Constructing Unrestricted Adversarial Examples with Generative Models

Abstract

Adversarial examples are typically constructed by perturbing an existing data point within a small matrix norm, and current defense methods are focused on guarding against this type of attack. In this paper, we propose unrestricted adversarial examples, a new threat model where the attackers are not restricted to small norm-bounded perturbations. Different from perturbation-based attacks, we propose to synthesize unrestricted adversarial examples entirely from scratch using conditional generative models. Specifically, we first train an Auxiliary Classifier Generative Adversarial Network (AC-GAN) to model the class-conditional distribution over data samples. Then, conditioned on a desired class, we search over the AC-GAN latent space to find images that are likely under the generative model and are misclassified by a target classifier. We demonstrate through human evaluation that unrestricted adversarial examples generated this way are legitimate and belong to the desired class. Our empirical results on the MNIST, SVHN, and CelebA datasets show that unrestricted adversarial examples can bypass strong adversarial training and certified defense methods designed for traditional adversarial attacks.

arXiv commentNeural Information Processing Systems (NeurIPS 2018)

References in corpus (16)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Conditional Image Synthesis With Auxiliary Classifier GANs
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• Certified Defenses against Adversarial Examples
• Generating Natural Adversarial Examples
• A DIRT-T Approach to Unsupervised Domain Adaptation
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Generating Adversarial Examples with Adversarial Networks
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Houdini: Fooling Deep Structured Prediction Models
• Multi-Agent Generative Adversarial Imitation Learning
• Generative Adversarial Trainer: Defense to Adversarial Perturbations with GAN
• Unrestricted Adversarial Examples
• Flow-GAN: Combining Maximum Likelihood and Adversarial Learning in Generative Models

Cited by in corpus (26)

• On Evaluating Adversarial Robustness
• Natural Adversarial Examples
• Testing Robustness Against Unforeseen Adversaries
• Unrestricted Adversarial Examples via Semantic Manipulation
• The Limitations of Adversarial Training and the Blind-Spot Attack
• Rigorous Agent Evaluation: An Adversarial Approach to Uncover Catastrophic Failures
• Deep Verifier Networks: Verification of Deep Discriminative Models with Deep Generative Models
• Software Testing for Machine Learning
• Exposing Previously Undetectable Faults in Deep Neural Networks
• Generative Adversarial Networks: A Survey Towards Private and Secure Applications
• ECGadv: Generating Adversarial Electrocardiogram to Misguide Arrhythmia Classification System
• Adversarial Defense by Latent Style Transformations
• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Universal Adversarial Attacks with Natural Triggers for Text Classification
• Towards Efficiently Evaluating the Robustness of Deep Neural Networks in IoT Systems: A GAN-based Method
• GAP++: Learning to generate target-conditioned adversarial examples
• Detecting Out-of-distribution Samples via Variational Auto-encoder with Reliable Uncertainty Estimation
• Transferable Sparse Adversarial Attack
• Generating Out of Distribution Adversarial Attack using Latent Space Poisoning
• PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Driving
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Stovepiping and Malicious Software: A Critical Review of AGI Containment
• SINVAD: Search-based Image Space Navigation for DNN Image Classifier Test Input Generation
• Adversarial Examples as an Input-Fault Tolerance Problem
• Amicable Aid: Perturbing Images to Improve Classification Performance
• A Systematical Solution for Face De-identification