Adversarial Reprogramming of Neural Networks

Abstract

Deep neural networks are susceptible to \emph{adversarial} attacks. In computer vision, well-crafted perturbations to images can cause neural networks to make mistakes such as confusing a cat with a computer. Previous adversarial attacks have been designed to degrade performance of models or cause machine learning models to produce specific outputs chosen ahead of time by the attacker. We introduce attacks that instead {\em reprogram} the target model to perform a task chosen by the attacker---without the attacker needing to specify or compute the desired output for each test-time input. This attack finds a single adversarial perturbation, that can be added to all test-time inputs to a machine learning model in order to cause the model to perform a task chosen by the adversary---even if the model was not trained to do this task. These perturbations can thus be considered a program for the new task. We demonstrate adversarial reprogramming on six ImageNet classification models, repurposing these models to perform a counting task, as well as classification tasks: classification of MNIST and CIFAR-10 examples presented as inputs to the ImageNet model.

References in corpus (13)

• DeCAF: A Deep Convolutional Activation Feature for Generic Visual Recognition
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• CNN Features off-the-shelf: an Astounding Baseline for Recognition
• Deep Neural Networks as Gaussian Processes
• Robust Physical-World Attacks on Deep Learning Models
• On the Expressive Power of Deep Neural Networks
• Interpretation of Neural Networks is Fragile
• Neural Programmer: Inducing Latent Programs with Gradient Descent
• A Powerful Generative Model Using Random Weights for the Deep Image Representation
• Measuring the Intrinsic Dimension of Objective Landscapes
• Adversarial examples for generative models
• Texture Synthesis Using Shallow Convolutional Networks with Random Filters

Cited by in corpus (9)

• On the Opportunities and Risks of Foundation Models
• Adversarial Attacks on Deep Learning Models in Natural Language Processing: A Survey
• Adversarial Machine Learning -- Industry Perspectives
• Beneficial Perturbation Network for designing general adaptive artificial intelligence systems
• Protecting Neural Networks with Hierarchical Random Switching: Towards Better Robustness-Accuracy Trade-off for Stochastic Defenses
• Adversarial Security Attacks and Perturbations on Machine Learning and Deep Learning Methods
• Mental Models of Adversarial Machine Learning
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack
• Bayesian Generative Models for Knowledge Transfer in MRI Semantic Segmentation Problems