LAFEAT: Piercing Through Adversarial Defenses with Latent Features

Abstract

Deep convolutional neural networks are susceptible to adversarial attacks. They can be easily deceived to give an incorrect output by adding a tiny perturbation to the input. This presents a great challenge in making CNNs robust against such attacks. An influx of new defense techniques have been proposed to this end. In this paper, we show that latent features in certain "robust" models are surprisingly susceptible to adversarial attacks. On top of this, we introduce a unified ${\ell }_{\infty }$-norm white-box attack algorithm which harnesses latent features in its gradient descent steps, namely LAFEAT. We show that not only is it computationally much more efficient for successful attacks, but it is also a stronger adversary than the current state-of-the-art across a wide range of defense mechanisms. This suggests that model robustness could be contingent on the effective use of the defender's hidden components, and it should no longer be viewed from a holistic perspective.

arXiv commentAccepted as an oral paper in Conference on Computer Vision and Pattern Recognition (CVPR) 2021. 11 pages, 6 figures, 3 tables

References in corpus (13)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• Theoretically Principled Trade-off between Robustness and Accuracy
• Interactive Medical Image Segmentation using Deep Learning with Image-specific Fine-tuning
• On Evaluating Adversarial Robustness
• Fast is better than free: Revisiting adversarial training
• Using Pre-Training Can Improve Model Robustness and Uncertainty
• Generating Adversarial Examples with Adversarial Networks
• Adversarial Robustness through Local Linearization
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples
• MMA Training: Direct Input Space Margin Maximization through Adversarial Training
• An Alternative Surrogate Loss for PGD-based Adversarial Testing
• Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
• Manifold Regularization for Locally Stable Deep Neural Networks

Cited by in corpus (1)

• Adversarial Attack and Defense in Deep Ranking