Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks

Abstract

Recent works have demonstrated the existence of {\it adversarial examples} targeting a single machine learning system. In this paper we ask a simple but fundamental question of "selective fooling": given {\it multiple} machine learning systems assigned to solve the same classification problem and taking the same input signal, is it possible to construct a perturbation to the input signal that manipulates the outputs of these {\it multiple} machine learning systems {\it simultaneously} in arbitrary pre-defined ways? For example, is it possible to selectively fool a set of "enemy" machine learning systems but does not fool the other "friend" machine learning systems? The answer to this question depends on the extent to which these different machine learning systems "think alike". We formulate the problem of "selective fooling" as a novel optimization problem, and report on a series of experiments on the MNIST dataset. Our preliminary findings from these experiments show that it is in fact very easy to selectively manipulate multiple MNIST classifiers simultaneously, even when the classifiers are identical in their architectures, training algorithms and training datasets except for random initialization during training. This suggests that two nominally equivalent machine learning systems do not in fact "think alike" at all, and opens the possibility for many novel applications and deeper understandings of the working principles of deep neural networks.

arXiv comment9 pages, submitted to ICML 2020

References in corpus (28)

• Explaining and Harnessing Adversarial Examples
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Delving into Transferable Adversarial Examples and Black-box Attacks
• The Space of Transferable Adversarial Examples
• Adversarial Attacks on Graph Neural Networks via Meta Learning
• Black-box Adversarial Attacks with Limited Queries and Information
• Adversarial Perturbations Against Deep Neural Networks for Malware Classification
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attacks
• Simple Black-Box Adversarial Perturbations for Deep Networks
• Adversarial vulnerability for any classifier
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Guessing Smart: Biased Sampling for Efficient Black-Box Adversarial Attacks
• Feature Denoising for Improving Adversarial Robustness
• Subspace Attack: Exploiting Promising Subspaces for Query-Efficient Black-box Attacks
• POPQORN: Quantifying Robustness of Recurrent Neural Networks
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Transfer of Adversarial Robustness Between Perturbation Types
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• COPYCAT: Practical Adversarial Attacks on Visualization-Based Malware Detection
• Yet another but more efficient black-box adversarial attack: tiling and evolution strategies
• On the Adversarial Robustness of Subspace Learning
• ATHENA: A Framework based on Diverse Weak Defenses for Building Adversarial Defense
• Efficient Adversarial Training with Transferable Adversarial Examples
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• Trust but Verify: An Information-Theoretic Explanation for the Adversarial Fragility of Machine Learning Systems, and a General Defense against Adversarial Attacks
• Reducing Adversarial Example Transferability Using Gradient Regularization