Enhancing Adversarial Example Transferability with an Intermediate Level Attack

Abstract

Neural networks are vulnerable to adversarial examples, malicious inputs crafted to fool trained models. Adversarial examples often exhibit black-box transfer, meaning that adversarial examples for one model can fool another model. However, adversarial examples are typically overfit to exploit the particular architecture and feature representation of a source model, resulting in sub-optimal black-box transfer attacks to other target models. We introduce the Intermediate Level Attack (ILA), which attempts to fine-tune an existing adversarial example for greater black-box transferability by increasing its perturbation on a pre-specified layer of the source model, improving upon state-of-the-art methods. We show that we can select a layer of the source model to perturb without any knowledge of the target models while achieving high transferability. Additionally, we provide some explanatory insights regarding our method and the effect of optimizing for adversarial examples using intermediate feature maps. Our code is available at https://github.com/CUVL/Intermediate-Level-Attack.

arXiv commentICCV 2019 camera-ready. Imagenet results are updated after fixing the normalization. arXiv admin note: text overlap with arXiv:1811.08458

References in corpus (8)

• Towards Deep Learning Models Resistant to Adversarial Attacks
• Going Deeper with Convolutions
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Robust Physical-World Attacks on Deep Learning Models
• Certifying Some Distributional Robustness with Principled Adversarial Training
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Boosting Adversarial Attacks with Momentum

Cited by in corpus (15)

• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability
• A Unified Approach to Interpreting and Boosting Adversarial Transferability
• On Improving Adversarial Transferability of Vision Transformers
• Understanding the Robustness of Skeleton-based Action Recognition under Adversarial Attack
• SMART: Skeletal Motion Action Recognition aTtack
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Adversarial Attack across Datasets
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Efficient and Transferable Adversarial Examples from Bayesian Neural Networks
• Query-Free Adversarial Transfer via Undertrained Surrogates
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?
• Delving into the pixels of adversarial samples
• Physical world assistive signals for deep neural network classifiers -- neither defense nor attack