Adversarial Transformation Networks: Learning to Generate Adversarial Examples

Abstract

Multiple different approaches of generating adversarial examples have been proposed to attack deep neural networks. These approaches involve either directly computing gradients with respect to the image pixels, or directly solving an optimization on the image pixels. In this work, we present a fundamentally new method for generating adversarial examples that is fast to execute and provides exceptional diversity of output. We efficiently train feed-forward neural networks in a self-supervised manner to generate adversarial examples against a target network or set of networks. We call such a network an Adversarial Transformation Network (ATN). ATNs are trained to generate adversarial examples that minimally modify the classifier's outputs given the original input, while constraining the new classification to match an adversarial target class. We present methods to train ATNs and analyze their effectiveness targeting a variety of MNIST classifiers as well as the latest state-of-the-art ImageNet classifier Inception ResNet v2.

References in corpus (2)

• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Texture Networks: Feed-forward Synthesis of Textures and Stylized Images

Cited by in corpus (66)

• Ensemble Adversarial Training: Attacks and Defenses
• Adversarial Examples: Opportunities and Challenges
• Generating Adversarial Examples with Adversarial Networks
• Natural Adversarial Examples
• Adversarial Example Detection for DNN Models: A Review and Experimental Comparison
• Adversarial Machine Learning in Image Classification: A Survey Towards the Defender's Perspective
• Constructing Unrestricted Adversarial Examples with Generative Models
• UPSET and ANGRI : Breaking High Performance Image Classifiers
• Malware Makeover: Breaking ML-based Static Analysis by Modifying Executable Bytes
• Security and Privacy Issues in Deep Learning
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety
• Model Patching: Closing the Subgroup Performance Gap with Data Augmentation
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inference
• Adversarial Distributional Training for Robust Deep Learning
• AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networks
• Learning to Defend by Learning to Attack
• Divide, Denoise, and Defend against Adversarial Attacks
• Generative Adversarial Networks: A Survey Towards Private and Secure Applications
• Black-box adversarial attacks using Evolution Strategies
• Stabilized Medical Image Attacks
• Security and Privacy for Artificial Intelligence: Opportunities and Challenges
• Adversarial Examples on Object Recognition: A Comprehensive Survey
• Generating Image Adversarial Examples by Embedding Digital Watermarks
• Geometric robustness of deep networks: analysis and improvement
• Towards Efficiently Evaluating the Robustness of Deep Neural Networks in IoT Systems: A GAN-based Method
• Targeted Nonlinear Adversarial Perturbations in Images and Videos
• Generative Dynamic Patch Attack
• Category-wise Attack: Transferable Adversarial Examples for Anchor Free Object Detection
• DAmageNet: A Universal Adversarial Dataset
• A Closer Look at Data Bias in Neural Extractive Summarization Models
• GAP++: Learning to generate target-conditioned adversarial examples
• Learning from Higher-Layer Feature Visualizations
• BASAR:Black-box Attack on Skeletal Action Recognition
• Transferable Sparse Adversarial Attack
• $n$-ML: Mitigating Adversarial Examples via Ensembles of Topologically Manipulated Classifiers
• A geometry-inspired decision-based attack
• Distortion Agnostic Deep Watermarking
• Adversarial Attacks on Multivariate Time Series
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Machine vs Machine: Minimax-Optimal Defense Against Adversarial Examples
• AutoGAN: Robust Classifier Against Adversarial Attacks
• CAAD 2018: Generating Transferable Adversarial Examples
• Active Subspace of Neural Networks: Structural Analysis and Universal Attacks
• Butterfly Effect: Bidirectional Control of Classification Performance by Small Additive Perturbation
• Defending Against Image Corruptions Through Adversarial Augmentations
• Multi-Task Adversarial Attack
• Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
• Prototype-supervised Adversarial Network for Targeted Attack of Deep Hashing
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• Moving Target Defense for Deep Visual Sensing against Adversarial Examples
• Thinking Outside the Pool: Active Training Image Creation for Relative Attributes
• Implicit Generative Modeling of Random Noise during Training for Adversarial Robustness
• Adversarial Black-Box Attacks On Text Classifiers Using Multi-Objective Genetic Optimization Guided By Deep Networks
• Techniques for Adversarial Examples Threatening the Safety of Artificial Intelligence Based Systems
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• Universal Adversarial Perturbations for CNN Classifiers in EEG-Based BCIs
• An Evasion Attack against Stacked Capsule Autoencoder
• Robust Training Using Natural Transformation
• CAAD 2018: Powerful None-Access Black-Box Attack Based on Adversarial Transformation Network
• Model-Agnostic Meta-Attack: Towards Reliable Evaluation of Adversarial Robustness
• Fast Local Attack: Generating Local Adversarial Examples for Object Detectors
• Defending Against Adversarial Attacks Using Random Forests
• Learning Realistic Patterns from Unrealistic Stimuli: Generalization and Data Anonymization
• Evolution Attack On Neural Networks