Source-linked AI summary
Patch-wise Attack for Fooling Deep Neural Network
Lianli Gao, Qilong Zhang, Jingkuan Song, Xianglong Liu, Heng Tao Shen
TL;DR
The paper addresses the difficulty of transferring adversarial examples to unknown models while retaining strong attack performance. It proposes PI-FGSM, which generates patch-wise perturbations using amplified iterative steps and a project kernel. On average, success rates improve by 9.2% for defense models and 3.7% for normally trained models over state-of-the-art attacks.
Problem
Black-box attacks must generate adversarial examples for unknown target models, where transferability is important and iterative methods can transfer less effectively than single-step attacks.
Method
PI-FGSM generates patch-wise noise by amplifying each iterative step and projecting excess noise into surrounding regions before L∞ restriction.
Results
9.2% higher success rate for defense models and 3.7% for normally trained models were reported on average against state-of-the-art attacks.
Takeaways & Limitations
PI-FGSM can serve as a baseline for generating more transferable adversarial examples and evaluating DNN robustness, and can integrate with gradient-based attacks.
Abstract
from arXiv · showhide
By adding human-imperceptible noise to clean images, the resultant adversarial examples can fool other unknown models. Features of a pixel extracted by deep neural networks (DNNs) are influenced by its surrounding regions, and different DNNs generally focus on different discriminative regions in recognition. Motivated by this, we propose a patch-wise iterative algorithm -- a black-box attack towards mainstream normally trained and defense models, which differs from the existing attack methods manipulating pixel-wise noise. In this way, without sacrificing the performance of white-box attack, our adversarial examples can have strong transferability. Specifically, we introduce an amplification factor to the step size in each iteration, and one pixel's overall gradient overflowing the $ε$-constraint is properly assigned to its surrounding regions by a project kernel. Our method can be generally integrated to any gradient-based attack methods. Compared with the current state-of-the-art attacks, we significantly improve the success rate by 9.2\% for defense models and 3.7\% for normally trained models on average. Our code is available at \url{https://github.com/qilong-zhang/Patch-wise-iterative-attack}
1 Introduction
Adversarial examples create security concerns because imperceptible perturbations can fool DNNs, while black-box attacks must balance substitute-model performance against transferability. The paper proposes PI-FGSM, a patch-wise attack that combines these benefits and improves black-box success rates.
- Human-imperceptible perturbations can cause DNNs to make unreasonable predictions, motivating research on attacks and defenses.
- Black-box attacks cannot access target-model information, making transferability important for adversarial examples generated on substitute models.
- Iterative attacks generally perform better on substitute models, whereas single-step attacks often transfer better but may underfit.
- PI-FGSM uses patch-wise noise, an amplification factor, and a project kernel to improve transferability without sacrificing substitute-model performance.
- 9.2% higher success rate for defense models and 3.7% for normally trained models were reported on average in the black-box setting.
2 Related work
Related work distinguishes adversarial-example applications, attack settings, and ensemble strategies. In particular, black-box attacks rely on transferability because target-model parameters and gradients are unavailable.
- Adversarial examples have been studied across image classification, object detection, semantic segmentation, embodied agents, and speech recognition.
- Attack settings: White-box attacks access full target-model knowledge, semi-black-box attacks access outputs, and black-box attacks generally lack target-model access.
- Attack settings: Transferability is central to black-box attacks because adversarial examples are usually generated using substitute models.
- Attack strategies: Prior black-box methods improve transferability through random transformations, momentum, and related iterative strategies.
- Ensemble strategies: Ensemble strategies either learn one universal perturbation from legitimate examples or estimate gradients using multiple models.
3 Methodology
The method extends gradient-based attacks with amplified iterative steps and a patch-wise projection strategy, aiming to preserve attack strength while improving black-box transferability.
- Attack Setting: The attack maximizes substitute-model cross-entropy under an l∞ perturbation constraint for untargeted black-box transfer.The adversarial example is formed by adding imperceptible noise while keeping ||xclean − xadv||∞ ≤ ϵ.
- Patch Map: PI-FGSM generates patch-wise rather than pixel-wise perturbations to improve transferability across models with different discriminative regions.The approach exploits clustered image regions and produces more aggregated noise than FGSM and I-FGSM.
- Amplified Updates: The iterative step size is amplified from ϵ/T to ϵ/T × β, trading off single large steps against iterative small steps.A larger amplification factor can help avoid poor local optima, although excessive amplification may cause deviation from the global optimum in some attacks.
- Project Strategy: The uniform project kernel spreads overflowing perturbation into surrounding regions, increasing the aggregation of noise patches without abandoning the l∞ clipping operation.The kernel has size kw × kw and its convolved cut noise supplies a feasible direction for the update.
- Box Constraint: When amplified noise exceeds the ϵ bound, the method records cut noise and reuses it through a project kernel before final clipping.This preserves feasible directional information that direct element-wise clipping would otherwise waste.
4 Experiment
Experiments evaluate patch-wise attacks across normally trained, ensemble-trained, and defense models, varying amplification factors and project-kernel sizes. PI-FGSM improves transferability while retaining strong substitute-model performance, with settings that depend on the target model category.
- Experimental setup: Experiments use 1000 ImageNet-compatible images and eleven normally trained or defense models, with ε = 16 and T = 10 for iterative methods.The evaluation includes normally trained models, ensemble adversarially trained models, and feature-distillation defenses.
- Amplification factor: Larger amplification factors generally improve transferability, but excessive values can reduce performance for some attacks, especially ADI-FGSM.PI-FGSM’s success rate rises rapidly with amplification and soon surpasses other approaches; momentum can stabilize update directions for AMI-FGSM.
- Project kernel size: The project-kernel size is target-dependent: 3 × 3 is best for NT, 7 × 7 improves EAT transferability, and 3 × 3 or 21 × 21 is preferred for FD depending on the substitute models.For FD, 3 × 3 is best when generating examples for FD, whereas 21 × 21 is slightly better when attacking FD from NT-generated examples.
- Attacks vs. Normally Trained Models: 3.7% average success-rate improvement is reported for PI-FGSM against normally trained models, with gains up to 17.2% when attacking Dense-161.DMPI-FGSM reaches a 92.2% success rate against Inc-v3 when examples are crafted for IncRes-v2.
- Attacks vs. Defense Models: 9.0% average improvement over TI-FGSM is reported for single-model EAT attacks, while ensemble attacks improve about 9.6% over MI-FGSM.The single-model comparison uses kw = 7 for consistency rather than the best kernel size for every attack.
- Attacks vs. Defense Models: Against FD models, PI-FGSM is superior by a large margin in both white-box and black-box settings, whereas simply combining existing methods may be ineffective.The paper attributes the poor transfer of some attacks to differences in decision boundaries and emphasizes the role of substitute-model choice.
5 Conclusions
The paper concludes that PI-FGSM is a patch-wise iterative black-box attack designed to improve transferability against normally trained and defense models. It can be integrated with gradient-based attacks and serves as a baseline for transferable adversarial examples and robustness evaluation.
- PI-FGSM generates larger perturbation patches in discriminative regions to improve transferability against normally trained and defense models.
- The patch-wise approach differs from existing attacks that manipulate pixel-wise noise.
- PI-FGSM can be generally integrated with gradient-based attack methods.
- The authors position PI-FGSM as a baseline for generating transferable adversarial examples and evaluating DNN robustness.
A Appendix
The appendix describes experiments across 12 models grouped into normally trained, ensemble adversarial trained, and feature denoising defense categories. It reports separate analyses of project-factor and iteration settings.
- A Appendix: The appendix evaluates PI-FGSM across 12 models in three groups: NT, EAT, and FD.
- A Appendix: NT includes Inc-v3, Inc-v4, IncRes-v2, Res-152, and Dense-161.
- A Appendix: EAT includes Inc-v3adv, Inc-v3ens3, Inc-v3ens4, and IncResens.
- A Appendix: FD includes ResNeXtDA, Res152B, and Res152D.
- A Appendix: The appendix reports the influence of project factor γ and iteration T in separate sections.
A.1 Selection of project factor γ
The appendix finds that setting γ to ϵ/T · β is usually best, while the preferred value changes for input-diversity attacks and a specific feature-denoising setup.
- A.1 Selection of project factor γ: γ = ϵ/T · β is the best project-factor setting in most cases.
- A.1 Selection of project factor γ: Large project factors are less suitable for attack methods using an input-diversity strategy.
- A.1 Selection of project factor γ: With Res152B attacking feature-denoising models, γ = 1.0 performs better.
- A.1 Selection of project factor γ: Table 5 reports average success rates for non-targeted PI-FGSM attacks generated with Inc-v3 under different γ settings.
A.2 The number of iteration T
The iteration analysis finds that increasing T beyond 10 brings no significant improvement while increasing computational cost, motivating T = 10 for PI-FGSM.
- A.2 The number of iteration T: The iteration analysis sets the step size to ϵ/T, β to T, and γ to ϵ/T · β.
- A.2 The number of iteration T: When T exceeds 10, further increases do not bring significant improvement.
- A.2 The number of iteration T: Computational cost is proportional to T.
- A.2 The number of iteration T: The authors set T to 10 because PI-FGSM is based on FGSM and is intended to be fast.
- A.2 The number of iteration T: Tables 11, 12, and 13 report average success rates across different T values against NT, EAT, and FD, respectively.