Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling

Abstract

Adversarial attacks on deep neural networks traditionally rely on a constrained optimization paradigm, where an optimization procedure is used to obtain a single adversarial perturbation for a given input example. In this work we frame the problem as learning a distribution of adversarial perturbations, enabling us to generate diverse adversarial distributions given an unperturbed input. We show that this framework is domain-agnostic in that the same framework can be employed to attack different input domains with minimal modification. Across three diverse domains---images, text, and graphs---our approach generates whitebox attacks with success rates that are competitive with or superior to existing approaches, with a new state-of-the-art achieved in the graph domain. Finally, we demonstrate that our framework can efficiently generate a diverse set of attacks for a single given input, and is even capable of attacking \textit{unseen} test instances in a zero-shot manner, exhibiting attack generalization.

References in corpus (15)

• Adam: A Method for Stochastic Optimization
• Auto-Encoding Variational Bayes
• Semi-Supervised Classification with Graph Convolutional Networks
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Adversarial Attacks on Neural Networks for Graph Data
• Generating Natural Adversarial Examples
• Adversarial Attack and Defense on Graph Data: A Survey
• Generating Adversarial Examples with Adversarial Networks
• Adversarial Transformation Networks: Learning to Generate Adversarial Examples
• Adversarial Attack on Graph Structured Data
• REBAR: Low-variance, unbiased gradient estimates for discrete latent variable models
• HotFlip: White-Box Adversarial Examples for Text Classification
• Adversarial Texts with Gradient Methods
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks

Cited by in corpus (5)

• Adversarial Attack and Defense on Graph Data: A Survey
• A Survey of Adversarial Learning on Graphs
• Adversarial Example Games
• DeepInsight: Interpretability Assisting Detection of Adversarial Samples on Graphs
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks