Distributionally Adversarial Attack

Abstract

Recent work on adversarial attack has shown that Projected Gradient Descent (PGD) Adversary is a universal first-order adversary, and the classifier adversarially trained by PGD is robust against a wide range of first-order attacks. It is worth noting that the original objective of an attack/defense model relies on a data distribution $p(\mathbf{x})$, typically in the form of risk maximization/minimization, e.g., $\max /\min {\mathbb{E}}_{p((x))}\mathcal{L}(\mathbf{x})$ with $p(\mathbf{x})$ some unknown data distribution and $\mathcal{L}(\cdot )$ a loss function. However, since PGD generates attack samples independently for each data sample based on $\mathcal{L}(\cdot )$, the procedure does not necessarily lead to good generalization in terms of risk optimization. In this paper, we achieve the goal by proposing distributionally adversarial attack (DAA), a framework to solve an optimal {\em adversarial-data distribution}, a perturbed distribution that satisfies the $L_{\infty }$ constraint but deviates from the original data distribution to increase the generalization risk maximally. Algorithmically, DAA performs optimization on the space of potential data distributions, which introduces direct dependency between all data points when generating adversarial samples. DAA is evaluated by attacking state-of-the-art defense models, including the adversarially-trained models provided by {\em MIT MadryLab}. Notably, DAA ranks {\em the first place} on MadryLab's white-box leaderboards, reducing the accuracy of their secret MNIST model to $88.79\%$ (with $l_{\infty }$ perturbations of $\epsilon =0.3$) and the accuracy of their secret CIFAR model to $44.71\%$ (with $l_{\infty }$ perturbations of $\epsilon =8.0$). Code for the experiments is released on \url{https://github.com/tianzheng4/Distributionally-Adversarial-Attack}.

arXiv commentaccepted to AAAI-19

References in corpus (12)

• Ensemble Adversarial Training: Attacks and Defenses
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Machine Learning at Scale
• Stein Variational Gradient Descent: A General Purpose Bayesian Inference Algorithm
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• Do CIFAR-10 Classifiers Generalize to CIFAR-10?
• Attacking the Madry Defense Model with $L_1$-based Adversarial Examples
• Stein Variational Policy Gradient
• Tackling Over-pruning in Variational Autoencoders
• A Unified Particle-Optimization Framework for Scalable Bayesian Sampling
• Curriculum Adversarial Training

Cited by in corpus (8)

• Accurate, reliable and fast robustness evaluation
• The Limitations of Adversarial Training and the Blind-Spot Attack
• On the Geometry of Adversarial Examples
• PointCloud Saliency Maps
• Structure-Preserving Transformation: Generating Diverse and Transferable Adversarial Examples
• Efficient Project Gradient Descent for Ensemble Adversarial Attack
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• Towards Sharper First-Order Adversary with Quantized Gradients