Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses

Abstract

This paper focuses on learning transferable adversarial examples specifically against defense models (models to defense adversarial attacks). In particular, we show that a simple universal perturbation can fool a series of state-of-the-art defenses. Adversarial examples generated by existing attacks are generally hard to transfer to defense models. We observe the property of regional homogeneity in adversarial perturbations and suggest that the defenses are less robust to regionally homogeneous perturbations. Therefore, we propose an effective transforming paradigm and a customized gradient transformer module to transform existing perturbations into regionally homogeneous ones. Without explicitly forcing the perturbations to be universal, we observe that a well-trained gradient transformer module tends to output input-independent gradients (hence universal) benefiting from the under-fitting phenomenon. Thorough experiments demonstrate that our work significantly outperforms the prior art attacking algorithms (either image-dependent or universal ones) by an average improvement of 14.0% when attacking 9 defenses in the transfer-based attack setting. In addition to the cross-model transferability, we also verify that regionally homogeneous perturbations can well transfer across different vision tasks (attacking with the semantic segmentation task and testing on the object detection task). The code is available here: https://github.com/LiYingwei/Regional-Homogeneity.

arXiv commentECCV 2020. Project page: https://github.com/LiYingwei/Regional-Homogeneity

References in corpus (33)

• Adam: A Method for Stochastic Optimization
• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• Instance Normalization: The Missing Ingredient for Fast Stylization
• Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
• An Overview of Multi-Task Learning in Deep Neural Networks
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Robustness May Be at Odds with Accuracy
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• A study of the effect of JPG compression on adversarial images
• Stochastic Activation Pruning for Robust Adversarial Defense
• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Fast Feature Fool: A data independent approach to universal adversarial perturbations
• Smooth Adversarial Training
• Practical Black-Box Attacks against Machine Learning
• Low Frequency Adversarial Perturbation
• Cross-Domain Transferability of Adversarial Perturbations
• Graph Structure Learning for Robust Graph Neural Networks
• Data Poisoning Attack against Unsupervised Node Embedding Methods
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Art of singular vectors and universal adversarial perturbations
• Adversarial Attacks on Monocular Depth Estimation
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• Adversarial Metric Attack and Defense for Person Re-identification
• GAP++: Learning to generate target-conditioned adversarial examples
• Patch-wise Attack for Fooling Deep Neural Network

Cited by in corpus (12)

• Transferring Robustness for Graph Neural Network Against Poisoning Attacks
• Defending Against Universal Attacks Through Selective Feature Regeneration
• Adversarial Attacks and Defenses on Graphs: A Review, A Tool and Empirical Studies
• Node Similarity Preserving Graph Convolutional Networks
• Fine-grained Synthesis of Unrestricted Adversarial Examples
• GAP++: Learning to generate target-conditioned adversarial examples
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Deep Neural Network Ensembles against Deception: Ensemble Diversity, Accuracy and Robustness
• Resilience of Autonomous Vehicle Object Category Detection to Universal Adversarial Perturbations
• Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks
• Patch-wise Attack for Fooling Deep Neural Network
• Adversarial Attacks with Time-Scale Representations