Cross-Domain Transferability of Adversarial Perturbations

Abstract

Adversarial examples reveal the blind spots of deep neural networks (DNNs) and represent a major concern for security-critical applications. The transferability of adversarial examples makes real-world attacks possible in black-box settings, where the attacker is forbidden to access the internal parameters of the model. The underlying assumption in most adversary generation methods, whether learning an instance-specific or an instance-agnostic perturbation, is the direct or indirect reliance on the original domain-specific data distribution. In this work, for the first time, we demonstrate the existence of domain-invariant adversaries, thereby showing common adversarial space among different datasets and models. To this end, we propose a framework capable of launching highly transferable attacks that crafts adversarial patterns to mislead networks trained on wholly different domains. For instance, an adversarial function learned on Paintings, Cartoons or Medical images can successfully perturb ImageNet samples to fool the classifier, with success rates as high as $\sim$99\% (${\ell }_{\infty }\le 10$). The core of our proposed adversarial function is a generative network that is trained using a relativistic supervisory signal that enables domain-invariant perturbations. Our approach sets the new state-of-the-art for fooling rates, both under the white-box and black-box scenarios. Furthermore, despite being an instance-agnostic perturbation function, our attack outperforms the conventionally much stronger instance-specific attack methods.

arXiv commentAccepted at NeurIPS 2019 (Camera Ready). Source Code along with pretrained adversarial generators is available at https://github.com/Muzammal-Naseer/Cross-domain-perturbations

Cited by in corpus (22)

• Transformers in Vision: A Survey
• Intriguing Properties of Vision Transformers
• AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds
• A Survey On Universal Adversarial Attack
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Regional Homogeneity: Towards Learning Transferable Universal Adversarial Perturbations Against Defenses
• Membership Leakage in Label-Only Exposures
• PatchAttack: A Black-box Texture-based Attack with Reinforcement Learning
• On Improving Adversarial Transferability of Vision Transformers
• Towards Security Threats of Deep Learning Systems: A Survey
• Adversarial Attacks on Black Box Video Classifiers: Leveraging the Power of Geometric Transformations
• Adversarial Transferability in Wearable Sensor Systems
• Understanding Adversarial Examples from the Mutual Influence of Images and Perturbations
• Model-Based Robust Deep Learning: Generalizing to Natural, Out-of-Distribution Data
• Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks
• Adversarial Attack across Datasets
• Uncovering the Connections Between Adversarial Transferability and Knowledge Transferability
• Targeted Adversarial Perturbations for Monocular Depth Prediction
• Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptation
• Removing Undesirable Feature Contributions Using Out-of-Distribution Data
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?
• Cross-Domain Latent Modulation for Variational Transfer Learning