Source-linked AI summary
Admix: Enhancing the Transferability of Adversarial Attacks
Xiaosen Wang, Xuanran He, Jingdong Wang, Kun He
TL;DR
Existing input transformations operate on a single image, leaving open whether information from other categories can improve adversarial transferability. Admix computes gradients on images formed by adding small portions of other-category samples while retaining the original label, and evaluations report stronger transferability with similar white-box performance, including a 3.4% average gain for Admix-TI-DIM over SI-TI-DIM against nine defenses.
Problem
Existing input transformations apply only to a single image, motivating investigation of whether other-category information can improve adversarial transferability.
Method
Admix admixes small portions of randomly sampled other-category images into each input and computes gradients using the original input label.
Results
3.4% average improvement: Admix-TI-DIM outperforms SI-TI-DIM against nine advanced defense models under ensemble-model evaluation, while Admix maintains similar white-box performance and improves black-box transferability.
Takeaways & Limitations
Admix can be combined with existing input transformations to further improve the transferability of crafted adversaries while maintaining high white-box attack success rates.
Takeaways & Limitations
Directly applying mixup improves transferability only slightly but significantly degrades white-box attack performance, motivating Admix’s unequal image weighting and unchanged label.
Abstract
from arXiv · showhide
Deep neural networks are known to be extremely vulnerable to adversarial examples under white-box setting. Moreover, the malicious adversaries crafted on the surrogate (source) model often exhibit black-box transferability on other models with the same learning task but having different architectures. Recently, various methods are proposed to boost the adversarial transferability, among which the input transformation is one of the most effective approaches. We investigate in this direction and observe that existing transformations are all applied on a single image, which might limit the adversarial transferability. To this end, we propose a new input transformation based attack method called Admix that considers the input image and a set of images randomly sampled from other categories. Instead of directly calculating the gradient on the original input, Admix calculates the gradient on the input image admixed with a small portion of each add-in image while using the original label of the input to craft more transferable adversaries. Empirical evaluations on standard ImageNet dataset demonstrate that Admix could achieve significantly better transferability than existing input transformation methods under both single model setting and ensemble-model setting. By incorporating with existing input transformations, our method could further improve the transferability and outperforms the state-of-the-art combination of input transformations by a clear margin when attacking nine advanced defense models under ensemble-model setting. Code is available at https://github.com/JHL-HUST/Admix.
1. Introduction
Adversarial examples can transfer across models, motivating attacks that improve black-box transferability. Admix addresses a limitation of single-image transformations by admixing other-category images while retaining the original label.
- Motivation: Adversarial examples can mislead models while appearing indistinguishable from legitimate inputs, threatening security-sensitive applications.Examples include face verification and autonomous driving.
- Motivation: Black-box transferability matters because attackers may target real-world DNN applications without knowing the target model.
- Motivation: Input transformation is an effective transferability strategy, but existing methods operate only on a single input image.
- Admix: Admix computes gradients on the original image admixed with small portions of randomly sampled images from other categories while preserving the original label.This produces diverse inputs for gradient calculation without treating the images equally or mixing labels.
- Results: On ImageNet, Admix achieves higher black-box attack success rates than existing input transformations while maintaining similar white-box performance.Combining Admix with other transformations further improves transferability.
2. Related Work
Prior work improves adversarial transferability through several attack families, while mixup and related methods use image or patch combinations for augmentation, inference, or robustness. Admix belongs to the input-transformation family and can be combined with other attack strategies.
- Transferability Attacks: Transferability attacks include ensemble-model, momentum-based, input-transformation, and model-specific methods.These categories organize prior approaches to generating more transferable adversarial examples.
- Transferability Attacks: Ensemble attacks optimize against multiple models, while momentum-based methods use advanced gradient calculations to improve transferability.
- Input Transformations: Input transformations include random resizing and padding, gradient convolution, and gradients computed over scaled images.
- Admix: Admix is an input transformation that can be integrated with ensemble-model, momentum-based, and other input-transformation attacks.
- The Mixup Family: Mixup interpolates two randomly sampled examples and their labels using λ, producing mixed inputs and mixed targets.The operation is introduced as a data-augmentation strategy for improving model generalization.
- The Mixup Family: The mixup family also includes manifold mixup, CutMix, mixup inference, and adversarial vertex mixup for training, inference, or robustness.
3. Methodology
Admix enhances transferability by calculating gradients on diverse images formed from the original input and small portions of images from other categories, while preserving the original label. It integrates with iterative and other transformation-based attacks and differs from mixup by treating the original image as primary and avoiding label mixing.
- Attack setting: Adversarial attacks seek examples within an ℓ∞-norm neighborhood of an input that cause the classifier to change its prediction.The attack objective is to find xadv ∈ Bϵ(x) that misleads the target classifier.
- Existing input transformations: Existing transferability methods transform a single input through resizing, translation, or scaling before calculating gradients.DIM uses random resizing and padding, TIM averages translated-image gradients, and SIM averages gradients over scaled copies.
- Motivation: Mixup degrades white-box attack performance because it treats both images equally and mixes their labels, potentially directing updates toward the wrong gradient.The paper motivates Admix as a way to use information from other categories without harming white-box performance.
- Admix operation: Admix forms each transformed image as ˜x = γ · x + η′ · x′, with x as the primary image and x′ contributing a smaller portion while retaining x’s label.The parameters γ and η′ control the portions of the original and sampled images, with η′ < γ.
- Admix attack: Admix averages gradients over admixed images generated by varying γ or sampling add-in images from different categories.The sampled set X′ contains m2 images, and m1 admixed copies are generated for each sampled image.
- Admix versus mixup: Unlike mixup’s linear interpolation and label mixing, admix uses a master-slave composition that produces more diverse transformed images.Mixup treats x and x′ equally, whereas admix preserves x as the primary component and adds only a small portion of x′.
- Integration and algorithm: Admix integrated into MI-FGSM can combine with gradient-based attacks and input transformations except SIM to improve transferability.The algorithm samples images from another category, computes the average admixed gradient, updates momentum, and returns an adversarial example within Bϵ(x).
4. Experiments
Experiments on ImageNet evaluate Admix across single and combined input transformations, ensemble attacks, advanced defenses, and ablations. Across these settings, Admix improves black-box transferability while preserving strong white-box performance.
- Experimental setup: Experiments use 1,000 randomly sampled ImageNet validation images and compare Admix with DIM, TIM, SIM, and their combinations.The evaluation covers seven models, including normally trained and adversarially trained networks, under single-model and ensemble-model settings.
- Single input transformation: 82.6% and 39.0% attack success rates on Inc-v4 and Inc-v3ens3, respectively, show Admix surpassing SIM while both methods reach 100% white-box success on Inc-v3.For these black-box attacks, SIM reaches 69.4% on Inc-v4 and 30.7% on Inc-v3ens3.
- Combined input transformation: Admix-integrated transformations improve transferability over corresponding SIM combinations across all models.For adversaries crafted on Inc-v3, improvements are 4%–7% for Admix-DIM over SI-DIM, 8%–12% for Admix-TIM over SI-TIM, and 5%–7% for Admix-TI-DIM over SI-TI-DIM.
- Ensemble-model attack: At least 6.7% higher attack success rates than SIM are achieved by Admix under ensemble-model attacks, while Admix also remains strongest for integrated transformations.Admix combined with DIM or TIM exceeds the corresponding baseline by at least 4%, and integrating it into DIM-TIM improves three adversarially trained models by more than 2%.
- Advanced defense models: 3.4% average improvement over SI-TI-DIM is achieved by Admix-TI-DIM across nine advanced defense models.The margin exceeds 5.7% against randomized smoothing and 5% against adversarially randomized smoothing.
- Ablation studies: Admix outperforms Mixup, Mixupwlm, and Admixlm by keeping the input dominant and retaining the original label.Mixupwlm improves over Mixup, while Admixlm improves over both alternatives.
5. Conclusion
The paper proposes Admix, an input transformation that uses minor portions of images from other categories while retaining the original label. Evaluations report stronger adversarial transferability than competitive input-transformation attacks while maintaining high white-box attack success rates.
- Admix randomly samples images from other categories and adds a minor portion of each to the original input for gradient calculation.The original label is retained, producing diverse images for crafting adversaries.
- Admix achieves much better adversarial transferability than existing competitive input-transformation attacks.The reported evaluations cover the proposed method's transferability against existing approaches.
- Admix maintains high attack success rates under the white-box setting while improving transferability.The conclusion presents this as the method's overall empirical outcome.