Adaptive Generation of Unrestricted Adversarial Inputs

Abstract

Neural networks are vulnerable to adversarially-constructed perturbations of their inputs. Most research so far has considered perturbations of a fixed magnitude under some $l_p$ norm. Although studying these attacks is valuable, there has been increasing interest in the construction of (and robustness to) unrestricted attacks, which are not constrained to a small and rather artificial subset of all possible adversarial inputs. We introduce a novel algorithm for generating such unrestricted adversarial inputs which, unlike prior work, is adaptive: it is able to tune its attacks to the classifier being targeted. It also offers a 400-2,000x speedup over the existing state of the art. We demonstrate our approach by generating unrestricted adversarial inputs that fool classifiers robust to perturbation-based attacks. We also show that, by virtue of being adaptive and unrestricted, our attack is able to defeat adversarial training against it.

Updated to include new results

References in corpus (18)

• Conditional Generative Adversarial Nets
• Large Scale GAN Training for High Fidelity Natural Image Synthesis
• Self-Attention Generative Adversarial Networks
• Conditional Image Synthesis With Auxiliary Classifier GANs
• NIPS 2016 Tutorial: Generative Adversarial Networks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Objective-Reinforced Generative Adversarial Networks (ORGAN) for Sequence Generation Models
• MolGAN: An implicit generative model for small molecular graphs
• Towards the first adversarially robust neural network model on MNIST
• Adversarial Examples: Attacks and Defenses for Deep Learning
• A General Framework for Adversarial Examples with Objectives
• Unrestricted Adversarial Examples
• Concolic Testing for Deep Neural Networks
• Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Network
• Global Robustness Evaluation of Deep Neural Networks with Provable Guarantees for the $L_0$ Norm
• A Research Agenda: Dynamic Models to Defend Against Correlated Attacks
• Global Adversarial Attacks for Assessing Deep Learning Robustness

Cited by in corpus (3)

• AdvSPADE: Realistic Unrestricted Attacks for Semantic Segmentation
• Evaluating Robustness to Context-Sensitive Feature Perturbations of Different Granularities
• Global Adversarial Attacks for Assessing Deep Learning Robustness