Adversarial Example Games

Abstract

The existence of adversarial examples capable of fooling trained neural network classifiers calls for a much better understanding of possible attacks to guide the development of safeguards against them. This includes attack methods in the challenging non-interactive blackbox setting, where adversarial attacks are generated without any access, including queries, to the target model. Prior attacks in this setting have relied mainly on algorithmic innovations derived from empirical observations (e.g., that momentum helps), lacking principled transferability guarantees. In this work, we provide a theoretical foundation for crafting transferable adversarial examples to entire hypothesis classes. We introduce Adversarial Example Games (AEG), a framework that models the crafting of adversarial examples as a min-max game between a generator of attacks and a classifier. AEG provides a new way to design adversarial examples by adversarially training a generator and a classifier from a given hypothesis class (e.g., architecture). We prove that this game has an equilibrium, and that the optimal generator is able to craft adversarial examples that can attack any classifier from the corresponding hypothesis class. We demonstrate the efficacy of AEG on the MNIST and CIFAR-10 datasets, outperforming prior state-of-the-art approaches with an average relative improvement of $29.9\%$ and $47.2\%$ against undefended and robust models (Table 2 & 3) respectively.

Appears in: Advances in Neural Information Processing Systems 33 (NeurIPS 2020)

References in corpus (33)

• Scikit-learn: Machine Learning in Python
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• Categorical Reparameterization with Gumbel-Softmax
• Ensemble Adversarial Training: Attacks and Defenses
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• The Concrete Distribution: A Continuous Relaxation of Discrete Random Variables
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks
• On Evaluating Adversarial Robustness
• Adversarial Attacks and Defences: A Survey
• Generating Natural Adversarial Examples
• Countering Adversarial Images using Input Transformations
• On the (Statistical) Detection of Adversarial Examples
• Prior Convictions: Black-Box Adversarial Attacks with Bandits and Priors
• On Detecting Adversarial Perturbations
• Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNets
• A Variational Inequality Perspective on Generative Adversarial Networks
• Simple Black-box Adversarial Attacks
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attack
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• Query-efficient Meta Attack to Deep Neural Networks
• A Closer Look at the Optimization Landscapes of Generative Adversarial Networks
• Query-Efficient Black-box Adversarial Examples (superceded)
• Painless Stochastic Gradient: Interpolation, Line-Search, and Convergence Rates
• A Survey of Black-Box Adversarial Attacks on Computer Vision Models
• Abelian right perpendicular subcategories in module categories
• A Geometric Perspective on the Transferability of Adversarial Directions
• A3T: Adversarially Augmented Adversarial Training
• Generalizable Adversarial Attacks with Latent Variable Perturbation Modelling
• A Limited-Capacity Minimax Theorem for Non-Convex Games or: How I Learned to Stop Worrying about Mixed-Nash and Love Neural Nets

Cited by in corpus (7)

• Adversarial Defense by Latent Style Transformations
• Synthesis-guided Adversarial Scenario Generation for Gray-box Feedback Control Systems with Sensing Imperfections
• Stochastic Extragradient: General Analysis and Improved Rates
• Can Targeted Adversarial Examples Transfer When the Source and Target Models Have No Label Space Overlap?
• Scalable Personalised Item Ranking through Parametric Density Estimation
• Complex Momentum for Optimization in Games
• Towards Optimal Randomized Strategies in Adversarial Example Game