Wasserstein Adversarial Examples via Projected Sinkhorn Iterations

Abstract

A rapidly growing area of work has studied the existence of adversarial examples, datapoints which have been perturbed to fool a classifier, but the vast majority of these works have focused primarily on threat models defined by ${\ell }_p$ norm-bounded perturbations. In this paper, we propose a new threat model for adversarial attacks based on the Wasserstein distance. In the image classification setting, such distances measure the cost of moving pixel mass, which naturally cover "standard" image manipulations such as scaling, rotation, translation, and distortion (and can potentially be applied to other settings as well). To generate Wasserstein adversarial examples, we develop a procedure for projecting onto the Wasserstein ball, based upon a modified version of the Sinkhorn iteration. The resulting algorithm can successfully attack image classification models, bringing traditional CIFAR10 models down to 3% accuracy within a Wasserstein ball with radius 0.1 (i.e., moving 10% of the image mass 1 pixel), and we demonstrate that PGD-based adversarial training can improve this adversarial accuracy to 76%. In total, this work opens up a new direction of study in adversarial robustness, more formally considering convex metrics that accurately capture the invariances that we typically believe should exist in classifiers. Code for all experiments in the paper is available at https://github.com/locuslab/projected_sinkhorn.

Cited by in corpus (18)

• Measuring Robustness to Natural Distribution Shifts in Image Classification
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• A Review of Adversarial Attack and Defense for Classification Methods
• MetaPoison: Practical General-purpose Clean-label Data Poisoning
• Instance adaptive adversarial training: Improved accuracy tradeoffs in neural nets
• Lipschitz constant estimation of Neural Networks via sparse polynomial optimization
• SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editing
• Scalable Optimal Transport Methods in Machine Learning: A Contemporary Survey
• Adversarial Lipschitz Regularization
• Minibatch optimal transport distances; analysis and applications
• Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attacks
• Random Smoothing Might be Unable to Certify ${\ell }_{\infty }$ Robustness for High-Dimensional Images
• Adversarial Color Enhancement: Generating Unrestricted Adversarial Images by Optimizing a Color Filter
• Towards Large yet Imperceptible Adversarial Image Perturbations with Perceptual Color Distance
• SOAR: Second-Order Adversarial Regularization
• The Intriguing Relation Between Counterfactual Explanations and Adversarial Examples
• Improving Hierarchical Adversarial Robustness of Deep Neural Networks
• Human Imperceptible Attacks and Applications to Improve Fairness