek incorrect predictions while remaining within an ϵ-ball around a clean input.
  • FGSM uses one gradient-sign step, while BIM iteratively perturbs the input for T steps with step size ϵ/T.
  • PGD iteratively perturbs inputs and projects them back onto the ϵ-ball, allowing step size α > ϵ/T unlike BIM.
  • Other approaches target sparsity, optimization objectives, or intermediate feature representations to improve adversarial transferability.
  • Transfer methods such as momentum, diverse input, and translation invariance improve black-box attacks but treat networks as single components.
  • Existing techniques do not directly consider different DNN architectural characteristics, leaving skip-connection effects as an unexplored transferability factor.

3 PROPOSED SKIP GRADIENT ATTACK

The paper decomposes gradients in ResNet-like networks into skip-connection and residual-module paths, then uses a decay factor to emphasize skip gradients when crafting adversarial examples. In a case study, this SGM adjustment substantially improves black-box transferability across source architectures.

  • 3.1 GRADIENT DECOMPOSITION WITH SKIP CONNECTIONS: ResNet-like networks can be decomposed into paths of different lengths because identity skip connections bypass residual layers.A residual block combines a skip connection with its associated residual module, enabling direct data flow from shallow to deeper layers.
  • 3.1 GRADIENT DECOMPOSITION WITH SKIP CONNECTIONS: The chain-rule gradient is decomposed into contributions from skip connections and residual modules across successive residual blocks.The paper illustrates this decomposition on the last three building blocks of ResNet-18.
  • 3.2 SKIP GRADIENT METHOD (SGM): SGM introduces a decay parameter that reduces gradients whenever backpropagation passes through residual modules, thereby using relatively more skip-connection gradients.The decay parameter γ lies in (0, 1], and the resulting adversarial example is crafted iteratively.
  • 3.2 SKIP GRADIENT METHOD (SGM): SGM is generic, adds no computation overhead, and can be implemented on neural networks with skip connections, including densely connected networks such as DenseNets.The reduction of residual gradients accumulates along the backpropagation path.
  • 3.3 ADVERSARIAL TRANSFERABILITY WITH SKIP CONNECTIONS: A CASE STUDY: 65.38% transferability against Inception V3 was achieved by SGM on DN201, versus 35.48% for the best non-SGM PGD result, a gain exceeding 29%.The case study used 10-step PGD, eight source models, 5000 ImageNet validation images, ε = 16, α = 2, and γ = 0.5.
  • 3.3 ADVERSARIAL TRANSFERABILITY WITH SKIP CONNECTIONS: A CASE STUDY: Within and across model families, adversarial examples become more transferable as networks contain more skip connections, especially when SGM manipulates those connections.The compared families include normal-block ResNets, bottleneck ResNets, and densely connected ResNets.

4 COMPARISON TO EXISTING TRANSFER ATTACKS

The paper evaluates SGM-based attacks against unsecured and secured ImageNet models, both alone and combined with existing transfer techniques. SGM consistently improves transferability on unsecured models and also strengthens attacks against secured models when combined with TI.

  • Experimental setup: The evaluation uses black-box attacks crafted on 8 source models and tested against unsecured and adversarially trained target models.Source models include ResNet-18/34/50/101/152 and DenseNet-121/169/201; attacks use 5000 randomly selected ImageNet validation images.
  • Unsecured models: SGM outperforms existing methods in almost all multi-step transfer scenarios against VGG19, SE154, and IncV3.Transferability generally increases with the number of skip connections in the source model, although architectural similarity also affects source-target transfer.
  • Unsecured models: 72.03% success rate for DN201 → SE154 with SGM, exceeding MI by >7% and DI by >10%.This result is reported for the best source models against unsecured target models.
  • Combining methods: SGM improves MI and DI transferability by 11.98% ∼21.98% when combined with those methods on DN201.Combining SGM with MI+DI raises the state-of-the-art transferability to at least 80.52%, versus 71% previously.
  • Secured models: Against secured models, TI remains the best standalone method, while SGM is second best and improves TI across all transfer scenarios.For IncV3ens3, TI+SGM reaches 87.65%, compared with 84.8% previously reported using six source models including IncV3.
  • SGM analysis: Lowering γ generally improves DenseNet transferability until a threshold, while ResNets require more residual-gradient decay.The best γ is generally related more to the source model than the unknown target model, enabling tuning on source models.
  • White-box attacks: SGM also improves one-step white-box FGSM strength under an L∞ perturbation bound of ϵ = 8.The one-step version of SGM is equivalent to FGSM with residual-gradient decay.

5 CONCLUSION

The paper identifies skip connections as an architectural weakness that enables highly transferable adversarial examples. SGM exploits this by emphasizing skip-connection gradients, improving transferability across unsecured and secured models and when combined with existing techniques.

  • SGM crafts adversarial examples by using more gradients from skip connections than residual modules through a decay factor.
  • Experiments with 8 source models and 10 target models, including 7 unsecured and 3 secured models, found significantly better transferability for SGM than existing methods.
  • SGM also boosted state-of-the-art transferability by a huge margin when combined with existing techniques.
  • The paper attributes skip connections’ high adversarial transferability to extra low-level information that is more transferable across different DNNs.
  • The findings highlight architectural vulnerability in DNNs and raise challenges for designing secure DNN architectures.

A VISUALIZATION OF ADVERSARIAL EXAMPLES CRAFTED BY SGM

The visualization compares clean images with SGM-crafted adversarial examples generated on ResNet-152 and DenseNet-201. The reported perturbations are human imperceptible under a maximum perturbation of ϵ = 16.

  • The visualization results report that SGM-generated adversarial perturbations are human imperceptible.
  • Figure 5 shows 6 clean images alongside corresponding SGM adversarial examples crafted on ResNet-152 and DenseNet-201.
  • The clean images appear in the top row, ResNet-152 examples in the middle row, and DenseNet-201 examples in the bottom row.
  • All adversarial examples use 10-step SGM with maximum perturbation ϵ = 16.

B COMPARISON WITH PREVIOUSLY PUBLISHED RESULTS

The paper compares its attack settings and baseline results with prior work, finding close agreement in many baseline success rates while attributing discrepancies to experimental settings and perturbation limits.

  • Tables 8 and 9 summarize differences from previous single-source and ensemble-based attack experiments.
  • The reported MI and DI baseline success rates match those in Xie et al. (2019), and are sometimes higher.
  • 81% success rate was reported for an optimization-based ResNet-152-to-VGG16 attack without restricting maximum perturbation ϵ, versus 65.52% for the paper’s ResNet-152-to-VGG19 result.
  • The paper reports RMSD values of 6.29 for PGD, 7.71 for SGM, and 12.55 for MI in its experiments.
  • Bounded small perturbations increase imperceptibility to human observers, as illustrated in Figure 5.
  • The experimental setup uses open-source codes, pretrained models, reproduced DI and TI implementations, and settings characterized by ϵ, N, and α.

C TRANSFERABILITY OF DECAY PARAMETER γ

The paper studies how SGM’s decay parameter γ transfers across target models. All tested black-box targets share the same best γ selection, allowing tuning on another model when the true target is unknown.

  • RN152 and DN201 serve as source models while target models vary to reveal decay-parameter trends.
  • All black-box target models share the same best γ selection, simplifying parameter choice.
  • When the true target model is unknown, γ can be tuned for a ResNet-like network using another model.
  • Figure 6 reports black-box attack success rates for 10-step SGM across decay values γ ∈[0.1, 1.0] against different target models.
Loading 2002.05990v1…