Fast Feature Fool: A data independent approach to universal adversarial perturbations

Abstract

State-of-the-art object recognition Convolutional Neural Networks (CNNs) are shown to be fooled by image agnostic perturbations, called universal adversarial perturbations. It is also observed that these perturbations generalize across multiple networks trained on the same target data. However, these algorithms require training data on which the CNNs were trained and compute adversarial perturbations via complex optimization. The fooling performance of these approaches is directly proportional to the amount of available training data. This makes them unsuitable for practical attacks since its unreasonable for an attacker to have access to the training data. In this paper, for the first time, we propose a novel data independent approach to generate image agnostic perturbations for a range of CNNs trained for object recognition. We further show that these perturbations are transferable across multiple network architectures trained either on same or different data. In the absence of data, our method generates universal adversarial perturbations efficiently via fooling the features learned at multiple layers thereby causing CNNs to misclassify. Experiments demonstrate impressive fooling rates and surprising transferability for the proposed universal perturbations generated without any training data.

arXiv commentBMVC 2017 and codes are available at https://github.com/utsavgarg/fast-feature-fool

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Return of the Devil in the Details: Delving Deep into Convolutional Nets
• Adversarial Machine Learning at Scale
• Universal adversarial perturbations
• Adversarial Manipulation of Deep Representations

Cited by in corpus (42)

• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• A Survey On Universal Adversarial Attack
• Adversarial Perturbations Against Real-Time Video Classification Systems
• Exploring the Space of Black-box Attacks on Deep Neural Networks
• Adversarial Examples in Modern Machine Learning: A Review
• Detecting Adversarial Samples for Deep Neural Networks through Mutation Testing
• Defending Against Universal Attacks Through Selective Feature Regeneration
• The Vulnerability of Semantic Segmentation Networks to Adversarial Attacks in Autonomous Driving: Enhancing Extensive Environment Sensing
• Task-generalizable Adversarial Attack based on Perceptual Metric
• Universal Adversarial Perturbations: A Survey
• When and How to Fool Explainable Models (and Humans) with Adversarial Examples
• Divide, Denoise, and Defend against Adversarial Attacks
• Universal adversarial examples in speech command classification
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Improving adversarial robustness of deep neural networks by using semantic information
• T-Miner: A Generative Approach to Defend Against Trojan Attacks on DNN-based Text Classification
• Geometry-Inspired Top-k Adversarial Perturbations
• Gradient Band-based Adversarial Training for Generalized Attack Immunity of A3C Path Finding
• Universal Adversarial Perturbation for Text Classification
• Deep Neural Network Concepts for Background Subtraction: A Systematic Review and Comparative Evaluation
• Convergence and Margin of Adversarial Training on Separable Data
• Decision-based Universal Adversarial Attack
• Frequency-Tuned Universal Adversarial Attacks
• Who's Afraid of Adversarial Queries? The Impact of Image Modifications on Content-based Image Retrieval
• A Method for Computing Class-wise Universal Adversarial Perturbations
• Performance Evaluation of Adversarial Attacks: Discrepancies and Solutions
• Label Universal Targeted Attack
• One Bit Matters: Understanding Adversarial Examples as the Abuse of Redundancy
• Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations
• Towards an Understanding of Neural Networks in Natural-Image Spaces
• Meta Adversarial Training against Universal Patches
• Technologies for Trustworthy Machine Learning: A Survey in a Socio-Technical Context
• A Self-supervised Approach for Adversarial Robustness
• Butterfly Effect: Bidirectional Control of Classification Performance by Small Additive Perturbation
• On the Structural Sensitivity of Deep Convolutional Networks to the Directions of Fourier Basis Functions
• Real-time Detection of Practical Universal Adversarial Perturbations
• Distribution Discrepancy Maximization for Image Privacy Preserving
• Adversarial Attacks with Time-Scale Representations
• Attack to Fool and Explain Deep Networks
• CD-UAP: Class Discriminative Universal Adversarial Perturbation
• Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressions
• Deep Bayesian Image Set Classification: A Defence Approach against Adversarial Attacks