PaperlayerView exact revision on arXiv

Source-linked AI summary

Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferability

Yifeng Xiong, Jiadong Lin, Min Zhang, John E. Hopcroft, Kun He

arXiv:2111.10752v2cs.LGcs.CRcs.CV

TL;DR

Black-box attacks must transfer across models without access to the target model, motivating ensemble attacks but exposing limitations in evenly fused model outputs. SVRE reduces gradient variance through stochastic variance-reduced ensemble updates, and experiments show stronger black-box transferability than vanilla ensemble attacks while preserving roughly similar white-box performance.

  • Problem

    Existing ensemble attacks simply fuse model outputs and ignore gradient variance across models, which can produce suboptimal optimization and limit transferability.

  • Method

    SVRE treats ensemble models as a stochastic optimization batch, combining an outer average gradient with randomly sampled inner-model updates to reduce gradient variance.

  • Results

    SVRE significantly outperforms vanilla ensemble attacks in black-box settings and keeps roughly the same white-box performance.

  • Takeaways & Limitations

    Reducing gradient variance lets ensemble attacks produce adversarial examples with higher transferability to other possible models.

Abstract

from arXiv · show

The black-box adversarial attack has attracted impressive attention for its practical use in the field of deep learning security. Meanwhile, it is very challenging as there is no access to the network architecture or internal weights of the target model. Based on the hypothesis that if an example remains adversarial for multiple models, then it is more likely to transfer the attack capability to other models, the ensemble-based adversarial attack methods are efficient and widely used for black-box attacks. However, ways of ensemble attack are rather less investigated, and existing ensemble attacks simply fuse the outputs of all the models evenly. In this work, we treat the iterative ensemble attack as a stochastic gradient descent optimization process, in which the variance of the gradients on different models may lead to poor local optima. To this end, we propose a novel attack method called the stochastic variance reduced ensemble (SVRE) attack, which could reduce the gradient variance of the ensemble models and take full advantage of the ensemble attack. Empirical results on the standard ImageNet dataset demonstrate that the proposed method could boost the adversarial transferability and outperforms existing ensemble attacks significantly. Code is available at https://github.com/JHL-HUST/SVRE.

1. Introduction

Black-box attacks are difficult because attackers lack target-model architecture and weights, motivating transferable adversarial examples and ensemble attacks. SVRE addresses a limitation of existing ensemble methods by reducing gradient variance across models, improving transferability in ImageNet experiments.

  • Black-box attacks are challenging because attackers cannot access the target model’s architecture or gradient information, despite strong white-box attack performance.
  • Ensemble attacks improve black-box performance by combining multiple models, but existing methods receive less investigation than gradient optimization and input transformation attacks.
  • Gradient-direction variance across different model architectures can make ensemble optimization less accurate and limit transferred attack capability.
  • SVRE treats ensemble models as a batch, using an outer average gradient and randomly sampled inner-model updates inspired by stochastic variance reduction.
  • SVRE consistently outperforms vanilla ensemble attacks in ImageNet black-box experiments by obtaining more accurate updates and avoiding overfitting to the ensemble.

2. Related Works

Prior adversarial-attack research spans gradient optimization, input transformations, and model ensembles, while defense research includes adversarial training and input transformations. These approaches target attack effectiveness, transferability, or robustness through different mechanisms.

  • Adversarial Attacks: Adversarial attacks seek perturbations that maximize classifier loss within an Lp-norm neighborhood, with this paper focusing on L∞-norm nontargeted attacks.
  • Gradient Optimization Attacks: Gradient optimization methods range from FGSM, BIM, and PGD to momentum, Nesterov acceleration, and gradient-variance reduction for stabilizing updates.
  • Input Transformation Attacks: Input transformation methods improve transferability by optimizing across diverse or transformed inputs, including random resizing, padding, and translated images.
  • Model Ensemble Attacks: Model ensemble attacks improve transferability by attacking multiple models simultaneously and fusing their predictions, logits, or losses.
  • Adversarial Defenses: Defense methods include adversarial training, which augments training data with adversarial examples, and input transformations that diminish or detect perturbations.

3. Methodology

The paper frames ensemble attacks as stochastic optimization and proposes SVRE to reduce gradient variance across surrogate models. It contrasts prediction, logit, and loss ensembles with a variance-reduced inner-loop update designed to improve transferability.

  • Ensemble attack methods: Existing ensemble attacks combine multiple models to improve adversarial transferability, but typically treat ensemble outputs as a plug-and-play average.The paper notes that ensemble attacks are broadly adopted while the ensemble strategy itself has received less investigation.
  • Ensemble attack methods: Prediction, logit, and loss ensembles construct a joint objective by averaging model outputs or losses, generally using equal weights w_k = 1/K.The prediction and logit variants aggregate model predictions or logits before computing the loss, while the loss ensemble averages individual losses.
  • Motivation: Low cosine similarity between sign-processed gradients across models indicates substantially different optimization directions, making simple output fusion prone to suboptimal ensemble updates.The authors connect this gradient variance to overfitting the ensemble model and limited transferability to other black-box models.
  • SVRE attack: SVRE treats iterative ensemble attack as stochastic gradient descent and reduces cross-model gradient variance to stabilize updates that generalize better to other models.Its design is inspired by stochastic variance reduced gradient methods and targets variance inherent in gradients from multiple models.
  • SVRE attack: SVRE computes an ensemble gradient, then performs M inner updates by randomly sampling models, forming variance-reduced stochastic gradients, and using accumulated gradients for the outer update.The method maintains the ensemble gradient during the inner loop, updates an inner adversarial example with momentum, and uses the final accumulated inner gradient to update the outer state.
  • Extensions: SVRE can be integrated with iterative gradient-based attacks such as I-FGSM, MI, DI, TI, and SI using the same inner- and outer-loop variance-reduction strategy.The paper specifically describes SVRE-I-FGSM as accumulating inner-loop gradients to improve transferability.

4. Experiments

Experiments evaluate SVRE against ensemble attacks on normally trained, adversarially trained, and defended ImageNet models, including ablations of its key parameters. Across these settings, SVRE generally improves black-box transferability, while its gains depend on internal update frequency and cannot be explained solely by additional gradient calculations.

  • Experimental setup: Experiments use an ImageNet-compatible dataset with 1,000 images and compare SVRE with Ens across five gradient-based attack methods.The evaluation considers normally trained models, adversarially trained models, and models with advanced defenses.
  • Normally trained models: SVRE outperforms Ens across normally trained hold-out models, with average improvements of 16.19% for I-FGSM, 9.46% for MI-FGSM, 5.35% for TIM, 2.86% for DIM, and 1.27% for SI-TI-DIM.Adversarial examples are generated on three models while the fourth is held out for black-box evaluation.
  • Advanced defense models: 17.30% higher average attack success rate is achieved by SVRE-TIM than Ens-TIM against adversarially trained models.SVRE outperforms Ens on each evaluated adversarially trained model and slightly improves white-box performance in most cases.
  • Advanced defense models: 93.59% average attack success rate is achieved by SVRE integrated with SI-TI-DIM against nine models with advanced defenses in the black-box setting.The experiments report a clear margin over Ens across all comparisons on these defense models.
  • Loss analysis: SVRE increases average loss on black-box models while remaining comparable to Ens on white-box models.The results indicate that improved transferability does not require sacrificing white-box attack performance.
  • Ablation study on hyper-parameters: Black-box attack success peaks at about M = 16, while too few or too many internal iterations may harm transferability through overfitting.At M = 0, SVRE degenerates to the normal ensemble method Ens.
  • Ablation study on hyper-parameters: SVRE's gains are not explained simply by more gradient calculations: increasing Ens iterations does not reproduce SVRE's high attack performance.With M = 16 and K = 4, SVRE uses nine times as many queries as Ens in the analyzed setting.

5. Conclusion

SVRE reduces gradient variance in ensemble attacks to improve adversarial transferability while preserving roughly the same white-box performance. The paper positions this as a better-designed ensemble attack in a comparatively underexplored area.

  • 5. Conclusion: SVRE accounts for and reduces gradient variance across models, stabilizing ensemble gradient updates and producing more transferable adversarial examples.This differs from existing ensemble attacks that evenly fuse multiple model outputs.
  • 5. Conclusion: SVRE significantly outperforms vanilla model ensemble attacks in the black-box setting.The conclusion reports this outcome across extensive experiments.
  • 5. Conclusion: SVRE maintains roughly the same performance as vanilla ensemble attacks in the white-box setting.
  • 5. Conclusion: Ensemble attacks remain less explored than gradient optimization and input transformation attacks.The authors identify improved ensemble design as a direction with substantial potential for boosting adversarial transferability.

A. Analysis on Training Time

SVRE requires additional queries because its extra loop performs more gradient calculations than the vanilla ensemble attack. The authors report that this added cost is acceptable given the improved performance.

  • A. Analysis on Training Time: SVRE introduces an extra loop for crafting adversarial examples, increasing computational cost relative to Ens.The complexity is proportional to the total number of model queries.
  • A. Analysis on Training Time: SVRE costs (2M + n)/n times as much as Ens, with M = 16 and n = 4 in the reported example.Here, M is the internal update frequency and n is the number of ensemble models.
  • A. Analysis on Training Time: The authors judge SVRE’s additional time cost acceptable in light of its improved performance.They compare this overhead with added costs introduced by other transferability-improvement methods.

B. SVRE with other Advanced Method

Combining SVRE with Admix-TI-DIM further improves black-box transferability beyond both the standalone base method and its vanilla ensemble version.

  • B. SVRE with other Advanced Method: SVRE-Admix-TI-DIM further improves performance over Ens-Admix-TI-DIM, while the ensemble version already exceeds Admix-TI-DIM.The comparison uses adversarial examples tested against three adversarially trained models.

C. Visualization on Crafted Examples

The visualization compares adversarial examples generated by Ens-MI-FGSM and SVRE-MI-FGSM on a four-model ensemble. The reported SVRE perturbations remain imperceptible to human eyes.

  • C. Visualization on Crafted Examples: Figure 6 compares Ens-MI-FGSM and SVRE-MI-FGSM adversarial examples crafted using Inc-v3, Inc-v4, IncRes-v2, and Res-152.The figure visualizes six randomly selected raw images and their corresponding adversarial examples.
  • C. Visualization on Crafted Examples: The SVRE-generated adversarial examples are reported to be imperceptible to human eyes.
Loading 2111.10752v2…