Boosting Adversarial Attacks with Momentum

Abstract

Deep neural networks are vulnerable to adversarial examples, which poses security concerns on these algorithms due to the potentially severe consequences. Adversarial attacks serve as an important surrogate to evaluate the robustness of deep learning models before they are deployed. However, most of existing adversarial attacks can only fool a black-box model with a low success rate. To address this issue, we propose a broad class of momentum-based iterative algorithms to boost adversarial attacks. By integrating the momentum term into the iterative process for attacks, our methods can stabilize update directions and escape from poor local maxima during the iterations, resulting in more transferable adversarial examples. To further improve the success rates for black-box attacks, we apply momentum iterative algorithms to an ensemble of models, and show that the adversarially trained models with a strong defense ability are also vulnerable to our black-box attacks. We hope that the proposed methods will serve as a benchmark for evaluating the robustness of various deep models and defense methods. With this method, we won the first places in NIPS 2017 Non-targeted Adversarial Attack and Targeted Adversarial Attack competitions.

arXiv commentCVPR 2018 Spotlight

References in corpus (13)

• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Deep Residual Learning for Image Recognition
• Ensemble Adversarial Training: Attacks and Defenses
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Rethinking the Inception Architecture for Computer Vision
• Rich feature hierarchies for accurate object detection and semantic segmentation
• Adversarial Machine Learning at Scale
• Dropout Inference in Bayesian Neural Networks with Alpha-divergences
• Practical Black-Box Attacks against Machine Learning
• Universal adversarial perturbations
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• Towards Robust Detection of Adversarial Examples

Cited by in corpus (27)

• AdvHat: Real-world adversarial attack on ArcFace Face ID system
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Understanding Measures of Uncertainty for Adversarial Example Detection
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Understanding and Enhancing the Transferability of Adversarial Examples
• Security and Privacy Issues in Deep Learning
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Enhancing Adversarial Example Transferability with an Intermediate Level Attack
• Towards a Robust Deep Neural Network in Texts: A Survey
• Sparse Adversarial Perturbations for Videos
• FenceBox: A Platform for Defeating Adversarial Examples with Data Augmentation Techniques
• Mitigating Advanced Adversarial Attacks with More Advanced Gradient Obfuscation Techniques
• On Improving Adversarial Transferability of Vision Transformers
• Enhancing Cross-task Black-Box Transferability of Adversarial Examples with Dispersion Reduction
• Improving Adversarial Robustness in Weight-quantized Neural Networks
• PointCloud Saliency Maps
• AVA: Adversarial Vignetting Attack against Visual Recognition
• Intermediate Level Adversarial Attack for Enhanced Transferability
• A Self-supervised Approach for Adversarial Robustness
• FineFool: Fine Object Contour Attack via Attention
• Spot Evasion Attacks: Adversarial Examples for License Plate Recognition Systems with Convolutional Neural Networks
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• Defective Convolutional Networks
• Ensemble-in-One: Learning Ensemble within Random Gated Networks for Enhanced Adversarial Robustness
• Feedback Learning for Improving the Robustness of Neural Networks
• A cryptographic approach to black box adversarial machine learning
• Mixing between the Cross Entropy and the Expectation Loss Terms