Source-linked AI summary
Improving Adversarial Transferability via Neuron Attribution-Based Attacks
Jianping Zhang, Weibin Wu, Jen-tse Huang, Yizhan Huang, Wenxuan Wang, Yuxin Su, Michael R. Lyu
TL;DR
DNN vulnerabilities motivate black-box attacks that can transfer across models, but feature-level attacks are limited by inaccurate neuron-importance estimates. NAA uses complete neuron attribution with an efficient approximation to weight feature-level attacks, and experiments report superiority over state-of-the-art baselines, including defended models.
Problem
Feature-level black-box attacks show promise through shared features, but inaccurate neuron-importance estimates limit their transferability.
Method
NAA attributes model output to middle-layer neurons, approximates those attributions to reduce computation, and weights neurons to launch feature-level attacks.
Results
NAA outperforms state-of-the-art baselines, including on undefended and defended models, with a 57.9 % average attack success rate against advanced defended models.
Takeaways & Limitations
The reported experiments support NAA as a more transferable feature-level attack against both undefended and defended models.
Takeaways & Limitations
The attribution approximation assumes that gradient sequences from the network's former and latter parts are linearly independent, and evaluations focus on L∞-norm distance.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are known to be vulnerable to adversarial examples. It is thus imperative to devise effective attack algorithms to identify the deficiencies of DNNs beforehand in security-sensitive applications. To efficiently tackle the black-box setting where the target model's particulars are unknown, feature-level transfer-based attacks propose to contaminate the intermediate feature outputs of local models, and then directly employ the crafted adversarial samples to attack the target model. Due to the transferability of features, feature-level attacks have shown promise in synthesizing more transferable adversarial samples. However, existing feature-level attacks generally employ inaccurate neuron importance estimations, which deteriorates their transferability. To overcome such pitfalls, in this paper, we propose the Neuron Attribution-based Attack (NAA), which conducts feature-level attacks with more accurate neuron importance estimations. Specifically, we first completely attribute a model's output to each neuron in a middle layer. We then derive an approximation scheme of neuron attribution to tremendously reduce the computation overhead. Finally, we weight neurons based on their attribution results and launch feature-level attacks. Extensive experiments confirm the superiority of our approach to the state-of-the-art benchmarks.
1. Introduction
The paper targets limited transferability in black-box feature-level attacks caused by inaccurate neuron-importance measures, proposing NAA with attribution-based weighting and an efficient approximation. Experiments report state-of-the-art performance on undefended and defended models.
- Black-box attacks are emphasized because attackers lack target-model structures and parameters, while query-based methods require impractically many queries.
- Feature-level attacks manipulate intermediate feature maps to exploit shared critical features and synthesize more transferable adversarial samples.
- Existing feature-level attacks use inappropriate neuron-importance measures, destroying positive and negative features together even though negative features should be enhanced.
- NAA completely attributes model output to middle-layer neurons, capturing both the polarity and magnitude of each neuron's importance.
- The method approximates neuron attribution to reduce computation time before weighting neurons for feature-level attacks.
- Comprehensive experiments report state-of-the-art performance against both undefended and defended models.
2. Related Work
Related work frames adversarial attacks through white-box and black-box settings, transferability improvements, feature-level manipulation, and defenses against adversarial perturbations.
- 2.1. Adversarial Attacks: White-box attacks access victim-model structure and parameters, whereas black-box attackers cannot fetch that information.
- 2.1. Adversarial Attacks: Transfer-based black-box attacks craft adversarial examples on source models and transfer them to other models, with gradients and input transformations improving transferability.
- 2.1. Adversarial Attacks: Feature-level methods improve transferability by manipulating intermediate representations, including feature-map distances, target-layer perturbations, and feature corruption.
- 2.2. Adversarial Defenses: Adversarial defenses mainly use adversarial training or denoising, including ensemble training, preprocessing filters, compression, and randomized smoothing.
3. Approach
NAA crafts transferable feature-level adversarial examples by attributing model output to middle-layer neurons, approximating those attributions efficiently, and weighting neuron contributions during optimization.
- Feature-level attack: Feature-level attacks target intermediate features because shared receptive-field features can transfer across DNN models.The attack seeks to destroy positive features or enlarge negative features rather than directly manipulating final outputs.
- Neuron attribution: Neuron attribution assigns each middle-layer neuron a contribution to the model output using input-to-baseline path integration.The neuron attributions sum to the total attribution across the selected layer, preserving completeness.
- Efficient approximation: The exact attribution computation is expensive because it requires gradients from each neuron to each input pixel across virtual images.The method assumes the former and latter gradient sequences are linearly independent, with zero covariance, to simplify the computation.
- Efficient approximation: NAA approximates each neuron’s attribution as relative activation Δy_j multiplied by Integrated Attention IA(y_j).This reduces the computation complexity from O(H ∗ W ∗ C) to O(1), using one gradient operation per integration step.
- Attack objective: The attack weights positive and negative neuron attributions separately, using γ and transformation functions f_p and f_n before constrained minimization.The adversarial example is optimized under an L∞ perturbation constraint and solved with MIM.
4. Experiments
Experiments evaluate NAA against feature-level and gradient-based baselines across undefended, adversarially trained, and advanced-defense models. Results show stronger black-box transferability, while ablations identify middle layers, n = 30, γ = 1, and linear attribution transformations as effective choices.
- Experiment Setup: The evaluation uses ImageNet models, 1000 validation images, four source architectures, and undefended, adversarially trained, and advanced-defense targets.Adversarial examples are tested in black-box transfer settings and on the source model in a white-box setting.
- Attack Results: NAA achieves nearly 100% white-box attack accuracy and outperforms all baselines in black-box transfer settings.Its white-box success is similar to FIA and slightly below MIM, but its black-box attack success rate is higher.
- Attack Results: 10.5%: NAA exceeds all baselines under every adversarial-training setting by a large margin.The comparison evaluates attacks against adversarially trained models and reports stronger transferability despite lower white-box success than MIM.
- Attack Results: 10.7%: NAA combined with PIM and DIM surpasses all baselines on average in black-box settings.The input transformations are applied to momentum-optimization-based attacks to further improve transferability.
- Ablation Study: Middle layers provide the best transferability; increasing integrated steps improves transferability but raises cost, motivating n = 30.Deep layers perform best in white-box attacks but overfit the source model, while γ = 1 and linear transformations perform best in weighted-attribution ablations.
5. Conclusion
NAA combines neuron attribution, an approximation scheme, and weighted feature-level optimization to craft transferable adversarial examples, outperforming state-of-the-art baselines.
- NAA estimates neuron importance with neuron attribution before launching feature-level attacks.
- An approximation scheme reduces the computation time required for neuron attribution.
- NAA minimizes a weighted combination of positive and negative neuron attribution values to generate adversarial samples.
- NAA outperforms state-of-the-art baselines by a considerable margin in experiments.