Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks

Abstract

Deep learning models are vulnerable to adversarial examples crafted by applying human-imperceptible perturbations on benign inputs. However, under the black-box setting, most existing adversaries often have a poor transferability to attack other defense models. In this work, from the perspective of regarding the adversarial example generation as an optimization process, we propose two new methods to improve the transferability of adversarial examples, namely Nesterov Iterative Fast Gradient Sign Method (NI-FGSM) and Scale-Invariant attack Method (SIM). NI-FGSM aims to adapt Nesterov accelerated gradient into the iterative attacks so as to effectively look ahead and improve the transferability of adversarial examples. While SIM is based on our discovery on the scale-invariant property of deep learning models, for which we leverage to optimize the adversarial perturbations over the scale copies of the input images so as to avoid "overfitting" on the white-box model being attacked and generate more transferable adversarial examples. NI-FGSM and SIM can be naturally integrated to build a robust gradient-based attack to generate more transferable adversarial examples against the defense models. Empirical results on ImageNet dataset demonstrate that our attack methods exhibit higher transferability and achieve higher attack success rates than state-of-the-art gradient-based attacks.

arXiv commentICLR 2020

References in corpus (8)

• Adam: A Method for Stochastic Optimization
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Ensemble Adversarial Training: Attacks and Defenses
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Certified Adversarial Robustness via Randomized Smoothing
• Improving the Generalization of Adversarial Training with Domain Adaptation
• Adversarially Robust Generalization Just Requires More Unlabeled Data
• Robust Local Features for Improving the Generalization of Adversarial Training

Cited by in corpus (12)

• Universal Adversarial Examples in Remote Sensing: Methodology and Benchmark
• Threatening Patch Attacks on Object Detection in Optical Remote Sensing Images
• Semantic-Aware Adversarial Training for Reliable Deep Hashing Retrieval
• Improving the Transferability of Adversarial Examples with Arbitrary Style Transfer
• Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATR
• On Improving Adversarial Transferability of Vision Transformers
• Boosting Adversarial Attacks on Neural Networks with Better Optimizer
• Improving the Transferability of Adversarial Attacks on Face Recognition with Beneficial Perturbation Feature Augmentation
• Adversarial Exposure Attack on Diabetic Retinopathy Imagery Grading
• SA-GD: Improved Gradient Descent Learning Strategy with Simulated Annealing
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Improving Adversarial Robustness for Free with Snapshot Ensemble