Generating Adversarial Examples with Adversarial Networks

Abstract

Deep neural networks (DNNs) have been found to be vulnerable to adversarial examples resulting from adding small-magnitude perturbations to inputs. Such adversarial examples can mislead DNNs to produce adversary-selected results. Different attack strategies have been proposed to generate adversarial examples, but how to produce them with high perceptual quality and more efficiently requires more research efforts. In this paper, we propose AdvGAN to generate adversarial examples with generative adversarial networks (GANs), which can learn and approximate the distribution of original instances. For AdvGAN, once the generator is trained, it can generate adversarial perturbations efficiently for any instance, so as to potentially accelerate adversarial training as defenses. We apply AdvGAN in both semi-whitebox and black-box attack settings. In semi-whitebox attacks, there is no need to access the original target model after the generator is trained, in contrast to traditional white-box attacks. In black-box attacks, we dynamically train a distilled model for the black-box model and optimize the generator accordingly. Adversarial examples generated by AdvGAN on different target models have high attack success rate under state-of-the-art defenses compared to other attacks. Our attack has placed the first with 92.76% accuracy on a public MNIST black-box attack challenge.

arXiv commentAccepted to IJCAI2018

References in corpus (16)

• Adam: A Method for Stochastic Optimization
• Distilling the Knowledge in a Neural Network
• Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
• Ensemble Adversarial Training: Attacks and Defenses
• Wide Residual Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Improved Training of Wasserstein GANs
• Delving into Transferable Adversarial Examples and Black-box Attacks
• BEGAN: Boundary Equilibrium Generative Adversarial Networks
• Robust Physical-World Attacks on Deep Learning Models
• The Space of Transferable Adversarial Examples
• Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN
• Spatially Transformed Adversarial Examples
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• DeepFool: a simple and accurate method to fool deep neural networks
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong

Cited by in corpus (93)

• TextBugger: Generating Adversarial Text Against Real-world Applications
• Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks
• Constructing Unrestricted Adversarial Examples with Generative Models
• Defense Against Adversarial Attacks Using Feature Scattering-based Adversarial Training
• Unrestricted Adversarial Examples via Semantic Manipulation
• Action Robust Reinforcement Learning and Applications in Continuous Control
• Adversarial Objects Against LiDAR-Based Autonomous Driving Systems
• Privacy Intelligence: A Survey on Image Privacy in Online Social Networks
• The Limitations of Adversarial Training and the Blind-Spot Attack
• RAB: Provable Robustness Against Backdoor Attacks
• Poisoning Attacks with Generative Adversarial Nets
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks
• Learning perturbation sets for robust machine learning
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Adversarially Robust Neural Architectures
• Transferable Adversarial Attacks for Image and Video Object Detection
• Learning to Defend by Learning to Attack
• Software Testing for Machine Learning
• Generative Adversarial Networks: A Survey Towards Private and Secure Applications
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Viewmaker Networks: Learning Views for Unsupervised Representation Learning
• Towards resilient machine learning for ransomware detection
• Generating 3D Adversarial Point Clouds
• Towards Visual Distortion in Black-Box Attacks
• Stackelberg GAN: Towards Provable Minimax Equilibrium via Multi-Generator Architectures
• Improving Robustness of Deep-Learning-Based Image Reconstruction
• A Provable Defense for Deep Residual Networks
• Adversarial symmetric GANs: bridging adversarial samples and adversarial networks
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems
• Orchestrating the Development Lifecycle of Machine Learning-Based IoT Applications: A Taxonomy and Survey
• Transferable Universal Adversarial Perturbations Using Generative Models
• Bias-based Universal Adversarial Patch Attack for Automatic Check-out
• GreedyFool: Distortion-Aware Sparse Adversarial Attack
• Fast Real-time Counterfactual Explanations
• Elephant in the Room: An Evaluation Framework for Assessing Adversarial Examples in NLP
• Sparse Adversarial Video Attacks with Spatial Transformations
• GAN- vs. JPEG2000 Image Compression for Distributed Automotive Perception: Higher Peak SNR Does Not Mean Better Semantic Segmentation
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Generative Dynamic Patch Attack
• Image Transformation can make Neural Networks more robust against Adversarial Examples
• On the Certified Robustness for Ensemble Models and Beyond
• GAP++: Learning to generate target-conditioned adversarial examples
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• Transferable Sparse Adversarial Attack
• Application-driven Privacy-preserving Data Publishing with Correlated Attributes
• Fooling thermal infrared pedestrian detectors in real world using small bulbs
• Cooling-Shrinking Attack: Blinding the Tracker with Imperceptible Noises
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Transformer-based Language Model Fine-tuning Methods for COVID-19 Fake News Detection
• Improving Transferability of Adversarial Patches on Face Recognition with Generative Models
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• Using a GAN to Generate Adversarial Examples to Facial Image Recognition
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Semantic-preserving Reinforcement Learning Attack Against Graph Neural Networks for Malware Detection
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Grey-box Adversarial Attack And Defence For Sentiment Classification
• QEBA: Query-Efficient Boundary-Based Blackbox Attack
• AutoGAN: Robust Classifier Against Adversarial Attacks
• Approximating Human Judgment of Generated Image Quality
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Customizing an Adversarial Example Generator with Class-Conditional GANs
• LAFEAT: Piercing Through Adversarial Defenses with Latent Features
• Towards an Explanation Space to Align Humans and Explainable-AI Teamwork
• Few-Features Attack to Fool Machine Learning Models through Mask-Based GAN
• Defending Against Image Corruptions Through Adversarial Augmentations
• Auditing AI models for Verified Deployment under Semantic Specifications
• Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
• Brain-inspired reverse adversarial examples
• Adversarial Attack Type I: Cheat Classifiers by Significant Changes
• Distributional Robustness with IPMs and links to Regularization and GANs
• Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• Combining Similarity and Adversarial Learning to Generate Visual Explanation: Application to Medical Image Classification
• Vax-a-Net: Training-time Defence Against Adversarial Patch Attacks
• Automated Detection System for Adversarial Examples with High-Frequency Noises Sieve
• Once a MAN: Towards Multi-Target Attack via Learning Multi-Target Adversarial Network Once
• Understanding the Error in Evaluating Adversarial Robustness
• Temporally-Transferable Perturbations: Efficient, One-Shot Adversarial Attacks for Online Visual Object Trackers
• Robust Training Using Natural Transformation
• Enabling Data Diversity: Efficient Automatic Augmentation via Regularized Adversarial Training
• Ensemble Generative Cleaning with Feedback Loops for Defending Adversarial Attacks
• Generating Adversarial Inputs Using A Black-box Differential Technique
• Cellular State Transformations using Generative Adversarial Networks
• Security Analysis of Capsule Network Inference using Horizontal Collaboration
• Improving Resistance to Adversarial Deformations by Regularizing Gradients
• Synthesizing Unrestricted False Positive Adversarial Objects Using Generative Models
• Learning Task-aware Robust Deep Learning Systems
• Explainable Adversarial Attacks in Deep Neural Networks Using Activation Profiles
• Fast Local Attack: Generating Local Adversarial Examples for Object Detectors
• PredCoin: Defense against Query-based Hard-label Attack