PaperlayerView exact revision on arXiv

Source-linked AI summary

Torchattacks: A PyTorch Repository for Adversarial Attacks

Hoki Kim

arXiv:2010.01950v3cs.LGcs.AIcs.CR

TL;DR

Deep learning models are vulnerable to adversarial examples, motivating a practical library for generating attacks and verifying robustness. Torchattacks implements multiple attack algorithms, including gradient-based, iterative, randomized, projected, and transformation-aware methods, subject to input and model-output requirements. The report provides algorithm descriptions and implementations, while its scope requires inputs scaled to [0, 1] and supports randomized models in the EOT setting.

  • Problem

    Deep learning models are vulnerable to adversarial examples, and a range of attack methods needs to be implemented for adversarial-example generation and robustness verification.

  • Method

    Torchattacks provides implementations and algorithm descriptions for gradient-based, iterative, randomized, projected, transformation-aware, and KL-divergence-based adversarial attacks.

  • Results

    The report presents a list of implemented adversarial attacks and explains the algorithms of each method.

  • Takeaways & Limitations

    The library supports adversarial-example generation across multiple attack formulations, including attacks for randomized models and adversarial training.

  • Takeaways & Limitations

    Inputs must be scaled to [0, 1], models must return a single class-score vector, and EOT assumes a randomized model whose outputs vary across forward passes.

Abstract

from arXiv · show

Torchattacks is a PyTorch library that contains adversarial attacks to generate adversarial examples and to verify the robustness of deep learning models. The code can be found at https://github.com/Harry24k/adversarial-attacks-pytorch.

1 Precautions

Before generating adversarial examples, torchattacks requires inputs and model outputs to follow specific formats. Inputs must be scaled to [0, 1], and models must return a single class-score vector.

  • Inputs must be scaled to [0, 1] before attacks are generated.Normalization should be added as a model layer because reverse-normalization is not included in the attack process.
  • Models should return one vector of shape (·, C), where C is the number of classes.The library supports only limited output forms, so model output shape requires checking.

2 A List of Adversarial Attacks

Adversarial attacks search for bounded perturbations that turn model inputs into adversarial examples. The section introduces the general formulation and FGSM as a one-gradient implementation using the L∞ distance.

  • Adversarial attacks generate x′ ∈[0, 1]n from (x, y) ∼D and model f by finding δ inside an ǫ-ball around x.Common distance measures for the ǫ-ball are L0, L2, and L∞.
  • 2.1 Fast Gradient Sign Method (FGSM): FGSM uses one loss gradient ∇xℓ to increase ℓ(f(x), y).Unless otherwise specified, the loss function ℓ is cross-entropy.
  • 2.1 Fast Gradient Sign Method (FGSM): x′ = x + ǫ · sgn(∇xℓ(f(x), y)) defines FGSM’s perturbation update under the L∞ distance.The implementation accepts a model and maximum perturbation eps; an example uses eps=8/255.

2.2 Basic Iterative Method (BIM)

BIM extends FGSM by applying multiple gradients with a step size smaller than the maximum perturbation. The section also describes Carlini–Wagner optimization in tanh space as an alternative construction.

  • 2.2 Basic Iterative Method (BIM): BIM, or iterative-FGSM, generates adversarial examples through multiple gradient steps.Its step size α is defined smaller than ǫ, and L∞ is used as the distance measure.
  • 2.2 Basic Iterative Method (BIM): BIM exposes eps, alpha, and steps for controlling the perturbation bound, step size, and number of iterations.The example uses eps=4/255, alpha=1/255, and steps=4.
  • 2.2 Basic Iterative Method (BIM): Carlini–Wagner performs adversarial-example optimization in tanh space using tanh(x) ∈[−1, 1]n.The implementation uses Adam to minimize the objective, with L2 as the distance measure.
  • 2.2 Basic Iterative Method (BIM): The Carlini–Wagner objective uses c to weight g(x), while κ encourages classification as an incorrect label with a specified confidence.For targeted attacks, g(x) is modified to move the adversarial example closer to target class y′.

2.4 R+FGSM

R+FGSM adds random initialization before computing the gradient to reduce gradient masking effects. Its implementation combines a maximum perturbation, step size, and number of steps under L∞.

  • 2.4 R+FGSM: R+FGSM adds a random initialization before gradient computation to avoid gradient masking effects.The method uses randomized noise before subsequent attack updates.
  • 2.4 R+FGSM: R+FGSM clips perturbed inputs within an ǫ-neighborhood of x using clip(x,ǫ){x′}.The clipping operation is defined as min(max(x′, x −ǫ), x + ǫ).
  • 2.4 R+FGSM: R+FGSM uses step size α and the L∞ distance measure across iterative adversarial-example steps.The implementation exposes eps, alpha, and steps; an example uses eps=8/255, alpha=4/255, and steps=2.

2.5 Projected Gradient Descent (PGD)

PGD generates adversarial examples by iteratively updating an input with gradient-based perturbations and projecting it into an epsilon-ball. It supports L∞ and L2 distance measures, with optional randomized initialization.

  • PGD projects the adversarial perturbation into an epsilon-ball around the original example to constrain the attack.
  • Before gradient calculation, PGD can add uniformly randomized noise to the original example.
  • The attack uses alpha as the step size and supports L∞ and L2 distance measures.
  • Torchattacks exposes PGD parameters for the model, maximum perturbation epsilon, step size alpha, number of steps, and random initialization.Examples instantiate Linf and L2 variants with different epsilon and alpha settings.

2.6 EOT+PGD (EOTPGD)

EOTPGD adapts PGD to randomized models by estimating gradients over expected transformations or multiple stochastic forward passes. The implementation exposes sampling to control mean-gradient estimation.

  • EOT computes gradients over the expected transformation of the input to attack randomized models.
  • APGD estimates a stronger gradient for Bayesian neural networks by averaging gradient information across model evaluations.
  • A randomized model can produce different outputs on each forward propagation even for the same input.
  • EOTPGD uses L∞ as its distance measure.
  • EOTPGD exposes sampling as the number of models used to estimate the mean gradient, alongside epsilon, alpha, and steps.The example uses sampling=10.

2.7 PGD in TRADES (TPGD)

TPGD applies PGD within TRADES, generating adversarial examples with KL-divergence loss. Its configuration specifies perturbation size, step size, and iteration count under an L∞ constraint.

  • TRADES uses PGD to generate adversarial examples with KL-divergence loss ℓKL.
  • The attack projects updates into the epsilon-ball around the input.
  • TPGD uses alpha as the step size and supports L∞ as the distance measure.
  • Torchattacks exposes TPGD parameters for the model, maximum perturbation epsilon, step size alpha, and number of steps.The example uses epsilon=8/255, alpha=2/255, and steps=7.

2.8 FGSM in fast adversarial training (FFGSM)

FFGSM implements fast adversarial training by replacing Gaussian-sign randomization with uniform randomization and using a step size larger than epsilon. The attack projects the result into an epsilon-ball under L∞.

  • Fast adversarial training replaces sgn(N(0n, In)) with uniform randomization U(−epsilon, epsilon) in R+FGSM.
  • FFGSM projects the adversarial example into the epsilon-ball and uses L∞ as the distance measure.
  • Torchattacks exposes FFGSM parameters for the model, maximum perturbation epsilon, and step size alpha.The example uses epsilon=8/255 and alpha=10/255.

2.9 MI-FGSM (MIFGSM)

MI-FGSM generates adversarial examples using momentum-based gradient updates, projection into an ε-ball, and an L∞ distance measure. Torchattacks exposes these settings through a PyTorch interface.

  • MI-FGSM is an FGSM variant with momentum, identified as the Dong et al. (2018) attack.
  • The attack projects perturbed inputs into B(x, ε), uses μ as the gradient-direction decay factor, and measures distance with L∞.
  • Users instantiate MIFGSM with a model, maximum perturbation eps=8/255, five steps, and decay=1.0 before generating adversarial examples.

3 Useful usage

Torchattacks provides inherited utilities for configuring, formatting, and saving adversarial examples, while MultiAttack combines several attacks. These interfaces support reusable examples and chained attack generation.

  • All torchattacks attacks subclass Attack, whose inherited methods help users generate and reuse adversarial examples.
  • Attack mode can be changed among default, targeted, and least-likely modes, as shown with PGD.
  • Generated adversarial examples can be returned as integer or floating-point values through set_return_type.
  • The save method creates adversarial examples from a DataLoader and writes them to a specified path, optionally reporting progress.
  • MultiAttack combines multiple adversarial attacks to generate more powerful adversarial examples.
  • An example combines PGD with eps=8/255 and PGDL2 with eps=0.3 through MultiAttack before processing examples and labels.
Loading 2010.01950v3…