Understanding and Enhancing the Transferability of Adversarial Examples

Abstract

State-of-the-art deep neural networks are known to be vulnerable to adversarial examples, formed by applying small but malicious perturbations to the original inputs. Moreover, the perturbations can \textit{transfer across models}: adversarial examples generated for a specific model will often mislead other unseen models. Consequently the adversary can leverage it to attack deployed systems without any query, which severely hinder the application of deep learning, especially in the areas where security is crucial. In this work, we systematically study how two classes of factors that might influence the transferability of adversarial examples. One is about model-specific factors, including network architecture, model capacity and test accuracy. The other is the local smoothness of loss function for constructing adversarial examples. Based on these understanding, a simple but effective strategy is proposed to enhance transferability. We call it variance-reduced attack, since it utilizes the variance-reduced gradient to generate adversarial example. The effectiveness is confirmed by a variety of experiments on both CIFAR-10 and ImageNet datasets.

arXiv comment15 pages

References in corpus (16)

• Explaining and Harnessing Adversarial Examples
• Ensemble Adversarial Training: Attacks and Defenses
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• SmoothGrad: removing noise by adding noise
• Synthesizing Robust Adversarial Examples
• The Space of Transferable Adversarial Examples
• Spatially Transformed Adversarial Examples
• NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
• Entropy-SGD: Biasing Gradient Descent Into Wide Valleys
• Practical Black-Box Attacks against Machine Learning
• Universal adversarial perturbations
• Towards Interpretable Deep Neural Networks by Leveraging Adversarial Examples
• Boosting Adversarial Attacks with Momentum

Cited by in corpus (29)

• Adversarial Examples: Opportunities and Challenges
• Biometric Backdoors: A Poisoning Attack Against Unsupervised Template Updating
• The Neural Network Approach to Inverse Problems in Differential Equations
• Towards a Robust Deep Neural Network in Texts: A Survey
• Enhancing the Robustness of Deep Neural Networks by Boundary Conditional GAN
• A Unified Approach to Interpreting and Boosting Adversarial Transferability
• Curls & Whey: Boosting Black-Box Adversarial Attacks
• Transferable Universal Adversarial Perturbations Using Generative Models
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• Boosting Gradient for White-Box Adversarial Attacks
• Dynamically Sampled Nonlocal Gradients for Stronger Adversarial Attacks
• Unrestricted Adversarial Attacks on ImageNet Competition
• Adversarial Learning with Margin-based Triplet Embedding Regularization
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations
• Adversarial Attack across Datasets
• Improving the Transferability of Adversarial Examples with New Iteration Framework and Input Dropout
• Reducing Adversarial Example Transferability Using Gradient Regularization
• Adversarial Light Projection Attacks on Face Recognition Systems: A Feasibility Study
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Who's Afraid of Adversarial Transferability?
• Network transferability of adversarial patches in real-time object detection
• Query-Free Adversarial Transfer via Undertrained Surrogates
• Adversarial Ranking Attack and Defense
• Orthogonal Deep Models As Defense Against Black-Box Attacks
• On the Transferability of Adversarial Attacksagainst Neural Text Classifier
• Attack to Fool and Explain Deep Networks
• CD-UAP: Class Discriminative Universal Adversarial Perturbation
• On the Vulnerability of CNN Classifiers in EEG-Based BCIs