Transferable Universal Adversarial Perturbations Using Generative Models

Abstract

Deep neural networks tend to be vulnerable to adversarial perturbations, which by adding to a natural image can fool a respective model with high confidence. Recently, the existence of image-agnostic perturbations, also known as universal adversarial perturbations (UAPs), were discovered. However, existing UAPs still lack a sufficiently high fooling rate, when being applied to an unknown target model. In this paper, we propose a novel deep learning technique for generating more transferable UAPs. We utilize a perturbation generator and some given pretrained networks so-called source models to generate UAPs using the ImageNet dataset. Due to the similar feature representation of various model architectures in the first layer, we propose a loss formulation that focuses on the adversarial energy only in the respective first layer of the source models. This supports the transferability of our generated UAPs to any other target model. We further empirically analyze our generated UAPs and demonstrate that these perturbations generalize very well towards different target models. Surpassing the current state of the art in both, fooling rate and model-transferability, we can show the superiority of our proposed approach. Using our generated non-targeted UAPs, we obtain an average fooling rate of 93.36% on the source models (state of the art: 82.16%). Generating our UAPs on the deep ResNet-152, we obtain about a 12% absolute fooling rate advantage vs. cutting-edge methods on VGG-16 and VGG-19 target models.

References in corpus (11)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• The Space of Transferable Adversarial Examples
• Fast-SCNN: Fast Semantic Segmentation Network
• Generating Adversarial Examples with Adversarial Networks
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• Understanding and Enhancing the Transferability of Adversarial Examples
• A Simple Explanation for the Existence of Adversarial Examples with Small Hamming Distance
• Robustness of classifiers to universal perturbations: a geometric perspective
• Transferable Adversarial Attacks for Image and Video Object Detection
• GTNet: Generative Transfer Network for Zero-Shot Object Detection

Cited by in corpus (2)

• A Survey On Universal Adversarial Attack
• Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety