Built-in Vulnerabilities to Imperceptible Adversarial Perturbations
arXiv:1806.07409
Abstract
Designing models that are robust to small adversarial perturbations of their inputs has proven remarkably difficult. In this work we show that the reverse problem---making models more vulnerable---is surprisingly easy. After presenting some proofs of concept on MNIST, we introduce a generic tilting attack that injects vulnerabilities into the linear layers of pre-trained networks by increasing their sensitivity to components of low variance in the training data without affecting their performance on test data. We illustrate this attack on a multilayer perceptron trained on SVHN and use it to design a stand-alone adversarial module which we call a steganogram decoder. Finally, we show on CIFAR-10 that a poisoning attack with a poisoning rate as low as 0.1% can induce vulnerabilities to chosen imperceptible backdoor signals in state-of-the-art networks. Beyond their practical implications, these different results shed new light on the nature of the adversarial example phenomenon.
References in corpus (32)
- Ensemble Adversarial Training: Attacks and Defenses
- Wide Residual Networks
- On Calibration of Modern Neural Networks
- Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
- Understanding Black-box Predictions via Influence Functions
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Delving into Transferable Adversarial Examples and Black-box Attacks
- Poisoning Attacks against Support Vector Machines
- Synthesizing Robust Adversarial Examples
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Adversarially Robust Generalization Requires More Data
- Detecting Adversarial Samples from Artifacts
- On the (Statistical) Detection of Adversarial Examples
- Robustness May Be at Odds with Accuracy
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- Adversarial Examples for Evaluating Reading Comprehension Systems
- NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehicles
- Generating Steganographic Images via Adversarial Training
- Measuring the tendency of CNNs to Learn Surface Statistical Regularities
- CycleGAN, a Master of Steganography
- Foveation-based Mechanisms Alleviate Adversarial Examples
- A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples
- Provably Minimally-Distorted Adversarial Examples
- Unrestricted Adversarial Examples
- Adversarial Manipulation of Deep Representations
- Adversarial Examples for Semantic Image Segmentation
- Robustness of classifiers to universal perturbations: a geometric perspective
- Adversarial examples for generative models
- Query-Efficient Black-box Adversarial Examples (superceded)
- Adversarial Training Versus Weight Decay
- Large Margin Deep Networks for Classification