Transferable Perturbations of Deep Feature Distributions

Abstract

Almost all current adversarial attacks of CNN classifiers rely on information derived from the output layer of the network. This work presents a new adversarial attack based on the modeling and exploitation of class-wise and layer-wise deep feature distributions. We achieve state-of-the-art targeted blackbox transfer-based attack results for undefended ImageNet models. Further, we place a priority on explainability and interpretability of the attacking process. Our methodology affords an analysis of how adversarial attacks change the intermediate feature distributions of CNNs, as well as a measure of layer-wise and class-wise feature distributional separability/entanglement. We also conceptualize a transition from task/data-specific to model-specific features within a CNN architecture that directly impacts the transferability of adversarial examples.

arXiv commentPublished as a conference paper at ICLR 2020

References in corpus (6)

• How transferable are features in deep neural networks?
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Delving into Transferable Adversarial Examples and Black-box Attacks
• SmoothGrad: removing noise by adding noise
• Convergent Learning: Do different neural networks learn the same representations?
• Analyzing and Improving Representations with the Soft Nearest Neighbor Loss

Cited by in corpus (10)

• DVERGE: Diversifying Vulnerabilities for Enhanced Robust Generation of Ensembles
• On Success and Simplicity: A Second Look at Transferable Targeted Attacks
• Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferability
• A Unified Approach to Interpreting and Boosting Adversarial Transferability
• On Improving Adversarial Transferability of Vision Transformers
• Patch-wise++ Perturbation for Adversarial Targeted Attacks
• Staircase Sign Method for Boosting Adversarial Attacks
• Exploring Transferable and Robust Adversarial Perturbation Generation from the Perspective of Network Hierarchy
• Feature Space Targeted Attacks by Statistic Alignment
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?