Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets

Abstract

Skip connections are an essential component of current state-of-the-art deep neural networks (DNNs) such as ResNet, WideResNet, DenseNet, and ResNeXt. Despite their huge success in building deeper and more powerful DNNs, we identify a surprising security weakness of skip connections in this paper. Use of skip connections allows easier generation of highly transferable adversarial examples. Specifically, in ResNet-like (with skip connections) neural networks, gradients can backpropagate through either skip connections or residual modules. We find that using more gradients from the skip connections rather than the residual modules according to a decay factor, allows one to craft adversarial examples with high transferability. Our method is termed Skip Gradient Method(SGM). We conduct comprehensive transfer attacks against state-of-the-art DNNs including ResNets, DenseNets, Inceptions, Inception-ResNet, Squeeze-and-Excitation Network (SENet) and robustly trained DNNs. We show that employing SGM on the gradient flow can greatly improve the transferability of crafted attacks in almost all cases. Furthermore, SGM can be easily combined with existing black-box attack techniques, and obtain high improvements over state-of-the-art transferability methods. Our findings not only motivate new research into the architectural vulnerability of DNNs, but also open up further challenges for the design of secure DNN architectures.

arXiv commentICLR 2020 conference paper (spotlight)

Cited by in corpus (46)

• Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systems
• Adversarial Weight Perturbation Helps Robust Generalization
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Adversarial Attack Vulnerability of Medical Image Analysis Systems: Unexplored Factors
• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• RobustART: Benchmarking Robustness on Architecture Design and Training Techniques
• Unlearnable Examples: Making Personal Data Unexploitable
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability
• Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
• Techniques for combining fast local decoders with global decoders under circuit-level noise
• Investigating the significance of adversarial attacks and their relation to interpretability for radar-based human activity recognition systems
• TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
• Adversarial Camouflage: Hiding Physical-World Attacks with Natural Styles
• Clean-Label Backdoor Attacks on Video Recognition Models
• Towards Assessing the Synthetic-to-Measured Adversarial Vulnerability of SAR ATR
• A Unified Approach to Interpreting and Boosting Adversarial Transferability
• Adversarial Example Games
• Bag of Tricks for Adversarial Training
• On Improving Adversarial Transferability of Vision Transformers
• Generating Image Adversarial Examples by Embedding Digital Watermarks
• Backdoor Attacks on Crowd Counting
• Residual-Concatenate Neural Network with Deep Regularization Layers for Binary Classification
• Boosting Black-Box Attack with Partially Transferred Conditional Adversarial Distribution
• Improving Query Efficiency of Black-box Adversarial Attack
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Adversarial Examples on Segmentation Models Can be Easy to Transfer
• Training Meta-Surrogate Model for Transferable Adversarial Attack
• Boosting Transferability of Targeted Adversarial Examples via Hierarchical Generative Networks
• Analysis and Applications of Class-wise Robustness in Adversarial Training
• Adversarial attacks on audio source separation
• Adversarial Attack across Datasets
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Clustering Effect of (Linearized) Adversarial Robust Models
• Targeted Attack for Deep Hashing based Retrieval
• Improving White-box Robustness of Pre-processing Defenses via Joint Adversarial Training
• Relevance Attack on Detectors
• Adaptive Image Transformations for Transfer-based Adversarial Attack
• Domain Invariant Adversarial Learning
• Adversarial Interaction Attack: Fooling AI to Misinterpret Human Intentions
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?
• Efficient and Transferable Adversarial Examples from Bayesian Neural Networks
• Dual Head Adversarial Training
• On the Security Risks of AutoML
• Moiré Attack (MA): A New Potential Risk of Screen Photos